diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 1c4202d44b..463a748668 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -19331,6 +19331,36 @@ "source_path": "windows/whats-new/windows-11-whats-new.md", "redirect_url": "/windows/whats-new/windows-11-overview", "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/waas-delivery-optimization.md", + "redirect_url": "/windows/deployment/do/waas-delivery-optimization", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/delivery-optimization-proxy.md", + "redirect_url": "/windows/deployment/do/delivery-optimization-proxy", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/delivery-optimization-workflow.md", + "redirect_url": "/windows/deployment/do/delivery-optimization-workflow", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/waas-delivery-optimization-reference.md", + "redirect_url": "/windows/deployment/do/waas-delivery-optimization-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/waas-delivery-optimization-setup.md", + "redirect_url": "/windows/deployment/do/waas-delivery-optimization-setup", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/waas-optimize-windows-10.md", + "redirect_url": "/windows/deployment/do/waas-optimize-windows-10", + "redirect_document_id": false } ] } diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index f1bee95c6a..26a30c88a6 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -8,7 +8,7 @@ ms.topic: article ms.prod: w11 ms.technology: windows author: lovina-saldanha -ms.date: 10/07/2021 +ms.date: 03/14/2022 --- # Secured-Core PC Configuration Lock @@ -48,31 +48,31 @@ The steps to turn on Config Lock using Microsoft Endpoint Manager (Microsoft Int - **Profile type**: Templates - **Template name**: Custom - :::image type="content" source="images/configlock-mem-createprofile.png" alt-text="create profile"::: + :::image type="content" source="images/configlock-mem-createprofile.png" alt-text="In Configuration profiles, the Create a profile page is showing, with the Platform set to Windows 10 and later, and a Profile Type of Templates"::: 1. Name your profile. 1. When you reach the Configuration Settings step, select “Add” and add the following information: - **OMA-URI**: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock - **Data type**: Integer - **Value**: 1
- To turn off Config Lock. Change value to 0. + To turn off Config Lock, change the value to 0. - :::image type="content" source="images/configlock-mem-editrow.png" alt-text="edit row"::: + :::image type="content" source="images/configlock-mem-editrow.png" alt-text="In the Configuration settings step, the Edit Row page is shown with a Name of Config Lock, a Description of Turn on Config Lock and the OMA-URI set as above, along with a Data type of Integer set to a Value of 1"::: 1. Select the devices to turn on Config Lock. If you're using a test tenant, you can select “+ Add all devices”. 1. You'll not need to set any applicability rules for test purposes. 1. Review the Configuration and select “Create” if everything is correct. 1. After the device syncs with the Microsoft Intune server, you can confirm if the Config Lock was successfully enabled. - :::image type="content" source="images/configlock-mem-dev.png" alt-text="status"::: + :::image type="content" source="images/configlock-mem-dev.png" alt-text="The Profile assignment status dashboard when viewing the Config Lock device configuration profile, showing one device has succeeded in having this profile applied"::: - :::image type="content" source="images/configlock-mem-devstatus.png" alt-text="device status"::: + :::image type="content" source="images/configlock-mem-devstatus.png" alt-text="The Device Status for the Config Lock Device Configuration Profile, showing one device with a Deployment Status as Succeeded and two with Pending"::: -## Disabling +## Configuring Secured-Core PC features -Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as Microsoft Intune. +Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally misconfigured. IT Admins retain the ability to change (enable/disable) SCPC features (for example Firmware protection) via Group Policies and/or mobile device management (MDM) tools, such as Microsoft Intune. -:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="firmware protect"::: +:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="The Defender Firmware protection setting, with a description of Windows Defender System Guard protects your device from compromised firmware. The setting is set to Off"::: ## FAQ @@ -89,45 +89,45 @@ Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally m |[ApplicationControl](applicationcontrol-csp.md) -|**MDM policies** | -|-----| -|[DataProtection/AllowDirectMemoryAccess](policy-csp-dataprotection.md) | -|[DataProtection/LegacySelectiveWipeID](policy-csp-dataprotection.md) | -|[DeviceGuard/ConfigureSystemGuardLaunch](policy-csp-deviceguard.md) | -|[DeviceGuard/EnableVirtualizationBasedSecurity](policy-csp-deviceguard.md) | -|[DeviceGuard/LsaCfgFlags](policy-csp-deviceguard.md) | -|[DeviceGuard/RequirePlatformSecurityFeatures](policy-csp-deviceguard.md) | -|[DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md) | -|[DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md) | -|[DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md) | -|[DeviceInstallation/PreventDeviceMetadataFromNetwork](policy-csp-deviceinstallation.md) | -|[DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](policy-csp-deviceinstallation.md) | -|[DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md) | -|[DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md) | -|[DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md) | -|[DmaGuard/DeviceEnumerationPolicy](policy-csp-dmaguard.md) | -|[WindowsDefenderSecurityCenter/CompanyName](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableNotifications](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md)| -|[WindowsDefenderSecurityCenter/DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/Email](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/Phone](policy-csp-windowsdefendersecuritycenter.md) | -|[WindowsDefenderSecurityCenter/URL](policy-csp-windowsdefendersecuritycenter.md) | -|[SmartScreen/EnableAppInstallControl](policy-csp-smartscreen.md)| -|[SmartScreen/EnableSmartScreenInShell](policy-csp-smartscreen.md) | -|[SmartScreen/PreventOverrideForFilesInShell](policy-csp-smartscreen.md) | +|**MDM policies** | **Supported by Group Policy** | +|-----|-----| +|[DataProtection/AllowDirectMemoryAccess](policy-csp-dataprotection.md) | No | +|[DataProtection/LegacySelectiveWipeID](policy-csp-dataprotection.md) | No | +|[DeviceGuard/ConfigureSystemGuardLaunch](policy-csp-deviceguard.md) | Yes | +|[DeviceGuard/EnableVirtualizationBasedSecurity](policy-csp-deviceguard.md) | Yes | +|[DeviceGuard/LsaCfgFlags](policy-csp-deviceguard.md) | Yes | +|[DeviceGuard/RequirePlatformSecurityFeatures](policy-csp-deviceguard.md) | Yes | +|[DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md) | Yes | +|[DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md) | Yes | +|[DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md) | Yes | +|[DeviceInstallation/PreventDeviceMetadataFromNetwork](policy-csp-deviceinstallation.md) | Yes | +|[DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](policy-csp-deviceinstallation.md) | Yes | +|[DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md) | Yes | +|[DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md) | Yes | +|[DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md) | Yes | +|[DmaGuard/DeviceEnumerationPolicy](policy-csp-dmaguard.md) | Yes | +|[WindowsDefenderSecurityCenter/CompanyName](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableNotifications](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md)| Yes | +|[WindowsDefenderSecurityCenter/DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/Email](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/Phone](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[WindowsDefenderSecurityCenter/URL](policy-csp-windowsdefendersecuritycenter.md) | Yes | +|[SmartScreen/EnableAppInstallControl](policy-csp-smartscreen.md)| Yes | +|[SmartScreen/EnableSmartScreenInShell](policy-csp-smartscreen.md) | Yes | +|[SmartScreen/PreventOverrideForFilesInShell](policy-csp-smartscreen.md) | Yes | diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index fb9c555681..cef5ea62ca 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -90,6 +90,8 @@ The data type is string. Expected value: Set and Execute are functionality equivalent, and each accepts a `Collection` XML snippet (as a string) describing what data to gather and where to upload it. The results are zipped and uploaded to the specified SasUrl. The zipped filename format is "DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip". +With Windows 10 KB5011543, Windows 11 KB5011563 we have added support for an additional element which will determine whether the output file generated by the CSP is a flattened folder structure, instead of having individual folders for each directive in the XML. + The following is an example of a `Collection` XML. ``` xml @@ -104,6 +106,7 @@ The following is an example of a `Collection` XML. %windir%\system32\mdmdiagnosticstool.exe -out %ProgramData%\temp\ %ProgramData%\temp\*.* Application + Flattened ``` @@ -176,6 +179,11 @@ The SasUrl value is the target URI to which the CSP uploads the zip file contain - .evtx - .etl +- **OutputFileFormat** + - Flattens folder structure, instead of having individual folders for each directive in the XML. + - The value “Flattened” is the only supported value for the OutputFileFormat. If the OutputFileFormat is absent in the XML, or if explicitly set to something other than Flattened, it will leave the file structure in old structure. + + **DiagnosticArchive/ArchiveResults** Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting displays the results of the last archive run. @@ -367,6 +375,7 @@ Added in version 1.4 of the CSP in Windows 10, version 1903. Dynamic node to rep Supported operations are Add, Delete, and Get. + Add **Channel** ``` xml diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md index 9be9cb8c8d..5df6a8b40b 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md @@ -66,7 +66,7 @@ Installation date of the application. Value type is string. Supported operation **MSI/*ProductID*/DownloadInstall** Executes the download and installation of the application. Value type is string. Supported operations are Execute and Get. -In Windows 10, version 1703 service release, a new tag \ was added to the \ section of the XML. The default value is 0 (do not send token). This tag is optional and needs to be set to 1 in case the server wants the download URL to get the AADUserToken. +In Windows 10, version 1703 service release, a new tag \ was added to the \ section of the XML. The default value is 0 (do not send token). This tag is optional and needs to be set to 1 in case the server wants the download URL to get the AADUserToken.\ 0 will set the timeout to infinite. Here is an example: @@ -112,7 +112,7 @@ Value type is string. Supported operation is Get. Added in the March service release of Windows 10, version 1607. **MSI/UpgradeCode/_Guid_** -Added in the March service release of Windows 10, version 1607. A gateway (or device management server) uses this method to detect matching upgrade MSI product when a Admin wants to update an existing MSI app. If the same upgrade product is installed, then the update is allowed. +Added in the March service release of Windows 10, version 1607. A gateway (or device management server) uses this method to detect matching upgrade MSI product when an Admin wants to update an existing MSI app. If the same upgrade product is installed, then the update is allowed. Value type is string. Supported operation is Get. @@ -261,7 +261,7 @@ The following table describes the fields in the previous sample: |Name|Description| |--- |--- | -|Add|This is required to precede the Exec command.
  • CmdID - Input value used to reference the request. Responses includes this value, which can be use to match the request and response.
  • LocURI - Path to Win32 CSP command processor, including the Product ID (in this example, 1803A630-3C38-4D2B-9B9A-0CB37243539C) property escaped for XML formatting.| +|Add|This is required to precede the Exec command.
  • CmdID - Input value used to reference the request. Responses include this value, which can be used to match the request and response.
  • LocURI - Path to Win32 CSP command processor, including the Product ID (in this example, 1803A630-3C38-4D2B-9B9A-0CB37243539C) property escaped for XML formatting.| |Exec|The Exec node includes the parameters and properties requires to locate, download, validate and perform product installation.
  • CmdID - Input value used to reference the request. Responses will include this value which can be used to match request and response.
  • LocURI - Path to Win32 CSP command processor, including the Product ID (in this example, 1803A630-3C38-4D2B-9B9A-0CB37243539C) property escaped for XML formatting.
  • Data - The Data node contains an embedded XML, of type “MsiInstallJob”
  • MsiInstallJob - Contains all information required for the successful download, validation and execution of the MSI installation process (see section at the end of this document for details on this embedded data object).| @@ -370,7 +370,7 @@ Here is an example of a common response to a request ## How to determine which installation context to use for an MSI package -The following tables shows how app targeting and MSI package type (per-user, per machine, or dual mode) are installed in the client. +The following tables show how app targeting and MSI package type (per-user, per machine, or dual mode) are installed in the client. For Intune standalone environment, the MSI package will determine the MSI execution context. diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 5028411604..7c493b6d8a 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -36,6 +36,9 @@ manager: dansimp
    Search/AllowSearchToUseLocation
    +
    + Search/AllowSearchHighlights +
    Search/AllowStoringImagesFromVisionSearch
    @@ -323,6 +326,63 @@ The following list shows the supported values:
    + +**Search/AllowSearchHighlights** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy controls whether search highlights are shown in the search box or in search home. + +- If you enable this policy setting, then this setting turns on search highlights in the search box or in the search home. +- If you disable this policy setting, then this setting turns off search highlights in the search box or in the search home. + + + + +ADMX Info: +- GP Friendly name: *Allow search and highlights* +- GP name: *AllowSearchHighlights* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + + +The following list shows the supported values in Windows 10: +- Not Configured/ Enabled (default) – Enabling or not configuring this setting turns on search highlights in the taskbar search box and in search home. + +- Disabled – Disabling this setting turns off search highlights in the taskbar search box and in search home. + +The following list shows the supported values in Windows 11: +- Not Configured/ Enabled (default) – Enabling or not configuring this setting turns on search highlights in the start menu search box and in search home. + +- Disabled – Disabling this setting turns off search highlights in the start menu search box and in search home. + + + + +
    + **Search/AllowStoringImagesFromVisionSearch** diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md index 028b44c522..d4e1cc8ad0 100644 --- a/windows/configuration/provisioning-packages/provisioning-multivariant.md +++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md @@ -121,30 +121,30 @@ Follow these steps to create a provisioning package with multivariant capabiliti The following example shows the contents of a sample customizations.xml file. ```XML - <?xml version="1.0" encoding="utf-8"?> - - - {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} - My Provisioning Package - 1.0 - OEM - 50 - - - - - - 0 - 0 - 0 - - - 0 - - - - - + + + + {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} + My Provisioning Package + 1.0 + OEM + 50 + + + + + + 0 + 0 + 0 + + + 0 + + + + + ``` 5. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings. @@ -152,48 +152,48 @@ Follow these steps to create a provisioning package with multivariant capabiliti The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**. ```XML - - - - {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} - My Provisioning Package - 1.0 - OEM - 50 - - - - - - 0 - 0 - 0 - - - 0 - - - - - - - - - - - - - - - - - - - - - - - + + + + {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} + My Provisioning Package + 1.0 + OEM + 50 + + + + + + 0 + 0 + 0 + + + 0 + + + + + + + + + + + + + + + + + + + + + + + ``` 6. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this: @@ -212,56 +212,56 @@ Follow these steps to create a provisioning package with multivariant capabiliti The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met. ```XML - <?xml version="1.0" encoding="utf-8"?> - - - {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} - My Provisioning Package - 1.0 - OEM - 50 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 - 1 - 1 - - - 1 - - - - - - + + + + {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} + My Provisioning Package + 1.0 + OEM + 50 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 1 + 1 + 1 + + + 1 + + + + + + ``` 7. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step. diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 6eb965d5b3..0e700e4349 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -47,12 +47,12 @@ - name: Define your servicing strategy href: update/plan-define-strategy.md - name: Delivery Optimization for Windows client updates - href: update/waas-delivery-optimization.md + href: do/waas-delivery-optimization.md items: - name: Using a proxy with Delivery Optimization - href: update/delivery-optimization-proxy.md + href: do/delivery-optimization-proxy.md - name: Delivery Optimization client-service communication - href: update/delivery-optimization-workflow.md + href: do/delivery-optimization-workflow.md - name: Windows 10 deployment considerations href: planning/windows-10-deployment-considerations.md - name: Windows 10 infrastructure requirements @@ -83,7 +83,7 @@ - name: Update Baseline href: update/update-baseline.md - name: Set up Delivery Optimization for Windows client updates - href: update/waas-delivery-optimization-setup.md + href: do/index.yml - name: Configure BranchCache for Windows client updates href: update/waas-branchcache.md - name: Prepare your deployment tools @@ -185,7 +185,7 @@ - name: Monitor Windows client updates items: - name: Monitor Delivery Optimization - href: update/waas-delivery-optimization-setup.md#monitor-delivery-optimization + href: do/waas-delivery-optimization-setup.md#monitor-delivery-optimization - name: Monitor Windows Updates items: - name: Monitor Windows Updates with Update Compliance @@ -283,7 +283,7 @@ - name: Additional Windows Update settings href: update/waas-wu-settings.md - name: Delivery Optimization reference - href: update/waas-delivery-optimization-reference.md + href: do/waas-delivery-optimization-reference.md - name: Windows client in S mode href: s-mode.md - name: Switch to Windows client Pro or Enterprise from S mode diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index a0c717c24f..2f3c3848c6 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -72,7 +72,7 @@ Windows PowerShell cmdlets for Delivery Optimization have been improved: - **Get-DeliveryOptimizationLogAnalysis** is a new cmdlet that provides a summary of the activity in your DO log (# of downloads, downloads from peers, overall peer efficiency). Use the **-ListConnections** option to for in-depth look at peer-to-peer connections. - **Enable-DeliveryOptimizationVerboseLogs** is a new cmdlet that enables a greater level of logging detail to assist in troubleshooting. -Additional improvements in [Delivery Optimization](./update/waas-delivery-optimization.md) include: +Additional improvements in [Delivery Optimization](./do/waas-delivery-optimization.md) include: - Enterprise network [throttling is enhanced](/windows-insider/archive/new-for-business#new-download-throttling-options-for-delivery-optimization-build-18917) to optimize foreground vs. background throttling. - Automatic cloud-based congestion detection is available for PCs with cloud service support. - Improved peer efficiency for enterprises and educational institutions with complex networks is enabled with [new policies](/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates and Intune content, with Microsoft Endpoint Manager content coming soon! diff --git a/windows/deployment/do/TOC.yml b/windows/deployment/do/TOC.yml new file mode 100644 index 0000000000..ba824d08fb --- /dev/null +++ b/windows/deployment/do/TOC.yml @@ -0,0 +1,42 @@ +- name: Delivery Optimization for Windows client + href: index.yml + items: + - name: Get started + items: + - name: What is Delivery Optimization + href: waas-delivery-optimization.md + - name: What's new + href: whats-new-do.md + + + + - name: Configure Delivery Optimization + items: + - name: Configure Windows Clients + items: + - name: Windows Delivery Optimization settings + href: waas-delivery-optimization-setup.md#recommended-delivery-optimization-settings + - name: Configure Microsoft Endpoint Manager + items: + - name: Delivery Optimization settings in Microsoft Intune + href: /mem/intune/configuration/delivery-optimization-windows + + - name: Microsoft Connected Cache + items: + - name: MCC overview + href: waas-microsoft-connected-cache.md + - name: MCC for Enterprise and Education + href: mcc-enterprise.md + - name: MCC for ISPs + href: mcc-isp.md + + - name: Resources + items: + - name: Set up Delivery Optimization for Windows + href: waas-delivery-optimization-setup.md + - name: Delivery Optimization reference + href: waas-delivery-optimization-reference.md + - name: Delivery Optimization client-service communication + href: delivery-optimization-workflow.md + - name: Using a proxy with Delivery Optimization + href: delivery-optimization-proxy.md diff --git a/windows/deployment/update/delivery-optimization-proxy.md b/windows/deployment/do/delivery-optimization-proxy.md similarity index 98% rename from windows/deployment/update/delivery-optimization-proxy.md rename to windows/deployment/do/delivery-optimization-proxy.md index a03d3f5fb1..cd25705e12 100644 --- a/windows/deployment/update/delivery-optimization-proxy.md +++ b/windows/deployment/do/delivery-optimization-proxy.md @@ -6,9 +6,9 @@ keywords: updates, downloads, network, bandwidth ms.prod: w10 ms.mktglfcycl: deploy audience: itpro -author: jaimeo +author: carmenf ms.localizationpriority: medium -ms.author: jaimeo +ms.author: carmenf ms.collection: M365-modern-desktop ms.topic: article --- diff --git a/windows/deployment/update/delivery-optimization-workflow.md b/windows/deployment/do/delivery-optimization-workflow.md similarity index 96% rename from windows/deployment/update/delivery-optimization-workflow.md rename to windows/deployment/do/delivery-optimization-workflow.md index c12811fc60..f3c6ba9095 100644 --- a/windows/deployment/update/delivery-optimization-workflow.md +++ b/windows/deployment/do/delivery-optimization-workflow.md @@ -29,12 +29,12 @@ This workflow allows Delivery Optimization to securely and efficiently deliver r 2. The authenticity of the content metadata file itself is verified prior to any content being downloaded using a hash that is obtained via an SSL channel from the Delivery Optimization service. The same channel is used to ensure the content is curated and authorized to leverage peer-to-peer. 3. When Delivery Optimization pulls a certain piece of the hash from another peer, it verifies the hash against the known hash in the content metadata file. 4. If a peer provides an invalid piece, that piece is discarded. When a peer sends multiple bad pieces, it's banned and will no longer be used as a source by the Delivery Optimization client performing the download. -5. If Delivery Optimization is unable to obtain the content metadata file, or if the verification of the hash file itself fails, the download will fall back to “simple mode” (pulling content only from an HTTP source) and peer-to-peer won't be allowed. +5. If Delivery Optimization is unable to obtain the content metadata file, or if the verification of the hash file itself fails, the download will fall back to "simple mode” (pulling content only from an HTTP source) and peer-to-peer won't be allowed. 6. Once downloading is complete, Delivery Optimization uses all retrieved pieces of the content to put the file together. At that point, the Delivery Optimization caller (for example, Windows Update) checks the entire file to verify the signature prior to installing it. ## Delivery Optimization service endpoint and data information -|Endpoint hostname|Port|Name|Description|Data sent from the computer to the endpoint +|Endpoint hostname | Port|Name|Description|Data sent from the computer to the endpoint |--------------------------------------------|--------|---------------|-----------------------|------------------------| | geover-prod.do.dsp.mp.microsoft.com
    geo-prod.do.dsp.mp.microsoft.com
    geo.prod.do.dsp.mp.microsoft.com
    geover.prod.do.dsp.mp.microsoft.com | 443 | Geo | Service used to identify the location of the device in order to direct it to the nearest data center. | **Profile**: The device type (for example, PC or Xbox)
    **doClientVersion**: The version of the DoSvc client
    **groupID**: Group the device belongs to (set with DownloadMode = '2' (Group download mode) + groupID group policy / MDM policies) | | kv\*.prod.do.dsp.mp.microsoft.com | 443| KeyValue | Bootstrap service provides endpoints for all other services as well as device configs. | **countryCode**: The country the client is connected from
    **doClientVersion**: The version of the DoSvc client
    **Profile**: The device type (for example, PC or Xbox)
    **eId**: Client grouping Id
    **CacheHost**: Cache host id | diff --git a/windows/deployment/do/images/UC_workspace_DO_status.png b/windows/deployment/do/images/UC_workspace_DO_status.png new file mode 100644 index 0000000000..fa7550f0f5 Binary files /dev/null and b/windows/deployment/do/images/UC_workspace_DO_status.png differ diff --git a/windows/deployment/do/images/backicon.png b/windows/deployment/do/images/backicon.png new file mode 100644 index 0000000000..3007e448b1 Binary files /dev/null and b/windows/deployment/do/images/backicon.png differ diff --git a/windows/deployment/do/images/checklistbox.gif b/windows/deployment/do/images/checklistbox.gif new file mode 100644 index 0000000000..cbcf4a4f11 Binary files /dev/null and b/windows/deployment/do/images/checklistbox.gif differ diff --git a/windows/deployment/do/images/checklistdone.png b/windows/deployment/do/images/checklistdone.png new file mode 100644 index 0000000000..7e53f74d0e Binary files /dev/null and b/windows/deployment/do/images/checklistdone.png differ diff --git a/windows/deployment/do/images/checkmark.png b/windows/deployment/do/images/checkmark.png new file mode 100644 index 0000000000..f9f04cd6bd Binary files /dev/null and b/windows/deployment/do/images/checkmark.png differ diff --git a/windows/deployment/do/images/crossmark.png b/windows/deployment/do/images/crossmark.png new file mode 100644 index 0000000000..69432ff71c Binary files /dev/null and b/windows/deployment/do/images/crossmark.png differ diff --git a/windows/deployment/do/images/doneicon.png b/windows/deployment/do/images/doneicon.png new file mode 100644 index 0000000000..d80389f35b Binary files /dev/null and b/windows/deployment/do/images/doneicon.png differ diff --git a/windows/deployment/do/images/emcc01.png b/windows/deployment/do/images/emcc01.png new file mode 100644 index 0000000000..a4e5a4f0ec Binary files /dev/null and b/windows/deployment/do/images/emcc01.png differ diff --git a/windows/deployment/do/images/emcc02.png b/windows/deployment/do/images/emcc02.png new file mode 100644 index 0000000000..1b8c882f7a Binary files /dev/null and b/windows/deployment/do/images/emcc02.png differ diff --git a/windows/deployment/do/images/emcc03.png b/windows/deployment/do/images/emcc03.png new file mode 100644 index 0000000000..90ced91541 Binary files /dev/null and b/windows/deployment/do/images/emcc03.png differ diff --git a/windows/deployment/do/images/emcc04.png b/windows/deployment/do/images/emcc04.png new file mode 100644 index 0000000000..84da06bd73 Binary files /dev/null and b/windows/deployment/do/images/emcc04.png differ diff --git a/windows/deployment/do/images/emcc05.png b/windows/deployment/do/images/emcc05.png new file mode 100644 index 0000000000..35d74e5d44 Binary files /dev/null and b/windows/deployment/do/images/emcc05.png differ diff --git a/windows/deployment/do/images/emcc06.png b/windows/deployment/do/images/emcc06.png new file mode 100644 index 0000000000..18bfc9b032 Binary files /dev/null and b/windows/deployment/do/images/emcc06.png differ diff --git a/windows/deployment/do/images/emcc07.png b/windows/deployment/do/images/emcc07.png new file mode 100644 index 0000000000..21420eab09 Binary files /dev/null and b/windows/deployment/do/images/emcc07.png differ diff --git a/windows/deployment/do/images/emcc08.png b/windows/deployment/do/images/emcc08.png new file mode 100644 index 0000000000..d8695d3098 Binary files /dev/null and b/windows/deployment/do/images/emcc08.png differ diff --git a/windows/deployment/do/images/emcc09.5.png b/windows/deployment/do/images/emcc09.5.png new file mode 100644 index 0000000000..18b77b6dc9 Binary files /dev/null and b/windows/deployment/do/images/emcc09.5.png differ diff --git a/windows/deployment/do/images/emcc09.png b/windows/deployment/do/images/emcc09.png new file mode 100644 index 0000000000..31c7d4bb03 Binary files /dev/null and b/windows/deployment/do/images/emcc09.png differ diff --git a/windows/deployment/do/images/emcc10.png b/windows/deployment/do/images/emcc10.png new file mode 100644 index 0000000000..77c8754bf5 Binary files /dev/null and b/windows/deployment/do/images/emcc10.png differ diff --git a/windows/deployment/do/images/emcc11.png b/windows/deployment/do/images/emcc11.png new file mode 100644 index 0000000000..ac2fce89d8 Binary files /dev/null and b/windows/deployment/do/images/emcc11.png differ diff --git a/windows/deployment/do/images/emcc12.png b/windows/deployment/do/images/emcc12.png new file mode 100644 index 0000000000..2626a870b4 Binary files /dev/null and b/windows/deployment/do/images/emcc12.png differ diff --git a/windows/deployment/do/images/emcc13.png b/windows/deployment/do/images/emcc13.png new file mode 100644 index 0000000000..80c975ed94 Binary files /dev/null and b/windows/deployment/do/images/emcc13.png differ diff --git a/windows/deployment/do/images/emcc14.png b/windows/deployment/do/images/emcc14.png new file mode 100644 index 0000000000..02ba3822b8 Binary files /dev/null and b/windows/deployment/do/images/emcc14.png differ diff --git a/windows/deployment/do/images/emcc15.png b/windows/deployment/do/images/emcc15.png new file mode 100644 index 0000000000..77ca7f44e7 Binary files /dev/null and b/windows/deployment/do/images/emcc15.png differ diff --git a/windows/deployment/do/images/emcc16.png b/windows/deployment/do/images/emcc16.png new file mode 100644 index 0000000000..f20d77288c Binary files /dev/null and b/windows/deployment/do/images/emcc16.png differ diff --git a/windows/deployment/do/images/emcc17.png b/windows/deployment/do/images/emcc17.png new file mode 100644 index 0000000000..30046d2616 Binary files /dev/null and b/windows/deployment/do/images/emcc17.png differ diff --git a/windows/deployment/do/images/emcc18.png b/windows/deployment/do/images/emcc18.png new file mode 100644 index 0000000000..f498901e87 Binary files /dev/null and b/windows/deployment/do/images/emcc18.png differ diff --git a/windows/deployment/do/images/emcc19.png b/windows/deployment/do/images/emcc19.png new file mode 100644 index 0000000000..67ceb5dcb6 Binary files /dev/null and b/windows/deployment/do/images/emcc19.png differ diff --git a/windows/deployment/do/images/emcc20.png b/windows/deployment/do/images/emcc20.png new file mode 100644 index 0000000000..33b94423c0 Binary files /dev/null and b/windows/deployment/do/images/emcc20.png differ diff --git a/windows/deployment/do/images/emcc21.png b/windows/deployment/do/images/emcc21.png new file mode 100644 index 0000000000..522b729612 Binary files /dev/null and b/windows/deployment/do/images/emcc21.png differ diff --git a/windows/deployment/do/images/emcc22.png b/windows/deployment/do/images/emcc22.png new file mode 100644 index 0000000000..c3dd8d1c66 Binary files /dev/null and b/windows/deployment/do/images/emcc22.png differ diff --git a/windows/deployment/do/images/emcc23.png b/windows/deployment/do/images/emcc23.png new file mode 100644 index 0000000000..87953d1140 Binary files /dev/null and b/windows/deployment/do/images/emcc23.png differ diff --git a/windows/deployment/do/images/emcc24.png b/windows/deployment/do/images/emcc24.png new file mode 100644 index 0000000000..c46a7e6363 Binary files /dev/null and b/windows/deployment/do/images/emcc24.png differ diff --git a/windows/deployment/do/images/emcc25.png b/windows/deployment/do/images/emcc25.png new file mode 100644 index 0000000000..01076b3ae5 Binary files /dev/null and b/windows/deployment/do/images/emcc25.png differ diff --git a/windows/deployment/do/images/emcc26.png b/windows/deployment/do/images/emcc26.png new file mode 100644 index 0000000000..723382935a Binary files /dev/null and b/windows/deployment/do/images/emcc26.png differ diff --git a/windows/deployment/do/images/emcc27.png b/windows/deployment/do/images/emcc27.png new file mode 100644 index 0000000000..6ba8d203a3 Binary files /dev/null and b/windows/deployment/do/images/emcc27.png differ diff --git a/windows/deployment/do/images/emcc28.png b/windows/deployment/do/images/emcc28.png new file mode 100644 index 0000000000..8beddeec47 Binary files /dev/null and b/windows/deployment/do/images/emcc28.png differ diff --git a/windows/deployment/do/images/emcc29.png b/windows/deployment/do/images/emcc29.png new file mode 100644 index 0000000000..60528cdb69 Binary files /dev/null and b/windows/deployment/do/images/emcc29.png differ diff --git a/windows/deployment/do/images/imcc01.png b/windows/deployment/do/images/imcc01.png new file mode 100644 index 0000000000..2e5a915b4f Binary files /dev/null and b/windows/deployment/do/images/imcc01.png differ diff --git a/windows/deployment/do/images/imcc02.png b/windows/deployment/do/images/imcc02.png new file mode 100644 index 0000000000..351dad7325 Binary files /dev/null and b/windows/deployment/do/images/imcc02.png differ diff --git a/windows/deployment/do/images/imcc03.png b/windows/deployment/do/images/imcc03.png new file mode 100644 index 0000000000..69fda255e9 Binary files /dev/null and b/windows/deployment/do/images/imcc03.png differ diff --git a/windows/deployment/do/images/imcc04.png b/windows/deployment/do/images/imcc04.png new file mode 100644 index 0000000000..1a3f2b3c49 Binary files /dev/null and b/windows/deployment/do/images/imcc04.png differ diff --git a/windows/deployment/do/images/imcc05.png b/windows/deployment/do/images/imcc05.png new file mode 100644 index 0000000000..35d74e5d44 Binary files /dev/null and b/windows/deployment/do/images/imcc05.png differ diff --git a/windows/deployment/do/images/imcc06.png b/windows/deployment/do/images/imcc06.png new file mode 100644 index 0000000000..18bfc9b032 Binary files /dev/null and b/windows/deployment/do/images/imcc06.png differ diff --git a/windows/deployment/do/images/imcc07.png b/windows/deployment/do/images/imcc07.png new file mode 100644 index 0000000000..31668ba8a1 Binary files /dev/null and b/windows/deployment/do/images/imcc07.png differ diff --git a/windows/deployment/do/images/imcc08.png b/windows/deployment/do/images/imcc08.png new file mode 100644 index 0000000000..d298242acb Binary files /dev/null and b/windows/deployment/do/images/imcc08.png differ diff --git a/windows/deployment/do/images/imcc09.png b/windows/deployment/do/images/imcc09.png new file mode 100644 index 0000000000..e6f4f5fc5e Binary files /dev/null and b/windows/deployment/do/images/imcc09.png differ diff --git a/windows/deployment/do/images/imcc10.png b/windows/deployment/do/images/imcc10.png new file mode 100644 index 0000000000..e5da041358 Binary files /dev/null and b/windows/deployment/do/images/imcc10.png differ diff --git a/windows/deployment/do/images/imcc11.png b/windows/deployment/do/images/imcc11.png new file mode 100644 index 0000000000..9ffaac6072 Binary files /dev/null and b/windows/deployment/do/images/imcc11.png differ diff --git a/windows/deployment/do/images/imcc12.png b/windows/deployment/do/images/imcc12.png new file mode 100644 index 0000000000..fcb5d40a45 Binary files /dev/null and b/windows/deployment/do/images/imcc12.png differ diff --git a/windows/deployment/do/images/imcc13.png b/windows/deployment/do/images/imcc13.png new file mode 100644 index 0000000000..3d2a566c8b Binary files /dev/null and b/windows/deployment/do/images/imcc13.png differ diff --git a/windows/deployment/do/images/imcc14.png b/windows/deployment/do/images/imcc14.png new file mode 100644 index 0000000000..627d496b4c Binary files /dev/null and b/windows/deployment/do/images/imcc14.png differ diff --git a/windows/deployment/do/images/imcc15.png b/windows/deployment/do/images/imcc15.png new file mode 100644 index 0000000000..56808cf9d7 Binary files /dev/null and b/windows/deployment/do/images/imcc15.png differ diff --git a/windows/deployment/do/images/imcc16.png b/windows/deployment/do/images/imcc16.png new file mode 100644 index 0000000000..2a9dcc85bd Binary files /dev/null and b/windows/deployment/do/images/imcc16.png differ diff --git a/windows/deployment/do/images/imcc17.png b/windows/deployment/do/images/imcc17.png new file mode 100644 index 0000000000..ac6b5be124 Binary files /dev/null and b/windows/deployment/do/images/imcc17.png differ diff --git a/windows/deployment/do/images/imcc18.png b/windows/deployment/do/images/imcc18.png new file mode 100644 index 0000000000..aa818361eb Binary files /dev/null and b/windows/deployment/do/images/imcc18.png differ diff --git a/windows/deployment/do/images/imcc19.png b/windows/deployment/do/images/imcc19.png new file mode 100644 index 0000000000..2a70b46b11 Binary files /dev/null and b/windows/deployment/do/images/imcc19.png differ diff --git a/windows/deployment/do/images/imcc20.png b/windows/deployment/do/images/imcc20.png new file mode 100644 index 0000000000..853a80b222 Binary files /dev/null and b/windows/deployment/do/images/imcc20.png differ diff --git a/windows/deployment/do/images/imcc21.png b/windows/deployment/do/images/imcc21.png new file mode 100644 index 0000000000..5bd68d66c5 Binary files /dev/null and b/windows/deployment/do/images/imcc21.png differ diff --git a/windows/deployment/do/images/imcc22.png b/windows/deployment/do/images/imcc22.png new file mode 100644 index 0000000000..6031ebe964 Binary files /dev/null and b/windows/deployment/do/images/imcc22.png differ diff --git a/windows/deployment/do/images/imcc23.png b/windows/deployment/do/images/imcc23.png new file mode 100644 index 0000000000..6a31b7298f Binary files /dev/null and b/windows/deployment/do/images/imcc23.png differ diff --git a/windows/deployment/do/images/imcc24.png b/windows/deployment/do/images/imcc24.png new file mode 100644 index 0000000000..9bfaf6fd8b Binary files /dev/null and b/windows/deployment/do/images/imcc24.png differ diff --git a/windows/deployment/do/images/imcc25.png b/windows/deployment/do/images/imcc25.png new file mode 100644 index 0000000000..9314eae66f Binary files /dev/null and b/windows/deployment/do/images/imcc25.png differ diff --git a/windows/deployment/do/images/imcc26.png b/windows/deployment/do/images/imcc26.png new file mode 100644 index 0000000000..c46a7e6363 Binary files /dev/null and b/windows/deployment/do/images/imcc26.png differ diff --git a/windows/deployment/do/images/imcc27.png b/windows/deployment/do/images/imcc27.png new file mode 100644 index 0000000000..01076b3ae5 Binary files /dev/null and b/windows/deployment/do/images/imcc27.png differ diff --git a/windows/deployment/do/images/imcc28.png b/windows/deployment/do/images/imcc28.png new file mode 100644 index 0000000000..a7aa7eecd7 Binary files /dev/null and b/windows/deployment/do/images/imcc28.png differ diff --git a/windows/deployment/do/images/imcc29.png b/windows/deployment/do/images/imcc29.png new file mode 100644 index 0000000000..2291487e5b Binary files /dev/null and b/windows/deployment/do/images/imcc29.png differ diff --git a/windows/deployment/do/images/imcc30.png b/windows/deployment/do/images/imcc30.png new file mode 100644 index 0000000000..8cabce52c8 Binary files /dev/null and b/windows/deployment/do/images/imcc30.png differ diff --git a/windows/deployment/do/images/imcc31.png b/windows/deployment/do/images/imcc31.png new file mode 100644 index 0000000000..d85d80d7ff Binary files /dev/null and b/windows/deployment/do/images/imcc31.png differ diff --git a/windows/deployment/do/images/imcc32.png b/windows/deployment/do/images/imcc32.png new file mode 100644 index 0000000000..f0414f11eb Binary files /dev/null and b/windows/deployment/do/images/imcc32.png differ diff --git a/windows/deployment/do/images/imcc33.png b/windows/deployment/do/images/imcc33.png new file mode 100644 index 0000000000..11dbe13c65 Binary files /dev/null and b/windows/deployment/do/images/imcc33.png differ diff --git a/windows/deployment/do/images/imcc34.png b/windows/deployment/do/images/imcc34.png new file mode 100644 index 0000000000..7c59929262 Binary files /dev/null and b/windows/deployment/do/images/imcc34.png differ diff --git a/windows/deployment/do/images/imcc35.png b/windows/deployment/do/images/imcc35.png new file mode 100644 index 0000000000..4f17166345 Binary files /dev/null and b/windows/deployment/do/images/imcc35.png differ diff --git a/windows/deployment/do/images/imcc36.png b/windows/deployment/do/images/imcc36.png new file mode 100644 index 0000000000..c60f31944d Binary files /dev/null and b/windows/deployment/do/images/imcc36.png differ diff --git a/windows/deployment/do/images/imcc37.png b/windows/deployment/do/images/imcc37.png new file mode 100644 index 0000000000..a9cd92e101 Binary files /dev/null and b/windows/deployment/do/images/imcc37.png differ diff --git a/windows/deployment/do/images/imcc38.png b/windows/deployment/do/images/imcc38.png new file mode 100644 index 0000000000..6dd3a698d8 Binary files /dev/null and b/windows/deployment/do/images/imcc38.png differ diff --git a/windows/deployment/do/images/imcc39.png b/windows/deployment/do/images/imcc39.png new file mode 100644 index 0000000000..de6fd0d13d Binary files /dev/null and b/windows/deployment/do/images/imcc39.png differ diff --git a/windows/deployment/do/images/imcc40.png b/windows/deployment/do/images/imcc40.png new file mode 100644 index 0000000000..ad2ae9b04d Binary files /dev/null and b/windows/deployment/do/images/imcc40.png differ diff --git a/windows/deployment/do/images/imcc41.png b/windows/deployment/do/images/imcc41.png new file mode 100644 index 0000000000..9554dce6a9 Binary files /dev/null and b/windows/deployment/do/images/imcc41.png differ diff --git a/windows/deployment/do/images/imcc42.png b/windows/deployment/do/images/imcc42.png new file mode 100644 index 0000000000..ee99dc71cf Binary files /dev/null and b/windows/deployment/do/images/imcc42.png differ diff --git a/windows/deployment/do/images/imcc43.png b/windows/deployment/do/images/imcc43.png new file mode 100644 index 0000000000..4d59561dca Binary files /dev/null and b/windows/deployment/do/images/imcc43.png differ diff --git a/windows/deployment/do/images/imcc44.png b/windows/deployment/do/images/imcc44.png new file mode 100644 index 0000000000..eb53b7a5be Binary files /dev/null and b/windows/deployment/do/images/imcc44.png differ diff --git a/windows/deployment/do/images/imcc45.png b/windows/deployment/do/images/imcc45.png new file mode 100644 index 0000000000..70dd66bf85 Binary files /dev/null and b/windows/deployment/do/images/imcc45.png differ diff --git a/windows/deployment/do/images/imcc46.png b/windows/deployment/do/images/imcc46.png new file mode 100644 index 0000000000..408ea9fabd Binary files /dev/null and b/windows/deployment/do/images/imcc46.png differ diff --git a/windows/deployment/do/images/imcc47.png b/windows/deployment/do/images/imcc47.png new file mode 100644 index 0000000000..93fa87dd0b Binary files /dev/null and b/windows/deployment/do/images/imcc47.png differ diff --git a/windows/deployment/do/images/imcc48.png b/windows/deployment/do/images/imcc48.png new file mode 100644 index 0000000000..eb53b7a5be Binary files /dev/null and b/windows/deployment/do/images/imcc48.png differ diff --git a/windows/deployment/do/images/imcc49.png b/windows/deployment/do/images/imcc49.png new file mode 100644 index 0000000000..eb53b7a5be Binary files /dev/null and b/windows/deployment/do/images/imcc49.png differ diff --git a/windows/deployment/do/images/imcc50.png b/windows/deployment/do/images/imcc50.png new file mode 100644 index 0000000000..a56ea44ca8 Binary files /dev/null and b/windows/deployment/do/images/imcc50.png differ diff --git a/windows/deployment/do/images/imcc51.png b/windows/deployment/do/images/imcc51.png new file mode 100644 index 0000000000..4eb6b626db Binary files /dev/null and b/windows/deployment/do/images/imcc51.png differ diff --git a/windows/deployment/do/images/imcc52.png b/windows/deployment/do/images/imcc52.png new file mode 100644 index 0000000000..ce6ceff758 Binary files /dev/null and b/windows/deployment/do/images/imcc52.png differ diff --git a/windows/deployment/do/images/imcc53.png b/windows/deployment/do/images/imcc53.png new file mode 100644 index 0000000000..ddec14d717 Binary files /dev/null and b/windows/deployment/do/images/imcc53.png differ diff --git a/windows/deployment/do/images/waas-mcc-diag-overview.png b/windows/deployment/do/images/waas-mcc-diag-overview.png new file mode 100644 index 0000000000..bd5c4ee8d9 Binary files /dev/null and b/windows/deployment/do/images/waas-mcc-diag-overview.png differ diff --git a/windows/deployment/do/index.yml b/windows/deployment/do/index.yml new file mode 100644 index 0000000000..986056d1ce --- /dev/null +++ b/windows/deployment/do/index.yml @@ -0,0 +1,97 @@ +### YamlMime:Landing + +title: Delivery Optimization for Windows client # < 60 chars +summary: Set up peer to peer downloads for Windows Updates and learn about Microsoft Connected Cache. # < 160 chars + +metadata: + title: Delivery Optimization # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about using peer to peer downloads on Windows clients and learn about Microsoft Connected Cache. # Required; article description that is displayed in search results. < 160 chars. + services: windows-10 + ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. + ms.subservice: subservice + ms.topic: landing-page # Required + ms.collection: + - windows-10 + - highpri + author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. + ms.author: greglin #Required; microsoft alias of author; optional team alias. + ms.date: 03/07/2022 #Required; mm/dd/yyyy format. + localization_priority: medium + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Overview + linkLists: + - linkListType: overview + links: + - text: What is Delivery Optimization + url: waas-delivery-optimization.md + - text: What's new in Delivery Optimization + url: whats-new-do.md + - text: Microsoft Connected Cache (MCC) overview + url: waas-microsoft-connected-cache.md + + + # Card (optional) + - title: Configure Delivery Optimization on Windows clients + linkLists: + - linkListType: how-to-guide + links: + - text: Delivery Optimization settings + url: waas-delivery-optimization-setup.md#recommended-delivery-optimization-settings + - text: Windows PowerShell for Delivery Optimization + url: waas-delivery-optimization-setup.md#windows-powershell-cmdlets + - text: Troubleshoot Delivery Optimization + url: waas-delivery-optimization-setup.md#troubleshooting + - text: Submit feedback + url: https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app + + # Card (optional) + - title: Configure Delivery Optimization on Microsoft Endpoint Manager + linkLists: + - linkListType: how-to-guide + links: + - text: Optimize Windows 10 or later update delivery with Configuration Manager + url: /mem/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#windows-delivery-optimization + - text: Delivery Optimization settings in Microsoft Intune + url: /mem/intune/configuration/delivery-optimization-windows + + + # Card + - title: Microsoft Connected Cache (MCC) for Enterprise and Education + linkLists: + - linkListType: deploy + links: + - text: MCC for Enterprise and Education (Private Preview) + url: mcc-enterprise.md + - text: Sign up + url: https://aka.ms/MSConnectedCacheSignup + + # Card + - title: Microsoft Connected Cache (MCC) for Internet Service Providers (ISPs) + linkLists: + - linkListType: deploy + links: + - text: MCC for ISPs (Private Preview) + url: mcc-isp.md + - text: Sign up + url: https://aka.ms/MSConnectedCacheSignup + + # Card (optional) + - title: Resources + linkLists: + - linkListType: learn + links: + - text: Introducing Microsoft Connected Cache + url: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-microsoft-connected-cache-microsoft-s-cloud-managed/ba-p/963898 + - text: Delivery Optimization reference + url: waas-delivery-optimization-reference.md + - text: Delivery Optimization client-service communication + url: delivery-optimization-workflow.md + - text: Using a proxy with Delivery Optimization + url: delivery-optimization-proxy.md + diff --git a/windows/deployment/do/mcc-enterprise.md b/windows/deployment/do/mcc-enterprise.md new file mode 100644 index 0000000000..8078d99554 --- /dev/null +++ b/windows/deployment/do/mcc-enterprise.md @@ -0,0 +1,547 @@ +--- +title: Microsoft Connected Cache for Enterprise and Education (private preview) +manager: dougeby +description: Details on Microsoft Connected Cache (MCC) for Enterprise and Education. +keywords: updates, downloads, network, bandwidth +ms.prod: w10 +ms.mktglfcycl: deploy +audience: itpro +author: carmenf +ms.localizationpriority: medium +ms.author: carmenf +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Microsoft Connected Cache for Enterprise and Education (private preview) + +**Applies to** + +- Windows 10 +- Windows 11 + +## Overview + +> [!IMPORTANT] +> Microsoft Connected Cache is currently a private preview feature. During this phase we invite customers to take part in early access for testing purposes. This phase does not include formal support, and should not be used for production workloads. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). + +Microsoft Connected Cache (MCC) preview is a software-only caching solution that delivers Microsoft content within Enterprise networks. MCC can be deployed to as many physical servers or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying a [client policy](/mem/intune/configuration/delivery-optimization-settings.md#local-server-caching) using your management tool, such as Intune. + +MCC is a hybrid (a mix of on-prem and cloud resources) SaaS solution built as an Azure IoT Edge module; it's a Docker compatible Linux container that is deployed to your Windows devices. IoT Edge for Linux on Windows (EFLOW) was chosen because it's a secure, reliable container management infrastructure. EFLOW is a Linux virtual machine, based on Microsoft's first party CBL-Mariner operating system. It’s built with the IoT Edge runtime and validated as a tier 1 supported environment for IoT Edge workloads. MCC will be a Linux IoT Edge module running on the Windows Host OS. + +Even though your MCC scenario isn't related to IoT, Azure IoT Edge is used as a more generic Linux container, deployment, and management infrastructure. The Azure IoT Edge runtime sits on your designated MCC device and performs management and communication operations. The runtime performs the following important functionsto manage MCC on your edge device: + +1. Installs and updates MCC on your edge device. +2. Maintains Azure IoT Edge security standards on your edge device. +3. Ensures that MCC is always running. +4. Reports MCC health and usage to the cloud for remote monitoring. + +To deploy a functional MCC to your device, you must obtain the necessary keys that will provision the Connected Cache instance to communicate with Delivery Optimization services and enable the device to cache and deliver content. See [figure 1](#fig1) below for a summary of the architecture of MCC, built using IoT Edge. + +For more information about Azure IoT Edge, see [What is Azure IoT Edge](/azure/iot-edge/about-iot-edge). + +## How MCC works + +The following steps describe how MCC is provisioned and used. + +1. The Azure Management Portal is used to create MCC nodes. +2. The MCC container is deployed and provisioned to a server using the installer provided in the portal. +3. Client policy is configured in your management solution to point to the IP address or FQDN of the cache server. +4. Microsoft end-user devices make range requests for content from the MCC node. +5. An MCC node pulls content from the CDN, seeds its local cache stored on disk, and delivers content to the client. +6. Subsequent requests from end-user devices for content come from the cache. + +If an MCC node is unavailable, the client will pull content from CDN to ensure uninterrupted service for your subscribers. + + + +![eMCC img01](images/emcc01.png) + +Figure 1: **MCC processes**. Each number in the diagram corresponds to the steps described above. + + +## Enterprise requirements for MCC + +1. **Azure subscription**: MCC management portal is hosted within Azure and is used to create the Connected Cache [Azure resource](/azure/cloud-adoption-framework/govern/resource-consistency/resource-access-management.md) and IoT Hub resource – both are free services. + + Your Azure subscription ID is first used to provision MCC services, and enable access to the preview. The MCC server requirement for an Azure subscription will cost you nothing. If you do not have an Azure subscription already, you can create an Azure [Pay-As-You-Go](https://azure.microsoft.com/offers/ms-azr-0003p/) account which requires a credit card for verification purposes. For more information, see the [Azure Free Account FAQ](https://azure.microsoft.com/free/free-account-faq/). + + The resources used for the preview and in the future when this product is ready for production will be completely free to you, like other caching solutions. + +2. **Hardware to host MCC**: The recommended configuration will serve approximately 35000 managed devices, downloading a 2GB payload in 24-hour timeframe at a sustained rate of 6.5 Gbps. + + **EFLOW Requires Hyper-V support** + - On Windows client, enable the Hyper-V feature + - On Windows Server, install the Hyper-V role and create a default network switch + + Disk recommendations: + - Using an SSD is recommended as cache read speed of SSD is superior to HDD + + NIC requirements: + - Multiple NICs on a single MCC instance aren't supported. + - 1 Gbps NIC is the minimum speed recommended but any NIC is supported. + - For best performance, NIC and BIOS should support SR-IOV + + VM networking: + - An external virtual switch to support outbound and inbound network communication (created during the installation process) + +### Sizing recommendations + +| Component | Branch Office / Small Enterprise | Large Enterprise | +| -- | --- | --- | +| OS| Windows Server 2019*/2022
    Windows 10*/11 (Pro or Enterprise) with Hyper-V Support

    * Windows 10 and Windows Server 2019 build 17763 or later | Same | +|NIC | 1 Gbps | 5 Gbps | +|Disk | SSD
    1 drive
    50GB each |SSD
    1 drive
    200GB each | +|Memory | 4GB | 8GB | +|Cores | 4 | 8 | + +## Steps to deploy MCC + +To deploy MCC to your server: + +1. [Provide Microsoft with the Azure subscription ID](#provide-microsoft-with-the-azure-subscription-id) +2. [Create the MCC Resource in Azure](#create-the-mcc-resource-in-azure) +3. [Create an MCC Node](#create-an-mcc-node-in-azure) +4. [Edit Cache Node Information](#edit-cache-node-information) +5. [Install MCC on a physical server or VM](#install-mcc-on-windows) +6. [Verify proper functioning MCC server](#verify-proper-functioning-mcc-server) +7. [Review common Issues](#common-issues) if needed. + +For questions regarding these instructions contact [msconnectedcache@microsoft.com](mailto:msconnectedcache@microsoft.com) + +### Provide Microsoft with the Azure Subscription ID + +As part of the MCC preview onboarding process an Azure subscription ID must be provided to Microsoft. + +> [!IMPORTANT] +> [Contact Microsoft](mailto:mccforenterprise@microsoft.com?subject=[MCC%20for%20Enterprise]%20Please%20add%20our%20Azure%20subscription%20to%20the%20allow%20list) and provide this information if you have not already. You'll not be able to proceed if you skip this step. + +For information about creating or locating your subscription ID, see [Steps to obtain an Azure Subscription ID](#steps-to-obtain-an-azure-subscription-id). + +### Create the MCC resource in Azure + +The MCC Azure management portal is used to create and manage MCC nodes. An Azure Subscription ID is used to grant access to the preview and to create the MCC resource in Azure and Cache nodes. + +Send email to the MCC team ([mccforenterprise@microsoft.com](mailto:mccforenterprise@microsoft.com)) with your Azure subscription ID to get access to the preview. The team will send you a link to the Azure portal which will allow you to create the resource described below. + +1. On the Azure Portal home page, choose **Create a resource**: + ![eMCC img02](images/emcc02.png) + +2. Type **Microsoft Connected Cache** into the search box, and hit **Enter** to show search results. + +> [!NOTE] +> You'll not see Microsoft Connected Cache in the drop-down list. You need to type it and press enter to see the result. + +3. Select **Microsoft Connected Cache** and choose **Create** on the next screen to start the process of creating the MCC resource. + + ![eMCC img03](images/emcc03.png) + ![eMCC img04](images/emcc04.png) + +4. Fill in the required fields to create the MCC resource. + + - Choose the subscription that you provided to Microsoft. + - Azure resource groups are logical groups of resources. Create a new resource group and choose a name for your resource group. + - Choose **(US) West US** for the location of the resource. This choice will not impact MCC if the physical location isn't in the West US, it's just a limitation of the preview. + + > [!NOTE] + > Your MCC resource will not be created properly if you do not select **(US) West US** + + - Choose a name for the MCC resource. + + > [!NOTE] + > Your MCC resource must not contain the word **Microsoft** in it. + + ![eMCC img05](images/emcc05.png) + +5. Once all the information has been entered, click the **Review + Create** button. Once validation is complete, click the **Create** button to start the + resource creation. + + ![eMCC img06](images/emcc06.png) + +#### Error: Validation failed + +- If you get a Validation failed error message on your portal, it's likely because you selected the **Location** as **US West 2** or some other location that isn't **(US) West US**. +- To resolve this error, go to the previous step and choose **(US) West US**. + + ![eMCC img07](images/emcc07.png) + +### Create an MCC node in Azure + +Creating a MCC node is a multi-step process and the first step is to access the MCC private preview management portal. + +1. After the successful resource creation click on the **Go to resource**. +2. Under **Cache Node Management** section on the leftmost panel, click on **Cache Nodes**. + + ![eMCC img08](images/emcc08.png) + +3. On the **Cache Nodes** blade, click on the **Create Cache Node** button. + + ![eMCC img09](images/emcc09.png) + +4. Clicking the **Create Cache Node** button will open the **Create Cache Node** page; **Cache Node Name** is the only field required for cache node creation. + +| **Field Name** | **Expected Value** | **Description** | +|---------------------|--------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| +| **Cache Node Name** | Alphanumeric name that includes no spaces. | The name of the cache node. You may choose names based on location like Seattle-1. This name must be unique and cannot be changed later. | + +5. Enter the information for the **Cache Node** and click the **Create** button. + +![eMCC img9.5](images/emcc09.5.png) + +If there are errors, the form will provide guidance on how to correct the errors. + +Once the MCC node has been created, the installer instructions will be exposed. More details on the installer instructions will be addressed later in this article, in the [Install Connected Cache](#install-mcc-on-windows) section. + +![eMCC img10](images/emcc10.png) + +#### Edit cache node information + +Cache nodes can be deleted here by clicking the check box to the left of a **Cache Node Name** and then clicking the delete toolbar item. Be aware that if a cache node is deleted, there is no way to recover the cache node or any of the information related to the cache node. + +![eMCC img11](images/emcc11.png) + +### Install MCC on Windows + +Installing MCC on your Windows device is a simple process. A PowerShell script performs the following tasks: + + - Installs the Azure CLI + - Downloads, installs, and deploys EFLOW + - Enables Microsoft Update so EFLOW can stay up to date + - Creates a virtual machine + - Enables the firewall and opens ports 80 and 22 for inbound and outbound traffic. Port 80 is used by MCC, and port 22 is used for SSH communications. + - Configures Connected Cache tuning settings. + - Creates the necessary *FREE* Azure resource - IoT Hub/IoT Edge. + - Deploys the MCC container to server. + +#### Run the installer + +1. Download and unzip mccinstaller.zip from the create cache node page or cache node configuration page which contains the necessary installation files. + + ![eMCC img12](images/emcc12.png) + +Files contained in the mccinstaller.zip file: + + - **installmcc.ps1**: Main installer file. + - **installEflow.ps1**: Installs the necessary prerequisites such as the Linux VM, IoT Edge runtime, and Docker, and makes necessary host OS settings to optimize caching performance. + - **resourceDeploymentForConnectedCache.ps1**: Creates Azure cloud resources required to support MCC control plane. + - **mccdeployment.json**: Deployment manifest used by IoT Edge to deploy the MCC container and configure settings on the container, such as cache drive location sizes. + - **updatemcc.ps1**: The update script used to upgrade MCC to a particular version. + - **mccupdate.json**: Used as part of the update script + +1. Open Windows PowerShell as administrator and navigate to the location of these files. + +> [!NOTE] +> Ensure that Hyper-V is enabled on your device. +> Do not use PowerShell ISE, PowerShell 6.x, or PowerShell 7.x. Only Windows PowerShell version 5.x is supported. + + **Windows 10:** [Enable Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v) + + **Windows Server:** [Install the Hyper-V role on Windows Server](/windows-server/virtualization/hyper-v/get-started/install-the-hyper-v-role-on-windows-server) + +#### If you're installing MCC on a local virtual machine: + +1. Enable Nested Virtualization + + ```powershell + Set -VMProcessor -VMName "VM name" -ExposeVirtualizationExtensions $true + ``` +2. Enable Mac Spoofing + ```powershell + Get-VMNetworkAdapter -VMName "VM name" | Set-VMNetworkAdapter -MacAddressSpoofing On + ``` + **Virtual machine should be in the OFF state while enabling Nested Virtualization and Mac Spoofing** + +3. Set the execution policy + + ```powershell + Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process + ``` + > [!NOTE] + > After setting the execution policy, you'll see a warning asking if you wish to change the execution policy. Choose **[A] Yes to All**. + +4. Copy the command from the portal and run it in Windows PowerShell + + ![eMCC img13](images/emcc13.png) + + > [!NOTE] + > After running the command, and multiple times throughout the installation process, you'll receive the following notice. **Please select [R] Run once to proceed**. + >
    + >
    Security warning + >
    Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning message. Do you want to run C:\\Users\\mccinstaller\\Eflow\\installmcc.ps1? + >
    + >
    [D] Do not run **[R] Run once** [S] Suspend [?] Help (default is "D"): + +3. Choose whether you would like to create a new virtual switch or select an existing one. Name your switch and select the Net Adapter to use for the switch. A computer restart will be required if you're creating a new switch. + + > [!NOTE] + > Restarting your computer after creating a switch is recommended. You'll notice network delays during installation if the computer has not been restarted. + + If you restarted your computer after creating a switch, start from Step 2 above and skip step 5. + + ![eMCC img14](images/emcc14.png) + +4. Re-run the script after the restart. This time, choose **No** when asked to create a new switch. Enter the number corresponding to the switch you previously created. + + ![eMCC img15](images/emcc15.png) + +5. Decide whether you would like to use dynamic or static address for the Eflow VM + + ![eMCC img16](images/emcc16.png) + + > [!NOTE] + > Choosing a dynamic IP address might assign a different IP address when the MCC restarts. + >
    A static IP address is recommended so you do not have to change this value in your management solution when MCC restarts. + +6. Choose where you would like to download, install, and store the virtual hard disk for EFLOW. You'll also be asked how much memory, storage, and cores you would like to allocate for the VM. In this example, we chose the default values for all prompts. + +7. Follow the Azure Device Login link and sign into the Azure Portal. + + ![eMCC img17](images/emcc17.png) + +8. If this is your first MCC deployment, please select **n** so that a new IoT Hub can be created. If you have already configured MCC before, choose **y** so that your MCCs are grouped in the same IoT Hub. + + 1. You'll be shown a list of existing IoT Hubs in your Azure Subscription; Enter the number corresponding to the IoT Hub to select it. **You'll likely have only 1 IoT Hub in your subscription, in which case you want to enter “1”** + + ![eMCC img18](images/emcc18.png) + ![eMCC img19](images/emcc19.png) + +9. Your MCC deployment is now complete. + + 1. If you do not see any errors, please continue to the next section to validate your MCC deployment. + 2. After validating your MCC is properly functional, please review your management solution documentation, such as [Intune](/mem/intune/configuration/delivery-optimization-windows), to set the cache host policy to the IP address of your MCC. + 3. If you had errors during your deployment, see the [Troubleshooting](#troubleshooting) section in this article. + +### Verify proper functioning MCC server + +#### Verify Client Side + +Connect to the EFLOW VM and check if MCC is properly running: + +1. Open PowerShell as an Administrator +2. Enter the following commands: + +```powershell +Connect-EflowVm +sudo -s +iotedge list +``` + +![eMCC img20](images/emcc20.png) + +You should see MCC, edgeAgent, and edgeHub running. If you see edgeAgent or edgeHub but not MCC, please try this command in a few minutes. The MCC container can take a few minutes to deploy + +#### Verify server side + +For a validation of properly functioning MCC, execute the following command in the EFLOW VM or any device in the network. Replace \ with the IP address of the cache server. + +```powershell +wget [http://\/mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com]() +``` + +A successful test result will look like this: + +![eMCC img21](images/emcc21.png) + +OR + +![eMCC img22](images/emcc22.png) + +Similarly, enter this URL from a browser in the network: + +[http://YourCacheServerIP/mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com]() + +If the test fails, see the common issues section for more information. + +### Intune (or other management software) configuration for MCC + +Example of setting the cache host policy to the MCC’s IP address / FQDN: + +![eMCC img23](images/emcc23.png) + +### Common Issues + +#### PowerShell issues + +If you're seeing errors similar to this: “The term ‘Get-Something’ isn't recognized as the name of a cmdlet, function, script file, or operable program.” + +1. Ensure you're running Windows PowerShell version 5.x. + +2. Run \$PSVersionTable and ensure you’re running version 5.x and *not version 6 or 7*. + +3. Ensure you have Hyper-V enabled: + + **Windows 10:** [Enable Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v) + + **Windows Server:** [Install the Hyper-V role on Windows Server](/windows-server/virtualization/hyper-v/get-started/install-the-hyper-v-role-on-windows-server) + +#### Verify Running MCC Container + +Connect to the Connected Cache server and check the list of running IoT Edge modules using the following commands: + +```bash +Connect-EflowVm +sudo iotedge list​ +``` + +![eMCC img24](images/emcc24.png) + +If edgeAgent and edgeHub containers are listed, but not “MCC”, you may view the status of the IoTEdge security manager using the command: + +```bash +sudo journalctl -u iotedge -f +``` + +For example, this command will provide the current status of the starting, stopping of a container, or the container pull and start as is shown in the sample below: + +![eMCC img25](images/emcc25.png) + +Use this command to check the IoT Edge Journal + +```bash +sudo journalctl -u iotedge –f +``` + +Please note: You should consult the IoT Edge troubleshooting guide ([Common issues and resolutions for Azure IoT Edge](/azure/iot-edge/troubleshoot)) for any issues you may encounter configuring IoT Edge, but we have listed a few issues below that we hit during our internal validation. + +## Diagnostics Script + +If you're having issues with your MCC, we included a diagnostics script which will collect all your logs and zip them into a single file. You can then send us these logs via email for the MCC team to debug. + +To run this script: + +1. Navigate to the following folder in the MCC installation files: + + mccinstaller \> Eflow \> Diagnostics + +2. Run the following commands: + +```powershell +Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process +.\collectMccDiagnostics.ps1 +``` + +3. The script stores all the debug files into a folder and then creates a tar file. After the script is finished running, it will output the path of the tar file which you can share with us (should be “**\**\\mccdiagnostics\\support_bundle_\$timestamp.tar.gz”) + +4. [Email the MCC team](mailto:mccforenterprise@microsoft.com?subject=Debugging%20Help%20Needed%20for%20MCC%20for%20Enterprise) and attach this file asking for debugging support. Screenshots of the error along with any other warnings you saw will be helpful during out debugging process. + +## Update MCC + +Throughout the private preview phase, we will send you security and feature updates for MCC. Please follow these steps to perform the update. + +Run the following command with the **arguments** we provided in the email to update your MCC: + +```powershell +# .\updatemcc.ps1 version="**\**" tenantid="**\**" customerid="**\**" cachenodeid="**\**" customerkey="**\**" +``` +For example: +```powershell +# .\updatemcc.ps1 version="msconnectedcacheprod.azurecr.io/mcc/linux/iot/mcc-ubuntu-iot-amd64:1.2.1.659" tenantid="799a999aa-99a1-99aa-99aa-9a9aa099db99" customerid="99a999aa-99a1-99aa-99aa-9aaa9aaa0saa" cachenodeid=" aa99aaaa-999a-9aas-99aa99daaa99 " customerkey="a99d999a-aaaa-aa99-0999aaaa99a” +``` + +## Uninstall MCC + +Please contact the MCC Team before uninstalling to let us know if you're facing +issues. + +This script will remove the following: + +1. EFLOW + Linux VM +2. IoT Edge +3. Edge Agent +4. Edge Hub +5. MCC +6. Moby CLI +7. Moby Engine + +To delete MCC, go to Control Panel \> Uninstall a program \> Select Azure IoT +Edge LTS \> Uninstall + +## Appendix + +### Steps to obtain an Azure Subscription ID + +1. Sign in to https://portal.azure.com/ and navigate to the Azure services section. +2. Click on **Subscriptions**. If you do not see **Subscriptions**, click on the **More Services** arrow and search for **Subscriptions**. +3. If you already have an Azure Subscription, skip to step 5. If you do not have an Azure Subscription, select **+ Add** on the top left. +4. Select the **Pay-As-You-Go** subscription. You'll be asked to enter credit card information, but you'll not be charged for using the MCC service. +5. On the **Subscriptions** blade, you'll find details about your current subscription. Click on the subscription name. +6. After you select the subscription name, you'll find the subscription ID in the **Overview** tab. Click on the **Copy to clipboard** icon next to your Subscription ID to copy the value. + +### Troubleshooting + +If you’re not able to sign up for a Microsoft Azure subscription with the error: **Account belongs to a directory that cannot be associated with an Azure subscription. Please sign in with a different account.** See [Can't sign up for a Microsoft Azure subscription](/troubleshoot/azure/general/cannot-sign-up-subscription). + +Also see [Troubleshoot issues when you sign up for a new account in the Azure portal](/azure/cost-management-billing/manage/troubleshoot-azure-sign-up). + +### IoT Edge runtime + +The Azure IoT Edge runtime enables custom and cloud logic on IoT Edge devices. +The runtime sits on the IoT Edge device, and performs management and +communication operations. The runtime performs several functions: + +- Installs and update workloads (Docker containers) on the device. +- Maintains Azure IoT Edge security standards on the device. +- Ensures that IoT Edge modules (Docker containers) are always running. +- Reports module (Docker containers) health to the cloud for remote monitoring. +- Manages communication between an IoT Edge device and the cloud. + +For more information on Azure IoT Edge, please see the [Azure IoT Edge documentation](/azure/iot-edge/about-iot-edge). + +### EFLOW + +- [What is Azure IoT Edge for Linux on Windows](/azure/iot-edge/iot-edge-for-linux-on-windows) +- [Install Azure IoT Edge for Linux on Windows](/azure/iot-edge/how-to-provision-single-device-linux-on-windows-symmetric#install-iot-edge) +- [PowerShell functions for Azure IoT Edge for Linux on Windows](/azure/iot-edge/reference-iot-edge-for-linux-on-windows-functions) +- EFLOW FAQ and Support: [Support · Azure/iotedge-eflow Wiki (github.com)](https://github.com/Azure/iotedge-eflow/wiki/Support#how-can-i-apply-updates-to-eflow) +- [Now ready for Production: Linux IoT Edge Modules on Windows - YouTube](https://www.youtube.com/watch?v=pgqVCg6cxVU&ab_channel=MicrosoftIoTDevelopers) + +### Routing local Windows Clients to an MCC + +#### Get the IP address of your MCC using ifconfig + +There are multiple methods that can be used to apply a policy to PCs that should participate in downloading from the MCC. + +##### Registry Key + +You can either set your MCC IP address or FQDN using: + +1. Registry Key in 1709 and higher - + [HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization]
    + "DOCacheHost"=" " + + From an elevated command prompt: + + ``` + reg add "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization" /v DOCacheHost /t REG_SZ /d "10.137.187.38" /f + ``` + +2. MDM Path in 1809 or higher: + + .Vendor/MSFT/Policy/Config/DeliveryOptimization/DOCacheHost + +3. In Windows release version 1809 and later, you can apply the policy via Group Policy Editor. The policy to apply is **DOCacheHost**. To configure the clients to pull content from the MCC using Group Policy, set the Cache Server Hostname (Setting found under Computer Configuration, Administrative Templates, Windows Components, Delivery Optimization) to the IP address of your MCC. For example 10.137.187.38. + + ![eMCC img26](images/emcc26.png) + +**Verify Content using the DO Client** + +To verify that the Delivery Optimization client can download content using MCC, you can use the following steps: + +1. Download a game or application from the Microsoft Store. + + ![eMCC img27](images/emcc27.png) + +2. Verify downloads came from MCC by one of two methods: + + - Using PowerShell Cmdlet Get-DeliveryOptimizationStatus you should see BytesFromCacheServer test + + ![eMCC img28](images/emcc28.png) + + - Looking at the Delivery Optimization Activity Monitor + + ![eMCC img29](images/emcc29.png) + +## Also see + +[Microsoft Connected Cache for ISPs](mcc-isp.md)
    +[Introducing Microsoft Connected Cache](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-microsoft-connected-cache-microsoft-s-cloud-managed/ba-p/963898) \ No newline at end of file diff --git a/windows/deployment/do/mcc-isp.md b/windows/deployment/do/mcc-isp.md new file mode 100644 index 0000000000..ccdf0bbec3 --- /dev/null +++ b/windows/deployment/do/mcc-isp.md @@ -0,0 +1,593 @@ +--- +title: Microsoft Connected Cache for Internet Service Providers (ISPs) +manager: dougeby +description: Details on Microsoft Connected Cache (MCC) for Internet Service Providers (ISPs). +keywords: updates, downloads, network, bandwidth +ms.prod: w10 +ms.mktglfcycl: deploy +audience: itpro +author: carmenf +ms.localizationpriority: medium +ms.author: carmenf +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Microsoft Connected Cached for Internet Service Providers (ISPs) + +**Applies to** + +- Windows 10 +- Windows 11 + +## Overview + +> [!IMPORTANT] +> Microsoft Connected Cache is currently a private preview feature. During this phase we invite customers to take part in early access for testing purposes. This phase does not include formal support, and should not be used for production workloads. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). + +Microsoft Connected Cache (MCC) preview is a software-only caching solution that delivers Microsoft content within Enterprise networks. MCC can be deployed to as many physical servers or VMs as needed, and is managed from a cloud portal. Microsoft cloud services handle routing of consumer devices to the cache server for content downloads. + +MCC is a hybrid (a mix of on-prem and cloud resources) SaaS solution built as an Azure IoT Edge module; it is a Docker compatible Linux container that is deployed to your Windows devices. IoT Edge for Linux on Windows (EFLOW) was chosen because it is a secure, reliable container management infrastructure. EFLOW is a Linux virtual machine, based on Microsoft's first party CBL-Mariner operating system. It’s built with the IoT Edge runtime and validated as a tier 1 supported environment for IoT Edge workloads. MCC will be a Linux IoT Edge module running on the Windows Host OS. Azure IoT Edge consists of three components that the MCC infrastructure will utilize: + +1. A cloud-based interface that enables secure, remote installation, monitoring, and management of MCC nodes. +2. A runtime that securely manages the modules deployed to each device. +3. Modules/containers that run the MCC functionality on your device. + +## How MCC works + +The following steps describe how MCC is provisioned and used. + +1. The Azure Management Portal used to create and manage MCC nodes. +2. The MCC container is deployed and provisioned to the server. +3. The Azure Management Portal is used to configure Microsoft Delivery Optimization Services to route traffic to the MCC server by providing two pieces of information: + - The publicly accessible IPv4 address of the server hosting the MCC container. + - The CIDR blocks that represent the client IP address space, which should be routed to the MCC node. +4. Microsoft end-user devices periodically connect with Microsoft Delivery Optimization Services, and the services match the IP address of the client with the IP address of the corresponding MCC node. +5. Microsoft end-user devices make the range requests for content from the MCC node. +6. An MCC node pulls content from the CDN, seeds its local cache stored on disk, and delivers the content to the client. +7. Subsequent requests from end-user devices for content will now come from cache. +8. If the MCC node is unavailable, the client will pull content from CDN to ensure uninterrupted service for your subscribers. + + ![MCC overview 1](images/imcc01.png) + +## ISP Requirements for MCC + +1. **Azure subscription**: The MCC management portal is hosted within Azure, and is used to create the Connected Cache Azure resource and IoT Hub resource. Both are free services. + + Your Azure subscription ID is first used to provision MCC services, and enable access to the preview. The MCC server requirement for an Azure subscription will cost you nothing. If you don't have an Azure subscription already, you can create an Azure [Pay-As-You-Go](https://azure.microsoft.com/offers/ms-azr-0003p/) account which requires a credit card for verification purposes. For more information, see the [Azure Free Account FAQ](https://azure.microsoft.com/free/free-account-faq/). + + The resources used for the preview, and in the future when this product is ready for production, will be completely free to you - like other caching solutions. + + > [!NOTE] + > If you request Exchange or Public peering in the future, business email addresses must be used to register ASN's, because Microsoft does not accept gmail or other non-business email addresses. + +2. **Hardware to host MCC**: The recommended configuration will serve approximately 35,000 consumer devices, downloading a 2GB payload in 24-hour timeframe at a sustained rate of 6.5 Gbps. + +Disk requirements: +- SSDs are recommended due to improved cache read speeds of SSD, compared to HDD. +- Using multiple disks is recommended to improve cache performance. +- RAID disk configurations are discouraged because cache performance will be impacted. If you're using RAID disk configurations, ensure striping. +- The maximum number of disks supported is 10. + +NIC requirements: +- Multiple NICs on a single MCC instance are not supported. +- 10Gbps NIC is the minimum speed recommended, but any NIC is supported. + +### Sizing recommendations + +| Component | Minimum | Recommended | +| -- | --- | --- | +| OS | Ubuntu 20.04 LTS VM or physical server | Ubuntu 20.04 LTS VM or physical server (preferred) | +| NIC | 10 Gbps| at least 10 Gbps | +| Disk | SSD
    1 drive
    2TB each |SSD
    2-4 drives
    at least 2TB each | +| Memory | 8GB | 32GB or greater | +| Cores | 4 | 8 or more | + +## Steps to deploy MCC + +To deploy MCC: + +1. [Provide Microsoft with the Azure subscription ID](#provide-microsoft-with-the-azure-subscription-id) +2. [Create the MCC Resource in Azure](#create-the-mcc-resource-in-azure) +3. [Create an MCC Node](#create-an-mcc-node-in-azure): IP address space approval information is required for this step. +4. [Edit Cache Node Information](#edit-cache-node-information) +5. [Set up your server](#set-up-a-server-with-sr-or-an-ubuntu) +6. [Install MCC on a physical server or VM](#install-mcc) +7. [Verify proper functioning MCC server](#verify-proper-functioning-mcc-server) +8. [Review the MCC summary report](#verify-server-side) +9. [Review common issues](#common-issues) if needed. + +For questions regarding these instructions contact [msconnectedcache@microsoft.com](mailto:msconnectedcache@microsoft.com) + +## Provide Microsoft with the Azure Subscription ID + +As part of the MCC preview onboarding process an Azure subscription ID must be provided to Microsoft. + +> [!IMPORTANT] +> [Contact Microsoft](mailto:mccforenterprise@microsoft.com?subject=[MCC%20for%20Enterprise]%20Please%20add%20our%20Azure%20subscription%20to%20the%20allow%20list) and provide your Azure subscription ID if you have not already. You'll not be able to proceed if you skip this step. + + +For information about creating or locating your subscription ID, see [Steps to obtain an Azure Subscription ID](#steps-to-obtain-an-azure-subscription-id). + +### Create the MCC resource in Azure + +The MCC Azure management portal is used to create and manage MCC nodes. An Azure Subscription ID is used to grant access to the preview and to create the MCC resource in Azure and Cache nodes. + +Send email to the MCC team ([msconnectedcache@microsoft.com](mailto:msconnectedcache@microsoft.com)) with your Azure subscription ID to get access to the preview. The team will send you a link to the Azure portal, which will allow you to create the resource described below. + +1. Choose **Create a resource** + + ![eMCC img02](images/imcc02.png) + +2. Type **Microsoft Connected Cache** into the search box, and hit **Enter** to show search results. + +3. Select **Microsoft Connected Cache** and choose **Create** on the next screen to start the process of creating the MCC resource. + + ![iMCC img03](images/imcc03.png) + ![iMCC img04](images/imcc04.png) + +4. Fill in the required fields to create the MCC resource. + + - Choose the subscription that you provided to Microsoft. + - Azure resource groups are logical groups of resources. Create a new resource group and choose a name for your resource group. + - Choose **(US) West US**” for the location of the resource. This choice will not impact MCC if the physical location isn't in the West US, it is just a limitation of the preview. + + > [!NOTE] + > Your MCC resource will not be created properly if you don't select **(US) West US** + + - Choose a name for the MCC resource. + + ![iMCC emg05](images/imcc05.png) + +5. Once all the information has been entered, click the **Review + Create** button. Once validation is complete, click the **Create** button to start the + resource creation. + + ![iMCC img06](images/imcc06.png) + +#### Error: Validation failed + +- If you get a Validation failed error message on your portal, it is likely because you selected the **Location** as **US West 2** or some other location that isn't **(US) West US**. +- To resolve this error, go to the previous step and choose **(US) West US**. + + ![iMCC img07](images/imcc07.png) + +### Create an MCC node in Azure + +Creating a MCC node is a multi-step process and the first step is to access the MCC private preview management portal. + +1. After the successful resource creation click on the **Go to resource**. +2. Under **Cache Node Management** section on the leftmost panel, click on **Cache Nodes**. + + ![iMCC img08](images/imcc08.png) + +3. On the **Cache Nodes** blade, click on the **Create Cache Node** button. + + ![iMCC img09](images/imcc09.png) + +4. Clicking the **Create Cache Node** button will open the **Create Cache Node** page; **Cache Node Name** is the only field required for cache node creation. + +| **Field Name** | **Expected Value** | **Description** | +|-------------------------------|--------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **Cache Node Name** | Alphanumeric name that includes no spaces. | The name of the cache node. You may choose names based on location like Seattle-1. This name must be unique and can't be changed later. | +| **Server II Address** | Ipv4 Address | IP address of your MCC server. This is used to route end-user devices in your network to the server for Microsoft content downloads. **The IP address must be publicly accessible.** | +| **Address Range/CIDR Blocks** | IPv4 CIDR notation | IP Address range/CIDR blocks that should be routed to the MCC server as a comma separated list. For example: 2.21.234.0/24 , 3.22.235.0/24 , 4.23.236.0/24 | +| **Enable Cache Node** | Enable/Disable Radio Button | **Enable** permits the cache node to receive content requests.
    **Disable** prevents the cache node from receiving content requests.
    Cache nodes are enabled by default. | + + ![iMCC img10](images/imcc10.png) + +Hovering your cursor next to each field will populate the details of that field. + + ![iMCC img11](images/imcc11.png) + +There are two other read-only fields on this page that are populated after the cache node is created: + +| **Field Name** | **Description** | +|---------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **IP Space** | Number of IP addresses that will be routed to your cache server. | +| **Activation Keys** | Set of keys to activate your cache node with the MCC services. Copy the keys for use during install. The CustomerID is your Azure subscripiton ID. | + +5. Enter the information for the Cache Node and click on the Create button. In the screenshot below only the Cache Node Name is provided, but all information can be included if desired. + + ![iMCC img12](images/imcc12.png) + + If there are errors the form will provide guidance on how to correct the errors. For example: + + - The cache node name is in use in the resource or is an incorrect format. + - If the CIDR block notation or list is incorrect. + - The server IP address or CIDR block are already in use. + + See the following example with all information entered: + + ![iMCC img13](images/imcc13.png) + + Once the MCC Node has been created, the installer instructions will be exposed. More details on the installer instructions will be addressed later in this doc can be found at the [Install Connected Cache](#install-mcc) section. + + ![iMCC img14](images/imcc14.png) + +### IP address space approval + +There are three states for IP address space that are explained in the table below. The preview will require approval from Microsoft CIDR block ranges that contain more than 50,000 IP addresses. In the future, MCC configuration will support BGP and will therefore have automatic routing capabilities. + +| **IP address space status** | **Description** | +|------------------------|------------------------------------| +| **Valid** | The IP address space is below the 50,000 IP address space threshold and the space does not overlap with existing cache nodes. | +| **In Review** | The IP address space exceeds the 50,000 IP address space and is under review with Microsoft to ensure valid IP address space. | +| **Attention Required** | The IP address space has been reviewed and an issue was discovered. Some examples include: IP address space overlap with existing cache node belonging to another customer. IP address space was exceedingly large. Contact Microsoft for more information if your IP address space has this status. | + +See the following example: + +![iMCC img15](images/imcc15.png) + +## Edit Cache Node Information + +IP address or CIDR information can be modified for existing MCC nodes in the portal. + +To edit IP address or CIDR information, click on the Cache Node Name which will open the Cache Node Configuration page. Cache nodes can be deleted here by clicking the check box to the left of a Cache Node Name and then clicking the delete toolbar item. Be aware that if a cache node is deleted, there is no way to recover the cache node or any of the information related to the cache node. + +![iMCC img16](images/imcc16.png) + +The Server IP Address, Address Range/CIDR Blocks, and Enable Cache Node are all editable as show below: + +![iMCC img17](images/imcc17.png) + +## Set up a server with SR or an Ubuntu + +The MCC module is optimized for Ubuntu 20.04 LTS. Install Ubuntu 20.04 LTS on a physical server or VM of your choice. As discussed earlier, the recommended configuration (details below) will serve approximately 35,000 consumer devices downloading a 2GB payload in 24-hour timeframe at a sustained rate of 6.5 Gbps. + +| | **Minimum** | **Recommended** | +|-------------|---------------------------------------------|----------------------------------------------------| +| **Server** | Ubuntu 20.04 LTS VM or physical server | Ubuntu 20.04 LTS VM or physical server (preferred) | +| **NIC** | 10 Gbps | 10 Gbps | +| **Disk** | SSD 1 – 2 drives minimum 2 TB each minimum | SSD 2 – 4 drives minimum 2 TB each minimum | +| **Memory** | 8 GB | 32 GB or more | +| **Cores** | 4 | 8 or more | + +## Install MCC + +Installing MCC on your physical server or VM is a straightforward process. A Bash script installer performs the following tasks: + +- Azure IoT Edge relies on an OCI-compatible container runtime. The script + will install the Moby engine and CLI. +- Installs IoT Edge. +- Installs SSH to support remote access to the server +- Enables the firewall and opens port 80 for inbound and outbound traffic. Port 80 is used by MCC. +- Configures Connected Cache tuning settings. +- Creates the necessary *FREE* Azure resource - IoT Hub/IoT Edge. +- Deploys the MCC container to server. + +> [!IMPORTANT] +> Ensure that port 5000 is open so Microsoft can verify proper functioning of the cache server + +### Steps to install MCC + +1. Download and unzip mccinstaller.zip from the create cache node page or cache node configuration page which contains the necessary installation files. + + ![iMCC img18](images/imcc18.png) + + Files contained in the mccinstaller.zip file: + + - **installmcc.sh** – main installer file. + - **installIotEdge.sh** – Installs the necessary prerequisites like IoT Edge runtime and Docker and makes necessary host OS settings to optimization caching performance. + - **resourceDeploymentForConnectedCache.sh** – Creates Azure cloud resources required to support MCC control plane. + - **mccdeployment.json** – Deployment manifest used by IoT Edge to deploy the MCC container and configure settings on the container like cache drives location sizes. + +2. Copy all 4 installation files to your Linux server (physical or VM) + +3. Before proceeding, ensure that you have a data drive configured on your server. You'll need to specify the location for this cache drive on step 9. Mimimum size for the data drive is 100GB. For instructions to mount a disk on a Linux VM, see [Attach a data disk to a Linux VM](/azure/virtual-machines/linux/attach-disk-portal#find-the-disk) + +4. Open a terminal and change the access permissions to execute on the **installmcc.sh** Bash script file using chmod. + + ```bash + sudo chmod +x installmcc.sh + ``` + +5. Copy the Bash script line provided and run the Bash script from the terminal. + + ![iMCC img19](images/imcc19.png) + +6. You'll be prompted to sign in to the Azure Portal using a device code. + + ![iMCC img20](images/imcc20.png) + +7. You'll be prompted to enter the Azure Container Registry (ACR) password for access to the MCC container. + + ![iMCC img21](images/imcc21.png) + +8. You'll then be prompted with the number of drives to configure. + + ![iMCC img22](images/imcc22.png) + +9. The script will prompt for location and size of the cache drives. + + ![iMCC img23](images/imcc23.png) + +> [!IMPORTANT] +> The permissions / ownerships on the cache drive location will be changed to everyone via chmod 777
    +> **Don't** point the cache drive location to any of the following: “**.**”, “**./var**”, “**/**”, “**\**” + +Specifying any of the directories mentioned above will corrupt the VM and you +will need to provision a new one. + +![iMCC img24](images/imcc24.png) + +1. If this is your first MCC deployment, select “n” when + prompted for an IoT Hub. If this is **not** your first MCC deployment, you + can use an existing IoT hub from your previous MCC installation. After + selecting “Y”, we will display your existing IoT Hubs, you can copy and + paste the resulting IoT Hub name to continue. + + ![iMCC img25](images/imcc25.png) + +2. If there are no errors go to the next step. + + - If there are errors, inspect the installer logs which are under /etc/mccresourcecreation/. + - If there were follow the instructions to [Troubleshoot your IoT Edge device(/azure/iot-edge/troubleshoot). + +## Verify Proper Functioning MCC Server + +### Verify client side + +Sign in to the Connected Cache server or ssh and run the following command from a terminal to see the running modules (containers): + +```bash +sudo iotedge list​ +``` + +![iMCC img26](images/imcc26.png) + +If **edgeAgent** and **8edgeHub** containers are listed, but not “MCC”, you may view the status of the IoTEdge security manager using the command: + +```bash +sudo journalctl -u iotedge -f +``` + +For example, this command provides the current status of the starting, stopping of a container, or the container pull and start as is shown in the sample below: + +![iMCC img27](images/imcc27.png) + +### Verify server side + +It can take a few minutes for the container to deploy. + +For a validation of properly functioning MCC, run the following command in the terminal of the cache server or any device in the network. Replace \ with the IP address of the cache server. + +```bash +wget http:///mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com +``` + +A successful test result will look like this: + +![iMCC img28](images/imcc28.png) + +Similarly, enter the following URL into a web browser on the network: + +```http +http:///mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com +``` + +If the test fails, see the [common issues](#common-issues) section below for more information. + +## Common Issues + +> [!NOTE] +> Consult the [IoT Edge troubleshooting guide](/azure/iot-edge/troubleshoot) for any issues you may encounter configuring IoT Edge. A few common issues are listed below. + +Use the following command to check the IoT Edge Journal: + +```bash +sudo journalctl -u iotedge –f +``` + +## DNS needs to be configured + +Run the following IoT Edge setup/install state check: + +```bash +sudo iotedge check --verbose +``` + +If you see issues with ports 5671, 443, and 8883 similar to the screenshot below, it means that your IoT Edge device needs to update the DNS for Docker. + +![iMCC img29](images/imcc29.png) + +Follow the steps below to configure the device to work with your DNS: + +1. Use ifconfig to find appropriate NIC adapter name. + + ```bash + ifconfig​ + ``` +2. Run nmcli device show \ to show you the DNS name for Ethernet adapter. For example to show DNS + information for eno1: + + ```bash + nmcli device show eno1 + ``` + + ![iMCC img30](images/imcc30.png) + +3. Open/create the Docker configuration file used to configure the DNS server + + ```bash + sudo nano /etc/docker/daemon.json​ + ``` + +4. Paste the following into the daemon.json file (In the example above IP4.DNS[1] is used) + + ```bash + { "dns": ["x.x.x.x"]} + ``` +5. Save the file changes to daemon.json. **Note**: You might need to change permissions on this file. For example: + + ```bash + sudo chmod 555 /etc/docker/daemon.json​ + ``` + +6. Restart Docker (to pick up the new DNS) and restart IoTEdge + + ```bash + sudo systemctl restart dockersudo systemctl daemon-reloadsudo restart IoTEdge + ``` + +## Diagnostics Script + +If you're having issues with your MCC, we included a diagnostics script which will collect all your logs and zip them into a single file. You can then send us these logs via email for the MCC team to debug. + +To run this script: + +1. Navigate to the following folder in the MCC installation files: + +**mccinstaller** \> **MccResourceInstall** \> **Diagnostics** + +2. Run the following commands: + + ```bash + sudo chmod +x collectMccDiagnostics.sh + sudo ./collectMccDiagnostics.sh + ``` +3. The script stores all the debug files into a folder and the creates a tar file. After the script is finished running, it will output the path of the tar file that you can share with the MCC team. The file should be **/etc/mccdiagnostics/support_bundle_\$timestamp.tar.gz**. + +4. [Email the MCC team](mailto:msconnectedcache@microsoft.com?subject=Debugging%20Support%20Request%20for%20MCC) and attach this tar file, asking for debugging support. Screenshots of the error along with any other warnings you saw will be helpful during out debugging process. + +## Updating your MCC + +Throughout the private preview phase, we will send you security and feature updates for MCC. Please follow these steps to perform the update. + +Run the following commands with the **arguments** we provided in the email to update your MCC: + +```bash +sudo chmod +x updatemcc.sh +sudo chmod +x installIoTEdge.sh +sudo ./updatemcc.sh version="\<**VERSION**\>" tenantid="\<**TENANTID**\>" customerid="\<**CUSTOMERID**\>" cachenodeid="\<**CACHENODEID**\>" customerkey="\<**CUSTOMERKEY**\>" +``` + +For example: +```bash +sudo ./updatemcc.sh version="msconnectedcacheprod.azurecr.io/mcc/linux/iot/mcc-ubuntu-iot-amd64:1.2.1.981" tenantid="799a999aa-99a1-99aa-99aa-9a9aa099db99" customerid="99a999aa-99a1-99aa-99aa-9aaa9aaa0saa" cachenodeid=" aa99aaaa-999a-9aas-99aa99daaa99 " customerkey="a99d999a-aaaa-aa99-0999aaaa99aa” +``` + +## Uninstalling MCC + +In the zip file, you'll find the file **uninstallmcc.sh** which uninstalls MCC and all the related components. Please contact the MCC Team before running this script and only run this script if you're facing issues with MCC installation. **Exercise caution before running this script as existing IoT workflows in this VM will also be erased.** + +The **uninstallmcc.sh** script will remove the following: + +- IoT Edge +- Edge Agent +- Edge Hub +- MCC +- Moby CLI +- Moby Engine + +To run the script, enter the following commands: + +```bash +sudo chmod +x uninstallmcc.sh +sudo ./uninstallmcc.sh +``` +## Appendix + +### Steps to obtain an Azure Subscription ID + +1. Sign in to https://portal.azure.com/ and navigate to the Azure services section. +2. Click on **Subscriptions**. If you don't see **Subscriptions**, click on the **More Services** arrow and search for **Subscriptions**. +3. If you already have an Azure Subscription, skip to step 5. If you don't have an Azure Subscription, select **+ Add** on the top left. +4. Select the **Pay-As-You-Go** subscription. You'll be asked to enter credit card information, but you'll not be charged for using the MCC service. +5. On the **Subscriptions** blade, you'll find details about your current subscription. Click on the subscription name. +6. After you select the subscription name, you'll find the subscription ID in the **Overview** tab. Click on the **Copy to clipboard** icon next to your Subscription ID to copy the value. + +### Performance of MCC in Hypervisor environments + +We have observed in hypervisor environments the cache server peak egress at around 1.1 Gbps. If you wish to maximize the egress in hypervisor environments it is critical to make two settings changes. + +1. Enable **SR-IOV** in the BIOS AND enable **SR-IOV** in the NIC properties, and finally, enable **SR-IOV** in the hypervisors for the MCC VM. Microsoft has found these settings to double egress when using a Microsoft Hyper-V deployment. + +2. Enable “high performance” in the BIOS as opposed to energy savings. Microsoft has found this setting nearly doubled egress a Microsoft Hyper-V deployment. + +### Setting up a VM on Windows Server + +You can use hardware that will natively run Ubuntu 20.04 LTS, or you can run an Ubuntu VM. The following steps describe how to set up a VM on Hyper-V. + +1. Download the ISO. You can use either Ubuntu Desktop or Ubuntu Server. + + 1. [Download Ubuntu Desktop](https://ubuntu.com/download/desktop) + 2. [Download Ubuntu Server](https://mirror.cs.jmu.edu/pub/ubuntu-iso/20.04.2/ubuntu-20.04.2-live-server-amd64.iso) + +2. Start the **New Virtual Machine Wizard**, give your VM a name, and choose a location. + + ![iMCC img31](images/imcc31.png) + ![iMCC img32](images/imcc32.png) + +3. Choose a **Generation 2** VM, and specify the startup memory. You can't change the VM generation 2 later. + + ![iMCC img33](images/imcc33.png) + ![iMCC img34](images/imcc34.png) + +4. Choose the network adapter. + + ![iMCC img35](images/imcc35.png) + +5. Set the virtual hard disk parameters. You should specify enough space for the OS and the content that will be cached. That example below allocates one terabyte. + + ![iMCC img36](images/imcc36.png) + +6. Install from the ISO for Ubuntu 20.04 LTS that you downloaded. + + ![iMCC img37](images/imcc37.png) + +7. Finish the creation of the Ubuntu VM. + + ![iMCC img38](images/imcc38.png) + +8. Before you start the Ubuntu VM make sure secure boot is **disabled** and that you have allocated multiple cores to the VM. The example below has allocated 12, but your configuration may vary. + + ![iMCC img39](images/imcc39.png) + ![iMCC img40](images/imcc40.png) + ![iMCC img41](images/imcc41.png) + +9. Start the VM and choose the option that will Install Ubuntu. Choose your default language. + + ![iMCC img42](images/imcc42.png) + ![iMCC img43](images/imcc43.png) + +10. Choose the options you wish for installing updates and third party hardware. In the example below, we have chosen to download updates and install + third party software drivers. + + ![iMCC img44](images/imcc44.png) + +11. If you had a previous version of Ubuntu installed, we recommend erasing and installing Ubuntu 16.04. Choose your time zone, and keyboard layout. + + ![iMCC img45](images/imcc45.png) + ![iMCC img46](images/imcc46.png) + ![iMCC img47](images/imcc47.png) + ![iMCC img48](images/imcc48.png) + +12. Choose your username, a name for your computer, and a password. Remember, everything is case sensitive in Linux. You'll be asked to reboot in order to complete the installation. + + ![iMCC img49](images/imcc49.png) + ![iMCC img50](images/imcc50.png) + +13. **Important**: When prompted with the option to upgrade, decline. + + ![iMCC img51](images/imcc51.png) + ![iMCC img52](images/imcc52.png) + +Your Ubuntu VM should now be ready to [Install MCC](#install-mcc). + +### IoT Edge runtime + +The Azure IoT Edge runtime enables custom and cloud logic on IoT Edge devices. The runtime sits on the IoT Edge device, and performs management and communication operations. The runtime performs several functions: + +- Installs and update workloads (Docker containers) on the device. +- Maintains Azure IoT Edge security standards on the device. +- Ensures that IoT Edge modules (Docker containers) are always running. +- Reports module (Docker containers) health to the cloud for remote + monitoring. +- Manages communication between an IoT Edge device and the cloud. + +For more information on Azure IoT Edge, please see the [Azure IoT Edge documentation](/azure/iot-edge/about-iot-edge). + +## Also see + +[Microsoft Connected Cache for Enterprise and Education](mcc-enterprise.md)
    +[Introducing Microsoft Connected Cache](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-microsoft-connected-cache-microsoft-s-cloud-managed/ba-p/963898) diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md similarity index 99% rename from windows/deployment/update/waas-delivery-optimization-reference.md rename to windows/deployment/do/waas-delivery-optimization-reference.md index 9ae67c4eed..d3311ce5e8 100644 --- a/windows/deployment/update/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -22,7 +22,7 @@ ms.custom: seo-marvel-apr2020 - Windows 10 - Windows 11 -> **Looking for more Group Policy settings?** See the master spreadsheet available at the [Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=103506). +> **Looking for more Group Policy settings?** See the master spreadsheet available at the [Download Center](https://www.microsoft.com/download/details.aspx?id=103506). There are a great many details you can set in Delivery Optimization to customize it to do just what you need it to. This topic summarizes them for your reference. If you just need an overview of Delivery Optimization, see [Delivery Optimization for Windows client updates](waas-delivery-optimization.md). If you need information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization for Windows client updates](waas-delivery-optimization-setup.md). diff --git a/windows/deployment/update/waas-delivery-optimization-setup.md b/windows/deployment/do/waas-delivery-optimization-setup.md similarity index 98% rename from windows/deployment/update/waas-delivery-optimization-setup.md rename to windows/deployment/do/waas-delivery-optimization-setup.md index b5df600cef..2f0fd3dee0 100644 --- a/windows/deployment/update/waas-delivery-optimization-setup.md +++ b/windows/deployment/do/waas-delivery-optimization-setup.md @@ -32,7 +32,7 @@ You will find the Delivery Optimization settings in Group Policy under **Compute Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile, which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](/intune/delivery-optimization-windows)) -**Starting with Windows 10, version 1903,** you can use the Azure Active Directory (Azure AD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. +**Starting with Windows 10, version 1903**, you can use the Azure Active Directory (Azure AD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. ## Recommended Delivery Optimization settings @@ -221,7 +221,7 @@ Update Compliance provides you with information about your Delivery Optimization [[DO status](images/UC_workspace_DO_status.png)](images/UC_workspace_DO_status.png#lightbox) -For details, see [Delivery Optimization in Update Compliance](update-compliance-delivery-optimization.md). +For details, see [Delivery Optimization in Update Compliance](../update/update-compliance-delivery-optimization.md). ## Troubleshooting diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/do/waas-delivery-optimization.md similarity index 79% rename from windows/deployment/update/waas-delivery-optimization.md rename to windows/deployment/do/waas-delivery-optimization.md index c5e770a342..25a9c49bfe 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/do/waas-delivery-optimization.md @@ -28,22 +28,12 @@ ms.custom: seo-marvel-apr2020 Windows updates, upgrades, and applications can contain packages with large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization is a cloud-managed solution that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or Microsoft Endpoint Manager (when installation of Express Updates is enabled). - Access to the Delivery Optimization cloud services and the Internet, are both requirements for using the peer-to-peer functionality of Delivery Optimization. +Access to the Delivery Optimization cloud services and the Internet, are both requirements for using the peer-to-peer functionality of Delivery Optimization. For information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization](waas-delivery-optimization-setup.md). For a comprehensive list of all Delivery Optimization settings, see [Delivery Optimization reference](waas-delivery-optimization-reference.md). ->[!NOTE] ->WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. - -## New in Windows 10, version 20H2 and Windows 11 - -- New peer selection options: Currently the available options include: 0 = None, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID)." -- Local Peer Discovery: a new option for **[Restrict Peer Selection By](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection)** (in Group Policy) or **DORestrictPeerSelectionBy** (in MDM). This option restricts the discovery of local peers using the DNS-SD protocol. When you set Option 2, Delivery Optimization will restrict peer selection to peers that are locally discovered (using DNS-SD). If Group mode is enabled, Delivery Optimization will connect to locally discovered peers that are also part of the same group, for those devices with the same Group ID). - > [!NOTE] -> The Local Peer Discovery (DNS-SD, [RFC 6763](https://datatracker.ietf.org/doc/html/rfc6763)) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. For more information, see [Delivery Optimization reference](/windows/deployment/update/waas-delivery-optimization-reference.md). - -- Starting with Windows 11, the Bypass option of [Download Mode](waas-delivery-optimization-reference.md#download-mode) is no longer used. +> WSUS can also use [BranchCache](../update/waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. ## Requirements @@ -113,3 +103,7 @@ To gain a deeper understanding of the Delivery Optimization client-service commu ## Delivery Optimization reference For a complete list of Delivery Optimization settings, see [Delivery Optimization reference](waas-delivery-optimization-reference.md). + +## New in Windows 10, version 20H2 and Windows 11 + +See [What's new in Delivery Optimization](whats-new-do.md) \ No newline at end of file diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md new file mode 100644 index 0000000000..9126dea4e9 --- /dev/null +++ b/windows/deployment/do/waas-microsoft-connected-cache.md @@ -0,0 +1,65 @@ +--- +title: Microsoft Connected Cache overview +manager: dougeby +description: This article provides information about Microsoft Connected Cache (MCC), a software-only caching solution. +keywords: oms, operations management suite, wdav, updates, downloads, log analytics +ms.prod: w10 +ms.mktglfcycl: deploy +audience: itpro +author: carmenf +ms.localizationpriority: medium +ms.author: carmenf +ms.collection: +- M365-modern-desktop +- m365initiative-coredeploy +- highpri +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Microsoft Connected Cache overview + +**Applies to** + +- Windows 10 +- Windows 11 + +> [!IMPORTANT] +> Microsoft Connected Cache is currently a private preview feature. During this phase we invite customers to take part in early access for testing purposes. This phase does not include formal support, and should not be used for production workloads. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). + +Microsoft Connected Cache (MCC) preview is a software-only caching solution that delivers Microsoft content within Enterprise networks. MCC can be deployed to as many bare-metal servers or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune. + +MCC is a hybrid (mix of on-prem and cloud resources) SaaS solution built as an Azure IoT Edge module and Docker compatible Linux container deployed to your Windows devices. The Delivery Optimization team chose IoT Edge for Linux on Windows (EFLOW) as a secure, reliable container management infrastructure. EFLOW is a Linux virtual machine, based on Microsoft's first party CBL-Mariner operating system. It’s built with the IoT Edge runtime and validated as a tier 1 supported environment for IoT Edge workloads. MCC will be a Linux IoT Edge module running on the Windows Host OS. + +Even though your MCC scenario is not related to IoT, Azure IoT Edge is used as a more generic Linux container deployment and management infrastructure. The Azure IoT Edge runtime sits on your designated MCC device and performs management and communication operations. The runtime performs several functions important to manage MCC on your edge device: + +1. Installs and updates MCC on your edge device. +2. Maintains Azure IoT Edge security standards on your edge device. +3. Ensures that MCC is always running. +4. Reports MCC health and usage to the cloud for remote monitoring. + +To deploy a functional MCC to your device, you must obtain the necessary keys to provision the Connected Cache instance that communicates with Delivery Optimization services, and enable the device to cache and deliver content. The architecture of MCC is described below. + +For more details information on Azure IoT Edge, please see the Azure IoT Edge [documentation](/azure/iot-edge/about-iot-edge). + +## How MCC Works + +1. The Azure Management Portal is used to create MCC nodes. +2. The MCC container is deployed and provisioned to the server using the installer provided in the portal. +3. Client policy is set in your management solution to point to the IP address or FQDN of the cache server. +4. Microsoft end-user devices make range requests for content from the MCC node. +5. The MCC node pulls content from the CDN, seeds its local cache stored on disk, and delivers the content to the client. +6. Subsequent requests from end-user devices for content will now come from cache. +7. If the MCC node is unavailable, the client will pull content from CDN to ensure uninterrupted service for your subscribers. + +See the following diagram. + +![MCC Overview](images/waas-mcc-diag-overview.png#lightbox) + +For more information about MCC, see the following articles: +- [Microsoft Connected Cache for Enterprise and Education](mcc-enterprise.md) +- [Microsoft Connected Cache for ISPs](mcc-isp.md) + +## Also see + +[Introducing Microsoft Connected Cache](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-microsoft-connected-cache-microsoft-s-cloud-managed/ba-p/963898) \ No newline at end of file diff --git a/windows/deployment/update/waas-optimize-windows-10-updates.md b/windows/deployment/do/waas-optimize-windows-10-updates.md similarity index 87% rename from windows/deployment/update/waas-optimize-windows-10-updates.md rename to windows/deployment/do/waas-optimize-windows-10-updates.md index 3b6d5aeee1..7892b0cb60 100644 --- a/windows/deployment/update/waas-optimize-windows-10-updates.md +++ b/windows/deployment/do/waas-optimize-windows-10-updates.md @@ -29,7 +29,7 @@ Two methods of peer-to-peer content distribution are available. Windows Update, Windows Update for Business, and Windows Server Update Services (WSUS) can use Delivery Optimization. Delivery Optimization can significantly reduce the amount of network traffic to external Windows Update sources as well as the time it takes for clients to retrieve the updates. -- [BranchCache](waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of Windows Server 2016 and Windows operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7. +- [BranchCache](../update/waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of Windows Server 2016 and Windows operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7. >[!NOTE] >Full BranchCache functionality is supported in Windows 10 Enterprise and Education; Windows 10 Pro supports some BranchCache functionality, including BITS transfers used for servicing operations. @@ -61,7 +61,7 @@ Windows client quality update downloads can be large because every package conta Express update delivery is available on [all support versions of WSUS](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc708456(v=ws.10)). - **Express on devices directly connected to Windows Update** -- **Enterprise devices managed using [Windows Update for Business](waas-manage-updates-wufb.md)** also get the benefit of Express update delivery support without any change in configuration. +- **Enterprise devices managed using [Windows Update for Business](../update/waas-manage-updates-wufb.md)** also get the benefit of Express update delivery support without any change in configuration. ### How Express download works @@ -89,11 +89,9 @@ At this point, the download is complete and the update is ready to be installed. |  |  | | --- | --- | -| ![done.](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | -| ![done.](images/checklistdone.png) | [Prepare servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md) | -| ![done.](images/checklistdone.png) | [Build deployment rings for Windows client updates](waas-deployment-rings-windows-10-updates.md) | -| ![done.](images/checklistdone.png) | [Assign devices to servicing channels for Windows client updates](waas-servicing-channels-windows-10-updates.md) | +| ![done.](images/checklistdone.png) | [Learn about updates and servicing channels](../update/waas-overview.md) | +| ![done.](images/checklistdone.png) | [Prepare servicing strategy for Windows client updates](../update/waas-servicing-strategy-windows-10-updates.md) | +| ![done.](images/checklistdone.png) | [Build deployment rings for Windows client updates](../update/waas-deployment-rings-windows-10-updates.md) | +| ![done.](images/checklistdone.png) | [Assign devices to servicing channels for Windows client updates](../update/waas-servicing-channels-windows-10-updates.md) | | ![done.](images/checklistdone.png) | Optimize update delivery for Windows 10 updates (this topic) | -| ![to do.](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
    or [Deploy Windows client updates using Windows Server Update Services](waas-manage-updates-wsus.md)
    or [Deploy Windows client updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) | - - +| ![to do.](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](../update/waas-manage-updates-wufb.md)
    or [Deploy Windows client updates using Windows Server Update Services](../update/waas-manage-updates-wsus.md)
    or [Deploy Windows client updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) | \ No newline at end of file diff --git a/windows/deployment/do/whats-new-do.md b/windows/deployment/do/whats-new-do.md new file mode 100644 index 0000000000..f1cd1edb98 --- /dev/null +++ b/windows/deployment/do/whats-new-do.md @@ -0,0 +1,43 @@ +--- +title: What's new in Delivery Optimization +manager: dougeby +description: What's new in Delivery Optimization, a peer-to-peer distribution method in Windows 10 and Windows 11. +keywords: oms, operations management suite, wdav, updates, downloads, log analytics, mcc, do, delivery, connected cache +ms.prod: w10 +ms.mktglfcycl: deploy +audience: itpro +author: carmenf +ms.localizationpriority: medium +ms.author: carmenf +ms.collection: +- M365-modern-desktop +- m365initiative-coredeploy +- highpri +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# What's new in Delivery Optimization + +**Applies to** + +- Windows 10 +- Windows 11 + +## Microsoft Connected Cache (private preview) + +Microsoft Connected Cache (MCC) is a software-only caching solution that delivers Microsoft content within Enterprise networks. MCC can be deployed to as many bare-metal servers or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune. + +For more information about MCC, see [Microsoft Connected Cache overview](waas-microsoft-connected-cache.md). + +## New in Delivery Optimization for Windows 10, version 20H2 and Windows 11 + +- New peer selection options: Currently the available options include: 0 = None, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID)." +- Local Peer Discovery: a new option for **[Restrict Peer Selection By](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection)** (in Group Policy) or **DORestrictPeerSelectionBy** (in MDM). This option restricts the discovery of local peers using the DNS-SD protocol. When you set Option 2, Delivery Optimization will restrict peer selection to peers that are locally discovered (using DNS-SD). If Group mode is enabled, Delivery Optimization will connect to locally discovered peers that are also part of the same group, for those devices with the same Group ID). + +> [!NOTE] +> The Local Peer Discovery (DNS-SD, [RFC 6763](https://datatracker.ietf.org/doc/html/rfc6763)) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. For more information, see [Delivery Optimization reference](waas-delivery-optimization-reference.md). + +- Starting with Windows 11, the Bypass option of [Download Mode](waas-delivery-optimization-reference.md#download-mode) is no longer used. + + diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 314d9aa780..f612082db5 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -15,7 +15,7 @@ metadata: - highpri author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. ms.author: greglin #Required; microsoft alias of author; optional team alias. - ms.date: 06/24/2021 #Required; mm/dd/yyyy format. + ms.date: 02/08/2022 #Required; mm/dd/yyyy format. localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -48,6 +48,8 @@ landingContent: url: update/waas-manage-updates-wufb.md - text: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager url: deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md + - text: Set up Delivery Optimization for Windows client updates + url: do/index.yml # Card (optional) - title: Deploy diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md index c4d62b04f1..44bd241363 100644 --- a/windows/deployment/update/how-windows-update-works.md +++ b/windows/deployment/update/how-windows-update-works.md @@ -133,7 +133,7 @@ Once the Windows Update Orchestrator determines which updates apply to your comp To ensure that your other downloads aren't affected or slowed down because updates are downloading, Windows Update uses Delivery Optimization, which downloads updates and reduces bandwidth consumption. -For more information, see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). +For more information, see [Configure Delivery Optimization for Windows 10 updates](../do/waas-delivery-optimization.md). ## Installing updates ![Windows Update install step.](images/update-install-step.png) diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md index 3eef8dae64..508735b15c 100644 --- a/windows/deployment/update/index.md +++ b/windows/deployment/update/index.md @@ -34,7 +34,7 @@ Windows as a service provides a new way to think about building, deploying, and | [Prepare servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md) | Explains the decisions you need to make in your servicing strategy. | | [Assign devices to servicing branches for Windows client updates](/waas-servicing-channels-windows-10-updates.md) | Explains how to assign devices to the General Availability Channel for feature and quality updates, and how to enroll devices in Windows Insider. | | [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | Explains how to use Update Compliance to monitor and manage Windows Updates on devices in your organization. | -| [Optimize update delivery](waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. | +| [Optimize update delivery](../do/waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. | | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune. | | [Deploy Windows client updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) | Explains how to use WSUS to manage Windows client updates. | | [Deploy Windows client updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) | Explains how to use Configuration Manager to manage Windows client updates. | diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md index 37afc617f7..c38e4c31a2 100644 --- a/windows/deployment/update/prepare-deploy-windows.md +++ b/windows/deployment/update/prepare-deploy-windows.md @@ -123,7 +123,7 @@ The specific endpoints can vary between Windows versions. See, for example, [Win ### Optimize download bandwidth -Set up [Delivery Optimization](waas-delivery-optimization.md) for peer network sharing or Microsoft Connected Cache. +Set up [Delivery Optimization](../do/waas-delivery-optimization.md) for peer network sharing or Microsoft Connected Cache. ### Address unhealthy devices diff --git a/windows/deployment/update/quality-updates.md b/windows/deployment/update/quality-updates.md index acae62d5a9..72b7cc08b6 100644 --- a/windows/deployment/update/quality-updates.md +++ b/windows/deployment/update/quality-updates.md @@ -8,7 +8,7 @@ author: greg-lindsay ms.localizationpriority: medium ms.author: greglin ms.reviewer: -manager: laurawi +manager: dougeby ms.topic: article --- @@ -68,7 +68,7 @@ For additional details about the different types of Windows updates like critica - [Overview of Windows as a service](waas-overview.md) - [Update Windows 10 in the enterprise](index.md) - [Quick guide to Windows as a service](waas-quick-start.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure Delivery Optimization for Windows 10 updates](../do/waas-delivery-optimization.md) - [Configure BranchCache for Windows 10 updates](waas-branchcache.md) - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) diff --git a/windows/deployment/update/update-compliance-delivery-optimization.md b/windows/deployment/update/update-compliance-delivery-optimization.md index 1aa38de12a..c3d41a7192 100644 --- a/windows/deployment/update/update-compliance-delivery-optimization.md +++ b/windows/deployment/update/update-compliance-delivery-optimization.md @@ -36,7 +36,7 @@ The Delivery Optimization Status section includes three blades: ## Device Configuration blade -Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Configure Delivery Optimization for Windows client updates](waas-delivery-optimization-setup.md). +Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Configure Delivery Optimization for Windows client updates](../do/waas-delivery-optimization-setup.md). ## Content Distribution (%) blade The first of two blades showing information on content breakdown, this blade shows a ring chart summarizing **Bandwidth Savings %**, which is the percentage of data received from peer sources out of the total data downloaded (for any device that used peer-to-peer distribution). diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index de2b593b39..9560167fe0 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -29,7 +29,7 @@ Update Compliance enables organizations to: * Monitor security, quality, and feature updates for Windows 10 or Windows 11 Professional, Education, and Enterprise editions. * View a report of device and update issues related to compliance that need attention. -* Check bandwidth savings incurred across multiple content types by using [Delivery Optimization](waas-delivery-optimization.md). +* Check bandwidth savings incurred across multiple content types by using [Delivery Optimization](../do/waas-delivery-optimization.md). Update Compliance is offered through the Azure portal, and is included as part of Windows 10 or Windows 11 licenses listed in the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites). Azure Log Analytics ingestion and retention charges are not incurred on your Azure subscription for Update Compliance data. diff --git a/windows/deployment/update/update-compliance-schema-waasupdatestatus.md b/windows/deployment/update/update-compliance-schema-waasupdatestatus.md index 2472b0182d..b65bc42893 100644 --- a/windows/deployment/update/update-compliance-schema-waasupdatestatus.md +++ b/windows/deployment/update/update-compliance-schema-waasupdatestatus.md @@ -22,7 +22,7 @@ WaaSUpdateStatus records contain device-centric data and acts as the device reco |--|-|----|------------------------| |**Computer** |[string](/azure/kusto/query/scalar-data-types/string) |`JohnPC-Contoso` |User or Organization-provided device name. If this appears as '#', then Device Name may not be sent through telemetry. To enable Device Name to be sent with telemetry, see [Enabling Device Name in Telemetry](./update-compliance-get-started.md). | |**ComputerID** |[string](/azure/kusto/query/scalar-data-types/string) |`g:6755412281299915` |Microsoft Global Device Identifier. This is an internal identifier used by Microsoft. A connection to the end-user Managed Service Account (MSA) service is required for this identifier to be populated; no device data will be present in Update Compliance without this identifier. | -|**DownloadMode** |[string](/azure/kusto/query/scalar-data-types/string) |`Simple (99)` |The device's Delivery Optimization DownloadMode. To learn about possible values, see [Delivery Optimization Reference - Download mode](./waas-delivery-optimization-reference.md#download-mode) | +|**DownloadMode** |[string](/azure/kusto/query/scalar-data-types/string) |`Simple (99)` |The device's Delivery Optimization DownloadMode. To learn about possible values, see [Delivery Optimization Reference - Download mode](../do/waas-delivery-optimization-reference.md#download-mode) | |**FeatureDeferralDays** |[int](/azure/kusto/query/scalar-data-types/int) |`0` |The on-client Windows Update for Business Deferral Policy days.
    - **<0**: A value below 0 indicates the policy is disabled.
    - **0**: A value of 0 indicates the policy is enabled, but the deferral period is zero days.
    - **1+**: A value of 1 and above indicates the deferral setting, in days. | |**FeaturePauseDays** |[int](/azure/kusto/query/scalar-data-types/int) |`0` |*Deprecated* This provides the count of days left in a pause | |**FeaturePauseState** |[int](/azure/kusto/query/scalar-data-types/int) |`NotConfigured` |The on-client Windows Update for Business Pause state. Reflects whether or not a device has paused Feature Updates.
  • **Expired**: The pause period has expired.
  • **NotConfigured**: Pause is not configured.
  • **Paused**: The device was last reported to be pausing this content type.
  • **NotPaused**: The device was last reported to not have any pause on this content type. | diff --git a/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md b/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md index 7ef5f590b2..056d243859 100644 --- a/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md +++ b/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md @@ -18,7 +18,7 @@ ms.topic: article WUDOAggregatedStatus records provide information, across all devices, on their bandwidth utilization for a specific content type in the event they use [Delivery Optimization](https://support.microsoft.com/help/4468254/windows-update-delivery-optimization-faq), over the past 28 days. -These fields are briefly described in this article, to learn more about Delivery Optimization in general, check out the [Delivery Optimization Reference](./waas-delivery-optimization-reference.md). +These fields are briefly described in this article, to learn more about Delivery Optimization in general, check out the [Delivery Optimization Reference](../do/waas-delivery-optimization-reference.md). |Field |Type |Example |Description | |-|-|-|-| @@ -30,5 +30,5 @@ These fields are briefly described in this article, to learn more about Delivery |**BytesFromIntPeers** |[long](/azure/kusto/query/scalar-data-types/long) |`328350` |Total number of bytes downloaded from Internet Peers. | |**BytesFromPeers** |[long](/azure/kusto/query/scalar-data-types/long) |`43145` |Total number of bytes downloaded from peers. | |**ContentType** |[int](/azure/kusto/query/scalar-data-types/int) |`Quality Updates` |The type of content being downloaded.| -|**DownloadMode** |[string](/azure/kusto/query/scalar-data-types/string) |`HTTP+LAN (1)` |Device's Delivery Optimization [Download Mode](./waas-delivery-optimization-reference.md#download-mode) configuration for this device. | +|**DownloadMode** |[string](/azure/kusto/query/scalar-data-types/string) |`HTTP+LAN (1)` |Device's Delivery Optimization [Download Mode](../do/waas-delivery-optimization-reference.md#download-mode) configuration for this device. | |**TimeGenerated** |[datetime](/azure/kusto/query/scalar-data-types/datetime)|`1601-01-01T00:00:00Z` |A DateTime corresponding to the moment Azure Monitor Logs ingested this record to your Log Analytics workspace.| \ No newline at end of file diff --git a/windows/deployment/update/update-compliance-schema-wudostatus.md b/windows/deployment/update/update-compliance-schema-wudostatus.md index 29099d3b8f..16fc2ce481 100644 --- a/windows/deployment/update/update-compliance-schema-wudostatus.md +++ b/windows/deployment/update/update-compliance-schema-wudostatus.md @@ -21,7 +21,7 @@ ms.topic: article WUDOStatus records provide information, for a single device, on their bandwidth utilization for a specific content type in the event they use [Delivery Optimization](https://support.microsoft.com/help/4468254/windows-update-delivery-optimization-faq), and other information to create more detailed reports and splice on certain common characteristics. -These fields are briefly described in this article, to learn more about Delivery Optimization in general, check out the [Delivery Optimization Reference](./waas-delivery-optimization-reference.md). +These fields are briefly described in this article, to learn more about Delivery Optimization in general, check out the [Delivery Optimization Reference](../do/waas-delivery-optimization-reference.md). |Field |Type |Example |Description | |-|-|-|-| @@ -36,10 +36,10 @@ These fields are briefly described in this article, to learn more about Delivery |**BytesFromGroupPeers** |[long](/azure/kusto/query/scalar-data-types/long) |`523132` |Total number of bytes downloaded from Group Peers. | |**BytesFromIntPeers** |[long](/azure/kusto/query/scalar-data-types/long) |`328350` |Total number of bytes downloaded from Internet Peers. | |**BytesFromPeers** |[long](/azure/kusto/query/scalar-data-types/long) |`43145` |Total number of bytes downloaded from peers. | -|**ContentDownloadMode** |[int](/azure/kusto/query/scalar-data-types/int) |`0` |Device's Delivery Optimization [Download Mode](./waas-delivery-optimization-reference.md#download-mode) configuration for this content. | +|**ContentDownloadMode** |[int](/azure/kusto/query/scalar-data-types/int) |`0` |Device's Delivery Optimization [Download Mode](../do/waas-delivery-optimization-reference.md#download-mode) configuration for this content. | |**ContentType** |[int](/azure/kusto/query/scalar-data-types/int) |`Quality Updates` |The type of content being downloaded. | |**DOStatusDescription** |[string](/azure/kusto/query/scalar-data-types/string) | |A short description of DO's status, if any. | -|**DownloadMode** |[string](/azure/kusto/query/scalar-data-types/string) |`HTTP+LAN (1)` |Device's Delivery Optimization [Download Mode](./waas-delivery-optimization-reference.md#download-mode) configuration for this device. | +|**DownloadMode** |[string](/azure/kusto/query/scalar-data-types/string) |`HTTP+LAN (1)` |Device's Delivery Optimization [Download Mode](../do/waas-delivery-optimization-reference.md#download-mode) configuration for this device. | |**DownloadModeSrc** |[string](/azure/kusto/query/scalar-data-types/string) |`Default` |The source of the DownloadMode configuration. | |**GroupID** |[string](/azure/kusto/query/scalar-data-types/string) | |The DO Group ID. | |**NoPeersCount** |[long](/azure/kusto/query/scalar-data-types/long) | |The number of peers this device interacted with. | diff --git a/windows/deployment/update/update-compliance-using.md b/windows/deployment/update/update-compliance-using.md index 3537d1c157..660ea98100 100644 --- a/windows/deployment/update/update-compliance-using.md +++ b/windows/deployment/update/update-compliance-using.md @@ -29,7 +29,7 @@ In this section you'll learn how to use Update Compliance to monitor your device Update Compliance: - Provides detailed deployment monitoring for Windows client feature and quality updates. - Reports when devices need attention due to issues related to update deployment. -- Shows bandwidth usage and savings for devices that are configured to use [Delivery Optimization](waas-delivery-optimization.md). +- Shows bandwidth usage and savings for devices that are configured to use [Delivery Optimization](../do/waas-delivery-optimization.md). - Provides all of the above data in [Log Analytics](#using-log-analytics), which affords additional querying and export capabilities. ## The Update Compliance tile diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md index 9cfa2f188d..72d95901a5 100644 --- a/windows/deployment/update/waas-branchcache.md +++ b/windows/deployment/update/waas-branchcache.md @@ -24,7 +24,7 @@ ms.custom: seo-marvel-apr2020 BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and Microsoft Endpoint Manager can use BranchCache to optimize network bandwidth during update deployment, and it's easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. -- Distributed Cache mode operates like the [Delivery Optimization](waas-delivery-optimization.md) feature in Windows client: each client contains a cached version of the BranchCache-enabled files it requests and acts as a distributed cache for other clients requesting that same file. +- Distributed Cache mode operates like the [Delivery Optimization](../do/waas-delivery-optimization.md) feature in Windows client: each client contains a cached version of the BranchCache-enabled files it requests and acts as a distributed cache for other clients requesting that same file. >[!TIP] >Distributed Cache mode is preferred to Hosted Cache mode for Windows clients updates to get the most benefit from peer-to-peer distribution. diff --git a/windows/deployment/update/waas-delivery-optimization-faq.md b/windows/deployment/update/waas-delivery-optimization-faq.md index cfdbb2a1ca..0f59183964 100644 --- a/windows/deployment/update/waas-delivery-optimization-faq.md +++ b/windows/deployment/update/waas-delivery-optimization-faq.md @@ -36,7 +36,7 @@ Delivery Optimization also communicates with its cloud service by using HTTP/HTT ## What are the requirements if I use a proxy? -For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see [Using a proxy with Delivery Optimization](./delivery-optimization-proxy.md). Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see [Proxy requirements for Windows Update](/windows/deployment/update/windows-update-troubleshooting.md). +For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see [Using a proxy with Delivery Optimization](../do/delivery-optimization-proxy.md). Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see [Proxy requirements for Windows Update](/windows/deployment/update/windows-update-troubleshooting.md). ## What hostnames should I allow through my firewall to support Delivery Optimization? @@ -64,9 +64,9 @@ Starting in Windows 10, version 1903, Delivery Optimization uses LEDBAT to relie Delivery Optimization attempts to identify VPNs by checking the network adapter type and details. A connection will be treated as a VPN if the adapter description contains certain keywords, such as "VPN" or "secure." -If the connection is identified as a VPN, Delivery Optimization will suspend uploads to other peers. However, you can allow uploads over a VPN by using the [Enable Peer Caching while the device connects via VPN](waas-delivery-optimization-reference.md#enable-peer-caching-while-the-device-connects-via-vpn) policy. +If the connection is identified as a VPN, Delivery Optimization will suspend uploads to other peers. However, you can allow uploads over a VPN by using the [Enable Peer Caching while the device connects via VPN](../do/waas-delivery-optimization-reference.md#enable-peer-caching-while-the-device-connects-via-vpn) policy. -If you have defined a boundary group in Configuration Manager for VPN IP ranges, you can set the [DownloadMode](waas-delivery-optimization-reference.md#download-mode) policy to 0 for that boundary group, to ensure that there will be no peer-to-peer activity over the VPN. When the device is not connected using a VPN, it can still use peer-to-peer with the default of LAN. +If you have defined a boundary group in Configuration Manager for VPN IP ranges, you can set the [DownloadMode](../do/waas-delivery-optimization-reference.md#download-mode) policy to 0 for that boundary group, to ensure that there will be no peer-to-peer activity over the VPN. When the device is not connected using a VPN, it can still use peer-to-peer with the default of LAN. With split tunneling, make sure to allow direct access to these endpoints: diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 3d2daa50ef..042a03a950 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -336,7 +336,7 @@ Now that you have the **All Windows 10 Upgrades** view, complete the following s | ![done.](images/checklistdone.png) | [Prepare servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md) | | ![done.](images/checklistdone.png) | [Build deployment rings for Windows client updates](waas-deployment-rings-windows-10-updates.md) | | ![done.](images/checklistdone.png) | [Assign devices to servicing channels for Windows client updates](waas-servicing-channels-windows-10-updates.md) | -| ![done.](images/checklistdone.png) | [Optimize update delivery for Windows client updates](waas-optimize-windows-10-updates.md) | +| ![done.](images/checklistdone.png) | [Optimize update delivery for Windows client updates](../do/waas-optimize-windows-10-updates.md) | | ![done.](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
    or Deploy Windows client updates using Windows Server Update Services (this topic)
    or [Deploy Windows client updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) | diff --git a/windows/deployment/update/waas-microsoft-connected-cache.md b/windows/deployment/update/waas-microsoft-connected-cache.md deleted file mode 100644 index 5363df4aeb..0000000000 --- a/windows/deployment/update/waas-microsoft-connected-cache.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: What is Microsoft Connected Cache? -manager: dougeby -description: This article provides information about Microsoft Connected Cache, a software-only caching solution. -keywords: oms, operations management suite, wdav, updates, downloads, log analytics -ms.prod: w10 -ms.mktglfcycl: deploy -audience: itpro -author: carmenf -ms.localizationpriority: medium -ms.author: carmenf -ms.collection: -- M365-modern-desktop -- m365initiative-coredeploy -- highpri -ms.topic: article -ms.custom: seo-marvel-apr2020 ---- - -# What is Microsoft Connected Cache? - -**Applies to** - -- Windows 10 -- Windows 11 - -Microsoft Connected Cache (MCC) preview is a software-only caching solution that delivers Microsoft content within Enterprise networks. MCC can be deployed to as many bare-metal servers or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune. - -Microsoft Connected Cache is a hybrid (mix of on-prem and cloud resources) SaaS solution built as an Azure IoT Edge module and Docker compatible Linux container deployed to your Windows devices. The Delivery Optimization team chose IoT Edge for Linux on Windows (EFLOW) as a secure, reliable container management infrastructure. EFLOW is a Linux virtual machine, based on Microsoft's first party CBL-Mariner operating system. It’s built with the IoT Edge runtime and validated as a tier 1 supported environment for IoT Edge workloads. Microsoft Connected Cache will be a Linux IoT Edge module running on the Windows Host OS. - -Even though your Microsoft Connected Cache scenario is not related to IoT, Azure IoT Edge is used as a more generic Linux container deployment and management infrastructure. The Azure IoT Edge runtime sits on your designated MCC device and performs management and communication operations. The runtime performs several functions important to manage Microsoft Connected Cache on your edge device: - -1. Installs and updates Microsoft Connected Cache on your edge device. -2. Maintains Azure IoT Edge security standards on your edge device. -3. Ensures that Microsoft Connected Cache is always running. -4. Reports Microsoft Connected Cache health and usage to the cloud for remote monitoring. - -To deploy a functional Microsoft Connected Cache to your device, you must obtain the necessary keys to provision the Connected Cache instance that communicates with Delivery Optimization services, and enable the device to cache and deliver content. The architecture of Microsoft Connected Cache is described below. - -For more details information on Azure IoT Edge, please see the Azure IoT Edge [documentation](/azure/iot-edge/about-iot-edge). - -## How Microsoft Connected Cache Works - -1. The Azure Management Portal is used to create Microsoft Connected Cache nodes. -2. The Microsoft Connected Cache container is deployed and provisioned to the server using the installer provided in the portal. -3. Client policy is set in your management solution to point to the IP address or FQDN of the cache server. -4. Microsoft end-user devices make range requests for content from the Microsoft Connected Cache node. -5. The Microsoft Connected Cache node pulls content from the CDN, seeds its local cache stored on disk, and delivers the content to the client. -6. Subsequent requests from end-user devices for content will now come from cache. -7. If the Microsoft Connected Cache node is unavailable, the client will pull content from CDN to ensure uninterrupted service for your subscribers. - -See the following diagram. - -![Microsoft Connected Cache Overview](images/waas-mcc-diag-overview.png#lightbox) - -## Also see - -[Introducing Microsoft Connected Cache](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-microsoft-connected-cache-microsoft-s-cloud-managed/ba-p/963898) \ No newline at end of file diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md index f98345cef2..8dd780d36a 100644 --- a/windows/deployment/update/waas-overview.md +++ b/windows/deployment/update/waas-overview.md @@ -142,6 +142,6 @@ There are many tools you can use to service Windows as a service. Each option ha | Windows Update | Yes (manual) | No | Delivery Optimization | None| | Windows Update for Business | Yes | No | Delivery Optimization | Other Group Policy objects | | WSUS | Yes | Yes | BranchCache or Delivery Optimization | Upstream/downstream server scalability | -| Configuration Manager | Yes | Yes | BranchCache, Client Peer Cache, or Delivery Optimization. For the latter, see [peer-to-peer content distribution](/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#peer-to-peer-content-distribution) and [Optimize Windows Update Delivery](./waas-optimize-windows-10-updates.md) | Distribution points, multiple deployment options | +| Configuration Manager | Yes | Yes | BranchCache, Client Peer Cache, or Delivery Optimization. For the latter, see [peer-to-peer content distribution](/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#peer-to-peer-content-distribution) and [Optimize Windows Update Delivery](../do/waas-optimize-windows-10-updates.md) | Distribution points, multiple deployment options | diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index 6f20c17750..7ef84ba4b5 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -3,9 +3,9 @@ title: Manage device restarts after updates (Windows 10) description: Use Group Policy settings, mobile device management (MDM), or Registry to configure when devices will restart after a Windows 10 update is installed. ms.prod: w10 ms.mktglfcycl: deploy -author: jaimeo +author: carmenf ms.localizationpriority: medium -ms.author: jaimeo +ms.author: carmenf manager: dougeby ms.topic: article ms.custom: @@ -201,7 +201,7 @@ There are three different registry combinations for controlling restart behavior - [Update Windows 10 in the enterprise](index.md) - [Overview of Windows as a service](waas-overview.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure Delivery Optimization for Windows 10 updates](../do/waas-delivery-optimization.md) - [Configure BranchCache for Windows 10 updates](waas-branchcache.md) - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md index a034dba7a3..f1fb5fafcf 100644 --- a/windows/deployment/update/windows-as-a-service.md +++ b/windows/deployment/update/windows-as-a-service.md @@ -105,7 +105,7 @@ Secure your organization's deployment investment. [Configure Windows Update for Business](waas-configure-wufb.md) -[Express update delivery](waas-optimize-windows-10-updates.md#express-update-delivery) +[Express update delivery](../do/waas-optimize-windows-10-updates.md#express-update-delivery) [Windows 10 deployment considerations](../planning/windows-10-deployment-considerations.md) diff --git a/windows/deployment/update/windows-update-resources.md b/windows/deployment/update/windows-update-resources.md index 8173d6ca5b..addbc016f4 100644 --- a/windows/deployment/update/windows-update-resources.md +++ b/windows/deployment/update/windows-update-resources.md @@ -82,6 +82,10 @@ If all else fails, try resetting the Windows Update Agent by running these comma Ren %Systemroot%\SoftwareDistribution\Download Download.bak Ren %Systemroot%\System32\catroot2 catroot2.bak ``` + + > [!IMPORTANT] + > The **reset** step below using sc.exe will **overwrite** your existing security ACLs on the BITS and Windows Update service and set them to default. Skip this step unless the other steps to reset Windows Update components have not resolved the issue. + 2. Reset the **BITS service** and the **Windows Update service** to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command. ``` console sc.exe sdset bits D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU) diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index 2c6e89c1e2..4153f5223b 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -16,7 +16,7 @@ ms.collection: - M365-identity-device-management - highpri ms.topic: article -ms.date: 08/17/2017 +ms.date: 03/10/2022 --- # Protect derived domain credentials with Windows Defender Credential Guard @@ -38,12 +38,8 @@ By enabling Windows Defender Credential Guard, the following features and soluti   ## Related topics -- [Isolated User Mode in Windows 10 with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert) -- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel) -- [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert) -- [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode) - [Protecting network passwords with Windows Defender Credential Guard](https://www.microsoft.com/itshowcase/Article/Content/831/Protecting-network-passwords-with-Windows-10-Credential-Guard) - [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382) - [What's New in Kerberos Authentication for Windows Server 2012](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831747(v=ws.11)) - [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd378897(v=ws.10)) -- [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview) \ No newline at end of file +- [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 9f55046b76..a6f347396d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -45,11 +45,15 @@ sections: - question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager? answer: | - Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. In Configuration Manager version 1910 and later, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](/configmgr/protect/deploy-use/windows-hello-for-business-settings). + Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](/configmgr/protect/deploy-use/windows-hello-for-business-settings). + + - question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Manager Intune? + answer: | + Windows Hello for Business deployments using Intune allow for a great deal of flexibility in deployment. For more information, see [Integrate Windows Hello for Business with Microsoft Intune](/mem/intune/protect/windows-hello). - question: How many users can enroll for Windows Hello for Business on a single Windows 10 computer? answer: | - The maximum number of supported enrollments on a single Windows 10 computer is 10. This limit lets 10 users each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we'll strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. + The maximum number of supported enrollments on a single Windows 10 computer is 10. This lets 10 users each enroll their face and up to 10 fingerprints. For devices with more than 10 users, we strongly encourage the use of FIDO2 security keys. - question: How can a PIN be more secure than a password? answer: | @@ -101,8 +105,8 @@ sections: [Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) - For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. - + For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can onboard their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs. Non-destructive PIN reset works without access to the corporate network. Destructive PIN reset requires access to the corporate network. For more details about destructive and non-destructive PIN reset, see [PIN reset](/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset). + - question: What URLs do I need to allow for a hybrid deployment? answer: | Communicating with Azure Active Directory uses the following URLs: diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 0635a17b37..6c4c54aee9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -1,6 +1,6 @@ --- -title: Why a PIN is better than a password (Windows) -description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password . +title: Why a PIN is better than an online password (Windows) +description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) an online password . ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212 keywords: pin, security, password, hello ms.prod: m365-security @@ -19,42 +19,44 @@ ms.localizationpriority: medium ms.date: 10/23/2017 --- -# Why a PIN is better than a password +# Why a PIN is better than an online password **Applies to** - Windows 10 - Windows 11 -Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? -On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. +Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a local password? +On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than an online password, it's how it works. First we need to distinguish between two types of passwords: `local` passwords are validated against the machine's password store, whereas `online` passwords are validated against a server. This article mostly covers the benefits a PIN has over an online password, and also why it can be considered even better than a local password. -Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than a password. +Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than an online password. > [!VIDEO https://www.youtube.com/embed/cC24rPBvdhA] ## PIN is tied to the device -One important difference between a password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too! +One important difference between an online password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your online password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too! Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Hello on each device. ## PIN is local to the device -A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. +An online password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server. +However, note that even though local passwords are also local to the device, they are still less secure than a PIN, as described in the next section. >[!NOTE] >For details on how Hello uses asymetric key pairs for authentication, see [Windows Hello for Business](hello-overview.md#benefits-of-windows-hello).   ## PIN is backed by hardware -The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Many modern devices have TPM. +The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Many modern devices have TPM. Windows 10, on the other hand, has a defect of not linking local passwords to TPM. This is the reason why PINs are considered more secure than local passwords. User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetric key pairs, users credentials can't be stolen in cases where the identity provider or websites the user accesses have been compromised. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked. + ## PIN can be complex The Windows Hello for Business PIN is subject to the same set of IT management policies as a password, such as complexity, length, expiration, and history. Although we generally think of a PIN as a simple four-digit code, administrators can set [policies](hello-manage-in-organization.md) for managed devices to require a PIN complexity similar to a password. You can require or block: special characters, uppercase characters, lowercase characters, and digits. diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index 2b18579a8c..26f5413422 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -14,7 +14,7 @@ ms.collection: - M365-security-compliance - highpri ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 03/10/2022 ms.custom: bitlocker --- @@ -64,6 +64,7 @@ Microsoft includes instrumentation in Windows 11 and Windows 10 that enable the ## Deploy hard drive encryption BitLocker is capable of encrypting entire hard drives, including both system and data drives. BitLocker pre-provisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 11 and Windows 10, administrators can turn on BitLocker and the TPM from within the Windows Preinstallation Environment before they install Windows or as part of an automated deployment task sequence without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), it takes only a few seconds to enable BitLocker. + With earlier versions of Windows, administrators had to enable BitLocker after Windows had been installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on drive size and performance, which significantly delayed deployment. Microsoft has improved this process through multiple features in Windows 11 and Windows 10. ## BitLocker Device Encryption @@ -130,11 +131,11 @@ For more information about how to configure Network Unlock, see [BitLocker: How ## Microsoft BitLocker Administration and Monitoring -Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features: +Part of the Microsoft Desktop Optimization Pack, Microsoft BitLocker Administration and Monitoring (MBAM) makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features: * Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. * Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. -* Provides centralized reporting and hardware management with Microsoft Microsoft Endpoint Configuration Manager. +* Provides centralized reporting and hardware management with Microsoft Endpoint Configuration Manager. * Reduces the workload on the help desk to assist end users with BitLocker recovery requests. * Enables end users to recover encrypted devices independently by using the Self-Service Portal. * Enables security officers to easily audit access to recovery key information. @@ -144,4 +145,9 @@ Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage * Offers an IT-customizable recovery user experience. * Supports Windows 10. -For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/) on the MDOP TechCenter. +> [!IMPORTANT] +> Enterprises could use MBAM to manage client computers with BitLocker that are domain-joined on-premises until mainstream support ended in July 2019, or they could receive extended support until April 2026. + +Going forward, the functionality of MBAM will be incorporated into Configuration Manager. For more details, see [Features in Configuration Manager technical preview version 1909](/mem/configmgr/core/get-started/2019/technical-preview-1909#bkmk_bitlocker). + +Enterprises not using Configuration Manager can use the built-in features of Azure AD and Microsoft Intune in Microsoft Endpoint Manager for administration and monitoring. For more details, see [Monitor device encryption with Intune](/mem/intune/protect/encryption-monitor). diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml index b9edd5b644..75d0561ae3 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml @@ -15,7 +15,7 @@ metadata: audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual - ms.date: 02/28/2019 + ms.date: 03/14/2022 ms.custom: bitlocker title: BitLocker Security FAQ @@ -41,7 +41,7 @@ sections: - question: | What are the implications of using the sleep or hibernate power management options? answer: | - BitLocker on operating system drives in its basic configuration (with a TPM but without other startup authentication) provides extra security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an another startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For improved security, we recommend disabling sleep mode and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](./bitlocker-group-policy-settings.md) or Mobile Device Management with the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp). + BitLocker on operating system drives in its basic configuration (with a TPM but without other startup authentication) provides extra security for the hibernate mode. However, BitLocker provides greater security when it is configured to use another startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. In sleep mode, the computer is vulnerable to direct memory access attacks, since it remains unprotected data in RAM. Therefore, for improved security, we recommend disabling sleep mode and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](./bitlocker-group-policy-settings.md) or Mobile Device Management with the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp). - question: | What are the advantages of a TPM? @@ -50,4 +50,4 @@ sections: > [!NOTE] > Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks. - \ No newline at end of file + diff --git a/windows/security/threat-protection/intelligence/phishing.md b/windows/security/threat-protection/intelligence/phishing.md index 36de3f06bf..960336ca09 100644 --- a/windows/security/threat-protection/intelligence/phishing.md +++ b/windows/security/threat-protection/intelligence/phishing.md @@ -81,11 +81,7 @@ If you feel you've been a victim of a phishing attack: - **Microsoft Office Outlook**: While in the suspicious message, select **Report message** from the ribbon, and then select **Phishing**. -- **Microsoft**: Create a new, blank email message with the one of the following recipients: - - Junk: junk@office365.microsoft.com - - Phishing: phish@office365.microsoft.com - - Drag and drop the junk or phishing message into the new message. This will save the junk or phishing message as an attachment in the new message. Don't copy and paste the content of the message or forward the message (we need the original message so we can inspect the message headers). For more information, see [Report messages and files to Microsoft](/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft). +- **Microsoft 365**: Use the [Submissions portal in Microsoft 365 Defender](/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft) to submit the junk or phishing sample to Microsoft for analysis. For more information, see [Report messages and files to Microsoft](/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft). - **Anti-Phishing Working Group**: phishing-report@us-cert.gov. The group uses reports generated from emails sent to fight phishing scams and hackers. ISPs, security vendors, financial institutions, and law enforcement agencies are involved. diff --git a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md index 0441e00ed4..272227666c 100644 --- a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md +++ b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md @@ -45,9 +45,7 @@ Test Provider | Lab Test Type | Minimum Level / Score AV-Comparatives | Real-World Protection Test
    https://www.av-comparatives.org/testmethod/real-world-protection-tests/ |“Approved” rating from AV Comparatives AV-Test | Must pass tests for Windows. Certifications for Mac and Linux aren't accepted
    https://www.av-test.org/en/about-the-institute/certification/ | Achieve "AV-TEST Certified" (for home users) or "AV-TEST Approved” (for corporate users) ICSA Labs | Endpoint Anti-Malware Detection
    https://www.icsalabs.com/technology-program/anti-virus/criteria |PASS/Certified -NSS Labs | Advanced Endpoint Protection AEP 3.0, which covers automatic threat prevention and threat event reporting capabilities
    https://www.nsslabs.com/tested-technologies/advanced-endpoint-protection/ |“Neutral” rating from NSS SKD Labs | Certification Requirements Product: Anti-virus or Antimalware
    http://www.skdlabs.com/html/english/
    http://www.skdlabs.com/cert/ |SKD Labs Star Check Certification Requirements Pass >= 98.5% with On Demand, On Access and Total Detection tests -SE Labs | Protection A rating or Small Business EP A rating or Enterprise EP Protection A rating
    https://selabs.uk/en/reports/consumers |Home or Enterprise “A” rating VB 100 | VB100 Certification Test V1.1
    https://www.virusbulletin.com/testing/vb100/vb100-methodology/vb100-methodology-ver1-1/ | VB100 Certification West Coast Labs | Checkmark Certified
    http://www.checkmarkcertified.com/sme/ | “A” Rating on Product Security Performance diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md index 725a653863..99819da4d5 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 09/20/2021 +ms.date: 03/10/2022 ms.reviewer: manager: dansimp ms.custom: asr @@ -31,13 +31,13 @@ Application Guard uses both network isolation and application-specific settings. These settings, located at `Computer Configuration\Administrative Templates\Network\Network Isolation`, help you define and manage your organization's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container. > [!NOTE] -> You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the "Domains categorized as both work and personal" policy. +> You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the **Domains categorized as both work and personal** policy. |Policy name|Supported versions|Description| |-----------|------------------|-----------| |Private network ranges for apps | At least Windows Server 2012, Windows 8, or Windows RT| A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| -|Enterprise resource domains hosted in the cloud| At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.

    **NOTE**: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| -|Domains categorized as both work and personal| At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment.

    **NOTE**: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| +|Enterprise resource domains hosted in the cloud| At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (`|`) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.

    Note that this list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| +|Domains categorized as both work and personal| At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment.

    Note that this list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| ## Network isolation settings wildcards @@ -49,7 +49,7 @@ These settings, located at `Computer Configuration\Administrative Templates\Netw |`..contoso.com`|2|Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include `shop.contoso.com`, `us.shop.contoso.com`, `www.us.shop.contoso.com`, but NOT `contoso.com` itself.| ## Application-specific settings -These settings, located at `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard`, can help you to manage your company's implementation of Application Guard. +These settings, located at `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard`, can help you to manage your organization's implementation of Application Guard. |Name|Supported versions|Description|Options| |-----------|------------------|-----------|-------| @@ -63,3 +63,9 @@ These settings, located at `Computer Configuration\Administrative Templates\Wind |Allow camera and microphone access in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher

    Windows 10 Pro, 1809 or higher

    Windows 11|Determines whether to allow camera and microphone access inside Microsoft Defender Application Guard.|**Enabled.** Applications inside Microsoft Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

    **Disabled or not configured.** Applications inside Microsoft Defender Application Guard are unable to access the camera and microphone on the user's device.| |Allow Microsoft Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise, 1809 or higher

    Windows 10 Pro, 1809 or higher

    Windows 11|Determines whether Root Certificates are shared with Microsoft Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.

    **Disabled or not configured.** Certificates are not shared with Microsoft Defender Application Guard.| |Allow auditing events in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher

    Windows 10 Pro, 1809 or higher

    Windows 11|This policy setting allows you to decide whether auditing events can be collected from Microsoft Defender Application Guard.|**Enabled.** Application Guard inherits auditing policies from your device and logs system events from the Application Guard container to your host.

    **Disabled or not configured.** event logs aren't collected from your Application Guard container.| + +## Application Guard support dialog settings + +These settings are located at `Administrative Templates\Windows Components\Windows Security\Enterprise Customization`. If an error is encountered, you are presented with a dialog box. By default, this dialog box only contains the error information and a button for you to report it to Microsoft via the feedback hub. However, it is possible to provide additional information in the dialog box. + +[Use Group Policy to enable and customize contact information](/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information#use-group-policy-to-enable-and-customize-contact-information). diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml index 867be41703..bb6166a66f 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml +++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml @@ -9,7 +9,7 @@ metadata: ms.localizationpriority: medium author: denisebmsft ms.author: deniseb - ms.date: 09/30/2021 + ms.date: 03/14/2022 ms.reviewer: manager: dansimp ms.custom: asr @@ -220,6 +220,11 @@ sections: 1. Ensure that the FragmentAware DWORD is set to 1 in this registry setting: `\Registry\Machine\SYSTEM\CurrentControlSet\Services\Winnat`. 2. Reboot the device. + + - question: | + What does the _Allow users to trust files that open in Microsoft Defender Application Guard_ option in the Group policy do? + answer: | + This policy was present in Windows 10 prior to version 2004. It was removed from later versions of Windows as it doesn't enforce anything for either Edge or Office. additionalContent: | diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md index cf455c976a..d5400d4de7 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md @@ -10,7 +10,7 @@ author: denisebmsft ms.author: deniseb ms.reviewer: manager: dansimp -ms.date: 09/09/2021 +ms.date: 03/14/2022 ms.custom: asr ms.technology: windows-sec --- @@ -215,20 +215,6 @@ You have the option to change each of these settings to work with your enterpris - Windows 10 Professional edition, version 1809 - Windows 11 -#### File trust options - -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow users to trust files that open in Microsoft Defender Application Guard** setting. - -2. Click **Enabled**, set **Options** to **2**, and click **OK**. - - ![Group Policy editor File trust options.](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) - -3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. - -4. Open a file in Edge, such an Office 365 file. - -5. Check to see that an antivirus scan completed before the file was opened. - #### Camera and microphone options 1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow camera and microphone access in Microsoft Defender Application Guard** setting. @@ -267,5 +253,5 @@ Once a user has the extension and its companion app installed on their enterpris 3. Navigate to a non-enterprise, external website site, such as [www.bing.com](https://www.bing.com). The site should be redirected to Microsoft Defender Application Guard Edge. ![A non-enterprise website being redirected to an Application Guard container -- the text displayed explains that the page is being opened in Application Guard for Microsoft Edge.](images/app-guard-chrome-extension-launchIng-edge.png) -4. Open a new Application Guard window, by select the Microsoft Defender Application Guard icon, then **New Application Guard Window** - ![The "New Application Guard Window" option is highlighted in red](images/app-guard-chrome-extension-new-app-guard-page.png) \ No newline at end of file +4. Open a new Application Guard window, by selecting the Microsoft Defender Application Guard icon, then **New Application Guard Window** + ![The "New Application Guard Window" option is highlighted in red](images/app-guard-chrome-extension-new-app-guard-page.png) diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md index 7928508380..74efe115ae 100644 --- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md @@ -62,11 +62,11 @@ Additional settings that can be included in a custom Passfilt.dll are the use of > [!TIP] > For the latest best practices, see [Password Guidance](https://www.microsoft.com/research/publication/password-guidance). -Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 218,340,105,584,896 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible. +Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 159,238,157,238,528 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible. The use of ALT key character combinations may greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements might result in unhappy users and an over-worked Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of that range can represent standard alphanumeric characters that do not add more complexity to the password.) -Passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and meet complexity requirements. +Short passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and/or meet complexity requirements. ### Location diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md index 4368a1ce60..e7c5dca396 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md +++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md @@ -10,7 +10,7 @@ ms.reviewer: jogeurte ms.author: jogeurte ms.manager: jsuther manager: dansimp -ms.date: 11/06/2021 +ms.date: 03/08/2022 ms.technology: windows-sec ms.topic: article ms.localizationpriority: medium @@ -88,8 +88,8 @@ In addition to the steps outlined above, the binary policy file must also be cop $MountPoint = 'C:\EFI' $EFIDestinationFolder = "$MountPoint\Microsoft\Boot\CiPolicies\Active" $EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0] - mkdir $EFIDestinationFolder mountvol $MountPoint $EFIPartition + mkdir $EFIDestinationFolder ``` 2. Copy the signed policy to the created folder: diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index f486f73efc..ddc5e3e2fe 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -46,7 +46,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- ```xml - 10.0.22530.0 + 10.0.25070.0 {D2BDA982-CCF6-4344-AC5B-0B44427B6816} {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -64,6 +64,8 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + @@ -108,6 +110,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + @@ -396,6 +402,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + @@ -406,6 +413,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + @@ -418,6 +426,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + @@ -473,6 +482,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + @@ -513,6 +523,16 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + + + @@ -544,9 +564,11 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + @@ -600,6 +622,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + @@ -698,6 +721,12 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + @@ -728,16 +757,20 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + - + + + @@ -802,6 +835,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + @@ -1106,7 +1143,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - 10.0.22530.0 + 10.0.25070.0 diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md index 2a3f6d6dc3..65b8c21047 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -29,6 +29,9 @@ Windows Sandbox has the following properties: - **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. - **Efficient:** Uses the integrated kernel scheduler, smart memory management, and virtual GPU. + > [!IMPORTANT] + > Windows Sandbox enables network connection by default. It can be disabled using the [Windows Sandbox configuration file](/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file#networking). + The following video provides an overview of Windows Sandbox. > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4rFAo]