diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index adc08ab268..8ff993ef33 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -1,5 +1,6 @@ # [Mobile device management](index.md) ## [What's new in MDM enrollment and management](new-in-windows-mdm-enrollment-management.md) +### [Change history for MDM documentation](change-history-for-mdm-documentation.md) ## [Mobile device enrollment](mobile-device-enrollment.md) ### [MDM enrollment of Windows devices](mdm-enrollment-of-windows-devices.md) #### [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md) diff --git a/windows/client-management/mdm/change-history-for-mdm-documentation.md b/windows/client-management/mdm/change-history-for-mdm-documentation.md new file mode 100644 index 0000000000..698c4fa9b7 --- /dev/null +++ b/windows/client-management/mdm/change-history-for-mdm-documentation.md @@ -0,0 +1,1078 @@ +--- +title: Change history for MDM documentation +description: This article lists new and updated articles for Mobile Device Management. +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/19/2020 +--- + +# Change history for Mobile Device Management documentation + +This article lists new and updated articles for the Mobile Device Management (MDM) documentation. Updated articles are those that had content addition, removal, or corrections—minor fixes, such as correction of typos, style, or formatting issues are not listed. + +## October 2020 + +|New or updated article | Description| +|--- | ---| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:
- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)
- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)
- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)
- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)
- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)
- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)
- [WindowsSandbox/AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput)
- [WindowsSandbox/AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection)
- [WindowsSandbox/AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking)
- [WindowsSandbox/AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection)
- [WindowsSandbox/AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu)
- [WindowsSandbox/AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) | + +## September 2020 + +|New or updated article | Description| +|--- | ---| +|[NetworkQoSPolicy CSP](networkqospolicy-csp.md)|Updated support information of the NetworkQoSPolicy CSP.| +|[Policy CSP - LocalPoliciesSecurityOptions](policy-csp-localpoliciessecurityoptions.md)|Removed the following unsupported LocalPoliciesSecurityOptions policy settings from the documentation:
- RecoveryConsole_AllowAutomaticAdministrativeLogon
- DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
- DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
- DomainMember_DisableMachineAccountPasswordChanges
- SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
| + +## August 2020 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - System](policy-csp-system.md)|Removed the following policy settings:
- System/AllowDesktopAnalyticsProcessing
- System/AllowMicrosoftManagedDesktopProcessing
- System/AllowUpdateComplianceProcessing
- System/AllowWUfBCloudProcessing
| + +## July 2020 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - System](policy-csp-system.md)|Added the following new policy settings:
- System/AllowDesktopAnalyticsProcessing
- System/AllowMicrosoftManagedDesktopProcessing
- System/AllowUpdateComplianceProcessing
- System/AllowWUfBCloudProcessing


Updated the following policy setting:
- System/AllowCommercialDataPipeline
| + +## June 2020 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added SKU support table for **AllowStandardUserEncryption**.| +|[Policy CSP - NetworkIsolation](policy-csp-networkisolation.md)|Updated the description from Boolean to Integer for the following policy settings:
EnterpriseIPRangesAreAuthoritative, EnterpriseProxyServersAreAuthoritative.| + +## May 2020 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added the bitmask table for the Status/DeviceEncryptionStatus node.| +|[Policy CSP - RestrictedGroups](policy-csp-restrictedgroups.md)| Updated the topic with additional details. Added policy timeline table. + +## February 2020 + +|New or updated article | Description| +|--- | ---| +|[CertificateStore CSP](certificatestore-csp.md)
[ClientCertificateInstall CSP](clientcertificateinstall-csp.md)|Added details about SubjectName value.| + +## January 2020 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - Defender](policy-csp-defender.md)|Added descriptions for supported actions for Defender/ThreatSeverityDefaultAction.| + +## November 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added option 5 in the supported values list for DeliveryOptimization/DOGroupIdSource.| +|[DiagnosticLog CSP](diagnosticlog-csp.md)|Added substantial updates to this CSP doc.| + +## October 2019 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added the following new nodes:
ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID.| +|[Defender CSP](defender-csp.md)|Added the following new nodes:
Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.| + +## September 2019 + +|New or updated article | Description| +|--- | ---| +|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following new node:
IsStub.| +|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| +|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policies:
DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| + +## August 2019 + +|New or updated article | Description| +|--- | ---| +|[DiagnosticLog CSP](diagnosticlog-csp.md)
[DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.| +|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| + +## July 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP](policy-configuration-service-provider.md)|Added the following list:
Policies supported by HoloLens 2| +|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.| +|[PassportForWork CSP](passportforwork-csp.md)|Added the following new nodes in Windows 10, version 1903:
SecurityKey, SecurityKey/UseSecurityKeyForSignin| +|[Policy CSP - Privacy](policy-csp-privacy.md)|Added the following new policies:
LetAppsActivateWithVoice, LetAppsActivateWithVoiceAboveLock| +|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:
Create a custom configuration service provider
Design a custom configuration service provider
IConfigServiceProvider2
IConfigServiceProvider2::ConfigManagerNotification
IConfigServiceProvider2::GetNode
ICSPNode
ICSPNode::Add
ICSPNode::Clear
ICSPNode::Copy
ICSPNode::DeleteChild
ICSPNode::DeleteProperty
ICSPNode::Execute
ICSPNode::GetChildNodeNames
ICSPNode::GetProperty
ICSPNode::GetPropertyIdentifiers
ICSPNode::GetValue
ICSPNode::Move
ICSPNode::SetProperty
ICSPNode::SetValue
ICSPNodeTransactioning
ICSPValidate
Samples for writing a custom configuration service provider.| + +## June 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md)|Added the following new policies:
AllowDeviceHealthMonitoring, ConfigDeviceHealthMonitoringScope, ConfigDeviceHealthMonitoringUploadDestination.| +|[Policy CSP - TimeLanguageSettings](policy-csp-timelanguagesettings.md)|Added the following new policy:
ConfigureTimeZone.| + +## May 2019 + +|New or updated article | Description| +|--- | ---| +|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes:
DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus.| +|[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies:
DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground.

Updated description of the following policies:
DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer.| +|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy:
ShowLockOnUserTile.| +|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies:
AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage.| +|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies:
EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn.| +|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy:
AllowFindMyFiles.| +|[Policy CSP - ServiceControlManager](policy-csp-servicecontrolmanager.md)|Added the following new policy:
SvchostProcessMitigation.| +|[Policy CSP - System](policy-csp-system.md)|Added the following new policies:
AllowCommercialDataPipeline, TurnOffFileHistory.| +|[Policy CSP - Troubleshooting](policy-csp-troubleshooting.md)|Added the following new policy:
AllowRecommendations.| +|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies:
AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot.| +|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies:
AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation.

Removed the following policy:
SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart. This policy is replaced by AllowAutomaticRestartSignOn.| + +## April 2019 + +| New or updated article | Description | +|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md) | Added the following warning at the end of the Overview section:
Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. | +| [Policy CSP - UserRights](policy-csp-userrights.md) | Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields. | + +## March 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies:
AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold.

Updated description of ConfigStorageSenseDownloadsCleanupThreshold.| + +## February 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP](policy-configuration-service-provider.md)|Updated supported policies for Holographic.| + +## January 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - Storage](policy-csp-storage.md)|Added the following new policies: AllowStorageSenseGlobal, ConfigStorageSenseGlobalCadence, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseRecycleBinCleanupThreshold, ConfigStorageSenseDownloadsCleanupThreshold, and ConfigStorageSenseCloudContentCleanupThreshold.| +|[SharedPC CSP](sharedpc-csp.md)|Updated values and supported operations.| +|[Mobile device management](index.md)|Updated information about MDM Security Baseline.| + +## December 2018 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Updated AllowWarningForOtherDiskEncryption policy description to describe silent and non-silent encryption scenarios, as well as where and how the recovery key is backed up for each scenario.| + +## September 2018 + +|New or updated article | Description| +|--- | ---| +|[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT).| +|[Policy CSP - DeviceGuard](policy-csp-deviceguard.md) | Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.| + +## August 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
BitLocker CSP

Added support for Windows 10 Pro starting in the version 1809.

+
Office CSP

Added FinalStatus setting in Windows 10, version 1809.

+
RemoteWipe CSP

Added new settings in Windows 10, version 1809.

+
TenantLockdown CSP

Added new CSP in Windows 10, version 1809.

+
WindowsDefenderApplicationGuard CSP

Added new settings in Windows 10, version 1809.

+
Policy DDF file

Posted an updated version of the Policy DDF for Windows 10, version 1809.

+
Policy CSP

Added the following new policies in Windows 10, version 1809:

+
    +
  • Browser/AllowFullScreenMode
    • +
  • Browser/AllowPrelaunch
    • +
  • Browser/AllowPrinting
    • +
  • Browser/AllowSavingHistory
    • +
  • Browser/AllowSideloadingOfExtensions
    • +
  • Browser/AllowTabPreloading
    • +
  • Browser/AllowWebContentOnNewTabPage
    • +
  • Browser/ConfigureFavoritesBar
    • +
  • Browser/ConfigureHomeButton
    • +
  • Browser/ConfigureKioskMode
    • +
  • Browser/ConfigureKioskResetAfterIdleTimeout
    • +
  • Browser/ConfigureOpenMicrosoftEdgeWith
    • +
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
    • +
  • Browser/PreventCertErrorOverrides
    • +
  • Browser/SetHomeButtonURL
    • +
  • Browser/SetNewTabPageURL
    • +
  • Browser/UnlockHomeButton
    • +
  • Experience/DoNotSyncBrowserSettings
    • +
  • Experience/PreventUsersFromTurningOnBrowserSyncing
    • +
  • Kerberos/UPNNameHints
    • +
  • Privacy/AllowCrossDeviceClipboard
    • +
  • Privacy/DisablePrivacyExperience
    • +
  • Privacy/UploadUserActivities
    • +
  • System/AllowDeviceNameInDiagnosticData
    • +
  • System/ConfigureMicrosoft365UploadEndpoint
    • +
  • System/DisableDeviceDelete
    • +
  • System/DisableDiagnosticDataViewer
    • +
  • Storage/RemovableDiskDenyWriteAccess
    • +
  • Update/UpdateNotificationLevel
    • +
+

Start/DisableContextMenus - added in Windows 10, version 1803.

+

RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.

+
+ +## July 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
AssignedAccess CSP

Added the following note:

+
    +
  • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
    • +
+
PassportForWork CSP

Added new settings in Windows 10, version 1809.

+
EnterpriseModernAppManagement CSP

Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

+
Win32CompatibilityAppraiser CSP

Added new configuration service provider in Windows 10, version 1809.

+
WindowsLicensing CSP

Added S mode settings and SyncML examples in Windows 10, version 1809.

+
SUPL CSP

Added 3 new certificate nodes in Windows 10, version 1809.

+
Defender CSP

Added a new node Health/ProductStatus in Windows 10, version 1809.

+
BitLocker CSP

Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

+
DevDetail CSP

Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

+
Policy CSP

Added the following new policies in Windows 10, version 1809:

+
    +
  • ApplicationManagement/LaunchAppAfterLogOn
    • +
  • ApplicationManagement/ScheduleForceRestartForUpdateFailures
    • +
  • Authentication/EnableFastFirstSignIn (Preview mode only)
    • +
  • Authentication/EnableWebSignIn (Preview mode only)
    • +
  • Authentication/PreferredAadTenantDomainName
    • +
  • Defender/CheckForSignaturesBeforeRunningScan
    • +
  • Defender/DisableCatchupFullScan
    • +
  • Defender/DisableCatchupQuickScan
    • +
  • Defender/EnableLowCPUPriority
    • +
  • Defender/SignatureUpdateFallbackOrder
    • +
  • Defender/SignatureUpdateFileSharesSources
    • +
  • DeviceGuard/ConfigureSystemGuardLaunch
    • +
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
    • +
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    • +
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • +
  • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
    • +
  • DmaGuard/DeviceEnumerationPolicy
    • +
  • Experience/AllowClipboardHistory
    • +
  • Security/RecoveryEnvironmentAuthentication
    • +
  • TaskManager/AllowEndTask
    • +
  • WindowsDefenderSecurityCenter/DisableClearTpmButton
    • +
  • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
    • +
  • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
    • +
  • WindowsLogon/DontDisplayNetworkSelectionUI
    • +
+

Recent changes:

+
    +
  • DataUsage/SetCost3G - deprecated in Windows 10, version 1809.
    • +
+
+ +## June 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
Wifi CSP

Added a new node WifiCost in Windows 10, version 1809.

+
Diagnose MDM failures in Windows 10

Recent changes:

+
    +
  • Added procedure for collecting logs remotely from Windows 10 Holographic.
    • +
  • Added procedure for downloading the MDM Diagnostic Information log.
    • +
+
Bitlocker CSP

Added new node AllowStandardUserEncryption in Windows 10, version 1809.

+
Policy CSP

Recent changes:

+
    +
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
    • +
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
    • +
  • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
    • +
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
    • +
  • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
    • +
  • Security/RequireDeviceEncryption is supported in the Home SKU.
    • +
  • Start/StartLayout - added a table of SKU support information.
    • +
  • Start/ImportEdgeAssets - added a table of SKU support information.
    • +
+

Added the following new policies in Windows 10, version 1809:

+
    +
  • Update/EngagedRestartDeadlineForFeatureUpdates
    • +
  • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
    • +
  • Update/EngagedRestartTransitionScheduleForFeatureUpdates
    • +
  • Update/SetDisablePauseUXAccess
    • +
  • Update/SetDisableUXWUAccess
    • +
+
WiredNetwork CSPNew CSP added in Windows 10, version 1809. +
+ +## May 2018 + + ++++ + + + + + + + + + + + +
New or updated articleDescription
Policy DDF file

Updated the DDF files in the Windows 10 version 1703 and 1709.

+ +
+ +## April 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
WindowsDefenderApplicationGuard CSP

Added the following node in Windows 10, version 1803:

+
    +
  • Settings/AllowVirtualGPU
    • +
  • Settings/SaveFilesToHost
    • +
+
NetworkProxy CSP

Added the following node in Windows 10, version 1803:

+
    +
  • ProxySettingsPerUser
    • +
+
Accounts CSP

Added a new CSP in Windows 10, version 1803.

+
MDM Migration Analysis Tool (MMAT)

Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

+
CSP DDF files download

Added the DDF download of Windows 10, version 1803 configuration service providers.

+
Policy CSP

Added the following new policies for Windows 10, version 1803:

+
    +
  • Bluetooth/AllowPromptedProximalConnections
    • +
  • KioskBrowser/EnableEndSessionButton
    • +
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
    • +
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
    • +
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
    • +
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    • +
+
+ +## March 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
eUICCs CSP

Added the following node in Windows 10, version 1803:

+
    +
  • IsEnabled
    • +
+
DeviceStatus CSP

Added the following node in Windows 10, version 1803:

+
    +
  • OS/Mode
    • +
+
Understanding ADMX-backed policies

Added the following videos:

+ +
AccountManagement CSP

Added a new CSP in Windows 10, version 1803.

+
RootCATrustedCertificates CSP

Added the following node in Windows 10, version 1803:

+
    +
  • UntrustedCertificates
    • +
+
Policy CSP

Added the following new policies for Windows 10, version 1803:

+
    +
  • ApplicationDefaults/EnableAppUriHandlers
    • +
  • ApplicationManagement/MSIAllowUserControlOverInstall
    • +
  • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
    • +
  • Connectivity/AllowPhonePCLinking
    • +
  • Notifications/DisallowCloudNotification
    • +
  • Notifications/DisallowTileNotification
    • +
  • RestrictedGroups/ConfigureGroupMembership
    • +
+

The following existing policies were updated:

+
    +
  • Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
    • +
  • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
    • +
  • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
    • +
+

Added a new section:

+ +
Policy CSP - Bluetooth

Added new section ServicesAllowedList usage guide.

+
MultiSIM CSP

Added SyncML examples and updated the settings descriptions.

+
RemoteWipe CSP

Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

+
+ +## February 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
Policy CSP

Added the following new policies for Windows 10, version 1803:

+
    +
  • Display/DisablePerProcessDpiForApps
    • +
  • Display/EnablePerProcessDpi
    • +
  • Display/EnablePerProcessDpiForApps
    • +
  • Experience/AllowWindowsSpotlightOnSettings
    • +
  • TextInput/ForceTouchKeyboardDockedState
    • +
  • TextInput/TouchKeyboardDictationButtonAvailability
    • +
  • TextInput/TouchKeyboardEmojiButtonAvailability
    • +
  • TextInput/TouchKeyboardFullModeAvailability
    • +
  • TextInput/TouchKeyboardHandwritingModeAvailability
    • +
  • TextInput/TouchKeyboardNarrowModeAvailability
    • +
  • TextInput/TouchKeyboardSplitModeAvailability
    • +
  • TextInput/TouchKeyboardWideModeAvailability
    • +
      +
VPNv2 ProfileXML XSD

Updated the XSD and Plug-in profile example for VPNv2 CSP.

+
AssignedAccess CSP

Added the following nodes in Windows 10, version 1803:

+
    +
  • Status
    • +
  • ShellLauncher
    • +
  • StatusConfiguration
    • +
+

Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

+
MultiSIM CSP

Added a new CSP in Windows 10, version 1803.

+
EnterpriseModernAppManagement CSP

Added the following node in Windows 10, version 1803:

+
    +
  • MaintainProcessorArchitectureOnUpdate
    • +
+
+ +## January 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
Policy CSP

Added the following new policies for Windows 10, version 1803:

+
    +
  • Browser/AllowConfigurationUpdateForBooksLibrary
    • +
  • Browser/AlwaysEnableBooksLibrary
    • +
  • Browser/EnableExtendedBooksTelemetry
    • +
  • Browser/UseSharedFolderForBooks
    • +
  • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    • +
  • DeliveryOptimization/DODelayForegroundDownloadFromHttp
    • +
  • DeliveryOptimization/DOGroupIdSource
    • +
  • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
    • +
  • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
    • +
  • DeliveryOptimization/DORestrictPeerSelectionBy
    • +
  • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
    • +
  • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
    • +
  • KioskBrowser/BlockedUrlExceptions
    • +
  • KioskBrowser/BlockedUrls
    • +
  • KioskBrowser/DefaultURL
    • +
  • KioskBrowser/EnableHomeButton
    • +
  • KioskBrowser/EnableNavigationButtons
    • +
  • KioskBrowser/RestartOnIdleTime
    • +
  • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
    • +
  • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    • +
  • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    • +
  • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    • +
  • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    • +
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    • +
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    • +
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
    • +
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
    • +
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
    • +
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
    • +
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    • +
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    • +
  • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    • +
  • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    • +
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
    • +
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    • +
  • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
    • +
  • RestrictedGroups/ConfigureGroupMembership
    • +
  • Search/AllowCortanaInAAD
    • +
  • Search/DoNotUseWebResults
    • +
  • Security/ConfigureWindowsPasswords
    • +
  • System/FeedbackHubAlwaysSaveDiagnosticsLocally
    • +
  • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
    • +
  • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
    • +
  • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
    • +
  • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
    • +
  • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
    • +
  • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
    • +
  • TaskScheduler/EnableXboxGameSaveTask
    • +
  • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
    • +
  • Update/ConfigureFeatureUpdateUninstallPeriod
    • +
  • UserRights/AccessCredentialManagerAsTrustedCaller
    • +
  • UserRights/AccessFromNetwork
    • +
  • UserRights/ActAsPartOfTheOperatingSystem
    • +
  • UserRights/AllowLocalLogOn
    • +
  • UserRights/BackupFilesAndDirectories
    • +
  • UserRights/ChangeSystemTime
    • +
  • UserRights/CreateGlobalObjects
    • +
  • UserRights/CreatePageFile
    • +
  • UserRights/CreatePermanentSharedObjects
    • +
  • UserRights/CreateSymbolicLinks
    • +
  • UserRights/CreateToken
    • +
  • UserRights/DebugPrograms
    • +
  • UserRights/DenyAccessFromNetwork
    • +
  • UserRights/DenyLocalLogOn
    • +
  • UserRights/DenyRemoteDesktopServicesLogOn
    • +
  • UserRights/EnableDelegation
    • +
  • UserRights/GenerateSecurityAudits
    • +
  • UserRights/ImpersonateClient
    • +
  • UserRights/IncreaseSchedulingPriority
    • +
  • UserRights/LoadUnloadDeviceDrivers
    • +
  • UserRights/LockMemory
    • +
  • UserRights/ManageAuditingAndSecurityLog
    • +
  • UserRights/ManageVolume
    • +
  • UserRights/ModifyFirmwareEnvironment
    • +
  • UserRights/ModifyObjectLabel
    • +
  • UserRights/ProfileSingleProcess
    • +
  • UserRights/RemoteShutdown
    • +
  • UserRights/RestoreFilesAndDirectories
    • +
  • UserRights/TakeOwnership
    • +
  • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
    • +
  • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
    • +
  • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
    • +
  • WindowsDefenderSecurityCenter/HideSecureBoot
    • +
  • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
    • +
+

Added the following policies the were added in Windows 10, version 1709

+
    +
  • DeviceLock/MinimumPasswordAge
    • +
  • Settings/AllowOnlineTips
    • +
  • System/DisableEnterpriseAuthProxy
    • +
+

Security/RequireDeviceEncryption - updated to show it is supported in desktop.

+
BitLocker CSP

Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

+
EnterpriseModernAppManagement CSP

Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

+
DMClient CSP

Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

+
    +
  • AADSendDeviceToken
    • +
  • BlockInStatusPage
    • +
  • AllowCollectLogsButton
    • +
  • CustomErrorText
    • +
  • SkipDeviceStatusPage
    • +
  • SkipUserStatusPage
    • +
+
Defender CSP

Added new node (OfflineScan) in Windows 10, version 1803.

+
UEFI CSP

Added a new CSP in Windows 10, version 1803.

+
Update CSP

Added the following nodes in Windows 10, version 1803:

+
    +
  • Rollback
    • +
  • Rollback/FeatureUpdate
    • +
  • Rollback/QualityUpdateStatus
    • +
  • Rollback/FeatureUpdateStatus
    • +
+
+ +## December 2017 + + ++++ + + + + + + + + + + + +
New or updated articleDescription
Configuration service provider reference

Added new section CSP DDF files download

+
+ +## November 2017 + + ++++ + + + + + + + + + + + +
New or updated articleDescription
Policy CSP

Added the following policies for Windows 10, version 1709:

+
    +
  • Authentication/AllowFidoDeviceSignon
    • +
  • Cellular/LetAppsAccessCellularData
    • +
  • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
    • +
  • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
    • +
  • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
    • +
  • Start/HidePeopleBar
    • +
  • Storage/EnhancedStorageDevices
    • +
  • Update/ManagePreviewBuilds
    • +
  • WirelessDisplay/AllowMdnsAdvertisement
    • +
  • WirelessDisplay/AllowMdnsDiscovery
    • +
+

Added missing policies from previous releases:

+
    +
  • Connectivity/DisallowNetworkConnectivityActiveTest
    • +
  • Search/AllowWindowsIndexer
    • +
+
+ +## October 2017 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
Policy DDF file

Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

+
Policy CSP

Updated the following policies:

+
    +
  • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
    • +
  • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
    • +
+
eUICCs CSP

Added new CSP in Windows 10, version 1709.

+
AssignedAccess CSP

Added SyncML examples for the new Configuration node.

+
DMClient CSP

Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

+
+ +## September 2017 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
Policy CSP

Added the following new policies for Windows 10, version 1709:

+
    +
  • Authentication/AllowAadPasswordReset
    • +
  • Handwriting/PanelDefaultModeDocked
    • +
  • Search/AllowCloudSearch
    • +
  • System/LimitEnhancedDiagnosticDataWindowsAnalytics
    • +
+

Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

+
AssignedAccess CSP

Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

+
Microsoft Store for Business and Microsoft Store

Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

+
The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

+
    +
  • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
    • +
  • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
    • +
  • DomainName - fully qualified domain name if the device is domain-joined.
    • +
+

For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

+
EnterpriseAPN CSP

Added a SyncML example.

+
VPNv2 CSP

Added RegisterDNS setting in Windows 10, version 1709.

+
Enroll a Windows 10 device automatically using Group Policy

Added new topic to introduce a new Group Policy for automatic MDM enrollment.

+
MDM enrollment of Windows-based devices

New features in the Settings app:

+
    +
  • User sees installation progress of critical policies during MDM enrollment.
    • +
  • User knows what policies, profiles, apps MDM has configured
    • +
  • IT helpdesk can get detailed MDM diagnostic information using client tools
    • +
+

For details, see Managing connections and Collecting diagnostic logs

+
+ +## August 2017 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
New or updated articleDescription
Enable ADMX-backed policies in MDM

Added new step-by-step guide to enable ADMX-backed policies.

+
Mobile device enrollment

Added the following statement:

+
    +
  • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
    • +
+
CM_CellularEntries CSP

Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

+
EnterpriseDataProtection CSP

Updated the Settings/EDPEnforcementLevel values to the following:

+
    +
  • 0 (default) – Off / No protection (decrypts previously protected data).
    • +
  • 1 – Silent mode (encrypt and audit only).
    • +
  • 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
    • +
  • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
    • +
+
AppLocker CSP

Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Allow list examples.

+
DeviceManageability CSP

Added the following settings in Windows 10, version 1709:

+
    +
  • Provider/ProviderID/ConfigInfo
    • +
  • Provider/ProviderID/EnrollmentInfo
    • +
+
Office CSP

Added the following setting in Windows 10, version 1709:

+
    +
  • Installation/CurrentStatus
    • +
+
BitLocker CSPAdded information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. +
Firewall CSPUpdated the CSP and DDF topics. Here are the changes: +
    +
  • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
    • +
  • Changed some data types from integer to bool.
    • +
  • Updated the list of supported operations for some settings.
    • +
  • Added default values.
    • +
+
Policy DDF fileAdded another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies: +
    +
  • Browser/AllowMicrosoftCompatibilityList
    • +
  • Update/DisableDualScan
    • +
  • Update/FillEmptyContentUrls
    • +
+
Policy CSP

Added the following new policies for Windows 10, version 1709:

+
    +
  • Browser/ProvisionFavorites
    • +
  • Browser/LockdownFavorites
    • +
  • ExploitGuard/ExploitProtectionSettings
    • +
  • Games/AllowAdvancedGamingServices
    • +
  • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
    • +
  • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
    • +
  • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
    • +
  • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
    • +
  • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    • +
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
    • +
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
    • +
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
    • +
  • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
    • +
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
    • +
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
    • +
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    • +
  • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
    • +
  • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
    • +
  • Privacy/EnableActivityFeed
    • +
  • Privacy/PublishUserActivities
    • +
  • Update/DisableDualScan
    • +
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
    • +
+

Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

+

Changed the names of the following policies:

+
    +
  • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
    • +
  • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
    • +
  • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
    • +
+

Added links to the additional ADMX-backed BitLocker policies.

+

There were issues reported with the previous release of the following policies. These issues were fixed in Window 10, version 1709:

+
    +
  • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
    • +
  • Start/HideAppList
    • +
+
diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index ba8dc31c1f..1fd9648769 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -13,1693 +13,208 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 08/18/2020 +ms.date: 10/20/2020 --- # What's new in mobile device enrollment and management - -This topic provides information about what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. +This article provides information about what's new in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. This article also provide details about the breaking changes and known issues and frequently asked questions. For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). -- **What’s new in MDM for Windows 10 versions** - - [What’s new in MDM for Windows 10, version 2004](#whats-new-in-mdm-for-windows-10-version-2004) - - [What’s new in MDM for Windows 10, version 1909](#whats-new-in-mdm-for-windows-10-version-1909) - - [What’s new in MDM for Windows 10, version 1903](#whats-new-in-mdm-for-windows-10-version-1903) - - [What’s new in MDM for Windows 10, version 1809](#whats-new-in-mdm-for-windows-10-version-1809) - - [What’s new in MDM for Windows 10, version 1803](#whats-new-in-mdm-for-windows-10-version-1803) - - [What’s new in MDM for Windows 10, version 1709](#whats-new-in-mdm-for-windows-10-version-1709) - - [What’s new in MDM for Windows 10, version 1703](#whats-new-in-mdm-for-windows-10-version-1703) - - [What’s new in MDM for Windows 10, version 1607](#whats-new-in-mdm-for-windows-10-version-1607) - - [What’s new in MDM for Windows 10, version 1511](#whats-new-in-mdm-for-windows-10-version-1511) +## What’s new in MDM for Windows 10, version 20H2 -- **Breaking changes and known issues** - - [Get command inside an atomic command is not supported](#get-command-inside-an-atomic-command-is-not-supported) - - [Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10](#notification-channel-uri-not-preserved-during-upgrade-from-windows-81-to-windows-10) - - [Apps installed using WMI classes are not removed](#apps-installed-using-wmi-classes-are-not-removed) - - [Passing CDATA in SyncML does not work](#passing-cdata-in-syncml-does-not-work) - - [SSL settings in IIS server for SCEP must be set to "Ignore"](#ssl-settings-in-iis-server-for-scep-must-be-set-to-ignore) - - [MDM enrollment fails on the mobile device when traffic is going through proxy](#mdm-enrollment-fails-on-the-mobile-device-when-traffic-is-going-through-proxy) - - [Server-initiated unenrollment failure](#server-initiated-unenrollment-failure) - - [Certificates causing issues with Wi-Fi and VPN](#certificates-causing-issues-with-wi-fi-and-vpn) - - [Version information for mobile devices](#version-information-for-mobile-devices) - - [Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218](#apps-dependent-on-microsoft-frameworks-may-get-blocked-in-phones-prior-to-build-10586218) - - [Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile](#multiple-certificates-might-cause-wi-fi-connection-instabilities-in-windows-10-mobile) - - [Remote PIN reset not supported in Azure Active Directory joined mobile devices](#remote-pin-reset-not-supported-in-azure-active-directory-joined-mobile-devices) - - [MDM client will immediately check-in with the MDM server after client renews WNS channel URI](#mdm-client-will-immediately-check-in-with-the-mdm-server-after-client-renews-wns-channel-uri) - - [User provisioning failure in Azure Active Directory joined Windows 10 PC](#user-provisioning-failure-in-azure-active-directory-joined-windows-10-pc) - - [Requirements to note for VPN certificates also used for Kerberos Authentication](#requirements-to-note-for-vpn-certificates-also-used-for-kerberos-authentication) - - [Device management agent for the push-button reset is not working](#device-management-agent-for-the-push-button-reset-is-not-working) - -- **Frequently Asked Questions** - - [Can there be more than 1 MDM server to enroll and manage devices in Windows 10?](#can-there-be-more-than-1-mdm-server-to-enroll-and-manage-devices-in-windows-10) - - [How do I set the maximum number of Azure Active Directory joined devices per user?](#how-do-i-set-the-maximum-number-of-azure-active-directory-joined-devices-per-user) - - [What is dmwappushsvc?](#what-is-dmwappushsvc) - -- **Change history in MDM documentation** - - [September 2020](#september-2020) - - [August 2020](#august-2020) - - [July 2020](#july-2020) - - [June 2020](#june-2020) - - [May 2020](#may-2020) - - [February 2020](#february-2020) - - [January 2020](#january-2020) - - [November 2019](#november-2019) - - [October 2019](#october-2019) - - [September 2019](#september-2019) - - [August 2019](#august-2019) - - [July 2019](#july-2019) - - [June 2019](#june-2019) - - [May 2019](#may-2019) - - [April 2019](#april-2019) - - [March 2019](#march-2019) - - [February 2019](#february-2019) - - [January 2019](#january-2019) - - [December 2018](#december-2018) - - [September 2018](#september-2018) - - [August 2018](#august-2018) - - [July 2018](#july-2018) - - [June 2018](#june-2018) - - [May 2018](#may-2018) - - [April 2018](#april-2018) - - [March 2018](#march-2018) - - [February 2018](#february-2018) - - [January 2018](#january-2018) - - [December 2017](#december-2017) - - [November 2017](#november-2017) - - [October 2017](#october-2017) - - [September 2017](#september-2017) - - [August 2017](#august-2017) +|New or updated article|Description| +|-----|-----| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:
- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)
- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)
- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)
- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)
- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)
- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)
- [WindowsSandbox/AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput)
- [WindowsSandbox/AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection)
- [WindowsSandbox/AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking)
- [WindowsSandbox/AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection)
- [WindowsSandbox/AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu)
- [WindowsSandbox/AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Updated the description of the following node:
- Settings/AllowWindowsDefenderApplicationGuard | ## What’s new in MDM for Windows 10, version 2004 - ---- - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies in Windows 10, version 2004:

- -

Updated the following policy in Windows 10, version 2004:

- - -

Deprecated the following policies in Windows 10, version 2004:

- -
DevDetail CSP

Added the following new node:
Ext/Microsoft/DNSComputerName

-
EnterpriseModernAppManagement CSP

Added the following new node:
IsStub

-
SUPL CSP

Added the following new node:
FullVersion

-
+| New or updated article | Description | +|-----|-----| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 2004:
- [ApplicationManagement/BlockNonAdminUserInstall](policy-csp-applicationmanagement.md#applicationmanagement-blocknonadminuserinstall)
- [Bluetooth/SetMinimumEncryptionKeySize](policy-csp-bluetooth.md#bluetooth-setminimumencryptionkeysize)
- [DeliveryOptimization/DOCacheHostSource](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource)
- [DeliveryOptimization/DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth)
- [DeliveryOptimization/DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth)
- [Education/AllowGraphingCalculator](policy-csp-education.md#education-allowgraphingcalculator)
- [TextInput/ConfigureJapaneseIMEVersion](policy-csp-textinput.md#textinput-configurejapaneseimeversion)
- [TextInput/ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md#textinput-configuresimplifiedchineseimeversion)
- [TextInput/ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md#textinput-configuretraditionalchineseimeversion)

Updated the following policy in Windows 10, version 2004:
- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost)

Deprecated the following policies in Windows 10, version 2004:
- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth)
- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth)
- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) | +| [DevDetail CSP](devdetail-csp.md) | Added the following new node:
- Ext/Microsoft/DNSComputerName | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following new node:
- IsStub | +| [SUPL CSP](supl-csp.md) | Added the following new node:
- FullVersion | ## What’s new in MDM for Windows 10, version 1909 - ---- - - - - - - - - - - - -
New or updated topicDescription
BitLocker CSP
Added the following new nodes in Windows 10, version 1909:

-ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID. -
+ +| New or updated article | Description | +|-----|-----| +| [BitLocker CSP](bitlocker-csp.md) | Added the following new nodes in Windows 10, version 1909:
- ConfigureRecoveryPasswordRotation
- RotateRecoveryPasswords
- RotateRecoveryPasswordsStatus
- RotateRecoveryPasswordsRequestID| ## What’s new in MDM for Windows 10, version 1903 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies in Windows 10, version 1903:

-
Policy CSP - Audit

Added new Audit policies in Windows 10, version 1903.

-
ApplicationControl CSP

Added new CSP in Windows 10, version 1903.

-
Defender CSP

Added the following new nodes:
Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.

-
DiagnosticLog CSP
-DiagnosticLog DDF

Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
-Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults. -

-
EnrollmentStatusTracking CSP

Added new CSP in Windows 10, version 1903.

-
PassportForWork CSP

Added the following new nodes in Windows 10, version 1903:
SecurityKey, SecurityKey/UseSecurityKeyForSignin

-
+ +| New or updated article | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 1903:
- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground)
- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground)
- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring)
- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope)
- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination)
- [DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceinstanceids)
- [DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceinstanceids)
- [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile)
- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar)
- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload)
- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview)
- [InternetExplorer/DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync)
- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation)
- [InternetExplorer/DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete)
- [InternetExplorer/NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage)
- [Power/EnergySaverBatteryThresholdOnBattery](policy-csp-power.md#power-energysaverbatterythresholdonbattery)
- [Power/EnergySaverBatteryThresholdPluggedIn](policy-csp-power.md#power-energysaverbatterythresholdpluggedin)
- [Power/SelectLidCloseActionOnBattery](policy-csp-power.md#power-selectlidcloseactiononbattery)
- [Power/SelectLidCloseActionPluggedIn](policy-csp-power.md#power-selectlidcloseactionpluggedin)
- [Power/SelectPowerButtonActionOnBattery](policy-csp-power.md#power-selectpowerbuttonactiononbattery)
- [Power/SelectPowerButtonActionPluggedIn](policy-csp-power.md#power-selectpowerbuttonactionpluggedin)
- [Power/SelectSleepButtonActionOnBattery](policy-csp-power.md#power-selectsleepbuttonactiononbattery)
- [Power/SelectSleepButtonActionPluggedIn](policy-csp-power.md#power-selectsleepbuttonactionpluggedin)
- [Power/TurnOffHybridSleepOnBattery](policy-csp-power.md#power-turnoffhybridsleeponbattery)
- [Power/TurnOffHybridSleepPluggedIn](policy-csp-power.md#power-turnoffhybridsleeppluggedin)
- [Power/UnattendedSleepTimeoutOnBattery](policy-csp-power.md#power-unattendedsleeptimeoutonbattery)
- [Power/UnattendedSleepTimeoutPluggedIn](policy-csp-power.md#power-unattendedsleeptimeoutpluggedin)
- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice)
- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock)
- [Search/AllowFindMyFiles](policy-csp-search.md#search-allowfindmyfiles)
- [ServiceControlManager/SvchostProcessMitigation](policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation)
- [System/AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline)
- [System/TurnOffFileHistory](policy-csp-system.md#system-turnofffilehistory)
- [TimeLanguageSettings/ConfigureTimeZone](policy-csp-timelanguagesettings.md#timelanguagesettings-configuretimezone)
- [Troubleshooting/AllowRecommendations](policy-csp-troubleshooting.md#troubleshooting-allowrecommendations)
- [Update/AutomaticMaintenanceWakeUp](policy-csp-update.md#update-automaticmaintenancewakeup)
- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates)
- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates)
- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod)
- [WindowsLogon/AllowAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon)
- [WindowsLogon/ConfigAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon)
- [WindowsLogon/EnableFirstLogonAnimation](policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation)| +| [Policy CSP - Audit](policy-csp-audit.md) | Added the new Audit policy CSP. | +| [ApplicationControl CSP](applicationcontrol-csp.md) | Added the new CSP. | +| [Defender CSP](defender-csp.md) | Added the following new nodes:
- Health/TamperProtectionEnabled
- Health/IsVirtualMachine
- Configuration
- Configuration/TamperProtection
- Configuration/EnableFileHashComputation | +| [DiagnosticLog CSP](diagnosticlog-csp.md)
[DiagnosticLog DDF](diagnosticlog-ddf.md) | Added version 1.4 of the CSP in Windows 10, version 1903.
Added the new 1.4 version of the DDF.
Added the following new nodes:
- Policy
- Policy/Channels
- Policy/Channels/ChannelName
- Policy/Channels/ChannelName/MaximumFileSize
- Policy/Channels/ChannelName/SDDL
- Policy/Channels/ChannelName/ActionWhenFull
- Policy/Channels/ChannelName/Enabled
- DiagnosticArchive
- DiagnosticArchive/ArchiveDefinition
- DiagnosticArchive/ArchiveResults | +| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | Added the new CSP. | +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new nodes:
- SecurityKey
- SecurityKey/UseSecurityKeyForSignin | + ## What’s new in MDM for Windows 10, version 1809 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies in Windows 10, version 1809:

-
    -
  • ApplicationManagement/LaunchAppAfterLogOn
    • -
  • ApplicationManagement/ScheduleForceRestartForUpdateFailures
    • -
  • Authentication/EnableFastFirstSignIn (Preview mode only)
    • -
  • Authentication/EnableWebSignIn (Preview mode only)
    • -
  • Authentication/PreferredAadTenantDomainName
    • -
  • Browser/AllowFullScreenMode
    • -
  • Browser/AllowPrelaunch
    • -
  • Browser/AllowPrinting
    • -
  • Browser/AllowSavingHistory
    • -
  • Browser/AllowSideloadingOfExtensions
    • -
  • Browser/AllowTabPreloading
    • -
  • Browser/AllowWebContentOnNewTabPage
    • -
  • Browser/ConfigureFavoritesBar
    • -
  • Browser/ConfigureHomeButton
    • -
  • Browser/ConfigureKioskMode
    • -
  • Browser/ConfigureKioskResetAfterIdleTimeout
    • -
  • Browser/ConfigureOpenMicrosoftEdgeWith
    • -
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
    • -
  • Browser/PreventCertErrorOverrides
    • -
  • Browser/SetHomeButtonURL
    • -
  • Browser/SetNewTabPageURL
    • -
  • Browser/UnlockHomeButton
    • -
  • Defender/CheckForSignaturesBeforeRunningScan
    • -
  • Defender/DisableCatchupFullScan
    • -
  • Defender/DisableCatchupQuickScan
    • -
  • Defender/EnableLowCPUPriority
    • -
  • Defender/SignatureUpdateFallbackOrder
    • -
  • Defender/SignatureUpdateFileSharesSources
    • -
  • DeviceGuard/ConfigureSystemGuardLaunch
    • -
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
    • -
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    • -
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • -
  • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
    • -
  • DmaGuard/DeviceEnumerationPolicy
    • -
  • Experience/AllowClipboardHistory
    • -
  • Experience/DoNotSyncBrowserSettings
    • -
  • Experience/PreventUsersFromTurningOnBrowserSyncing
    • -
  • Kerberos/UPNNameHints
    • -
  • Privacy/AllowCrossDeviceClipboard
    • -
  • Privacy/DisablePrivacyExperience
    • -
  • Privacy/UploadUserActivities
    • -
  • Security/RecoveryEnvironmentAuthentication
    • -
  • System/AllowDeviceNameInDiagnosticData
    • -
  • System/ConfigureMicrosoft365UploadEndpoint
    • -
  • System/DisableDeviceDelete
    • -
  • System/DisableDiagnosticDataViewer
    • -
  • Storage/RemovableDiskDenyWriteAccess
    • -
  • TaskManager/AllowEndTask
    • -
  • Update/EngagedRestartDeadlineForFeatureUpdates
    • -
  • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
    • -
  • Update/EngagedRestartTransitionScheduleForFeatureUpdates
    • -
  • Update/SetDisablePauseUXAccess
    • -
  • Update/SetDisableUXWUAccess
    • -
  • WindowsDefenderSecurityCenter/DisableClearTpmButton
    • -
  • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
    • -
  • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
    • -
  • WindowsLogon/DontDisplayNetworkSelectionUI
    • -
-
PassportForWork CSP

Added new settings in Windows 10, version 1809.

-
EnterpriseModernAppManagement CSP

Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

-
Win32CompatibilityAppraiser CSP

Added new configuration service provider in Windows 10, version 1809.

-
WindowsLicensing CSP

Added S mode settings and SyncML examples in Windows 10, version 1809.

-
SUPL CSP

Added 3 new certificate nodes in Windows 10, version 1809.

-
Defender CSP

Added a new node Health/ProductStatus in Windows 10, version 1809.

-
BitLocker CSP

Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro.

-
DevDetail CSP

Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

-
Wifi CSP

Added a new node WifiCost in Windows 10, version 1809.

-
WindowsDefenderApplicationGuard CSP

Added new settings in Windows 10, version 1809.

-
RemoteWipe CSP

Added new settings in Windows 10, version 1809.

-
TenantLockdown CSP

Added new CSP in Windows 10, version 1809.

-
Office CSP

Added FinalStatus setting in Windows 10, version 1809.

-
+| New or updated article | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policy settings in Windows 10, version 1809:
- ApplicationManagement/LaunchAppAfterLogOn
- ApplicationManagement/ScheduleForceRestartForUpdateFailures
- Authentication/EnableFastFirstSignIn (Preview mode only)
- Authentication/EnableWebSignIn (Preview mode only)
- Authentication/PreferredAadTenantDomainName
- Browser/AllowFullScreenMode
- Browser/AllowPrelaunch
- Browser/AllowPrinting
- Browser/AllowSavingHistory
- Browser/AllowSideloadingOfExtensions
- Browser/AllowTabPreloading
- Browser/AllowWebContentOnNewTabPage
- Browser/ConfigureFavoritesBar
- Browser/ConfigureHomeButton
- Browser/ConfigureKioskMode
- Browser/ConfigureKioskResetAfterIdleTimeout
- Browser/ConfigureOpenMicrosoftEdgeWith
- Browser/ConfigureTelemetryForMicrosoft365Analytics
- Browser/PreventCertErrorOverrides
- Browser/SetHomeButtonURL
- Browser/SetNewTabPageURL
- Browser/UnlockHomeButton
- Defender/CheckForSignaturesBeforeRunningScan
- Defender/DisableCatchupFullScan
- Defender/DisableCatchupQuickScan
- Defender/EnableLowCPUPriority
- Defender/SignatureUpdateFallbackOrder
- Defender/SignatureUpdateFileSharesSources
- DeviceGuard/ConfigureSystemGuardLaunch
- DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
- DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
- DeviceInstallation/PreventDeviceMetadataFromNetwork
- DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
- DmaGuard/DeviceEnumerationPolicy
- Experience/AllowClipboardHistory
- Experience/DoNotSyncBrowserSettings
- Experience/PreventUsersFromTurningOnBrowserSyncing
- Kerberos/UPNNameHints
- Privacy/AllowCrossDeviceClipboard
- Privacy/DisablePrivacyExperience
- Privacy/UploadUserActivities
- Security/RecoveryEnvironmentAuthentication
- System/AllowDeviceNameInDiagnosticData
- System/ConfigureMicrosoft365UploadEndpoint
- System/DisableDeviceDelete
- System/DisableDiagnosticDataViewer
- Storage/RemovableDiskDenyWriteAccess
- TaskManager/AllowEndTask
- Update/EngagedRestartDeadlineForFeatureUpdates
- Update/EngagedRestartSnoozeScheduleForFeatureUpdates
- Update/EngagedRestartTransitionScheduleForFeatureUpdates
- Update/SetDisablePauseUXAccess
- Update/SetDisableUXWUAccess
- WindowsDefenderSecurityCenter/DisableClearTpmButton
- WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
- WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
- WindowsLogon/DontDisplayNetworkSelectionUI | +| [BitLocker CSP](bitlocker-csp.md) | Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro. | +| [Defender CSP](defender-csp.md) | Added a new node Health/ProductStatus in Windows 10, version 1809. | +| [DevDetail CSP](devdetail-csp.md) | Added a new node SMBIOSSerialNumber in Windows 10, version 1809. | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added NonRemovable setting under AppManagement node in Windows 10, version 1809. | +| [Office CSP](office-csp.md) | Added FinalStatus setting in Windows 10, version 1809. | +| [PassportForWork CSP](passportforwork-csp.md) | Added new settings in Windows 10, version 1809. | +| [RemoteWipe CSP](remotewipe-csp.md) | Added new settings in Windows 10, version 1809. | +| [SUPL CSP](supl-csp.md) | Added 3 new certificate nodes in Windows 10, version 1809. | +| [TenantLockdown CSP](tenantlockdown-csp.md) | Added new CSP in Windows 10, version 1809. | +| [Wifi CSP](wifi-csp.md) | Added a new node WifiCost in Windows 10, version 1809. | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Added new settings in Windows 10, version 1809. | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added S mode settings and SyncML examples in Windows 10, version 1809. | +| [Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md) | Added new configuration service provider in Windows 10, version 1809. | + ## What’s new in MDM for Windows 10, version 1803 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies for Windows 10, version 1803:

-
    -
  • ApplicationDefaults/EnableAppUriHandlers
    • -
  • ApplicationManagement/MSIAllowUserControlOverInstall
    • -
  • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
    • -
  • Bluetooth/AllowPromptedProximalConnections
    • -
  • Browser/AllowConfigurationUpdateForBooksLibrary
    • -
  • Browser/AlwaysEnableBooksLibrary
    • -
  • Browser/EnableExtendedBooksTelemetry
    • -
  • Browser/UseSharedFolderForBooks
    • -
  • Connectivity/AllowPhonePCLinking
    • -
  • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    • -
  • DeliveryOptimization/DODelayForegroundDownloadFromHttp
    • -
  • DeliveryOptimization/DOGroupIdSource
    • -
  • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
    • -
  • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
    • -
  • DeliveryOptimization/DORestrictPeerSelectionBy
    • -
  • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
    • -
  • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
    • -
  • Display/DisablePerProcessDpiForApps
    • -
  • Display/EnablePerProcessDpi
    • -
  • Display/EnablePerProcessDpiForApps
    • -
  • Experience/AllowWindowsSpotlightOnSettings
    • -
  • KioskBrowser/BlockedUrlExceptions
    • -
  • KioskBrowser/BlockedUrls
    • -
  • KioskBrowser/DefaultURL
    • -
  • KioskBrowser/EnableEndSessionButton
    • -
  • KioskBrowser/EnableHomeButton
    • -
  • KioskBrowser/EnableNavigationButtons
    • -
  • KioskBrowser/RestartOnIdleTime
    • -
  • LanmanWorkstation/EnableInsecureGuestLogons
    • -
  • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
    • -
  • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    • -
  • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    • -
  • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    • -
  • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
    • -
  • Notifications/DisallowCloudNotification
    • -
  • RestrictedGroups/ConfigureGroupMembership
    • -
  • Search/AllowCortanaInAAD
    • -
  • Search/DoNotUseWebResults
    • -
  • Security/ConfigureWindowsPasswords
    • -
  • Start/DisableContextMenus
    • -
  • System/FeedbackHubAlwaysSaveDiagnosticsLocally
    • -
  • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
    • -
  • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
    • -
  • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
    • -
  • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
    • -
  • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
    • -
  • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
    • -
  • TaskScheduler/EnableXboxGameSaveTask
    • -
  • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
    • -
  • TextInput/ForceTouchKeyboardDockedState
    • -
  • TextInput/TouchKeyboardDictationButtonAvailability
    • -
  • TextInput/TouchKeyboardEmojiButtonAvailability
    • -
  • TextInput/TouchKeyboardFullModeAvailability
    • -
  • TextInput/TouchKeyboardHandwritingModeAvailability
    • -
  • TextInput/TouchKeyboardNarrowModeAvailability
    • -
  • TextInput/TouchKeyboardSplitModeAvailability
    • -
  • TextInput/TouchKeyboardWideModeAvailability
    • -
  • Update/ConfigureFeatureUpdateUninstallPeriod
    • -
  • Update/TargetReleaseVersion
    • -
  • UserRights/AccessCredentialManagerAsTrustedCaller
    • -
  • UserRights/AccessFromNetwork
    • -
  • UserRights/ActAsPartOfTheOperatingSystem
    • -
  • UserRights/AllowLocalLogOn
    • -
  • UserRights/BackupFilesAndDirectories
    • -
  • UserRights/ChangeSystemTime
    • -
  • UserRights/CreateGlobalObjects
    • -
  • UserRights/CreatePageFile
    • -
  • UserRights/CreatePermanentSharedObjects
    • -
  • UserRights/CreateSymbolicLinks
    • -
  • UserRights/CreateToken
    • -
  • UserRights/DebugPrograms
    • -
  • UserRights/DenyAccessFromNetwork
    • -
  • UserRights/DenyLocalLogOn
    • -
  • UserRights/DenyRemoteDesktopServicesLogOn
    • -
  • UserRights/EnableDelegation
    • -
  • UserRights/GenerateSecurityAudits
    • -
  • UserRights/ImpersonateClient
    • -
  • UserRights/IncreaseSchedulingPriority
    • -
  • UserRights/LoadUnloadDeviceDrivers
    • -
  • UserRights/LockMemory
    • -
  • UserRights/ManageAuditingAndSecurityLog
    • -
  • UserRights/ManageVolume
    • -
  • UserRights/ModifyFirmwareEnvironment
    • -
  • UserRights/ModifyObjectLabel
    • -
  • UserRights/ProfileSingleProcess
    • -
  • UserRights/RemoteShutdown
    • -
  • UserRights/RestoreFilesAndDirectories
    • -
  • UserRights/TakeOwnership
    • -
  • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
    • -
  • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
    • -
  • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
    • -
  • WindowsDefenderSecurityCenter/HideSecureBoot
    • -
  • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
    • -
-

Security/RequireDeviceEncryption - updated to show it is supported in desktop.

-
BitLocker CSP

Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

-
DMClient CSP

Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

-
    -
  • AADSendDeviceToken
    • -
  • BlockInStatusPage
    • -
  • AllowCollectLogsButton
    • -
  • CustomErrorText
    • -
  • SkipDeviceStatusPage
    • -
  • SkipUserStatusPage
    • -
-
Defender CSP

Added new node (OfflineScan) in Windows 10, version 1803.

-
UEFI CSP

Added a new CSP in Windows 10, version 1803.

-
Update CSP

Added the following nodes in Windows 10, version 1803:

-
    -
  • Rollback
    • -
  • Rollback/FeatureUpdate
    • -
  • Rollback/QualityUpdateStatus
    • -
  • Rollback/FeatureUpdateStatus
    • -
-
AssignedAccess CSP

Added the following nodes in Windows 10, version 1803:

-
    -
  • Status
    • -
  • ShellLauncher
    • -
  • StatusConfiguration
    • -
-

Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

-
MultiSIM CSP

Added a new CSP in Windows 10, version 1803.

-
EnterpriseModernAppManagement CSP

Added the following node in Windows 10, version 1803:

-
    -
  • MaintainProcessorArchitectureOnUpdate
    • -
-
eUICCs CSP

Added the following node in Windows 10, version 1803:

-
    -
  • IsEnabled
    • -
-
DeviceStatus CSP

Added the following node in Windows 10, version 1803:

-
    -
  • OS/Mode
    • -
-
AccountManagement CSP

Added a new CSP in Windows 10, version 1803.

-
RootCATrustedCertificates CSP

Added the following node in Windows 10, version 1803:

-
    -
  • UntrustedCertificates
    • -
-
NetworkProxy CSP

Added the following node in Windows 10, version 1803:

-
    -
  • ProxySettingsPerUser
    • -
-
Accounts CSP

Added a new CSP in Windows 10, version 1803.

-
MDM Migration Analysis Too (MMAT)

Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

-
CSP DDF files download

Added the DDF download of Windows 10, version 1803 configuration service providers.

-
+| New or updated article | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policies for Windows 10, version 1803:
- ApplicationDefaults/EnableAppUriHandlers
- ApplicationManagement/MSIAllowUserControlOverInstall
- ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
- Bluetooth/AllowPromptedProximalConnections
- Browser/AllowConfigurationUpdateForBooksLibrary
- Browser/AlwaysEnableBooksLibrary
- Browser/EnableExtendedBooksTelemetry
- Browser/UseSharedFolderForBooks
- Connectivity/AllowPhonePCLinking
- DeliveryOptimization/DODelayBackgroundDownloadFromHttp
- DeliveryOptimization/DODelayForegroundDownloadFromHttp
- DeliveryOptimization/DOGroupIdSource
- DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
- DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
- DeliveryOptimization/DORestrictPeerSelectionBy
- DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
- DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
- Display/DisablePerProcessDpiForApps
- Display/EnablePerProcessDpi
- Display/EnablePerProcessDpiForApps
- Experience/AllowWindowsSpotlightOnSettings
- KioskBrowser/BlockedUrlExceptions
- KioskBrowser/BlockedUrls
- KioskBrowser/DefaultURL
- KioskBrowser/EnableEndSessionButton
- KioskBrowser/EnableHomeButton
- KioskBrowser/EnableNavigationButtons
- KioskBrowser/RestartOnIdleTime
- LanmanWorkstation/EnableInsecureGuestLogons
- LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
- LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
- LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
- LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
- LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
- LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
- LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
- LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
- LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
- LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
- LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
- LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
- LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
- LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
- LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
- LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
- LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
- LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
- LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
- Notifications/DisallowCloudNotification
- RestrictedGroups/ConfigureGroupMembership
- Search/AllowCortanaInAAD
- Search/DoNotUseWebResults
- Security/ConfigureWindowsPasswords
- Start/DisableContextMenus
- System/FeedbackHubAlwaysSaveDiagnosticsLocally
- SystemServices/ConfigureHomeGroupListenerServiceStartupMode
- SystemServices/ConfigureHomeGroupProviderServiceStartupMode
- SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
- SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
- SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
- SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
- TaskScheduler/EnableXboxGameSaveTask
- TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
- TextInput/ForceTouchKeyboardDockedState
- TextInput/TouchKeyboardDictationButtonAvailability
- TextInput/TouchKeyboardEmojiButtonAvailability
- TextInput/TouchKeyboardFullModeAvailability
- TextInput/TouchKeyboardHandwritingModeAvailability
- TextInput/TouchKeyboardNarrowModeAvailability
- TextInput/TouchKeyboardSplitModeAvailability
- TextInput/TouchKeyboardWideModeAvailability
- Update/ConfigureFeatureUpdateUninstallPeriod
- Update/TargetReleaseVersion
- UserRights/AccessCredentialManagerAsTrustedCaller
- UserRights/AccessFromNetwork
- UserRights/ActAsPartOfTheOperatingSystem
- UserRights/AllowLocalLogOn
- UserRights/BackupFilesAndDirectories
- UserRights/ChangeSystemTime
- UserRights/CreateGlobalObjects
- UserRights/CreatePageFile
- UserRights/CreatePermanentSharedObjects
- UserRights/CreateSymbolicLinks
- UserRights/CreateToken
- UserRights/DebugPrograms
- UserRights/DenyAccessFromNetwork
- UserRights/DenyLocalLogOn
- UserRights/DenyRemoteDesktopServicesLogOn
- UserRights/EnableDelegation
- UserRights/GenerateSecurityAudits
- UserRights/ImpersonateClient
- UserRights/IncreaseSchedulingPriority
- UserRights/LoadUnloadDeviceDrivers
- UserRights/LockMemory
- UserRights/ManageAuditingAndSecurityLog
- UserRights/ManageVolume
- UserRights/ModifyFirmwareEnvironment
- UserRights/ModifyObjectLabel
- UserRights/ProfileSingleProcess
- UserRights/RemoteShutdown
- UserRights/RestoreFilesAndDirectories
- UserRights/TakeOwnership
- WindowsDefenderSecurityCenter/DisableAccountProtectionUI
- WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
- WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
- WindowsDefenderSecurityCenter/HideSecureBoot
- WindowsDefenderSecurityCenter/HideTPMTroubleshooting
- Security/RequireDeviceEncryption - updated to show it is supported in desktop. | +| [Accounts CSP](accounts-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [AccountManagement CSP](accountmanagement-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added the following nodes in Windows 10, version 1803:
- Status
- ShellLauncher
- StatusConfiguration

Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite. | +| [BitLocker CSP](bitlocker-csp.md) | Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803. | +| [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) | Added the DDF download of Windows 10, version 1803 configuration service providers. | +| [Defender CSP](defender-csp.md) | Added new node (OfflineScan) in Windows 10, version 1803. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following node in Windows 10, version 1803:
- OS/Mode | +| [DMClient CSP](dmclient-csp.md) | Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:
- AADSendDeviceToken
- BlockInStatusPage
- AllowCollectLogsButton
- CustomErrorText
- SkipDeviceStatusPage
- SkipUserStatusPage | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following node in Windows 10, version 1803:
- MaintainProcessorArchitectureOnUpdate | +| [eUICCs CSP](euiccs-csp.md) | Added the following node in Windows 10, version 1803:
- IsEnabled | +| [MDM Migration Analysis Too (MMAT)](https://aka.ms/mmat) | MDM Migration Analysis Too (MMAT)
Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies. | +| [MultiSIM CSP](multisim-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [NetworkProxy CSP](networkproxy-csp.md) | Added the following node in Windows 10, version 1803:
- ProxySettingsPerUser | +| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | Added the following node in Windows 10, version 1803:
- UntrustedCertificates | +| [UEFI CSP](uefi-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [Update CSP](update-csp.md) | Added the following nodes in Windows 10, version 1803:
- Rollback
- Rollback/FeatureUpdate
- Rollback/QualityUpdateStatus
- Rollback/FeatureUpdateStatus | ## What’s new in MDM for Windows 10, version 1709 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ItemDescription
The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

-
    -
  • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
    • -
  • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
    • -
  • DomainName - fully qualified domain name if the device is domain-joined.
    • -
-

For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

-
Firewall CSP

Added new CSP in Windows 10, version 1709.

-
eUICCs CSP

Added new CSP in Windows 10, version 1709.

-
WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
CM_ProxyEntries CSP and CMPolicy CSPIn Windows 10, version 1709, support for desktop SKUs were added to these CSPs. The table of SKU information in the Configuration service provider reference was updated.
WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
VPNv2 CSP

Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709.

-
DeviceStatus CSP

Added the following settings in Windows 10, version 1709:

-
    -
  • DeviceStatus/DomainName
    • -
  • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
    • -
  • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
    • -
  • DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus
    • -
-
AssignedAccess CSP

Added the following setting in Windows 10, version 1709.

-
    -
  • Configuration
    • -
-

Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro.

-
DeviceManageability CSP

Added the following settings in Windows 10, version 1709:

-
    -
  • Provider/ProviderID/ConfigInfo
    • -
  • Provider/ProviderID/EnrollmentInfo
    • -
-
Office CSP

Added the following setting in Windows 10, version 1709:

-
    -
  • Installation/CurrentStatus
    • -
-
DMClient CSP

Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

-
Bitlocker CSP

Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.

-
ADMX-backed policies in Policy CSP

Added new policies.

-
Microsoft Store for Business and Microsoft Store

Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

-
MDM enrollment of Windows-based devices

New features in the Settings app:

-
    -
  • User sees installation progress of critical policies during MDM enrollment.
    • -
  • User knows what policies, profiles, apps MDM has configured
    • -
  • IT helpdesk can get detailed MDM diagnostic information using client tools
    • -
-

For details, see Managing connection and Collecting diagnostic logs

-
Enroll a Windows 10 device automatically using Group Policy

Added new topic to introduce a new Group Policy for automatic MDM enrollment.

-
Policy CSP

Added the following new policies for Windows 10, version 1709:

-
    -
  • Authentication/AllowAadPasswordReset
    • -
  • Authentication/AllowFidoDeviceSignon
    • -
  • Browser/LockdownFavorites
    • -
  • Browser/ProvisionFavorites
    • -
  • Cellular/LetAppsAccessCellularData
    • -
  • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
    • -
  • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
    • -
  • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
    • -
  • CredentialProviders/DisableAutomaticReDeploymentCredentials
    • -
  • DeviceGuard/EnableVirtualizationBasedSecurity
    • -
  • DeviceGuard/RequirePlatformSecurityFeatures
    • -
  • DeviceGuard/LsaCfgFlags
    • -
  • DeviceLock/MinimumPasswordAge
    • -
  • ExploitGuard/ExploitProtectionSettings
    • -
  • Games/AllowAdvancedGamingServices
    • -
  • Handwriting/PanelDefaultModeDocked
    • -
  • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
    • -
  • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
    • -
  • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
    • -
  • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    • -
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
    • -
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
    • -
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    • -
  • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
    • -
  • Power/DisplayOffTimeoutOnBattery
    • -
  • Power/DisplayOffTimeoutPluggedIn
    • -
  • Power/HibernateTimeoutOnBattery
    • -
  • Power/HibernateTimeoutPluggedIn
    • -
  • Power/StandbyTimeoutOnBattery
    • -
  • Power/StandbyTimeoutPluggedIn
    • -
  • Privacy/EnableActivityFeed
    • -
  • Privacy/PublishUserActivities
    • -
  • Defender/AttackSurfaceReductionOnlyExclusions
    • -
  • Defender/AttackSurfaceReductionRules
    • -
  • Defender/CloudBlockLevel
    • -
  • Defender/CloudExtendedTimeout
    • -
  • Defender/ControlledFolderAccessAllowedApplications
    • -
  • Defender/ControlledFolderAccessProtectedFolders
    • -
  • Defender/EnableControlledFolderAccess
    • -
  • Defender/EnableNetworkProtection
    • -
  • Education/DefaultPrinterName
    • -
  • Education/PreventAddingNewPrinters
    • -
  • Education/PrinterNames
    • -
  • Search/AllowCloudSearch
    • -
  • Security/ClearTPMIfNotReady
    • -
  • Settings/AllowOnlineTips
    • -
  • Start/HidePeopleBar
    • -
  • Storage/AllowDiskHealthModelUpdates
    • -
  • System/DisableEnterpriseAuthProxy
    • -
  • System/LimitEnhancedDiagnosticDataWindowsAnalytics
    • -
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
    • -
  • Update/DisableDualScan
    • -
  • Update/ManagePreviewBuilds
    • -
  • Update/ScheduledInstallEveryWeek
    • -
  • Update/ScheduledInstallFirstWeek
    • -
  • Update/ScheduledInstallFourthWeek
    • -
  • Update/ScheduledInstallSecondWeek
    • -
  • Update/ScheduledInstallThirdWeek
    • -
  • WindowsDefenderSecurityCenter/CompanyName
    • -
  • WindowsDefenderSecurityCenter/DisableAppBrowserUI
    • -
  • WindowsDefenderSecurityCenter/DisableEnhancedNotifications
    • -
  • WindowsDefenderSecurityCenter/DisableFamilyUI
    • -
  • WindowsDefenderSecurityCenter/DisableHealthUI
    • -
  • WindowsDefenderSecurityCenter/DisableNetworkUI
    • -
  • WindowsDefenderSecurityCenter/DisableNotifications
    • -
  • WindowsDefenderSecurityCenter/DisableVirusUI
    • -
  • WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
    • -
  • WindowsDefenderSecurityCenter/Email
    • -
  • WindowsDefenderSecurityCenter/EnableCustomizedToasts
    • -
  • WindowsDefenderSecurityCenter/EnableInAppCustomization
    • -
  • WindowsDefenderSecurityCenter/Phone
    • -
  • WindowsDefenderSecurityCenter/URL
    • -
  • WirelessDisplay/AllowMdnsAdvertisement
    • -
  • WirelessDisplay/AllowMdnsDiscovery
    • -
-
+| New or updated article | Description | +|-----|-----| +| The [The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2](https://docs.microsoft.com/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692?redirectedfrom=MSDN) | The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:
- UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
-ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
- DomainName - fully qualified domain name if the device is domain-joined. | +| [Firewall CSP](firewall-csp.md) | Added new CSP in Windows 10, version 1709. | +| [eUICCs CSP](euiccs-csp.md) | Added new CSP in Windows 10, version 1709. | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)
[WindowsDefenderApplicationGuard DDF file](windowsdefenderapplicationguard-ddf-file.md) | New CSP added in Windows 10, version 1709. Also added the DDF topic. | +| [CM_ProxyEntries CSP](cm-proxyentries-csp.md) and [CMPolicy CSP](cmpolicy-csp.md) | In Windows 10, version 1709, support for desktop SKUs were added to these CSPs. | +| [VPNv2 CSP](vpnv2-csp.md) | Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following settings in Windows 10, version 1709:
- DeviceStatus/DomainName
- DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
- DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
- DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added the following setting in Windows 10, version 1709:
- Configuration
Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro. | +| [DeviceManageability CSP](devicemanageability-csp.md) | Added the following settings in Windows 10, version 1709:
- Provider/_ProviderID_/ConfigInfo
- Provider/_ProviderID_/EnrollmentInfo | +| [Office CSP](office-csp.md) | Added the following setting in Windows 10, version 1709:
- Installation/CurrentStatus | +| [DMClient CSP](dmclient-csp.md) | Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF articles. | +| [Bitlocker CSP](bitlocker-csp.md) | Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. | +| [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) | Added new policies. | +| Microsoft Store for Business and Microsoft Store | Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store. | +| [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) | New features in the Settings app:
- User sees installation progress of critical policies during MDM enrollment.
- User knows what policies, profiles, apps MDM has configured
- IT helpdesk can get detailed MDM diagnostic information using client tools
For details, see [Managing connection](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#manage-connections) and [Collecting diagnostic logs](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#collecting-diagnostic-logs).| +| [Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md) | Added new topic to introduce a new Group Policy for automatic MDM enrollment. | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies for Windows 10, version 1709:
- Authentication/AllowAadPasswordReset
- Authentication/AllowFidoDeviceSignon
- Browser/LockdownFavorites
- Browser/ProvisionFavorites
- Cellular/LetAppsAccessCellularData
- Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
- Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
- Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
- CredentialProviders/DisableAutomaticReDeploymentCredentials
- DeviceGuard/EnableVirtualizationBasedSecurity
- DeviceGuard/RequirePlatformSecurityFeatures
- DeviceGuard/LsaCfgFlags
- DeviceLock/MinimumPasswordAge
- ExploitGuard/ExploitProtectionSettings
- Games/AllowAdvancedGamingServices
- Handwriting/PanelDefaultModeDocked
- LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
- LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
- LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
- LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
- LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
- LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
- LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
- LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
- LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
- LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
- LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
- LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
- LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
- LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
- LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
- LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
- LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
- LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
- LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
- LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
- LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
- LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
- Power/DisplayOffTimeoutOnBattery
- Power/DisplayOffTimeoutPluggedIn
- Power/HibernateTimeoutOnBattery
- Power/HibernateTimeoutPluggedIn
- Power/StandbyTimeoutOnBattery
- Power/StandbyTimeoutPluggedIn
- Privacy/EnableActivityFeed
- Privacy/PublishUserActivities
- Defender/AttackSurfaceReductionOnlyExclusions
- Defender/AttackSurfaceReductionRules
- Defender/CloudBlockLevel
- Defender/CloudExtendedTimeout
- Defender/ControlledFolderAccessAllowedApplications
- Defender/ControlledFolderAccessProtectedFolders
- Defender/EnableControlledFolderAccess
- Defender/EnableNetworkProtection
- Education/DefaultPrinterName
- Education/PreventAddingNewPrinters
- Education/PrinterNames
- Search/AllowCloudSearch
- Security/ClearTPMIfNotReady
- Settings/AllowOnlineTips
- Start/HidePeopleBar
- Storage/AllowDiskHealthModelUpdates
- System/DisableEnterpriseAuthProxy
- System/LimitEnhancedDiagnosticDataWindowsAnalytics
- Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
- Update/DisableDualScan
- Update/ManagePreviewBuilds
- Update/ScheduledInstallEveryWeek
- Update/ScheduledInstallFirstWeek
- Update/ScheduledInstallFourthWeek
- Update/ScheduledInstallSecondWeek
- Update/ScheduledInstallThirdWeek
- WindowsDefenderSecurityCenter/CompanyName
- WindowsDefenderSecurityCenter/DisableAppBrowserUI
- WindowsDefenderSecurityCenter/DisableEnhancedNotifications
- WindowsDefenderSecurityCenter/DisableFamilyUI
- WindowsDefenderSecurityCenter/DisableHealthUI
- WindowsDefenderSecurityCenter/DisableNetworkUI
- WindowsDefenderSecurityCenter/DisableNotifications
- WindowsDefenderSecurityCenter/DisableVirusUI
- WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
- WindowsDefenderSecurityCenter/Email
- WindowsDefenderSecurityCenter/EnableCustomizedToasts
- WindowsDefenderSecurityCenter/EnableInAppCustomization
- WindowsDefenderSecurityCenter/Phone
- WindowsDefenderSecurityCenter/URL
- WirelessDisplay/AllowMdnsAdvertisement
- WirelessDisplay/AllowMdnsDiscovery | + ## What’s new in MDM for Windows 10, version 1703 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ItemDescription

Update CSP

Added the following nodes:

-
    -
  • FailedUpdates/Failed Update Guid/RevisionNumber
    • -
  • InstalledUpdates/Installed Update Guid/RevisionNumber
    • -
  • PendingRebootUpdates/Pending Reboot Update Guid/RevisionNumber
    • -
-
CM_CellularEntries CSP

To PurposeGroups setting, added the following values:

-
    -
  • Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
    • -
  • Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364
    • -
-

CertificateStore CSP

Added the following setting:

-
    -
  • My/WSTEP/Renew/RetryAfterExpiryInterval
    • -
-

ClientCertificateInstall CSP

Added the following setting:

-
    -
  • SCEP/UniqueID/Install/AADKeyIdentifierList
    • -
-

DMAcc CSP

Added the following setting:

-
    -
  • AccountUID/EXT/Microsoft/InitiateSession
    • -
-

DMClient CSP

Added the following nodes and settings:

-
    -
  • HWDevID
    • -
  • Provider/ProviderID/ManagementServerToUpgradeTo
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage/Title
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText
    • -
-

CellularSettings CSP

CM_CellularEntries CSP

EnterpriseAPN CSP

For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions.

-
SecureAssessment CSP

Added the following settings:

-
    -
  • AllowTextSuggestions
    • -
  • RequirePrinting
    • -
-
EnterpriseAPN CSP

Added the following setting:

-
    -
  • Roaming
    • -
-
Messaging CSP

Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions.

-
Policy CSP

Added the following new policies:

-
    -
  • Accounts/AllowMicrosoftAccountSignInAssistant
    • -
  • ApplicationDefaults/DefaultAssociationsConfiguration
    • -
  • Browser/AllowAddressBarDropdown
    • -
  • Browser/AllowFlashClickToRun
    • -
  • Browser/AllowMicrosoftCompatibilityList
    • -
  • Browser/AllowSearchEngineCustomization
    • -
  • Browser/ClearBrowsingDataOnExit
    • -
  • Browser/ConfigureAdditionalSearchEngines
    • -
  • Browser/DisableLockdownOfStartPages
    • -
  • Browser/PreventFirstRunPage
    • -
  • Browser/PreventLiveTileDataCollection
    • -
  • Browser/SetDefaultSearchEngine
    • -
  • Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
    • -
  • Connectivity/AllowConnectedDevices
    • -
  • DeliveryOptimization/DOAllowVPNPeerCaching
    • -
  • DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
    • -
  • DeliveryOptimization/DOMinDiskSizeAllowedToPeer
    • -
  • DeliveryOptimization/DOMinFileSizeToCache
    • -
  • DeliveryOptimization/DOMinRAMAllowedToPeer
    • -
  • DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
    • -
  • Display/TurnOffGdiDPIScalingForApps
    • -
  • Display/TurnOnGdiDPIScalingForApps
    • -
  • EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
    • -
  • EnterpriseCloudPrint/CloudPrintOAuthAuthority
    • -
  • EnterpriseCloudPrint/CloudPrintOAuthClientId
    • -
  • EnterpriseCloudPrint/CloudPrintResourceId
    • -
  • EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
    • -
  • EnterpriseCloudPrint/MopriaDiscoveryResourceId
    • -
  • Experience/AllowFindMyDevice
    • -
  • Experience/AllowTailoredExperiencesWithDiagnosticData
    • -
  • Experience/AllowWindowsSpotlightOnActionCenter
    • -
  • Experience/AllowWindowsSpotlightWindowsWelcomeExperience
    • -
  • Location/EnableLocation
    • -
  • Messaging/AllowMMS
    • -
  • Messaging/AllowRCS
    • -
  • Privacy/LetAppsAccessTasks
    • -
  • Privacy/LetAppsAccessTasks_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessTasks_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsGetDiagnosticInfo
    • -
  • Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
    • -
  • Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
    • -
  • Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsRunInBackground
    • -
  • Privacy/LetAppsRunInBackground_ForceAllowTheseApps
    • -
  • Privacy/LetAppsRunInBackground_ForceDenyTheseApps
    • -
  • Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
    • -
  • Settings/ConfigureTaskbarCalendar
    • -
  • Settings/PageVisibilityList
    • -
  • SmartScreen/EnableAppInstallControl
    • -
  • SmartScreen/EnableSmartScreenInShell
    • -
  • SmartScreen/PreventOverrideForFilesInShell
    • -
  • Start/AllowPinnedFolderDocuments
    • -
  • Start/AllowPinnedFolderDownloads
    • -
  • Start/AllowPinnedFolderFileExplorer
    • -
  • Start/AllowPinnedFolderHomeGroup
    • -
  • Start/AllowPinnedFolderMusic
    • -
  • Start/AllowPinnedFolderNetwork
    • -
  • Start/AllowPinnedFolderPersonalFolder
    • -
  • Start/AllowPinnedFolderPictures
    • -
  • Start/AllowPinnedFolderSettings
    • -
  • Start/AllowPinnedFolderVideos
    • -
  • Start/HideAppList
    • -
  • Start/HideChangeAccountSettings
    • -
  • Start/HideFrequentlyUsedApps
    • -
  • Start/HideHibernate
    • -
  • Start/HideLock
    • -
  • Start/HidePowerButton
    • -
  • Start/HideRecentJumplists
    • -
  • Start/HideRecentlyAddedApps
    • -
  • Start/HideRestart
    • -
  • Start/HideShutDown
    • -
  • Start/HideSignOut
    • -
  • Start/HideSleep
    • -
  • Start/HideSwitchAccount
    • -
  • Start/HideUserTile
    • -
  • Start/ImportEdgeAssets
    • -
  • Start/NoPinningToTaskbar
    • -
  • System/AllowFontProviders
    • -
  • System/DisableOneDriveFileSync
    • -
  • TextInput/AllowKeyboardTextSuggestions
    • -
  • TimeLanguageSettings/AllowSet24HourClock
    • -
  • Update/ActiveHoursMaxRange
    • -
  • Update/AutoRestartDeadlinePeriodInDays
    • -
  • Update/AutoRestartNotificationSchedule
    • -
  • Update/AutoRestartRequiredNotificationDismissal
    • -
  • Update/DetectionFrequency
    • -
  • Update/EngagedRestartDeadline
    • -
  • Update/EngagedRestartSnoozeSchedule
    • -
  • Update/EngagedRestartTransitionSchedule
    • -
  • Update/IgnoreMOAppDownloadLimit
    • -
  • Update/IgnoreMOUpdateDownloadLimit
    • -
  • Update/PauseFeatureUpdatesStartTime
    • -
  • Update/PauseQualityUpdatesStartTime
    • -
  • Update/SetAutoRestartNotificationDisable
    • -
  • Update/SetEDURestart
    • -
  • WiFi/AllowWiFiDirect
    • -
  • WindowsLogon/HideFastUserSwitching
    • -
  • WirelessDisplay/AllowProjectionFromPC
    • -
  • WirelessDisplay/AllowProjectionFromPCOverInfrastructure
    • -
  • WirelessDisplay/AllowProjectionToPCOverInfrastructure
    • -
  • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
    • -

Removed TextInput/AllowLinguisticDataCollection

-

Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise

-

Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

-

Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

-

Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

-

Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files.

-
DevDetail CSP

Added the following setting:

-
    -
  • DeviceHardwareData
    • -
-
CleanPC CSP

Added new CSP.

DeveloperSetup CSP

Added new CSP.

NetworkProxy CSP

Added new CSP.

BitLocker CSP

Added new CSP.

-

Added the following setting:

-
    -
  • AllowWarningForOtherDiskEncryption
    • -
-
EnterpriseDataProtection CSP

Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.

Added the following settings:

-
    -
  • RevokeOnMDMHandoff
    • -
  • SMBAutoEncryptedFileExtensions
    • -
DynamicManagement CSP

Added new CSP.

Implement server-side support for mobile application management on Windows

New mobile application management (MAM) support added in Windows 10, version 1703.

PassportForWork CSP

Added the following new node and settings:

-
    -
  • TenantId/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
    • -
  • TenantId/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
    • -
  • TenantId/Policies/EnablePinRecovery
    • -
Office CSP

Added new CSP.

Personalization CSP

Added new CSP.

EnterpriseAppVManagement CSP

Added new CSP.

HealthAttestation CSP

Added the following settings:

-
    -
  • HASEndpoint - added in Windows 10, version 1607, but not documented
    • -
  • TpmReadyStatus - added in the March service release of Windows 10, version 1607
    • -

SurfaceHub CSP

Added the following nodes and settings:

-
    -
  • InBoxApps/SkypeForBusiness
    • -
  • InBoxApps/SkypeForBusiness/DomainName
    • -
  • InBoxApps/Connect
    • -
  • InBoxApps/Connect/AutoLaunch
    • -
  • Properties/DefaultVolume
    • -
  • Properties/ScreenTimeout
    • -
  • Properties/SessionTimeout
    • -
  • Properties/SleepTimeout
    • -
  • Properties/AllowSessionResume
    • -
  • Properties/AllowAutoProxyAuth
    • -
  • Properties/DisableSigninSuggestions
    • -
  • Properties/DoNotShowMyMeetingsAndFiles
    • -
-
NetworkQoSPolicy CSP

Added new CSP.

WindowsLicensing CSP

Added the following setting:

-
    -
  • ChangeProductKey
    • -
-
WindowsAdvancedThreatProtection CSP

Added the following setting:

-
    -
  • Configuration/TelemetryReportingFrequency
    • -
-
DMSessionActions CSP

Added new CSP.

-
SharedPC CSP

Added new settings in Windows 10, version 1703.

-
    -
  • RestrictLocalStorage
    • -
  • KioskModeAUMID
    • -
  • KioskModeUserTileDisplayText
    • -
  • InactiveThreshold
    • -
  • MaxPageFileSizeMB
    • -
-

The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300.

-
RemoteLock CSP

Added following setting:

-
    -
  • LockAndRecoverPIN
    • -
-
NodeCache CSP

Added following settings:

-
    -
  • ChangedNodesData
    • -
  • AutoSetExpectedValue
    • -
-
Download all the DDF files for Windows 10, version 1703

Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF topics of various CSPs.

-
RemoteWipe CSP

Added new setting in Windows 10, version 1703.

-
    -
  • doWipeProtected
    • -
-
MDM Bridge WMI Provider

Added new classes and properties.

-
Understanding ADMX-backed policies

Added a section describing SyncML examples of various ADMX elements.

-
Win32 and Desktop Bridge app policy configurationNew topic.
Deploy and configure App-V apps using MDM

Added a new topic describing how to deploy and configure App-V apps using MDM.

-
EnterpriseDesktopAppManagement CSP

Added new setting in the March service release of Windows 10, version 1607.

-
    -
  • MSI/UpgradeCode/[Guid]
    • -
-
Reporting CSP

Added new settings in Windows 10, version 1703.

-
    -
  • EnterpriseDataProtection/RetrieveByTimeRange/Type
    • -
  • EnterpriseDataProtection/RetrieveByCount/Type
    • -
-
Connect your Windows 10-based device to work using a deep link

Added following deep link parameters to the table:

-
    -
  • Username
    • -
  • Servername
    • -
  • Accesstoken
    • -
  • Deviceidentifier
    • -
  • Tenantidentifier
    • -
  • Ownership
    • -
-
MDM support for Windows 10 S

Updated the following topics to indicate MDM support in Windows 10 S.

- -
TPMPolicy CSPNew CSP added in Windows 10, version 1703.
  - +| New or updated article | Description | +|-----|-----| +| [Update CSP](update-csp.md) | Added the following nodes:
- FailedUpdates/_Failed Update Guid_/RevisionNumber
- InstalledUpdates/_Installed Update Guid_/RevisionNumber
- PendingRebootUpdates/_Pending Reboot Update Guid_/RevisionNumber | +| [CM_CellularEntries CSP](cm-cellularentries-csp.md) | To PurposeGroups setting, added the following values:
- Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
- Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364 | +| [CertificateStore CSP](certificatestore-csp.md) | Added the following setting:
- My/WSTEP/Renew/RetryAfterExpiryInterval | +| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | Added the following setting:
- SCEP/UniqueID/Install/AADKeyIdentifierList | +| [DMAcc CSP](dmacc-csp.md) | Added the following setting:
- AccountUID/EXT/Microsoft/InitiateSession | +| [DMClient CSP](dmclient-csp.md) | Added the following nodes and settings:
- HWDevID
- Provider/ProviderID/ManagementServerToUpgradeTo
- Provider/ProviderID/CustomEnrollmentCompletePage
- Provider/ProviderID/CustomEnrollmentCompletePage/Title
- Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
- Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
- Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText | +| [CellularSettings CSP](cellularsettings-csp.md)
[CM_CellularEntries CSP](cm-cellularentries-csp.md)
[EnterpriseAPN CSP](enterpriseapn-csp.md) | For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions. | +| [SecureAssessment CSP](secureassessment-csp.md) | Added the following settings:
- AllowTextSuggestions
- RequirePrinting | +| [EnterpriseAPN CSP](enterpriseapn-csp.md) | Added the following setting:
- Roaming | +| [Messaging CSP](messaging-csp.md) | Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions. | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies:
- Accounts/AllowMicrosoftAccountSignInAssistant
- ApplicationDefaults/DefaultAssociationsConfiguration
- Browser/AllowAddressBarDropdown
- Browser/AllowFlashClickToRun
- Browser/AllowMicrosoftCompatibilityList
- Browser/AllowSearchEngineCustomization
- Browser/ClearBrowsingDataOnExit
- Browser/ConfigureAdditionalSearchEngines
- Browser/DisableLockdownOfStartPages
- Browser/PreventFirstRunPage
- Browser/PreventLiveTileDataCollection
- Browser/SetDefaultSearchEngine
- Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
- Connectivity/AllowConnectedDevices
- DeliveryOptimization/DOAllowVPNPeerCaching
- DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
- DeliveryOptimization/DOMinDiskSizeAllowedToPeer
- DeliveryOptimization/DOMinFileSizeToCache
- DeliveryOptimization/DOMinRAMAllowedToPeer
- DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
- Display/TurnOffGdiDPIScalingForApps
- Display/TurnOnGdiDPIScalingForApps
- EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
- EnterpriseCloudPrint/CloudPrintOAuthAuthority
- EnterpriseCloudPrint/CloudPrintOAuthClientId
- EnterpriseCloudPrint/CloudPrintResourceId
- EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
- EnterpriseCloudPrint/MopriaDiscoveryResourceId
- Experience/AllowFindMyDevice
- Experience/AllowTailoredExperiencesWithDiagnosticData
- Experience/AllowWindowsSpotlightOnActionCenter
- Experience/AllowWindowsSpotlightWindowsWelcomeExperience
- Location/EnableLocation
- Messaging/AllowMMS
- Messaging/AllowRCS
- Privacy/LetAppsAccessTasks
- Privacy/LetAppsAccessTasks_ForceAllowTheseApps
- Privacy/LetAppsAccessTasks_ForceDenyTheseApps
- Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
- Privacy/LetAppsGetDiagnosticInfo
- Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
- Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
- Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
- Privacy/LetAppsRunInBackground
- Privacy/LetAppsRunInBackground_ForceAllowTheseApps
- Privacy/LetAppsRunInBackground_ForceDenyTheseApps
- Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
- Settings/ConfigureTaskbarCalendar
- Settings/PageVisibilityList
- SmartScreen/EnableAppInstallControl
- SmartScreen/EnableSmartScreenInShell
- SmartScreen/PreventOverrideForFilesInShell
- Start/AllowPinnedFolderDocuments
- Start/AllowPinnedFolderDownloads
- Start/AllowPinnedFolderFileExplorer
- Start/AllowPinnedFolderHomeGroup
- Start/AllowPinnedFolderMusic
- Start/AllowPinnedFolderNetwork
- Start/AllowPinnedFolderPersonalFolder
- Start/AllowPinnedFolderPictures
- Start/AllowPinnedFolderSettings
- Start/AllowPinnedFolderVideos
- Start/HideAppList
- Start/HideChangeAccountSettings
- Start/HideFrequentlyUsedApps
- Start/HideHibernate
- Start/HideLock
- Start/HidePowerButton
- Start/HideRecentJumplists
- Start/HideRecentlyAddedApps
- Start/HideRestart
- Start/HideShutDown
- Start/HideSignOut
- Start/HideSleep
- Start/HideSwitchAccount
- Start/HideUserTile
- Start/ImportEdgeAssets
- Start/NoPinningToTaskbar
- System/AllowFontProviders
- System/DisableOneDriveFileSync
- TextInput/AllowKeyboardTextSuggestions
- TimeLanguageSettings/AllowSet24HourClock
- Update/ActiveHoursMaxRange
- Update/AutoRestartDeadlinePeriodInDays
- Update/AutoRestartNotificationSchedule
- Update/AutoRestartRequiredNotificationDismissal
- Update/DetectionFrequency
- Update/EngagedRestartDeadline
- Update/EngagedRestartSnoozeSchedule
- Update/EngagedRestartTransitionSchedule
- Update/IgnoreMOAppDownloadLimit
- Update/IgnoreMOUpdateDownloadLimit
- Update/PauseFeatureUpdatesStartTime
- Update/PauseQualityUpdatesStartTime
- Update/SetAutoRestartNotificationDisable
- Update/SetEDURestart
- WiFi/AllowWiFiDirect
- WindowsLogon/HideFastUserSwitching
- WirelessDisplay/AllowProjectionFromPC
- WirelessDisplay/AllowProjectionFromPCOverInfrastructure
- WirelessDisplay/AllowProjectionToPCOverInfrastructure
- WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
Removed TextInput/AllowLinguisticDataCollection
Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise
Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.
Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.
Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.
Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files. | +| [DevDetail CSP](devdetail-csp.md) | Added the following setting:
- DeviceHardwareData | +| [CleanPC CSP](cleanpc-csp.md) | Added the new CSP. | +| [DeveloperSetup CSP](developersetup-csp.md) | Added the new CSP. | +| [NetworkProxy CSP](networkproxy-csp.md) | Added the new CSP. | +| [BitLocker CSP](bitlocker-csp.md) | Added the new CSP.

Added the following setting:
- AllowWarningForOtherDiskEncryption | +| [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) | Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.
Added the following settings:
- RevokeOnMDMHandoff
- SMBAutoEncryptedFileExtensions | +| [DynamicManagement CSP](dynamicmanagement-csp.md) | Added the new CSP. | +| [Implement server-side support for mobile application management on Windows](https://docs.microsoft.com/windows/client-management/mdm/implement-server-side-mobile-application-management) | New mobile application management (MAM) support added in Windows 10, version 1703. | +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new node and settings:
- _TenantId_/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
- _TenantId_/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
- _TenantId_/Policies/EnablePinRecovery | +| [Office CSP](office-csp.md) | Added the new CSP. | +| [Personalization CSP](personalization-csp.md) | Added the new CSP. | +| [EnterpriseAppVManagement CSP](enterpriseappvmanagement-csp.md) | Added the new CSP. | +| [HealthAttestation CSP](healthattestation-csp.md) | Added the following settings:
- HASEndpoint - added in Windows 10, version 1607, but not documented
- TpmReadyStatus - added in the March service release of Windows 10, version 1607 | +| [SurfaceHub CSP](surfacehub-csp.md) | Added the following nodes and settings:
- InBoxApps/SkypeForBusiness
- InBoxApps/SkypeForBusiness/DomainName
- InBoxApps/Connect
- InBoxApps/Connect/AutoLaunch
- Properties/DefaultVolume
- Properties/ScreenTimeout
- Properties/SessionTimeout
- Properties/SleepTimeout
- Properties/AllowSessionResume
- Properties/AllowAutoProxyAuth
- Properties/DisableSigninSuggestions
- Properties/DoNotShowMyMeetingsAndFiles | +| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | Added the new CSP. | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added the following setting:
- ChangeProductKey | +| [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) | Added the following setting:
- Configuration/TelemetryReportingFrequency | +| [DMSessionActions CSP](dmsessionactions-csp.md) | Added the new CSP. | +| [SharedPC CSP](dmsessionactions-csp.md) | Added new settings in Windows 10, version 1703:
- RestrictLocalStorage
- KioskModeAUMID
- KioskModeUserTileDisplayText
- InactiveThreshold
- MaxPageFileSizeMB
The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300. | +| [RemoteLock CSP](remotelock-csp.md) | Added following setting:
- LockAndRecoverPIN | +| [NodeCache CSP](nodecache-csp.md) | Added following settings:
- ChangedNodesData
- AutoSetExpectedValue | +| [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) | Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF articles of various CSPs. | +| [RemoteWipe CSP](remotewipe-csp.md) | Added new setting in Windows 10, version 1703:
- doWipeProtected | +| [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224) | Added new classes and properties. | +| [Understanding ADMX-backed policies](https://docs.microsoft.com/windows/client-management/mdm/understanding-admx-backed-policies) | Added a section describing SyncML examples of various ADMX elements. | +| [Win32 and Desktop Bridge app policy configuration](https://docs.microsoft.com/windows/client-management/mdm/win32-and-centennial-app-policy-configuration) | New article. | +| [Deploy and configure App-V apps using MDM](https://docs.microsoft.com/windows/client-management/mdm/appv-deploy-and-config) | Added a new article describing how to deploy and configure App-V apps using MDM. | +| [EnterpriseDesktopAppManagement CSP](enterprisedesktopappmanagement-csp.md) | Added new setting in the March service release of Windows 10, version 1607.
- MSI/UpgradeCode/[Guid] | +| [Reporting CSP](reporting-csp.md) | Added new settings in Windows 10, version 1703.
- EnterpriseDataProtection/RetrieveByTimeRange/Type
- EnterpriseDataProtection/RetrieveByCount/Type | +| [Connect your Windows 10-based device to work using a deep link](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#connect-your-windows-10-based-device-to-work-using-a-deep-link) | Added following deep link parameters to the table:
- Username
- Servername
- Accesstoken
- Deviceidentifier
- Tenantidentifier
- Ownership | +| MDM support for Windows 10 S | Updated the following articles to indicate MDM support in Windows 10 S.
- [Configuration service provider reference](configuration-service-provider-reference.md)
- [Policy CSP](policy-configuration-service-provider.md) | +| [TPMPolicy CSP](tpmpolicy-csp.md) | Added the new CSP. | ## What’s new in MDM for Windows 10, version 1607 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ItemDescription

Sideloading of apps

Starting in Windows 10, version 1607, sideloading of apps is only allowed through EnterpriseModernAppManagement CSP. Product keys (5x5) will no longer be supported to enable sideloading on Windows 10, version 1607 devices.

New value for NodeCache CSP

In NodeCache CSP, the value of NodeCache root node starting in Windows 10, version 1607 is com.microsoft/1.0/MDM/NodeCache.

EnterpriseDataProtection CSP

New CSP.

Policy CSP

Removed the following policies:

-
    -
  • DataProtection/AllowAzureRMSForEDP - moved this policy to EnterpriseDataProtection CSP
    • -
  • DataProtection/AllowUserDecryption - moved this policy to EnterpriseDataProtection CSP
    • -
  • DataProtection/EDPEnforcementLevel - moved this policy to EnterpriseDataProtection CSP
    • -
  • DataProtection/RequireProtectionUnderLockConfig - moved this policy to EnterpriseDataProtection CSP
    • -
  • DataProtection/RevokeOnUnenroll - moved this policy to EnterpriseDataProtection CSP
    • -
  • DataProtection/EnterpriseCloudResources - moved this policy to NetworkIsolation policy
    • -
  • DataProtection/EnterpriseInternalProxyServers - moved this policy to NetworkIsolation policy
    • -
  • DataProtection/EnterpriseIPRange - moved this policy to NetworkIsolation policy
    • -
  • DataProtection/EnterpriseNetworkDomainNames - moved this policy to NetworkIsolation policy
    • -
  • DataProtection/EnterpriseProxyServers - moved this policy to NetworkIsolation policy
    • -
  • Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices - this policy has been deprecated.
    • -
-

Added the WiFi/AllowManualWiFiConfiguration and WiFi/AllowWiFi policies for Windows 10, version 1607:

-
    -
  • Windows 10 Pro
    • -
  • Windows 10 Enterprise
    • -
  • Windows 10 Education
    • -
-

Added the following new policies:

-
    -
  • AboveLock/AllowCortanaAboveLock
    • -
  • ApplicationManagement/DisableStoreOriginatedApps
    • -
  • Authentication/AllowSecondaryAuthenticationDevice
    • -
  • Bluetooth/AllowPrepairing
    • -
  • Browser/AllowExtensions
    • -
  • Browser/PreventAccessToAboutFlagsInMicrosoftEdge
    • -
  • Browser/ShowMessageWhenOpeningSitesInInternetExplorer
    • -
  • DeliveryOptimization/DOAbsoluteMaxCacheSize
    • -
  • DeliveryOptimization/DOMaxDownloadBandwidth
    • -
  • DeliveryOptimization/DOMinBackgroundQoS
    • -
  • DeliveryOptimization/DOModifyCacheDrive
    • -
  • DeliveryOptimization/DOMonthlyUploadDataCap
    • -
  • DeliveryOptimization/DOPercentageMaxDownloadBandwidth
    • -
  • DeviceLock/EnforceLockScreenAndLogonImage
    • -
  • DeviceLock/EnforceLockScreenProvider
    • -
  • Defender/PUAProtection
    • -
  • Experience/AllowThirdPartySuggestionsInWindowsSpotlight
    • -
  • Experience/AllowWindowsSpotlight
    • -
  • Experience/ConfigureWindowsSpotlightOnLockScreen
    • -
  • Experience/DoNotShowFeedbackNotifications
    • -
  • Licensing/AllowWindowsEntitlementActivation
    • -
  • Licensing/DisallowKMSClientOnlineAVSValidation
    • -
  • LockDown/AllowEdgeSwipe
    • -
  • Maps/EnableOfflineMapsAutoUpdate
    • -
  • Maps/AllowOfflineMapsDownloadOverMeteredConnection
    • -
  • Messaging/AllowMessageSync
    • -
  • NetworkIsolation/EnterpriseCloudResources
    • -
  • NetworkIsolation/EnterpriseInternalProxyServers
    • -
  • NetworkIsolation/EnterpriseIPRange
    • -
  • NetworkIsolation/EnterpriseIPRangesAreAuthoritative
    • -
  • NetworkIsolation/EnterpriseNetworkDomainNames
    • -
  • NetworkIsolation/EnterpriseProxyServers
    • -
  • NetworkIsolation/EnterpriseProxyServersAreAuthoritative
    • -
  • NetworkIsolation/NeutralResources
    • -
  • Notifications/DisallowNotificationMirroring
    • -
  • Privacy/DisableAdvertisingId
    • -
  • Privacy/LetAppsAccessAccountInfo
    • -
  • Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessCalendar
    • -
  • Privacy/LetAppsAccessCalendar_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessCalendar_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessCallHistory
    • -
  • Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessCamera
    • -
  • Privacy/LetAppsAccessCamera_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessCamera_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessCamera_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessContacts
    • -
  • Privacy/LetAppsAccessContacts_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessContacts_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessContacts_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessEmail
    • -
  • Privacy/LetAppsAccessEmail_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessEmail_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessLocation
    • -
  • Privacy/LetAppsAccessLocation_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessLocation_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessLocation_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessMessaging
    • -
  • Privacy/LetAppsAccessMessaging_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessMessaging_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessMicrophone
    • -
  • Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessMotion
    • -
  • Privacy/LetAppsAccessMotion_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessMotion_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessMotion_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessNotifications
    • -
  • Privacy/LetAppsAccessNotifications_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessNotifications_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessPhone
    • -
  • Privacy/LetAppsAccessPhone_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessPhone_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessPhone_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessRadios
    • -
  • Privacy/LetAppsAccessRadios_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessRadios_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessRadios_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsAccessTrustedDevices
    • -
  • Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsSyncWithDevices
    • -
  • Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps
    • -
  • Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps
    • -
  • Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps
    • -
  • Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
    • -
  • Settings/AllowEditDeviceName
    • -
  • Speech/AllowSpeechModelUpdate
    • -
  • System/TelemetryProxy
    • -
  • Update/ActiveHoursStart
    • -
  • Update/ActiveHoursEnd
    • -
  • Update/AllowMUUpdateService
    • -
  • Update/BranchReadinessLevel
    • -
  • Update/DeferFeatureUpdatesPeriodInDays
    • -
  • Update/DeferQualityUpdatesPeriodInDays
    • -
  • Update/ExcludeWUDriversInQualityUpdate
    • -
  • Update/PauseFeatureUpdates
    • -
  • Update/PauseQualityUpdates
    • -
  • Update/SetProxyBehaviorForUpdateDetection
    • -
  • Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
    • -
  • WindowsInkWorkspace/AllowWindowsInkWorkspace
    • -
  • WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
    • -
  • WirelessDisplay/AllowProjectionToPC
    • -
  • WirelessDisplay/RequirePinForPairing
    • -
-

Updated the Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts description to remove outdated information.

-

Updated DeliveryOptimization/DODownloadMode to add new values.

-

Updated Experience/AllowCortana description to clarify what each supported value does.

-

Updated Security/AntiTheftMode description to clarify what each supported value does.

DMClient CSP

Added the following settings:

-
    -
  • ManagementServerAddressList
    • -
  • AADDeviceID
    • -
  • EnrollmentType
    • -
  • HWDevID
    • -
  • CommercialID
    • -
-

Removed the EnrollmentID setting.

DeviceManageability CSP

New CSP.

DeviceStatus CSP

Added the following new settings:

-
    -
  • DeviceStatus/TPM/SpecificationVersion
    • -
  • DeviceStatus/OS/Edition
    • -
  • DeviceStatus/Antivirus/SignatureStatus
    • -
  • DeviceStatus/Antivirus/Status
    • -
  • DeviceStatus/Antispyware/SignatureStatus
    • -
  • DeviceStatus/Antispyware/Status
    • -
  • DeviceStatus/Firewall/Status
    • -
  • DeviceStatus/UAC/Status
    • -
  • DeviceStatus/Battery/Status
    • -
  • DeviceStatus/Battery/EstimatedChargeRemaining
    • -
  • DeviceStatus/Battery/EstimatedRuntime
    • -
AssignedAccess CSP

Added SyncML examples.

EnterpriseAssignedAccess CSP
    -
  • Added a new Folder table entry in the AssignedAccess/AssignedAccessXml description.
    • -
  • Updated the DDF and XSD file sections.
    • -
SecureAssessment CSP

New CSP for Windows 10, version 1607

DiagnosticLog CSP -

DiagnosticLog DDF

Added version 1.3 of the CSP with two new settings. Added the new 1.3 version of the DDF. Added the following new settings in Windows 10, version 1607.

-
    -
  • DeviceStateData
    • -
  • DeviceStateData/MdmConfiguration
    • -
Reboot CSP

New CSP for Windows 10, version 1607

CMPolicyEnterprise CSP

New CSP for Windows 10, version 1607

VPNv2 CSP

Added the following settings for Windows 10, version 1607

-
    -
  • ProfileName/RouteList/routeRowId/ExclusionRoute
    • -
  • ProfileName/DomainNameInformationList/dniRowId/AutoTrigger
    • -
  • ProfileName/DomainNameInformationList/dniRowId/Persistent
    • -
  • ProfileName/ProfileXML
    • -
  • ProfileName/DeviceCompliance/Enabled
    • -
  • ProfileName/DeviceCompliance/Sso
    • -
  • ProfileName/DeviceCompliance/Sso/Enabled
    • -
  • ProfileName/DeviceCompliance/Sso/IssuerHash
    • -
  • ProfileName/DeviceCompliance/Sso/Eku
    • -
  • ProfileName/NativeProfile/CryptographySuite
    • -
  • ProfileName/NativeProfile/CryptographySuite/AuthenticationTransformConstants
    • -
  • ProfileName/NativeProfile/CryptographySuite/CipherTransformConstants
    • -
  • ProfileName/NativeProfile/CryptographySuite/EncryptionMethod
    • -
  • ProfileName/NativeProfile/CryptographySuite/IntegrityCheckMethod
    • -
  • ProfileName/NativeProfile/CryptographySuite/DHGroup
    • -
  • ProfileName/NativeProfile/CryptographySuite/PfsGroup
    • -
  • ProfileName/NativeProfile/L2tpPsk
    • -
Win32AppInventory CSP -

Win32AppInventory DDF

New CSP for Windows 10, version 1607.

SharedPC CSP

New CSP for Windows 10, version 1607.

WindowsAdvancedThreatProtection CSP

New CSP for Windows 10, version 1607.

MDM Bridge WMI Provider

Added new classes for Windows 10, version 1607.

MDM enrollment of Windows devices

Topic renamed from "Enrollment UI".

-

Completely updated enrollment procedures and screenshots.

UnifiedWriteFilter CSP -

UnifiedWriteFilter DDF File

Added the following new setting for Windows 10, version 1607:

-
    -
  • NextSession/HORMEnabled
    • -
CertificateStore CSP -

CertificateStore DDF file

Added the following new settings in Windows 10, version 1607:

-
    -
  • My/WSTEP/Renew/LastRenewalAttemptTime
    • -
  • My/WSTEP/Renew/RenewNow
    • -

WindowsLicensing CSP

Added the following new node and settings in Windows 10, version 1607, but not documented:

-
    -
  • Subscriptions
    • -
  • Subscriptions/SubscriptionId
    • -
  • Subscriptions/SubscriptionId/Status
    • -
  • Subscriptions/SubscriptionId/Name
    • -
-

WiFi CSP

Deprecated the following node in Windows 10, version 1607:

-
    -
  • DisableInternetConnectivityChecks
    • -
-
+| New or updated article | Description | +|-----|-----| +| Sideloading of apps | Starting in Windows 10, version 1607, sideloading of apps is only allowed through [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md). Product keys (5x5) will no longer be supported to enable sideloading on Windows 10, version 1607 devices. | +| [NodeCache CSP](nodecache-csp.md) | The value of NodeCache root node starting in Windows 10, version 1607 is com.microsoft/1.0/MDM/NodeCache. | +| [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) | New CSP. | +| [Policy CSP](policy-configuration-service-provider.md) | Removed the following policies:
- DataProtection/AllowAzureRMSForEDP - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
- DataProtection/AllowUserDecryption - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
- DataProtection/EDPEnforcementLevel - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
- DataProtection/RequireProtectionUnderLockConfig - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
- DataProtection/RevokeOnUnenroll - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
- DataProtection/EnterpriseCloudResources - moved this policy to NetworkIsolation policy
- DataProtection/EnterpriseInternalProxyServers - moved this policy to NetworkIsolation policy
- DataProtection/EnterpriseIPRange - moved this policy to NetworkIsolation policy
- DataProtection/EnterpriseNetworkDomainNames - moved this policy to NetworkIsolation policy
- DataProtection/EnterpriseProxyServers - moved this policy to NetworkIsolation policy
- Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices - this policy has been deprecated.

Added the WiFi/AllowManualWiFiConfiguration and WiFi/AllowWiFi policies for Windows 10, version 1607:
- Windows 10 Pro
- Windows 10 Enterprise
- Windows 10 Education

Added the following new policies:
- AboveLock/AllowCortanaAboveLock
- ApplicationManagement/DisableStoreOriginatedApps
- Authentication/AllowSecondaryAuthenticationDevice
- Bluetooth/AllowPrepairing
- Browser/AllowExtensions
- Browser/PreventAccessToAboutFlagsInMicrosoftEdge
- Browser/ShowMessageWhenOpeningSitesInInternetExplorer
- DeliveryOptimization/DOAbsoluteMaxCacheSize
- DeliveryOptimization/DOMaxDownloadBandwidth
- DeliveryOptimization/DOMinBackgroundQoS
- DeliveryOptimization/DOModifyCacheDrive
- DeliveryOptimization/DOMonthlyUploadDataCap
- DeliveryOptimization/DOPercentageMaxDownloadBandwidth
- DeviceLock/EnforceLockScreenAndLogonImage
- DeviceLock/EnforceLockScreenProvider
- Defender/PUAProtection
- Experience/AllowThirdPartySuggestionsInWindowsSpotlight
- Experience/AllowWindowsSpotlight
- Experience/ConfigureWindowsSpotlightOnLockScreen
- Experience/DoNotShowFeedbackNotifications
- Licensing/AllowWindowsEntitlementActivation
- Licensing/DisallowKMSClientOnlineAVSValidation
- LockDown/AllowEdgeSwipe
- Maps/EnableOfflineMapsAutoUpdate
- Maps/AllowOfflineMapsDownloadOverMeteredConnection
- Messaging/AllowMessageSync
- NetworkIsolation/EnterpriseCloudResources
- NetworkIsolation/EnterpriseInternalProxyServers
- NetworkIsolation/EnterpriseIPRange
- NetworkIsolation/EnterpriseIPRangesAreAuthoritative
- NetworkIsolation/EnterpriseNetworkDomainNames
- NetworkIsolation/EnterpriseProxyServers
- NetworkIsolation/EnterpriseProxyServersAreAuthoritative
- NetworkIsolation/NeutralResources
- Notifications/DisallowNotificationMirroring
- Privacy/DisableAdvertisingId
- Privacy/LetAppsAccessAccountInfo
- Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps
- Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps
- Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
- Privacy/LetAppsAccessCalendar
- Privacy/LetAppsAccessCalendar_ForceAllowTheseApps
- Privacy/LetAppsAccessCalendar_ForceDenyTheseApps
- Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps
- Privacy/LetAppsAccessCallHistory
- Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps
- Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps
- Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps
- Privacy/LetAppsAccessCamera
- Privacy/LetAppsAccessCamera_ForceAllowTheseApps
- Privacy/LetAppsAccessCamera_ForceDenyTheseApps
- Privacy/LetAppsAccessCamera_UserInControlOfTheseApps
- Privacy/LetAppsAccessContacts
- Privacy/LetAppsAccessContacts_ForceAllowTheseApps
- Privacy/LetAppsAccessContacts_ForceDenyTheseApps
- Privacy/LetAppsAccessContacts_UserInControlOfTheseApps
- Privacy/LetAppsAccessEmail
- Privacy/LetAppsAccessEmail_ForceAllowTheseApps
- Privacy/LetAppsAccessEmail_ForceDenyTheseApps
- Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
- Privacy/LetAppsAccessLocation
- Privacy/LetAppsAccessLocation_ForceAllowTheseApps
- Privacy/LetAppsAccessLocation_ForceDenyTheseApps
- Privacy/LetAppsAccessLocation_UserInControlOfTheseApps
- Privacy/LetAppsAccessMessaging
- Privacy/LetAppsAccessMessaging_ForceAllowTheseApps
- Privacy/LetAppsAccessMessaging_ForceDenyTheseApps
- Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps
- Privacy/LetAppsAccessMicrophone
- Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps
- Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps
- Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps
- Privacy/LetAppsAccessMotion
- Privacy/LetAppsAccessMotion_ForceAllowTheseApps
- Privacy/LetAppsAccessMotion_ForceDenyTheseApps
- Privacy/LetAppsAccessMotion_UserInControlOfTheseApps
- Privacy/LetAppsAccessNotifications
- Privacy/LetAppsAccessNotifications_ForceAllowTheseApps
- Privacy/LetAppsAccessNotifications_ForceDenyTheseApps
- Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps
- Privacy/LetAppsAccessPhone
- Privacy/LetAppsAccessPhone_ForceAllowTheseApps
- Privacy/LetAppsAccessPhone_ForceDenyTheseApps
- Privacy/LetAppsAccessPhone_UserInControlOfTheseApps
- Privacy/LetAppsAccessRadios
- Privacy/LetAppsAccessRadios_ForceAllowTheseApps
- Privacy/LetAppsAccessRadios_ForceDenyTheseApps
- Privacy/LetAppsAccessRadios_UserInControlOfTheseApps
- Privacy/LetAppsAccessTrustedDevices
- Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps
- Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps
- Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
- Privacy/LetAppsSyncWithDevices
- Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps
- Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps
- Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps
- Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
- Settings/AllowEditDeviceName
- Speech/AllowSpeechModelUpdate
- System/TelemetryProxy
- Update/ActiveHoursStart
- Update/ActiveHoursEnd
- Update/AllowMUUpdateService
- Update/BranchReadinessLevel
- Update/DeferFeatureUpdatesPeriodInDays
- Update/DeferQualityUpdatesPeriodInDays
- Update/ExcludeWUDriversInQualityUpdate
- Update/PauseFeatureUpdates
- Update/PauseQualityUpdates
- Update/SetProxyBehaviorForUpdateDetection
- Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
- WindowsInkWorkspace/AllowWindowsInkWorkspace
- WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
- WirelessDisplay/AllowProjectionToPC
- WirelessDisplay/RequirePinForPairing

Updated the Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts description to remove outdated information.

Updated DeliveryOptimization/DODownloadMode to add new values.

Updated Experience/AllowCortana description to clarify what each supported value does.

Updated Security/AntiTheftMode description to clarify what each supported value does. | +| [DMClient CSP](dmclient-csp.md) | Added the following settings:
- ManagementServerAddressList
- AADDeviceID
- EnrollmentType
- HWDevID
- CommercialID

Removed the EnrollmentID setting. | +| [DeviceManageability CSP](devicemanageability-csp.md) | New CSP. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following new settings:
- DeviceStatus/TPM/SpecificationVersion
- DeviceStatus/OS/Edition
- DeviceStatus/Antivirus/SignatureStatus
- DeviceStatus/Antivirus/Status
- DeviceStatus/Antispyware/SignatureStatus
- DeviceStatus/Antispyware/Status
- DeviceStatus/Firewall/Status
- DeviceStatus/UAC/Status
- DeviceStatus/Battery/Status
- DeviceStatus/Battery/EstimatedChargeRemaining
- DeviceStatus/Battery/EstimatedRuntime | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added SyncML examples. | +| [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md) | Added a new Folder table entry in the AssignedAccess/AssignedAccessXml description.
Updated the DDF and XSD file sections. | +| [SecureAssessment CSP](secureassessment-csp.md) | New CSP. | +| [DiagnosticLog CSP](diagnosticlog-csp.md)
[DiagnosticLog DDF](diagnosticlog-ddf.md) | Added version 1.3 of the CSP with two new settings.

Added the new 1.3 version of the DDF.

Added the following new settings in Windows 10, version 1607
- DeviceStateData
- DeviceStateData/MdmConfiguration | +| [Reboot CSP](reboot-csp.md) | New CSP. | +| [CMPolicyEnterprise CSP](cmpolicyenterprise-csp.md) | New CSP. | +| [VPNv2 CSP](vpnv2-csp.md) | Added the following settings for Windows 10, version 1607:
- _ProfileName_/RouteList/routeRowId/ExclusionRoute
- _ProfileName_/DomainNameInformationList/_dniRowId_/AutoTrigger
- _ProfileName_/DomainNameInformationList/dniRowId/Persistent
- _ProfileName_/ProfileXML
- _ProfileName_/DeviceCompliance/Enabled
- _ProfileName_/DeviceCompliance/Sso
- _ProfileName_/DeviceCompliance/Sso/Enabled
- _ProfileName_/DeviceCompliance/Sso/IssuerHash
- _ProfileName_/DeviceCompliance/Sso/Eku
- _ProfileName_/NativeProfile/CryptographySuite
- _ProfileName_/NativeProfile/CryptographySuite/AuthenticationTransformConstants
- _ProfileName_/NativeProfile/CryptographySuite/CipherTransformConstants
- _ProfileName_/NativeProfile/CryptographySuite/EncryptionMethod
- _ProfileName_/NativeProfile/CryptographySuite/IntegrityCheckMethod
- _ProfileName_/NativeProfile/CryptographySuite/DHGroup
- _ProfileName_/NativeProfile/CryptographySuite/PfsGroup
- _ProfileName_/NativeProfile/L2tpPsk | +| [Win32AppInventory CSP](win32appinventory-csp.md) | New CSP. | +| [SharedPC CSP](sharedpc-csp.md) | New CSP. | +| [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) | New CSP. | +| [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224) | Added new classes for Windows 10, version 1607. | +| [MDM enrollment of Windows devices](mdm-enrollment-of-windows-devices.md) | Article renamed from "Enrollment UI".

Completely updated enrollment procedures and screenshots. | +| [UnifiedWriteFilter CSP](unifiedwritefilter-csp.md)
[UnifiedWriteFilter DDF File](unifiedwritefilter-ddf.md) | Added the following new setting for Windows 10, version 1607:
- NextSession/HORMEnabled | +| [CertificateStore CSP](certificatestore-csp.md)
[CertificateStore DDF file](certificatestore-ddf-file.md) | Added the following new settings in Windows 10, version 1607:
- My/WSTEP/Renew/LastRenewalAttemptTime
- My/WSTEP/Renew/RenewNow | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added the following new node and settings in Windows 10, version 1607, but not documented:
- Subscriptions
- Subscriptions/SubscriptionId
- Subscriptions/SubscriptionId/Status
- Subscriptions/SubscriptionId/Name | +| [WiFi CSP](wifi-csp.md) | Deprecated the following node in Windows 10, version 1607:
- DisableInternetConnectivityChecks | ## What’s new in MDM for Windows 10, version 1511 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ItemDescription

New configuration service providers added in Windows 10, version 1511

New and updated policies in Policy CSP

The following policies have been added to the Policy CSP:

-
    -
  • ApplicationManagement/AllowWindowsBridgeForAndroidAppsExecution
    • -
  • Bluetooth/ServicesAllowedList
    • -
  • DataProtection/AllowAzureRMSForEDP
    • -
  • DataProtection/RevokeOnUnenroll
    • -
  • DeviceLock/DevicePasswordExpiration
    • -
  • DeviceLock/DevicePasswordHistory
    • -
  • TextInput/AllowInputPanel
    • -
  • Update/PauseDeferrals
    • -
  • Update/RequireDeferUpdate
    • -
  • Update/RequireUpdateApproval
    • -
-

The following policies have been updated in the Policy CSP:

-
    -
  • System/AllowLocation
    • -
  • Update/RequireDeferUpgrade
    • -
-

The following policies have been deprecated in the Policy CSP:

-
    -
  • TextInput/AllowKoreanExtendedHanja
    • -
  • WiFi/AllowWiFiHotSpotReporting
    • -

Management tool for the Microsoft Store for Business

New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.

Custom header for generic alert

The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format:

-MDM-GenericAlert: <AlertType1><AlertType2> -

If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this OMA website.

Alert message for slow client response

When the MDM server sends a configuration request, sometimes it takes the client longer than the HTTP timeout to get all information together and then the session ends unexpectedly due to timeout. By default, the MDM client does not send an alert that a DM request is pending.

-

To work around the timeout, you can use EnableOmaDmKeepAliveMessage setting to keep the session alive by sending a heartbeat message back to the server. This is achieved by sending a SyncML message with a specific device alert element in the body until the client is able to respond back to the server with the requested information. For details, see EnableOmaDmKeepAliveMessage node in the DMClient CSP.

New node in DMClient CSP

Added a new node EnableOmaDmKeepAliveMessage to the DMClient CSP and updated the ManagementServerAddress to indicate that it can contain a list of URLs.

New nodes in EnterpriseModernAppManagement CSP

Added the following nodes to the EnterpriseModernAppManagement CSP:

-
    -
  • AppManagement/GetInventoryQuery
    • -
  • AppManagement/GetInventoryResults
    • -
  • .../PackageFamilyName/AppSettingPolicy/SettingValue
    • -
  • AppLicenses/StoreLicenses/LicenseID/LicenseCategory
    • -
  • AppLicenses/StoreLicenses/LicenseID/LicenseUsage
    • -
  • AppLicenses/StoreLicenses/LicenseID/RequesterID
    • -
  • AppLicenses/StoreLicenses/LicenseID/GetLicenseFromStore
    • -

New nodes in EnterpriseExt CSP

Added the following nodes to the EnterpriseExt CSP:

-
    -
  • DeviceCustomData (CustomID, CustomeString)
    • -
  • Brightness (Default, MaxAuto)
    • -
  • LedAlertNotification (State, Intensity, Period, DutyCycle, Cyclecount)
    • -

New node in EnterpriseExtFileSystem CSP

Added OemProfile node to EnterpriseExtFileSystem CSP.

New nodes in PassportForWork CSP

Added the following nodes to PassportForWork CSP:

-
    -
  • TenantId/Policies/PINComplexity/History
    • -
  • TenantId/Policies/PINComplexity/Expiration
    • -
  • TenantId/Policies/Remote/UseRemotePassport (only for ./Device/Vendor/MSFT)
    • -
  • Biometrics/UseBiometrics (only for ./Device/Vendor/MSFT)
    • -
  • Biometrics/FacialFeaturesUseEnhancedAntiSpoofing (only for ./Device/Vendor/MSFT)
    • -

Updated EnterpriseAssignedAccess CSP

Here are the changes to the EnterpriseAssignedAccess CSP:

-
    -
  • In AssignedAccessXML node, added new page settings and quick action settings.
    • -
  • In AssignedAccessXML node, added an example about how to pin applications in multiple app packages using the AUMID.
    • -
  • Updated the EnterpriseAssignedAccess XSD topic.
    • -

New nodes in the DevDetail CSP

Here are the changes to the DevDetail CSP:

-
    -
  • Added TotalStore and TotalRAM settings.
    • -
  • Added support for Replace command for the DeviceName setting.
    • -

Handling large objects

Added support for the client to handle uploading of large objects to the server.

+| New or updated article | Description | +|-----|-----| +| New configuration service providers added in Windows 10, version 1511 | - [AllJoynManagement CSP](alljoynmanagement-csp.md)
- [Maps CSP](maps-csp.md)
- [Reporting CSP](reporting-csp.md)
- [SurfaceHub CSP](surfacehub-csp.md)
- [WindowsSecurityAuditing CSP](windowssecurityauditing-csp.md) | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policy settings:
- ApplicationManagement/AllowWindowsBridgeForAndroidAppsExecution
- Bluetooth/ServicesAllowedList
- DataProtection/AllowAzureRMSForEDP
- DataProtection/RevokeOnUnenroll
- DeviceLock/DevicePasswordExpiration
- DeviceLock/DevicePasswordHistory
- TextInput/AllowInputPanel
- Update/PauseDeferrals
- Update/RequireDeferUpdate
- Update/RequireUpdateApproval

Updated the following policy settings:
- System/AllowLocation
- Update/RequireDeferUpgrade

Deprecated the following policy settings:
- TextInput/AllowKoreanExtendedHanja
- WiFi/AllowWiFiHotSpotReporting | +| Management tool for the Microsoft Store for Business | New articles. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates. | +| Custom header for generic alert | The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format: `MDM-GenericAlert: `

If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526). | +| Alert message for slow client response | When the MDM server sends a configuration request, sometimes it takes the client longer than the HTTP timeout to get all information together and then the session ends unexpectedly due to timeout. By default, the MDM client does not send an alert that a DM request is pending.

To work around the timeout, you can use EnableOmaDmKeepAliveMessage setting to keep the session alive by sending a heartbeat message back to the server. This is achieved by sending a SyncML message with a specific device alert element in the body until the client is able to respond back to the server with the requested information. For details, see EnableOmaDmKeepAliveMessage node in the [DMClient CSP](dmclient-csp.md). | +| [DMClient CSP](dmclient-csp.md) | Added a new node EnableOmaDmKeepAliveMessage to the [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) and updated the ManagementServerAddress to indicate that it can contain a list of URLs. | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following new nodes:
- AppManagement/GetInventoryQuery
- AppManagement/GetInventoryResults
- .../_PackageFamilyName_/AppSettingPolicy/_SettingValue_
- AppLicenses/StoreLicenses/_LicenseID_/LicenseCategory
- AppLicenses/StoreLicenses/_LicenseID_/LicenseUsage
- AppLicenses/StoreLicenses/_LicenseID_/RequesterID
- AppLicenses/StoreLicenses/_LicenseID_/GetLicenseFromStore | +| [EnterpriseExt CSP](enterpriseext-csp.md) | Added the following new nodes:
- DeviceCustomData (CustomID, CustomeString)
- Brightness (Default, MaxAuto)
- LedAlertNotification (State, Intensity, Period, DutyCycle, Cyclecount) | +| [EnterpriseExtFileSystem CSP](enterpriseextfilessystem-csp.md) | Added the OemProfile node. +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new nodes:
- TenantId/Policies/PINComplexity/History
- TenantId/Policies/PINComplexity/Expiration
- TenantId/Policies/Remote/UseRemotePassport (only for ./Device/Vendor/MSFT)
- Biometrics/UseBiometrics (only for ./Device/Vendor/MSFT)
- Biometrics/FacialFeaturesUseEnhancedAntiSpoofing (only for ./Device/Vendor/MSFT) | +| [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md) | The following updates are done to the [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md):
- In AssignedAccessXML node, added new page settings and quick action settings.
- In AssignedAccessXML node, added an example about how to pin applications in multiple app packages using the AUMID.
- Updated the [EnterpriseAssignedAccess XSD](enterpriseassignedaccess-xsd.md) article. | +| [DevDetail CSP](devdetail-csp.md) | The following updates are done to [DevDetail CSP](devdetail-csp.md):
- Added TotalStore and TotalRAM settings.
- Added support for Replace command for the DeviceName setting. | +| Handling large objects | Added support for the client to handle uploading of large objects to the server. | ## Breaking changes and known issues @@ -1815,8 +330,7 @@ The following list describes the prerequisites for a certificate to be used with The following XML sample explains the properties for the EAP TLS XML including certificate filtering. > [!NOTE] ->For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. - +> For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. ```xml @@ -1918,13 +432,11 @@ The following XML sample explains the properties for the EAP TLS XML including c ``` > [!NOTE] ->The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** - - +> The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** Alternatively you can use the following procedure to create an EAP Configuration XML. -1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) topic. +1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) article. 2. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop down (this selects EAP TLS.) ![vpn selfhost properties window](images/certfiltering1.png) @@ -1941,7 +453,7 @@ Alternatively you can use the following procedure to create an EAP Configuration ![configure certificate selection window](images/certfiltering3.png) 6. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. 7. Close the rasphone dialog box. -8. Continue following the procedure in the [EAP configuration](eap-configuration.md) topic from Step 9 to get an EAP TLS profile with appropriate filtering. +8. Continue following the procedure in the [EAP configuration](eap-configuration.md) article from Step 9 to get an EAP TLS profile with appropriate filtering. > [!NOTE] > You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) Settings for Network Access](https://technet.microsoft.com/library/hh945104.aspx). @@ -1970,7 +482,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Frequently Asked Questions -### **Can there be more than 1 MDM server to enroll and manage devices in Windows 10?** +### **Can there be more than one MDM server to enroll and manage devices in Windows 10?** No. Only one MDM is allowed. ### **How do I set the maximum number of Azure Active Directory joined devices per user?** @@ -1991,1059 +503,6 @@ What is dmwappushsvc? | It is a Windows service that ships in Windows 10 operati What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. | How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | -## Change history in MDM documentation +## Change history for MDM documentation -### September 2020 -|New or updated topic | Description| -|--- | ---| -|[NetworkQoSPolicy CSP](networkqospolicy-csp.md)|Updated support information of the NetworkQoSPolicy CSP.| -|[Policy CSP - LocalPoliciesSecurityOptions](policy-csp-localpoliciessecurityoptions.md)|Removed the following unsupported LocalPoliciesSecurityOptions policy settings from the documentation:
- RecoveryConsole_AllowAutomaticAdministrativeLogon
- DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
- DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
- DomainMember_DisableMachineAccountPasswordChanges
- SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
| - -### August 2020 -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - System](policy-csp-system.md)|Removed the following policy settings:
- System/AllowDesktopAnalyticsProcessing
- System/AllowMicrosoftManagedDesktopProcessing
- System/AllowUpdateComplianceProcessing
- System/AllowWUfBCloudProcessing
| - -### July 2020 -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - System](policy-csp-system.md)|Added the following new policy settings:
- System/AllowDesktopAnalyticsProcessing
- System/AllowMicrosoftManagedDesktopProcessing
- System/AllowUpdateComplianceProcessing
- System/AllowWUfBCloudProcessing


Updated the following policy setting:
- System/AllowCommercialDataPipeline
| - -### June 2020 -|New or updated topic | Description| -|--- | ---| -|[BitLocker CSP](bitlocker-csp.md)|Added SKU support table for **AllowStandardUserEncryption**.| -|[Policy CSP - NetworkIsolation](policy-csp-networkisolation.md)|Updated the description from Boolean to Integer for the following policy settings:
EnterpriseIPRangesAreAuthoritative, EnterpriseProxyServersAreAuthoritative.| - -### May 2020 -|New or updated topic | Description| -|--- | ---| -|[BitLocker CSP](bitlocker-csp.md)|Added the bitmask table for the Status/DeviceEncryptionStatus node.| -|[Policy CSP - RestrictedGroups](policy-csp-restrictedgroups.md)| Updated the topic with additional details. Added policy timeline table. - - -### February 2020 -|New or updated topic | Description| -|--- | ---| -|[CertificateStore CSP](certificatestore-csp.md)
[ClientCertificateInstall CSP](clientcertificateinstall-csp.md)|Added details about SubjectName value.| - -### January 2020 -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - Defender](policy-csp-defender.md)|Added descriptions for supported actions for Defender/ThreatSeverityDefaultAction.| - - -### November 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added option 5 in the supported values list for DeliveryOptimization/DOGroupIdSource.| -|[DiagnosticLog CSP](diagnosticlog-csp.md)|Added substantial updates to this CSP doc.| - -### October 2019 - -|New or updated topic | Description| -|--- | ---| -|[BitLocker CSP](bitlocker-csp.md)|Added the following new nodes:
ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID.| -|[Defender CSP](defender-csp.md)|Added the following new nodes:
Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.| - -### September 2019 - -|New or updated topic | Description| -|--- | ---| -|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following new node:
IsStub.| -|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| -|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policies:
DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| - -### August 2019 - -|New or updated topic | Description| -|--- | ---| -|[DiagnosticLog CSP](diagnosticlog-csp.md)
[DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.| -|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| - -### July 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP](policy-configuration-service-provider.md)|Added the following list:
Policies supported by HoloLens 2| -|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.| -|[PassportForWork CSP](passportforwork-csp.md)|Added the following new nodes in Windows 10, version 1903:
SecurityKey, SecurityKey/UseSecurityKeyForSignin| -|[Policy CSP - Privacy](policy-csp-privacy.md)|Added the following new policies:
LetAppsActivateWithVoice, LetAppsActivateWithVoiceAboveLock| -|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:
Create a custom configuration service provider
Design a custom configuration service provider
IConfigServiceProvider2
IConfigServiceProvider2::ConfigManagerNotification
IConfigServiceProvider2::GetNode
ICSPNode
ICSPNode::Add
ICSPNode::Clear
ICSPNode::Copy
ICSPNode::DeleteChild
ICSPNode::DeleteProperty
ICSPNode::Execute
ICSPNode::GetChildNodeNames
ICSPNode::GetProperty
ICSPNode::GetPropertyIdentifiers
ICSPNode::GetValue
ICSPNode::Move
ICSPNode::SetProperty
ICSPNode::SetValue
ICSPNodeTransactioning
ICSPValidate
Samples for writing a custom configuration service provider.| - - -### June 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md)|Added the following new policies:
AllowDeviceHealthMonitoring, ConfigDeviceHealthMonitoringScope, ConfigDeviceHealthMonitoringUploadDestination.| -|[Policy CSP - TimeLanguageSettings](policy-csp-timelanguagesettings.md)|Added the following new policy:
ConfigureTimeZone.| - - -### May 2019 - -|New or updated topic | Description| -|--- | ---| -|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes:
DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus.| -|[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| -|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies:
DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground.

Updated description of the following policies:
DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer.| -|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy:
ShowLockOnUserTile.| -|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies:
AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage.| -|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies:
EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn.| -|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy:
AllowFindMyFiles.| -|[Policy CSP - ServiceControlManager](policy-csp-servicecontrolmanager.md)|Added the following new policy:
SvchostProcessMitigation.| -|[Policy CSP - System](policy-csp-system.md)|Added the following new policies:
AllowCommercialDataPipeline, TurnOffFileHistory.| -|[Policy CSP - Troubleshooting](policy-csp-troubleshooting.md)|Added the following new policy:
AllowRecommendations.| -|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies:
AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot.| -|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies:
AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation.

Removed the following policy:
SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart. This policy is replaced by AllowAutomaticRestartSignOn.| - -### April 2019 - -| New or updated topic | Description | -|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md) | Added the following warning at the end of the Overview section:
Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. | -| [Policy CSP - UserRights](policy-csp-userrights.md) | Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields. | - -### March 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies:
AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold.

Updated description of ConfigStorageSenseDownloadsCleanupThreshold.| - - -### February 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP](policy-configuration-service-provider.md)|Updated supported policies for Holographic.| - -### January 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - Storage](policy-csp-storage.md)|Added the following new policies: AllowStorageSenseGlobal, ConfigStorageSenseGlobalCadence, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseRecycleBinCleanupThreshold, ConfigStorageSenseDownloadsCleanupThreshold, and ConfigStorageSenseCloudContentCleanupThreshold.| -|[SharedPC CSP](sharedpc-csp.md)|Updated values and supported operations.| -|[Mobile device management](index.md)|Updated information about MDM Security Baseline.| - -### December 2018 - -|New or updated topic | Description| -|--- | ---| -|[BitLocker CSP](bitlocker-csp.md)|Updated AllowWarningForOtherDiskEncryption policy description to describe silent and non-silent encryption scenarios, as well as where and how the recovery key is backed up for each scenario.| - -### September 2018 - -|New or updated topic | Description| -|--- | ---| -|[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT).| -|[Policy CSP - DeviceGuard](policy-csp-deviceguard.md) | Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.| - -### August 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
BitLocker CSP

Added support for Windows 10 Pro starting in the version 1809.

-
Office CSP

Added FinalStatus setting in Windows 10, version 1809.

-
RemoteWipe CSP

Added new settings in Windows 10, version 1809.

-
TenantLockdown CSP

Added new CSP in Windows 10, version 1809.

-
WindowsDefenderApplicationGuard CSP

Added new settings in Windows 10, version 1809.

-
Policy DDF file

Posted an updated version of the Policy DDF for Windows 10, version 1809.

-
Policy CSP

Added the following new policies in Windows 10, version 1809:

-
    -
  • Browser/AllowFullScreenMode
    • -
  • Browser/AllowPrelaunch
    • -
  • Browser/AllowPrinting
    • -
  • Browser/AllowSavingHistory
    • -
  • Browser/AllowSideloadingOfExtensions
    • -
  • Browser/AllowTabPreloading
    • -
  • Browser/AllowWebContentOnNewTabPage
    • -
  • Browser/ConfigureFavoritesBar
    • -
  • Browser/ConfigureHomeButton
    • -
  • Browser/ConfigureKioskMode
    • -
  • Browser/ConfigureKioskResetAfterIdleTimeout
    • -
  • Browser/ConfigureOpenMicrosoftEdgeWith
    • -
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
    • -
  • Browser/PreventCertErrorOverrides
    • -
  • Browser/SetHomeButtonURL
    • -
  • Browser/SetNewTabPageURL
    • -
  • Browser/UnlockHomeButton
    • -
  • Experience/DoNotSyncBrowserSettings
    • -
  • Experience/PreventUsersFromTurningOnBrowserSyncing
    • -
  • Kerberos/UPNNameHints
    • -
  • Privacy/AllowCrossDeviceClipboard
    • -
  • Privacy/DisablePrivacyExperience
    • -
  • Privacy/UploadUserActivities
    • -
  • System/AllowDeviceNameInDiagnosticData
    • -
  • System/ConfigureMicrosoft365UploadEndpoint
    • -
  • System/DisableDeviceDelete
    • -
  • System/DisableDiagnosticDataViewer
    • -
  • Storage/RemovableDiskDenyWriteAccess
    • -
  • Update/UpdateNotificationLevel
    • -
-

Start/DisableContextMenus - added in Windows 10, version 1803.

-

RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.

-
- -### July 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
AssignedAccess CSP

Added the following note:

-
    -
  • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
    • -
-
PassportForWork CSP

Added new settings in Windows 10, version 1809.

-
EnterpriseModernAppManagement CSP

Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

-
Win32CompatibilityAppraiser CSP

Added new configuration service provider in Windows 10, version 1809.

-
WindowsLicensing CSP

Added S mode settings and SyncML examples in Windows 10, version 1809.

-
SUPL CSP

Added 3 new certificate nodes in Windows 10, version 1809.

-
Defender CSP

Added a new node Health/ProductStatus in Windows 10, version 1809.

-
BitLocker CSP

Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

-
DevDetail CSP

Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

-
Policy CSP

Added the following new policies in Windows 10, version 1809:

-
    -
  • ApplicationManagement/LaunchAppAfterLogOn
    • -
  • ApplicationManagement/ScheduleForceRestartForUpdateFailures
    • -
  • Authentication/EnableFastFirstSignIn (Preview mode only)
    • -
  • Authentication/EnableWebSignIn (Preview mode only)
    • -
  • Authentication/PreferredAadTenantDomainName
    • -
  • Defender/CheckForSignaturesBeforeRunningScan
    • -
  • Defender/DisableCatchupFullScan
    • -
  • Defender/DisableCatchupQuickScan
    • -
  • Defender/EnableLowCPUPriority
    • -
  • Defender/SignatureUpdateFallbackOrder
    • -
  • Defender/SignatureUpdateFileSharesSources
    • -
  • DeviceGuard/ConfigureSystemGuardLaunch
    • -
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
    • -
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    • -
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • -
  • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
    • -
  • DmaGuard/DeviceEnumerationPolicy
    • -
  • Experience/AllowClipboardHistory
    • -
  • Security/RecoveryEnvironmentAuthentication
    • -
  • TaskManager/AllowEndTask
    • -
  • WindowsDefenderSecurityCenter/DisableClearTpmButton
    • -
  • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
    • -
  • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
    • -
  • WindowsLogon/DontDisplayNetworkSelectionUI
    • -
-

Recent changes:

-
    -
  • DataUsage/SetCost3G - deprecated in Windows 10, version 1809.
    • -
-
- -### June 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Wifi CSP

Added a new node WifiCost in Windows 10, version 1809.

-
Diagnose MDM failures in Windows 10

Recent changes:

-
    -
  • Added procedure for collecting logs remotely from Windows 10 Holographic.
    • -
  • Added procedure for downloading the MDM Diagnostic Information log.
    • -
-
Bitlocker CSP

Added new node AllowStandardUserEncryption in Windows 10, version 1809.

-
Policy CSP

Recent changes:

-
    -
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
    • -
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
    • -
  • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
    • -
  • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
    • -
  • Security/RequireDeviceEncryption is supported in the Home SKU.
    • -
  • Start/StartLayout - added a table of SKU support information.
    • -
  • Start/ImportEdgeAssets - added a table of SKU support information.
    • -
-

Added the following new policies in Windows 10, version 1809:

-
    -
  • Update/EngagedRestartDeadlineForFeatureUpdates
    • -
  • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
    • -
  • Update/EngagedRestartTransitionScheduleForFeatureUpdates
    • -
  • Update/SetDisablePauseUXAccess
    • -
  • Update/SetDisableUXWUAccess
    • -
-
WiredNetwork CSPNew CSP added in Windows 10, version 1809. -
- - -### May 2018 - - ---- - - - - - - - - - - - -
New or updated topicDescription
Policy DDF file

Updated the DDF files in the Windows 10 version 1703 and 1709.

- -
- -### April 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
WindowsDefenderApplicationGuard CSP

Added the following node in Windows 10, version 1803:

-
    -
  • Settings/AllowVirtualGPU
    • -
  • Settings/SaveFilesToHost
    • -
-
NetworkProxy CSP

Added the following node in Windows 10, version 1803:

-
    -
  • ProxySettingsPerUser
    • -
-
Accounts CSP

Added a new CSP in Windows 10, version 1803.

-
MDM Migration Analysis Too (MMAT)

Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

-
CSP DDF files download

Added the DDF download of Windows 10, version 1803 configuration service providers.

-
Policy CSP

Added the following new policies for Windows 10, version 1803:

-
    -
  • Bluetooth/AllowPromptedProximalConnections
    • -
  • KioskBrowser/EnableEndSessionButton
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    • -
-
- -### March 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
eUICCs CSP

Added the following node in Windows 10, version 1803:

-
    -
  • IsEnabled
    • -
-
DeviceStatus CSP

Added the following node in Windows 10, version 1803:

-
    -
  • OS/Mode
    • -
-
Understanding ADMX-backed policies

Added the following videos:

- -
AccountManagement CSP

Added a new CSP in Windows 10, version 1803.

-
RootCATrustedCertificates CSP

Added the following node in Windows 10, version 1803:

-
    -
  • UntrustedCertificates
    • -
-
Policy CSP

Added the following new policies for Windows 10, version 1803:

-
    -
  • ApplicationDefaults/EnableAppUriHandlers
    • -
  • ApplicationManagement/MSIAllowUserControlOverInstall
    • -
  • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
    • -
  • Connectivity/AllowPhonePCLinking
    • -
  • Notifications/DisallowCloudNotification
    • -
  • Notifications/DisallowTileNotification
    • -
  • RestrictedGroups/ConfigureGroupMembership
    • -
-

The following existing policies were updated:

-
    -
  • Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
    • -
  • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
    • -
  • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
    • -
-

Added a new section:

- -
Policy CSP - Bluetooth

Added new section ServicesAllowedList usage guide.

-
MultiSIM CSP

Added SyncML examples and updated the settings descriptions.

-
RemoteWipe CSP

Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

-
- -### February 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies for Windows 10, version 1803:

-
    -
  • Display/DisablePerProcessDpiForApps
    • -
  • Display/EnablePerProcessDpi
    • -
  • Display/EnablePerProcessDpiForApps
    • -
  • Experience/AllowWindowsSpotlightOnSettings
    • -
  • TextInput/ForceTouchKeyboardDockedState
    • -
  • TextInput/TouchKeyboardDictationButtonAvailability
    • -
  • TextInput/TouchKeyboardEmojiButtonAvailability
    • -
  • TextInput/TouchKeyboardFullModeAvailability
    • -
  • TextInput/TouchKeyboardHandwritingModeAvailability
    • -
  • TextInput/TouchKeyboardNarrowModeAvailability
    • -
  • TextInput/TouchKeyboardSplitModeAvailability
    • -
  • TextInput/TouchKeyboardWideModeAvailability
    • -
      -
VPNv2 ProfileXML XSD

Updated the XSD and Plug-in profile example for VPNv2 CSP.

-
AssignedAccess CSP

Added the following nodes in Windows 10, version 1803:

-
    -
  • Status
    • -
  • ShellLauncher
    • -
  • StatusConfiguration
    • -
-

Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

-
MultiSIM CSP

Added a new CSP in Windows 10, version 1803.

-
EnterpriseModernAppManagement CSP

Added the following node in Windows 10, version 1803:

-
    -
  • MaintainProcessorArchitectureOnUpdate
    • -
-
- -### January 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies for Windows 10, version 1803:

-
    -
  • Browser/AllowConfigurationUpdateForBooksLibrary
    • -
  • Browser/AlwaysEnableBooksLibrary
    • -
  • Browser/EnableExtendedBooksTelemetry
    • -
  • Browser/UseSharedFolderForBooks
    • -
  • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    • -
  • DeliveryOptimization/DODelayForegroundDownloadFromHttp
    • -
  • DeliveryOptimization/DOGroupIdSource
    • -
  • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
    • -
  • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
    • -
  • DeliveryOptimization/DORestrictPeerSelectionBy
    • -
  • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
    • -
  • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
    • -
  • KioskBrowser/BlockedUrlExceptions
    • -
  • KioskBrowser/BlockedUrls
    • -
  • KioskBrowser/DefaultURL
    • -
  • KioskBrowser/EnableHomeButton
    • -
  • KioskBrowser/EnableNavigationButtons
    • -
  • KioskBrowser/RestartOnIdleTime
    • -
  • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
    • -
  • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    • -
  • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    • -
  • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    • -
  • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
    • -
  • RestrictedGroups/ConfigureGroupMembership
    • -
  • Search/AllowCortanaInAAD
    • -
  • Search/DoNotUseWebResults
    • -
  • Security/ConfigureWindowsPasswords
    • -
  • System/FeedbackHubAlwaysSaveDiagnosticsLocally
    • -
  • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
    • -
  • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
    • -
  • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
    • -
  • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
    • -
  • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
    • -
  • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
    • -
  • TaskScheduler/EnableXboxGameSaveTask
    • -
  • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
    • -
  • Update/ConfigureFeatureUpdateUninstallPeriod
    • -
  • UserRights/AccessCredentialManagerAsTrustedCaller
    • -
  • UserRights/AccessFromNetwork
    • -
  • UserRights/ActAsPartOfTheOperatingSystem
    • -
  • UserRights/AllowLocalLogOn
    • -
  • UserRights/BackupFilesAndDirectories
    • -
  • UserRights/ChangeSystemTime
    • -
  • UserRights/CreateGlobalObjects
    • -
  • UserRights/CreatePageFile
    • -
  • UserRights/CreatePermanentSharedObjects
    • -
  • UserRights/CreateSymbolicLinks
    • -
  • UserRights/CreateToken
    • -
  • UserRights/DebugPrograms
    • -
  • UserRights/DenyAccessFromNetwork
    • -
  • UserRights/DenyLocalLogOn
    • -
  • UserRights/DenyRemoteDesktopServicesLogOn
    • -
  • UserRights/EnableDelegation
    • -
  • UserRights/GenerateSecurityAudits
    • -
  • UserRights/ImpersonateClient
    • -
  • UserRights/IncreaseSchedulingPriority
    • -
  • UserRights/LoadUnloadDeviceDrivers
    • -
  • UserRights/LockMemory
    • -
  • UserRights/ManageAuditingAndSecurityLog
    • -
  • UserRights/ManageVolume
    • -
  • UserRights/ModifyFirmwareEnvironment
    • -
  • UserRights/ModifyObjectLabel
    • -
  • UserRights/ProfileSingleProcess
    • -
  • UserRights/RemoteShutdown
    • -
  • UserRights/RestoreFilesAndDirectories
    • -
  • UserRights/TakeOwnership
    • -
  • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
    • -
  • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
    • -
  • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
    • -
  • WindowsDefenderSecurityCenter/HideSecureBoot
    • -
  • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
    • -
-

Added the following policies the were added in Windows 10, version 1709

-
    -
  • DeviceLock/MinimumPasswordAge
    • -
  • Settings/AllowOnlineTips
    • -
  • System/DisableEnterpriseAuthProxy
    • -
-

Security/RequireDeviceEncryption - updated to show it is supported in desktop.

-
BitLocker CSP

Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

-
EnterpriseModernAppManagement CSP

Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

-
DMClient CSP

Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

-
    -
  • AADSendDeviceToken
    • -
  • BlockInStatusPage
    • -
  • AllowCollectLogsButton
    • -
  • CustomErrorText
    • -
  • SkipDeviceStatusPage
    • -
  • SkipUserStatusPage
    • -
-
Defender CSP

Added new node (OfflineScan) in Windows 10, version 1803.

-
UEFI CSP

Added a new CSP in Windows 10, version 1803.

-
Update CSP

Added the following nodes in Windows 10, version 1803:

-
    -
  • Rollback
    • -
  • Rollback/FeatureUpdate
    • -
  • Rollback/QualityUpdateStatus
    • -
  • Rollback/FeatureUpdateStatus
    • -
-
- -### December 2017 - - ---- - - - - - - - - - - - -
New or updated topicDescription
Configuration service provider reference

Added new section CSP DDF files download

-
- -### November 2017 - - ---- - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following policies for Windows 10, version 1709:

-
    -
  • Authentication/AllowFidoDeviceSignon
    • -
  • Cellular/LetAppsAccessCellularData
    • -
  • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
    • -
  • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
    • -
  • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
    • -
  • Start/HidePeopleBar
    • -
  • Storage/EnhancedStorageDevices
    • -
  • Update/ManagePreviewBuilds
    • -
  • WirelessDisplay/AllowMdnsAdvertisement
    • -
  • WirelessDisplay/AllowMdnsDiscovery
    • -
-

Added missing policies from previous releases:

-
    -
  • Connectivity/DisallowNetworkConnectivityActiveTest
    • -
  • Search/AllowWindowsIndexer
    • -
-
- -### October 2017 - - ---- - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy DDF file

Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

-
Policy CSP

Updated the following policies:

-
    -
  • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
    • -
  • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
    • -
-
eUICCs CSP

Added new CSP in Windows 10, version 1709.

-
AssignedAccess CSP

Added SyncML examples for the new Configuration node.

-
DMClient CSP

Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

-
- - -### September 2017 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies for Windows 10, version 1709:

-
    -
  • Authentication/AllowAadPasswordReset
    • -
  • Handwriting/PanelDefaultModeDocked
    • -
  • Search/AllowCloudSearch
    • -
  • System/LimitEnhancedDiagnosticDataWindowsAnalytics
    • -
-

Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

-
AssignedAccess CSP

Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

-
Microsoft Store for Business and Microsoft Store

Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

-
The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

-
    -
  • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
    • -
  • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
    • -
  • DomainName - fully qualified domain name if the device is domain-joined.
    • -
-

For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

-
EnterpriseAPN CSP

Added a SyncML example.

-
VPNv2 CSP

Added RegisterDNS setting in Windows 10, version 1709.

-
Enroll a Windows 10 device automatically using Group Policy

Added new topic to introduce a new Group Policy for automatic MDM enrollment.

-
MDM enrollment of Windows-based devices

New features in the Settings app:

-
    -
  • User sees installation progress of critical policies during MDM enrollment.
    • -
  • User knows what policies, profiles, apps MDM has configured
    • -
  • IT helpdesk can get detailed MDM diagnostic information using client tools
    • -
-

For details, see Managing connections and Collecting diagnostic logs

-
- -### August 2017 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Enable ADMX-backed policies in MDM

Added new step-by-step guide to enable ADMX-backed policies.

-
Mobile device enrollment

Added the following statement:

-
    -
  • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
    • -
-
CM_CellularEntries CSP

Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

-
EnterpriseDataProtection CSP

Updated the Settings/EDPEnforcementLevel values to the following:

-
    -
  • 0 (default) – Off / No protection (decrypts previously protected data).
    • -
  • 1 – Silent mode (encrypt and audit only).
    • -
  • 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
    • -
  • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
    • -
-
AppLocker CSP

Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Allow list examples.

-
DeviceManageability CSP

Added the following settings in Windows 10, version 1709:

-
    -
  • Provider/ProviderID/ConfigInfo
    • -
  • Provider/ProviderID/EnrollmentInfo
    • -
-
Office CSP

Added the following setting in Windows 10, version 1709:

-
    -
  • Installation/CurrentStatus
    • -
-
BitLocker CSPAdded information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. -
Firewall CSPUpdated the CSP and DDF topics. Here are the changes: -
    -
  • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
    • -
  • Changed some data types from integer to bool.
    • -
  • Updated the list of supported operations for some settings.
    • -
  • Added default values.
    • -
-
Policy DDF fileAdded another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies: -
    -
  • Browser/AllowMicrosoftCompatibilityList
    • -
  • Update/DisableDualScan
    • -
  • Update/FillEmptyContentUrls
    • -
-
Policy CSP

Added the following new policies for Windows 10, version 1709:

-
    -
  • Browser/ProvisionFavorites
    • -
  • Browser/LockdownFavorites
    • -
  • ExploitGuard/ExploitProtectionSettings
    • -
  • Games/AllowAdvancedGamingServices
    • -
  • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
    • -
  • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
    • -
  • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
    • -
  • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    • -
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
    • -
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
    • -
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    • -
  • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
    • -
  • Privacy/EnableActivityFeed
    • -
  • Privacy/PublishUserActivities
    • -
  • Update/DisableDualScan
    • -
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
    • -
-

Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

-

Changed the names of the following policies:

-
    -
  • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
    • -
  • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
    • -
  • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
    • -
-

Added links to the additional ADMX-backed BitLocker policies.

-

There were issues reported with the previous release of the following policies. These issues were fixed in Window 10, version 1709:

-
    -
  • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
    • -
  • Start/HideAppList
    • -
-
+To know what's changed in MDM documentation, see [Change history for MDM documentation](change-history-for-mdm-documentation.md). \ No newline at end of file diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index ec0aca468f..11bb156559 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4006,7 +4006,13 @@ The following diagram shows the Policy configuration service provider in tree fo +### LocalUsersAndGroups policies +

+
+ LocalUsersAndGroups/Configure +
+
### LockDown policies diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md index a192f2c35f..38ef9aa0b9 100644 --- a/windows/client-management/mdm/policy-csp-localusersandgroups.md +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -75,12 +75,12 @@ manager: dansimp -Available in Windows 10, version 2010. This policy setting allows IT admins to add, remove, or replace members of local groups on a managed device. +Available in Windows 10, version 20H2. This policy setting allows IT admins to add, remove, or replace members of local groups on a managed device. > [!NOTE] > The [RestrictedGroups/ConfigureGroupMembership](./policy-csp-restrictedgroups.md#restrictedgroups-configuregroupmembership) policy setting also allows you to configure members (users or AAD groups) to a Windows 10 local group. However, it allows only for a full replace of the existing groups with the new members and does not allow selective add or remove. > -> Starting from Windows 10, version 2010, it is recommended to use the LocalUsersandGroups policy instead of the RestrictedGroups policy. Applying both the policies to the same device is unsupported and may yield unpredictable results. +> Starting from Windows 10, version 20H2, it is recommended to use the LocalUsersandGroups policy instead of the RestrictedGroups policy. Applying both the policies to the same device is unsupported and may yield unpredictable results. Here's an example of the policy definition XML for group configuration: @@ -227,6 +227,6 @@ To troubleshoot Name/SID lookup APIs: Footnotes: -- 9 - Available in Windows 10, version 2010. +- 9 - Available in Windows 10, version 20H2. diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index 79fa5b1264..9b9c05d03d 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -308,7 +308,7 @@ The following list shows the supported values: Footnotes: -- 9 - Available in the next major release of Windows 10. +- 9 - Available in Windows 10, version 20H2. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index b840169332..4b9506c5c9 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -15,7 +15,7 @@ manager: dansimp # Policy CSP - RestrictedGroups > [!IMPORTANT] -> Starting from Windows 10, version 2010, it is recommended to use the [LocalUsersandGroups](policy-csp-localusersandgroups.md) policy instead of the RestrictedGroups policy to configure members (users or AAD groups) to a Windows 10 local group. Applying both the policies to the same device is unsupported and may yield unpredictable results. +> Starting from Windows 10, version 20H2, it is recommended to use the [LocalUsersandGroups](policy-csp-localusersandgroups.md) policy instead of the RestrictedGroups policy to configure members (users or AAD groups) to a Windows 10 local group. Applying both the policies to the same device is unsupported and may yield unpredictable results.
diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md index a00be7e6d7..898af9ddd1 100644 --- a/windows/client-management/mdm/policy-csp-windowssandbox.md +++ b/windows/client-management/mdm/policy-csp-windowssandbox.md @@ -556,6 +556,6 @@ Footnotes: - 6 - Available in Windows 10, version 1903. - 7 - Available in Windows 10, version 1909. - 8 - Available in Windows 10, version 2004. -- 9 - Available in Windows 10, version 2010. +- 9 - Available in Windows 10, version 20H2. diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index e34b68d47e..18d1d96008 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -26,6 +26,7 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | +| Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | | Companion Device Framework | The [Companion Device Framework](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 | | Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | | Dynamic Disks | The [Dynamic Disks](https://docs.microsoft.com/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](https://docs.microsoft.com/windows-server/storage/storage-spaces/overview) in a future release.| 2004 | @@ -37,12 +38,13 @@ The features described below are no longer being actively developed, and might b | Wi-Fi WEP and TKIP | Since the 1903 release, a warning message has appeared when connecting to Wi-Fi networks secured with WEP or TKIP (which are not as secure as those using WPA2 or WPA3). In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | 1903 | | Windows To Go | Windows To Go is no longer being developed.

The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.| 1903 | | Print 3D app | Going forward, 3D Builder is the recommended 3D printing app. To 3D print objects on new Windows devices, customers must first install 3D Builder from the Store.| 1903 | -|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because third party partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| 1809 | +|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because non-Microsoft partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| 1809 | |OneSync service|The OneSync service synchronizes data for the Mail, Calendar, and People apps. We've added a sync engine to the Outlook app that provides the same synchronization.| 1809 | |Snipping Tool|The Snipping Tool is an application included in Windows 10 that is used to capture screenshots, either the full screen or a smaller, custom "snip" of the screen. In Windows 10, version 1809, we're [introducing a new universal app, Snip & Sketch](https://blogs.windows.com/windowsexperience/2018/05/03/announcing-windows-10-insider-preview-build-17661/#8xbvP8vMO0lF20AM.97), that provides the same screen snipping abilities, as well as additional features. You can launch Snip & Sketch directly and start a snip from there, or just press WIN + Shift + S. Snip & Sketch can also be launched from the “Screen snip” button in the Action Center. We're no longer developing the Snipping Tool as a separate app but are instead consolidating its functionality into Snip & Sketch.| 1809 | |[Software Restriction Policies](https://docs.microsoft.com/windows-server/identity/software-restriction-policies/software-restriction-policies) in Group Policy|Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control) to control which apps users can access and what code can run in the kernel.| 1803 | |[Offline symbol packages](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs)|We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](https://blogs.msdn.microsoft.com/windbg/2017/10/18/update-on-microsofts-symbol-server/). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access.| 1803 | |Windows Help Viewer (WinHlp32.exe)|All Windows help information is [available online](https://support.microsoft.com/products/windows?os=windows-10). The Windows Help Viewer is no longer supported in Windows 10. If for any reason you see an error message about "help not supported," possibly when using a non-Microsoft application, read [this support article](https://support.microsoft.com/help/917607/error-opening-help-in-windows-based-programs-feature-not-included-or-h) for additional information and any next steps.| 1803 | +|MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. For more information, see [Developer guide for creating service metadata](https://docs.microsoft.com/windows-hardware/drivers/mobilebroadband/developer-guide-for-creating-service-metadata) | 1803 | |Contacts feature in File Explorer|We're no longer developing the Contacts feature or the corresponding [Windows Contacts API](https://msdn.microsoft.com/library/ff800913.aspx). Instead, you can use the People app in Windows 10 to maintain your contacts.| 1803 | |Phone Companion|Use the **Phone** page in the Settings app. In Windows 10, version 1709, we added the new **Phone** page to help you sync your mobile phone with your PC. It includes all the Phone Companion features.| 1803 | |IPv4/6 Transition Technologies (6to4, ISATAP, Teredo, and Direct Tunnels)|6to4 has been disabled by default since Windows 10, version 1607 (the Anniversary Update), ISATAP has been disabled by default since Windows 10, version 1703 (the Creators Update), Teredo has been disabled since Windows 10, version 1803, and Direct Tunnels has always been disabled by default. Please use native IPv6 support instead.| 1803 | diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/deployment/planning/windows-10-removed-features.md index 7085ba9fb5..427f15beab 100644 --- a/windows/deployment/planning/windows-10-removed-features.md +++ b/windows/deployment/planning/windows-10-removed-features.md @@ -27,6 +27,7 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Removed in version | | ----------- | --------------------- | ------ | +|MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. Metadata for the MBAE service is removed. | 20H2 | | Connect app | The **Connect** app for wireless projection using Miracast is no longer installed by default, but is available as an optional feature. To install the app, click on **Settings** > **Apps** > **Optional features** > **Add a feature** and then install the **Wireless Display** app. | 2004 | | Rinna and Japanese Address suggestion | The Rinna and Japanese Address suggestion service for Microsoft Japanese Input Method Editor (IME) ended on August 13th, 2020. For more information, see [Rinna and Japanese Address suggestion will no longer be offered](https://support.microsoft.com/help/4576767/windows-10-rinna-and-japanese-address-suggestion) | 2004 | | Cortana | Cortana has been updated and enhanced in the Windows 10 May 2020 Update. With [these changes](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-2004#cortana), some previously available consumer skills such as music, connected home, and other non-Microsoft skills are no longer available. | 2004 | diff --git a/windows/deployment/update/create-deployment-plan.md b/windows/deployment/update/create-deployment-plan.md index da1db27ff2..a1ce6bbe19 100644 --- a/windows/deployment/update/create-deployment-plan.md +++ b/windows/deployment/update/create-deployment-plan.md @@ -6,20 +6,20 @@ ms.mktglfcycl: manage author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.reviewer: +ms.collection: m365initiative-coredeploy manager: laurawi ms.topic: article --- # Create a deployment plan -A service management mindset means that the devices in your organization fall into a continuum, with the software update process being constantly planned, deployed, monitored, and optimized. And once this process is used for feature updates, quality updates become a lightweight procedure that is simple and fast to execute, ultimately increasing velocity. +A "service management" mindset means that the devices in your organization fall into a continuum, with the software update process being constantly planned, deployed, monitored, and optimized. And once you use this process for feature updates, quality updates become a lightweight procedure that is simple and fast to execute, ultimately increasing velocity. -When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices, and we’ve found that ring-based deployment is a methodology that works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades--they are simply a method by which to separate devices into a deployment timeline. +When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We’ve found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method to separate devices into a deployment timeline. -At the highest level, each “ring” comprise a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur. +At the highest level, each “ring” comprises a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur. -A common ring structure comprises three deployment groups: +A common ring structure uses three deployment groups: - Preview: Planning and development - Limited: Pilot and validation @@ -34,22 +34,20 @@ A common ring structure comprises three deployment groups: ## How many rings should I have? -There are no definite rules for exactly how many rings to have for your deployments. As mentioned previously, you might want to ensure zero downtime for mission-critical devices by putting them in their own ring. If you have a large -organization, you might want to consider assigning devices to rings based on geographic location or the size of rings so that helpdesk resources are more available. Consider the needs of your business and introduce rings that make sense for your organization. +There are no definite rules for exactly how many rings to have for your deployments. As mentioned previously, you might want to ensure zero downtime for mission-critical devices by putting them in their own ring. If you have a large organization, you might want to consider assigning devices to rings based on geographic location or the size of rings so that helpdesk resources are more available. Consider the needs of your business and introduce rings that make sense for your organization. ## Advancing between rings -There are basically two strategies for moving deployments from one ring to the next. One is service based, the other project based. +There are basically two strategies for moving deployments from one ring to the next. One is service-based, the other project based. - "Red button" (service based): Assumes that content is good until proven bad. Content flows until an issue is discovered, at which point the IT administrator presses the “red button” to stop further distribution. - Green button (project based): Assumes that content is bad until proven good. Once all validation has passed, the IT administrator presses the “green button” to push the content to the next ring. -When it comes to deployments, having manual steps in the process usually impedes update velocity, so a "red button" strategy is better when that is your goal. +When it comes to deployments, having manual steps in the process usually impedes update velocity. A "red button" strategy is better when that is your goal. ## Preview ring -The purpose of the Preview ring is to evaluate the new features of the update. This is specifically *not* for broad parts of the organization but is limited to the people who are responsible for knowing what is coming next, -generally IT administrators. Ultimately, this is the time the design and planning work happens so that when the public update is actually shipped, you can have greater confidence in the update. +The purpose of the Preview ring is to evaluate the new features of the update. It's *not* for broad parts of the organization but is limited to the people who are responsible for knowing what is coming next, generally IT administrators. Ultimately, this phase is the time the design and planning work happens so that when the public update is shipped, you can have greater confidence in the update. > [!NOTE] > Being part of the [Windows Insider Program](https://insider.windows.com/for-business/) gives you early access to Windows releases so that you can use Insider Preview builds in your Preview ring to validate your apps and infrastructure, preparing you for public Windows releases. @@ -57,14 +55,14 @@ generally IT administrators. Ultimately, this is the time the design and plannin ### Who goes in the Preview ring? -The Preview ring users are the most tech savvy and resilient people, who will not lose productivity if something goes wrong. In general, these are IT pros, and perhaps a few people in the business organization. +The Preview ring users are the most tech savvy and resilient people, who will not lose productivity if something goes wrong. In general, these users are IT pros, and perhaps a few people in the business organization. -During your plan and prepare phases, these are the activities you should focus on: +During your plan and prepare phases, you should focus on the following activities: - Work with Windows Insider Preview builds. - Identify the features and functionality your organization can or wants to use. - Establish who will use the features and how they will benefit. -- Understand why you are putting the update out. +- Understand why you are putting out the update. - Plan for usage feedback. Remember, you are working with pre-release software in the Preview ring and you will be evaluating features and testing the update for a targeted release. @@ -76,7 +74,7 @@ Remember, you are working with pre-release software in the Preview ring and you ## Limited ring -The purpose of the Limited ring is to validate the update on representative devices across the network. During this period, data, and feedback is generated to enable the decision to move forward to broader deployment. Desktop +The purpose of the Limited ring is to validate the update on representative devices across the network. During this period, data, and feedback are generated to enable the decision to move forward to broader deployment. Desktop Analytics can help with defining a good Limited ring of representative devices and assist in monitoring the deployment. ### Who goes in the Limited ring? @@ -84,7 +82,7 @@ Analytics can help with defining a good Limited ring of representative devices a The most important part of this phase is finding a representative sample of devices and applications across your network. If possible, all hardware and all applications should be represented, and it's important that the people selected for this ring are using their devices regularly in order to generate the data you will need to make a decision for broader deployment across your organization. The IT department, lab devices, and users with the most cutting-edge hardware usually don’t have the applications or device drivers that are truly a representative sample of your network. -During your pilot and validate phases, these are the activities you should focus on: +During your pilot and validate phases, you should focus on the following activities: - Deploy new innovations. - Assess and act if issues are encountered. @@ -104,7 +102,7 @@ In most businesses, the Broad ring includes the rest of your organization. Becau > In some instances, you might hold back on mission critical devices (such as medical devices) until deployment in the Broad ring is complete. Get best practices and recommendations for deploying Windows 10 feature > updates to mission critical devices. -During the broad deployment phase, these are the activities you should focus on: +During the broad deployment phase, you should focus on the following activities: - Deploy to all devices in the organization. - Work through any final unusual issues that were not detected in your Limited ring. @@ -112,7 +110,7 @@ During the broad deployment phase, these are the activities you should focus on: ## Ring deployment planning -Previously, we have provided methods for analyzing your deployments, but these have generally been standalone tools to assess, manage and execute deployments. In other words, you would generate an analysis, make a deployment strategy, and then move to your console for implementation, repeating these steps for each deployment. We have combined many of these tasks, and more, into a single interface with Desktop Analytics. +Previously, we have provided methods for analyzing your deployments, but these have been standalone tools to assess, manage and execute deployments. In other words, you would generate an analysis, make a deployment strategy, and then move to your console for implementation, repeating these steps for each deployment. We have combined many of these tasks, and more, into a single interface with Desktop Analytics. [Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) is a cloud-based service and a key tool in [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/configmgr/core/understand/microsoft-endpoint-manager-faq). Using artificial intelligence and machine learning, Desktop Analytics is a powerful tool to give you insights and intelligence to diff --git a/windows/deployment/update/eval-infra-tools.md b/windows/deployment/update/eval-infra-tools.md index 77795ce1c4..ce3c85e030 100644 --- a/windows/deployment/update/eval-infra-tools.md +++ b/windows/deployment/update/eval-infra-tools.md @@ -1,8 +1,7 @@ --- title: Evaluate infrastructure and tools -ms.reviewer: manager: laurawi -description: +description: Steps to make sure your infrastructure is ready to deploy updates keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools ms.prod: w10 ms.mktglfcycl: manage @@ -11,18 +10,18 @@ author: jaimeo ms.localizationpriority: medium ms.audience: itpro ms.topic: article -ms.collection: M365-modern-desktop +ms.collection: m365initiative-coredeploy --- # Evaluate infrastructure and tools -Before you deploy an update, it's best to assess your deployment infrastucture (that is, tools such as Configuration Manager, Microsoft Intune, or similar) and current configurations (such as security baselines, administrative templates, and policies that affect updates). Then, set some criteria to define your operational readiness. +Before you deploy an update, it's best to assess your deployment infrastructure (that is, tools such as Configuration Manager, Microsoft Intune, or similar) and current configurations (such as security baselines, administrative templates, and policies that affect updates). Then, set some criteria to define your operational readiness. ## Infrastructure Do your deployment tools need updates? -- If you use Configuration Manager, is it on the Current Branch with the latest release installed. This ensures that it supports the next Windows 10 feature update. Configuration Manager releases are supported for 18 months. +- If you use Configuration Manager, is it on the Current Branch with the latest release installed. Being on this branch ensures that it supports the next Windows 10 feature update. Configuration Manager releases are supported for 18 months. - Using a cloud-based management tool like Microsoft Intune reduces support challenges, since no related products need to be updated. - If you use a non-Microsoft tool, check with its product support to make sure you're using the current version and that it supports the next Windows 10 feature update. @@ -30,11 +29,11 @@ Rely on your experiences and data from previous deployments to help you judge ho ## Device settings -Make sure your security basline, administrative templates, and policies have the right settings to support your devices once the new Windows 10 update is installed. +Make sure your security baseline, administrative templates, and policies have the right settings to support your devices once the new Windows 10 update is installed. ### Security baseline -Keep security baslines current to help ensure that your environment is secure and that new security feature in the coming Windows 10 update are set properly. +Keep security baselines current to help ensure that your environment is secure and that new security feature in the coming Windows 10 update are set properly. - **Microsoft security baselines**: You should implement security baselines from Microsoft. They are included in the [Security Compliance Toolkit](https://www.microsoft.com/download/details.aspx?id=55319), along with tools for managing them. - **Industry- or region-specific baselines**: Your specific industry or region might have particular baselines that you must follow per regulations. Ensure that any new baselines support the version of Windows 10 you are about to deploy. @@ -49,14 +48,14 @@ There are a number of Windows policies (set by Group Policy, Intune, or other me ## Define operational readiness criteria -When you’ve deployed an update, you’ll need to make sure the update isn’t introducing new operational issues. And you’ll also ensure that if incidents arise, the needed documentation and processes are available. To achieve this, work with your operations and support team to define acceptable trends and what documents or processes require updating: +When you’ve deployed an update, you’ll need to make sure the update isn’t introducing new operational issues. And you’ll also ensure that if incidents arise, the needed documentation and processes are available. Work with your operations and support team to define acceptable trends and what documents or processes require updating: - **Call trend**: Define what percentage increase in calls relating to Windows 10 feature updates are acceptable or can be supported. - **Incident trend**: Define what percentage of increase in calls asking for support relating to Windows 10 feature updates are acceptable or can be supported. - **Support documentation**: Review supporting documentation that requires an update to support new infrastructure tooling or configuration as part of the Windows 10 feature update. - **Process changes:** Define and update any processes that will change as a result of the Windows 10 feature update. -Your operations and support staff can help you determine if the appropriate information is being tracked at the moment. If it isn't, work out how to get get this information so you can gain the right insight. +Your operations and support staff can help you determine if the appropriate information is being tracked at the moment. If it isn't, work out how to get this information so you can gain the right insight. ## Tasks diff --git a/windows/deployment/update/plan-define-readiness.md b/windows/deployment/update/plan-define-readiness.md index 4264b434b1..2e371a0df1 100644 --- a/windows/deployment/update/plan-define-readiness.md +++ b/windows/deployment/update/plan-define-readiness.md @@ -1,6 +1,5 @@ --- title: Define readiness criteria -ms.reviewer: manager: laurawi description: Identify important roles and figure out how to classify apps keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools @@ -11,14 +10,14 @@ author: jaimeo ms.localizationpriority: medium ms.audience: itpro ms.topic: article -ms.collection: M365-modern-desktop +ms.collection: m365initiative-coredeploy --- # Define readiness criteria ## Figure out roles and personnel -Planning and managing a deployment involves a variety of distinct activies and roles best suited to each. As you plan, it's worth figuring out which roles you'll need to carry out the deployment and who should fill them. Different roles are active at various phases of a deployment. Depending on the size and complexity of your organization, some of the roles could be filled by the same person. However, it's best to have an established *process manager*, who will oversee all of the tasks for the deployment. +Planning and managing a deployment involves a variety of distinct activities and roles best suited to each. As you plan, it's worth figuring out which roles you'll need to carry out the deployment and who should fill them. Different roles are active at various phases of a deployment. Depending on the size and complexity of your organization, some of the roles could be filled by the same person. However, it's best to have an established *process manager*, who will oversee all of the tasks for the deployment. ### Process manager @@ -39,7 +38,7 @@ This table sketches out one view of the other roles, with their responsibilities |Role |Responsibilities |Skills |Active phases | |---------|---------|---------|---------| -|Process manager | Manages the process end to end; ensures inputs and outputs are captures; ensures that activities progress | IT service management | Plan, prepare, pilot deployment, broad deployment | +|Process manager | Manages the process end to end; ensures inputs and outputs are captures; ensures that activities progress | IT Service Management | Plan, prepare, pilot deployment, broad deployment | |Application owner | Define application test plan; assign user acceptance testers; certify the application | Knowledge of critical and important applications | Plan, prepare, pilot deployment | |Application developer | Ensure apps are developed to stay compatible with current Windows versions | Application development; application remediation | Plan, prepare | |End-user computing | Typically a group including infrastructure engineers or deployment engineers who ensure upgrade tools are compatible with Windows | Bare-metal deployment; infrastructure management; application delivery; update management | Plan, prepare, pilot deployment, broad deployment | @@ -54,7 +53,7 @@ This table sketches out one view of the other roles, with their responsibilities ## Set criteria for rating apps -Some apps in your environment are fundamental to your core business activities. Other apps help workers perform their roles, but aren’t critical to your business operations. Before you start inventorying and assessing the apps in your environment, you should establish some criteria for categorizing your apps, and then determine a priority for each. This will help you understand how best to deploy updates and how to resolve any issues that could arise. +Some apps in your environment are fundamental to your core business activities. Other apps help workers perform their roles, but aren’t critical to your business operations. Before you start inventorying and assessing the apps in your environment, you should establish some criteria for categorizing your apps, and then determine a priority for each. This process will help you understand how best to deploy updates and how to resolve any issues that could arise. In the Prepare phase, you'll apply the criteria you define now to every app in your organization. @@ -67,9 +66,9 @@ Here's a suggested classification scheme: |Important | Applications that individual staff members need to support their productivity. Downtime here would affect individual users, but would only have a minimal impact on the business. | |Not important | There is no impact on the business if these apps are not available for a while. | -Once you have classified your applications, you should agree what each classification means to the organization in terms of priority and severity. This will help ensure that you can triage problems with the right level of urgency. You should assign each app a time-based priority. +Once you have classified your applications, you should agree what each classification means to the organization in terms of priority and severity. This activity will help ensure that you can triage problems with the right level of urgency. You should assign each app a time-based priority. -Here's an example priority rating system; of course the specifics could vary for your organization: +Here's an example priority rating system; the specifics could vary for your organization: |Priority |Definition | @@ -101,7 +100,7 @@ Using the suggested scheme, a financial corporation might classify their apps li |Credit processing app | Critical | |Frontline customer service app | Critical | |PDF viewer | Important | -|Image processing app | Not important | +|Image-processing app | Not important | Further, they might combine this classification with severity and priority rankings like this: diff --git a/windows/deployment/update/plan-define-strategy.md b/windows/deployment/update/plan-define-strategy.md index 4f1c4edfac..fc033d13bd 100644 --- a/windows/deployment/update/plan-define-strategy.md +++ b/windows/deployment/update/plan-define-strategy.md @@ -7,18 +7,18 @@ ms.mktglfcycl: manage author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.reviewer: manager: laurawi ms.topic: article +ms.collection: m365initiative-coredeploy --- # Define update strategy with a calendar Traditionally, organizations treated the deployment of operating system updates (especially feature updates) as a discrete project that had a beginning, a middle, and an end. A release was "built" (usually in the form of an image) and then distributed to users and their devices. -Today, more organizations are treating deployment as a continual process of updates which roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. Microsoft has been evolving its Windows 10 release cycles, update mechanisms, and relevant tools to support this model. Feature updates are released twice per year, around March and September. All releases of Windows 10 have 18 months of servicing for all editions. Fall releases of the Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. +Today, more organizations are treating deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. Microsoft has been evolving its Windows 10 release cycles, update mechanisms, and relevant tools to support this model. Feature updates are released twice per year, around March and September. All releases of Windows 10 have 18 months of servicing for all editions. Fall releases of the Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. -Though we encourage you to deploy every available release and maintain a fast cadence for some portion of your environment, we also recognize that you might have a large number of devices, and a need for little or no disruption, an so you might choose to update annually. The 18/30 month lifecycle cadence lets you to allow some portion of you environment to move faster while a majority can move less quickly. +Though we encourage you to deploy every available release and maintain a fast cadence for some portion of your environment, we also recognize that you might have a large number of devices, and a need for little or no disruption, and so you might choose to update annually. The 18/30 month lifecycle cadence lets you allow some portion of your environment to move faster while a majority can move less quickly. ## Calendar approaches You can use a calendar approach for either a faster twice-per-year cadence or an annual cadence. Depending on company size, installing Windows 10 feature updates less often than once annually risks devices going out of service and becoming vulnerable to security threats, because they will stop receiving the monthly security updates. @@ -26,24 +26,26 @@ You can use a calendar approach for either a faster twice-per-year cadence or an ### Annual Here's a calendar showing an example schedule that applies one Windows 10 feature update per calendar year, aligned with Microsoft Endpoint Configuration Manager and Microsoft 365 Apps release cycles: -![Calendar showing an annual update cadence](images/annual-calendar.png) +[ ![Calendar showing an annual update cadence](images/annual-calendar.png) ](images/annual-calendar.png#lightbox) -This approach provides approximately twelve months of use from each feature update before the next update is due to be installed. By aligning to the Windows 10, version H2 feature update, each release will be serviced for 30 months from the time of availability, giving you more flexibility when applying future feature updates. +This approach provides approximately 12 months of use from each feature update before the next update is due to be installed. By aligning to the Windows 10, version H2 feature update, each release will be serviced for 30 months from the time of availability, giving you more flexibility when applying future feature updates. This cadence might be most suitable for you if any of these conditions apply: -- You are just starting your journey with the Windows 10 servicing process. If you are unfamiliar with new processes that support Windows 10 servicing, moving from a once every 3-5 year project to a twice a year feature update process can be daunting. This approach gives you time to learn new approaches and tools to reduce effort and cost. +- You are just starting your journey with the Windows 10 servicing process. If you are unfamiliar with new processes that support Windows 10 servicing, moving from a project happening once every three to five years to a twice-a-year feature update process can be daunting. This approach gives you time to learn new approaches and tools to reduce effort and cost. + - You want to wait and see how successful other companies are at adopting a Windows 10 feature update. + - You want to go quickly with feature updates, and want the ability to skip a feature update while keeping Windows 10 serviced in case business priorities change. Aligning to the Windows 10 feature update released in the second half of each calendar year, you get additional servicing for Windows 10 (30 months of servicing compared to 18 months). ### Rapid This calendar shows an example schedule that installs each feature update as it is released, twice per year: -![Update calendar showing a faster update cadence](images/rapid-calendar.png) +[ ![Update calendar showing a faster update cadence](images/rapid-calendar.png) ](images/rapid-calendar.png#lightbox) This cadence might be best for you if these conditions apply: - You have a strong appetite for change. - You want to continuously update supporting infrastructure and unlock new scenarios. - Your organization has a large population of information workers that can use the latest features and functionality in Windows 10 and Office. -- You have experience with feature updates for Windows 10. \ No newline at end of file +- You have experience with feature updates for Windows 10. diff --git a/windows/deployment/update/plan-determine-app-readiness.md b/windows/deployment/update/plan-determine-app-readiness.md index 645903d80f..82ecea00a3 100644 --- a/windows/deployment/update/plan-determine-app-readiness.md +++ b/windows/deployment/update/plan-determine-app-readiness.md @@ -1,6 +1,5 @@ --- title: Determine application readiness -ms.reviewer: manager: laurawi description: How to test your apps to know which need attention prior to deploying an update keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools @@ -10,7 +9,7 @@ audience: itpro ms.localizationpriority: medium ms.audience: itpro ms.topic: article -ms.collection: M365-modern-desktop +ms.collection: m365initiative-coredeploy ms.author: jaimeo author: jaimeo --- @@ -26,11 +25,11 @@ You can choose from a variety of methods to validate apps. Exactly which ones to |Validation method |Description | |---------|---------| -|Full regression | A full quality assurance probing. Staff who know the application very well and can validate its core functionality should do this. | +|Full regression | A full quality assurance probing. Staff who know the application well and can validate its core functionality should do this. | |Smoke testing | The application goes through formal validation. That is, a user validates the application following a detailed plan, ideally with limited, or no knowledge of the application they’re validating. | |Automated testing | Software performs tests automatically. The software will let you know whether the tests have passed or failed, and will provide detailed reporting for you automatically. | |Test in pilot | You pre-select users to be in the pilot deployment group and carry out the same tasks they do on a day-to-day basis to validate the application. Normally you use this method in addition to one of the other validation types. | -|Reactive response | Applications are validated in late pilot, and no specific users are selected. These are normally applications aren't installed on many devices and aren’t handled by enterprise application distribution. | +|Reactive response | Applications are validated in late pilot, and no specific users are selected. These applications normally aren't installed on many devices and aren’t handled by enterprise application distribution. | Combining the various validation methods with the app classifications you've previously established might look like this: diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md index 76cbb5eea0..53b1f289ec 100644 --- a/windows/deployment/update/prepare-deploy-windows.md +++ b/windows/deployment/update/prepare-deploy-windows.md @@ -1,6 +1,6 @@ --- title: Prepare to deploy Windows -description: +description: Final steps to get ready to deploy Windows, including preparing infrastructure, environment, applications, devices, network, capability, and users keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools ms.prod: w10 ms.mktglfcycl: manage @@ -10,6 +10,7 @@ ms.author: jaimeo ms.reviewer: manager: laurawi ms.topic: article +ms.collection: m365initiative-coredeploy --- # Prepare to deploy Windows @@ -31,19 +32,25 @@ Now you're ready to actually start making changes in your environment to get rea Your infrastructure probably includes many different components and tools. You’ll need to ensure your environment isn’t affected by issues due to the changes you make to the various parts of the infrastructure. Follow these steps: -1. Review all of the infrastructure changes that you’ve identified in your plan. It’s important to understand the changes that need to be made and to detail how to implement them. This prevents problems later on. +1. Review all of the infrastructure changes that you’ve identified in your plan. It’s important to understand the changes that need to be made and to detail how to implement them. This process prevents problems later on. + 2. Validate your changes. You’ll validate the changes for your infrastructure’s components and tools, to help you understand how your changes could affect your production environment. + 3. Implement the changes. Once the changes have been validated, you can implement the changes across the wider infrastructure. You should also look at your organization’s environment’s configuration and outline how you’ll implement any necessary changes previously identified in the plan phase to support the update. Consider what you’ll need to do for the various settings and policies that currently underpin the environment. For example: - Implement new draft security guidance. New versions of Windows can include new features that improve your environment’s security. Your security teams will want to make appropriate changes to security related configurations. + - Update security baselines. Security teams understand the relevant security baselines and will have to work to make sure all baselines fit into whatever guidance they have to adhere to. + However, your configuration will consist of many different settings and policies. It’s important to only apply changes where they are necessary, and where you gain a clear improvement. Otherwise, your environment might face issues that will slow down the update process. You want to ensure your environment isn’t affected adversely because of changes you make. For example: 1. Review new security settings. Your security team will review the new security settings, to understand how they can best be set to facilitate the update, and to also investigate the potential effects they might have on your environment. + 2. Review security baselines for changes. Security teams will also review all the necessary security baselines, to ensure the changes can be implemented, and ensure your environment remains compliant. + 3. Implement and validate security settings and baseline changes. Your security teams will then implement all of the security settings and baselines, having addressed any potential outstanding issues. @@ -100,39 +107,42 @@ Set up [Delivery Optimization](waas-delivery-optimization.md) for peer network s In the course of surveying your device population, either with Desktop Analytics or by some other means, you might find devices that have systemic problems that could interfere with update installation. Now is the time to fix those problems. -- **Low disk space:** Quality updates require a minimum of two GB to successfully install. Feature updates require between 8 and 15 GB depending upon the configuration. On Windows 10, version 1903 and later you can proactively use the "reserved storage" feature (for wipe and loads, rebuilds, and new builds) to avoid running out of disk space. If you find a group of devices that don't have enough disk space, you can often resolve this by cleaning up log files and asking users to clean up data if necessary. A good place to start is to delete the following files: -- C:\Windows\temp -- C:\Windows\cbstemp (though this file might be necessary to investigate update failures) -- C:\Windows\WindowsUpdate.log (though this file might be necessary to investigate update failures) -- C:\Windows.Old (these files should automatically clean up after 10 days or might ask the device user for permission to clean up sooner when constrained for disk space) +- **Low disk space:** Quality updates require a minimum of 2 GB to successfully install. Feature updates require between 8 GB and 15 GB depending upon the configuration. On Windows 10, version 1903 and later you can proactively use the "reserved storage" feature (for wipe and loads, rebuilds, and new builds) to avoid running out of disk space. If you find a group of devices that don't have enough disk space, you can often resolve the problem by cleaning up log files and asking users to clean up data if necessary. A good place to start is to delete the following files: + + - C:\Windows\temp + - C:\Windows\cbstemp (though this file might be necessary to investigate update failures) + - C:\Windows\WindowsUpdate.log (though this file might be necessary to investigate update failures) + - C:\Windows.Old (these files should automatically clean up after 10 days or might ask the device user for permission to clean up sooner when constrained for disk space) You can also create and run scripts to perform additional cleanup actions on devices, with administrative rights, or use Group Policy settings. -- Clean up the Windows Store Cache by running C:\Windows\sytem32\wsreset.exe -- Optimize the WinSxS folder on the client machine by using **Dism.exe /online /Cleanup-Image /StartComponentCleanup** -- Compact the operating system by running **Compact.exe /CompactOS:always** +- Clean up the Windows Store Cache by running C:\Windows\sytem32\wsreset.exe. + +- Optimize the WinSxS folder on the client machine by using **Dism.exe /online /Cleanup-Image /StartComponentCleanup**. + +- Compact the operating system by running **Compact.exe /CompactOS:always**. + - Remove Windows Features on Demand that the user doesn't need. See [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) for more guidance. + - Move Windows Known Folders to OneDrive. See [Use Group Policy to control OneDrive sync settings](https://docs.microsoft.com/onedrive/use-group-policy) for more information. + - Clean up the Software Distribution folder. Try deploying these commands as a batch file to run on devices to reset the download state of Windows Updates: -``` -net stop wuauserv -net stop cryptSvc -net stop bits -net stop msiserver -ren C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution.old -net start wuauserv -net start cryptSvc -net start bits -net start msiserver -``` - -- **Application and driver updates:** Out-of-date app or driver software can prevent devices from updating successfully. Desktop Analytics will help you identify drivers and applications that need attention. You can also -check for known issues in order to take any appropriate action. Deploy any updates from the vendor(s) for any problematic application or driver versions to resolve issues. -- **Corruption:** In rare circumstances, a device that has repeated installation errors might be corrupted in a way that prevents the system from applying a new update. You might have to repair the Component Based Store from another source. You can do this with the [System File Checker](https://support.microsoft.com/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system). - + ```console + net stop wuauserv + net stop cryptSvc + net stop bits + net stop msiserver + ren C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution.old + net start wuauserv + net start cryptSvc + net start bits + net start msiserver + ``` +- **Application and driver updates:** Out-of-date app or driver software can prevent devices from updating successfully. Desktop Analytics will help you identify drivers and applications that need attention. You can also check for known issues in order to take any appropriate action. Deploy any updates from the vendor(s) for any problematic application or driver versions to resolve issues. +- **Corruption:** In rare circumstances, a device that has repeated installation errors might be corrupted in a way that prevents the system from applying a new update. You might have to repair the Component-Based Store from another source. You can fix the problem with the [System File Checker](https://support.microsoft.com/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system). ## Prepare capability @@ -140,14 +150,16 @@ check for known issues in order to take any appropriate action. Deploy any updat In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You'll need to complete these higher-level tasks to gain those new capabilities: - Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions will come with new policies that you use to update ADMX templates. + - Validate new changes to understand how they affect the wider environment. + - Remediate any potential problems that have been identified through validation. ## Prepare users Users often feel like they are forced into updating their devices randomly. They often don't fully understand why an update is needed, and they don't know when updates would be applied to their devices ahead of time. It's best to ensure that upcoming updates are communicated clearly and with adequate warning. -You can employ a variety of measures to achieve this, for example: +You can employ a variety of measures to achieve this goal, for example: - Send overview email about the update and how it will be deployed to the entire organization. - Send personalized emails to users about the update with specific details. diff --git a/windows/hub/index.yml b/windows/hub/index.yml index 0ac1aa5523..289a9ff9e7 100644 --- a/windows/hub/index.yml +++ b/windows/hub/index.yml @@ -13,7 +13,7 @@ metadata: ms.collection: windows-10 author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. ms.author: greglin #Required; microsoft alias of author; optional team alias. - ms.date: 09/23/2020 #Required; mm/dd/yyyy format. + ms.date: 10/20/2020 #Required; mm/dd/yyyy format. localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -26,12 +26,12 @@ landingContent: linkLists: - linkListType: overview links: + - text: What's new in Windows 10, version 20H2 + url: /windows/whats-new/whats-new-windows-10-version-20H2 - text: What's new in Windows 10, version 2004 url: /windows/whats-new/whats-new-windows-10-version-2004 - text: What's new in Windows 10, version 1909 url: /windows/whats-new/whats-new-windows-10-version-1909 - - text: What's new in Windows 10, version 1903 - url: /windows/whats-new/whats-new-windows-10-version-1903 - text: Windows 10 release information url: https://docs.microsoft.com/windows/release-information/ diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index fc3ba2d75a..d3555a0e8a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -81,7 +82,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -This event sends compatibility information about a file to help keep Windows up-to-date. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -97,7 +98,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -108,7 +109,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -136,7 +137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -147,7 +148,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -167,7 +168,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -178,7 +179,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -198,7 +199,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -209,7 +210,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -229,7 +230,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -240,7 +241,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -260,7 +261,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -271,7 +272,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -292,7 +293,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -303,7 +304,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -341,7 +342,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -352,7 +353,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -386,7 +387,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -397,7 +398,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -This event indicates that the DecisionDevicePnp object is no longer present. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -422,7 +423,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -433,7 +434,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -459,7 +460,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -470,7 +471,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -492,7 +493,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -503,7 +504,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -527,7 +528,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -538,7 +539,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -564,7 +565,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -575,7 +576,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -597,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -608,7 +609,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -619,7 +620,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning -This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. +This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -643,7 +644,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -666,7 +667,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -677,7 +678,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -699,7 +700,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -710,7 +711,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -737,7 +738,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -748,7 +749,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -759,7 +760,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -772,7 +773,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -783,7 +784,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -794,7 +795,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -819,7 +820,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -830,7 +831,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -841,7 +842,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -871,7 +872,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -882,7 +883,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -904,7 +905,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -915,7 +916,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -937,7 +938,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -948,7 +949,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -971,7 +972,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -982,7 +983,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1004,7 +1005,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1015,7 +1016,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1037,7 +1038,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1048,7 +1049,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1070,7 +1071,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1081,7 +1082,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1103,7 +1104,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1114,7 +1115,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1136,7 +1137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1147,7 +1148,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1173,7 +1174,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1184,7 +1185,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1247,7 +1248,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1258,7 +1259,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1271,7 +1272,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1281,7 +1282,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1292,19 +1293,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1321,14 +1312,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise System Center Configuration Manager (SCCM) environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. - **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier. ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1340,7 +1331,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1355,7 +1346,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1391,7 +1382,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1401,7 +1392,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1424,7 +1415,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1466,7 +1457,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1482,13 +1473,13 @@ The following fields are available: ### Census.Security -Provides information on several important data points about security settings. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1505,7 +1496,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1516,7 +1507,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1526,7 +1517,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1548,7 +1539,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1561,7 +1552,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1574,7 +1565,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1769,7 +1760,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. @@ -1868,7 +1859,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1887,7 +1878,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1906,7 +1897,7 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: @@ -2168,7 +2159,7 @@ The following fields are available: ### ChecksumDictionary -The list of values sent by each object type. +This event provides the list of values sent by each object type. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2178,7 +2169,7 @@ The following fields are available: ### COMPID -This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. +This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2188,7 +2179,7 @@ The following fields are available: ### HWID -This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. +This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2198,7 +2189,7 @@ The following fields are available: ### InstallDateArpLastModified -This event indicates the date the add/remove program (ARP) entry was last modified by an update. +This event indicates the date the add/remove program (ARP) entry was last modified by an update. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2208,7 +2199,7 @@ The following fields are available: ### InstallDateFromLinkFile -This event provides the application installation date from the linked file. +This event provides the application installation date from the linked file. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2218,7 +2209,7 @@ The following fields are available: ### InstallDateMsi -The install date from the Microsoft installer (MSI) database. +This event provides the install date from the Microsoft installer (MSI) database. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2228,7 +2219,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2254,7 +2245,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2266,7 +2257,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2283,7 +2274,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2312,31 +2303,31 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2347,7 +2338,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2358,7 +2349,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2382,7 +2373,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2393,7 +2384,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2404,7 +2395,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2433,7 +2424,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2444,7 +2435,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2457,7 +2448,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2468,7 +2459,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2477,9 +2468,48 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd + +This event represents the basic metadata about a plug and play (PNP) device and its associated driver. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Class** The device setup class of the driver loaded for the device. +- **ClassGuid** The device class unique identifier of the driver package loaded on the device. +- **COMPID** The list of “Compatible IDs” for this device. See [COMPID](#compid). +- **ContainerId** The system-supplied unique identifier that specifies which group(s) the device(s) installed on the parent (main) device belong to. +- **Description** The description of the device. +- **DeviceState** Identifies the current state of the parent (main) device. +- **DriverId** The unique identifier for the installed driver. +- **DriverName** The name of the driver image file. +- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage. +- **DriverVerDate** The date of the driver loaded for the device +- **DriverVerVersion** The version of the driver loaded for the device +- **Enumerator** Identifies the bus that enumerated the device. +- **HWID** A list of hardware IDs for the device. See [HWID](#hwid). +- **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InventoryVersion** The version number of the inventory process generating the events. +- **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. +- **LowerFilters** The identifiers of the Lower filters installed for the device. +- **Manufacturer** The manufacturer of the device. +- **MatchingID** The Hardware ID or Compatible ID that Windows uses to install a device instance. +- **Model** Identifies the model of the device. +- **objectInstanceId** Deprecated. The Device Instance ID of the device (uniquely identifies a device in the system). Example: pci\ven_8086&dev_0085&subsys_13118086&rev_34\4&2dded11c&0&00e1 +- **ParentId** The Device Instance ID of the parent of the device. +- **ProblemCode** The error code currently returned by the device, if applicable. +- **Provider** Identifies the device provider. +- **Service** The name of the device service. +- **STACKID** The list of hardware IDs for the stack. See [STACKID](#stackid). +- **UpperClassFilters** The identifiers of the Upper Class filters installed for the device. +- **UpperFilters** The identifiers of the Upper filters installed for the device. + + ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2490,7 +2520,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2501,19 +2531,19 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2540,7 +2570,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2551,7 +2581,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2562,7 +2592,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2581,7 +2611,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2592,7 +2622,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2601,9 +2631,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2630,7 +2668,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2642,115 +2680,121 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2760,7 +2804,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2772,7 +2816,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2780,7 +2824,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2788,7 +2832,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2796,7 +2840,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### STACKID -This event provides the internal compatible ID for the stack. +This event provides the internal compatible ID for the stack. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2818,7 +2862,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2843,7 +2887,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. +This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2868,15 +2912,21 @@ The following fields are available: ## Migration events +### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -2884,7 +2934,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2897,7 +2947,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2909,7 +2959,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2925,7 +2975,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2938,7 +2988,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2948,7 +2998,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OfficeRegistration -This event indicates the status of the OneDrive integration with Microsoft Office. +This event indicates the status of the OneDrive integration with Microsoft Office. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2957,7 +3007,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2967,7 +3017,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.RepairResult -The event determines the result of the installation repair. +The event determines the result of the installation repair. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2976,7 +3026,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.SetupBinaryDownloadHResult -This event indicates the status when downloading the OneDrive setup file. +This event indicates the status when downloading the OneDrive setup file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2985,7 +3035,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2996,7 +3046,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateTierReg -This event determines status of the update tier registry values. +This event determines status of the update tier registry values. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3006,7 +3056,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3015,7 +3065,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3026,7 +3076,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3043,7 +3093,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -3055,7 +3105,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3067,7 +3117,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3079,7 +3129,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3093,7 +3143,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3141,7 +3191,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -3268,7 +3318,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.DiskCleanUnExpectedErrorEvent -This event indicates that an unexpected error occurred during an update and provides information to help address the issue. +This event indicates that an unexpected error occurred during an update and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3282,7 +3332,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Error -This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. +This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3293,7 +3343,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.FallbackError -This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. +This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3303,7 +3353,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationNotifyUserFixIssuesInvokeUIEvent -This event occurs when the Notify User task executes and provides information about the cause of the notification. +This event occurs when the Notify User task executes and provides information about the cause of the notification. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3319,7 +3369,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellFailedAutomaticAppUpdateModifyEventId -This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. +This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3331,7 +3381,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellUnexpectedExceptionId -This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. +This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3343,7 +3393,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationUHEnableServiceFailed -This event tracks the health of key update (Remediation) services and whether they are enabled. +This event tracks the health of key update (Remediation) services and whether they are enabled. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3382,7 +3432,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Started -deny +This event is sent when Windows Update sediment remediations have started on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3452,7 +3502,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. @@ -3473,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DownloadServiceProgress -This event indicates the progress of the downloader in 1% increments. +This event indicates the progress of the downloader in 1% increments. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3574,7 +3624,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3637,7 +3687,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3648,7 +3698,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3662,7 +3712,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3693,7 +3743,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3797,7 +3847,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3813,7 +3863,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3828,7 +3878,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3839,7 +3889,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3848,7 +3898,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3859,7 +3909,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3872,7 +3922,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3897,7 +3947,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3913,7 +3963,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3935,7 +3985,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3946,7 +3996,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3955,7 +4005,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3966,7 +4016,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3979,7 +4029,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4070,7 +4120,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4095,7 +4145,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4122,19 +4172,19 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. @@ -4142,7 +4192,7 @@ This event reports the status of an action following a reboot, should one have b ### SoftwareUpdateClientTelemetry.CheckForUpdates -This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4339,7 +4389,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4361,7 +4411,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4466,7 +4516,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.SLSDiscovery -This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. +This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4482,7 +4532,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4497,7 +4547,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -This event identifies whether updates have been tampered with and protects against man-in-the-middle attacks. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4529,7 +4579,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4540,7 +4590,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -4553,7 +4603,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4564,7 +4614,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4575,7 +4625,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4585,7 +4635,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4599,7 +4649,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4612,7 +4662,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4639,7 +4689,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4655,7 +4705,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4673,7 +4723,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4689,7 +4739,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4705,7 +4755,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4720,7 +4770,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4737,7 +4787,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4753,7 +4803,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4784,7 +4834,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4804,7 +4854,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4822,7 +4872,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4838,7 +4888,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4864,13 +4914,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4886,13 +4936,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4921,13 +4971,13 @@ This event indicates whether devices received additional or critical supplementa ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. @@ -4975,7 +5025,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5122,19 +5172,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. @@ -5222,7 +5272,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5635,7 +5685,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5660,7 +5710,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5699,7 +5749,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5717,7 +5767,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5749,7 +5799,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5770,7 +5820,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5826,7 +5876,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5850,7 +5900,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5865,7 +5915,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5880,7 +5930,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5895,7 +5945,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5910,7 +5960,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5925,7 +5975,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5940,7 +5990,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5955,7 +6005,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5970,7 +6020,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5980,7 +6030,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5991,7 +6041,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -6010,7 +6060,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -6028,7 +6078,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6043,7 +6093,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -6060,7 +6110,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -6085,7 +6135,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6097,7 +6147,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -6109,7 +6159,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -6125,7 +6175,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6137,7 +6187,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6146,7 +6196,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6166,7 +6216,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6178,7 +6228,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6190,7 +6240,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6206,7 +6256,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6219,7 +6269,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6234,7 +6284,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6244,7 +6294,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6257,7 +6307,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6293,7 +6343,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6315,7 +6365,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6324,7 +6374,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6342,7 +6392,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot -This event is sent when a toast notification is shown to the user about scheduling a device restart. +This event is sent when a toast notification is shown to the user about scheduling a device restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6351,7 +6401,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6371,7 +6421,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6395,7 +6445,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS Updates. +This event sends data specific to the FixupEditionId mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. @@ -6403,25 +6453,25 @@ This event sends data specific to the FixupEditionId mitigation used for OS Upda ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 6c91cf051e..2be76e6660 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -Invalid Signature - This event is superseded by an event that contains additional fields. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -89,7 +90,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -107,7 +108,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -118,7 +119,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -145,7 +146,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -156,7 +157,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -178,7 +179,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -189,7 +190,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -211,7 +212,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -222,7 +223,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -244,7 +245,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -255,7 +256,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -277,7 +278,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -288,7 +289,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -310,7 +311,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -321,7 +322,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -361,7 +362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -372,7 +373,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -409,7 +410,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -420,7 +421,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -447,7 +448,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -458,7 +459,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -486,7 +487,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -497,7 +498,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -521,7 +522,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -532,7 +533,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -558,7 +559,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -569,7 +570,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -597,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -608,7 +609,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -633,7 +634,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -644,7 +645,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -669,7 +670,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -698,7 +699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -709,7 +710,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -733,7 +734,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -744,7 +745,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -773,7 +774,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -784,7 +785,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -795,7 +796,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -810,7 +811,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -821,7 +822,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -832,7 +833,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -857,7 +858,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -868,7 +869,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -879,7 +880,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -912,7 +913,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -923,7 +924,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -947,7 +948,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -958,7 +959,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -982,7 +983,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -993,7 +994,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1018,7 +1019,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1029,7 +1030,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1053,7 +1054,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1064,7 +1065,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1088,7 +1089,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1099,7 +1100,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1123,7 +1124,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1134,7 +1135,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1158,7 +1159,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1169,7 +1170,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1193,7 +1194,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1204,7 +1205,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1232,7 +1233,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1243,7 +1244,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1306,7 +1307,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1317,7 +1318,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1330,7 +1331,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1348,7 +1349,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1359,19 +1360,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1389,14 +1380,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. -- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1408,7 +1399,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1423,7 +1414,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1464,7 +1455,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1474,7 +1465,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1497,7 +1488,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1539,7 +1530,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1561,7 +1552,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1578,7 +1569,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1595,7 +1586,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1606,7 +1597,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1616,7 +1607,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1637,7 +1628,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1650,7 +1641,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1665,7 +1656,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1888,7 +1879,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -1958,19 +1949,19 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. @@ -2016,6 +2007,25 @@ This event is triggered when UTC determines it needs to send information about p ## DxgKernelTelemetry events +### DxgKrnlTelemetry.BddDiag + +This event records Microsoft basic display driver diagnostic information. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BiosFlags** Bitwise flags that contain graphics related firmware information on the device such as the system was booted with display or not, system was using VBIOS or UEFI GOP, and VBIOS has a valid display mode list or not. +- **CurrentMode** Information about the current display mode such as the resolution, rotation, and scaling. +- **DefaultModeReason** Numeric value indicating the reason that the Microsoft Basic Display Driver is in use. +- **DefaultModeResolution** Default resolution that Microsoft Basic Display Driver detected. +- **DefaultResolutionProvider** Numeric value indicating the source of the default resolution. +- **Flags** Bitwise flags containing Microsoft Basic Display Driver related information such as if it is running because there is no graphics driver or user PnP stopped the graphics driver, it has valid EDID or not on the connected monitor and where the EDID was from, it is running at gray scale mode or not, it is running without display or not. +- **HeadlessReason** Numeric value indicating why there is no display. +- **LogAssertionCount** Number of assertions that were encountered before this event was recorded. +- **LogErrorCount** Number of errors that were encountered before this event was recorded. +- **MonitorPowerState** Current power state of the monitor. +- **Version** Version of the schema for this event. + + ### DxgKrnlTelemetry.GPUAdapterInventoryV2 This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date. @@ -2169,7 +2179,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2179,7 +2189,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2223,7 +2233,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2250,7 +2260,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2260,7 +2270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2289,7 +2299,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2301,7 +2311,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2312,7 +2322,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2326,7 +2336,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2337,7 +2347,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2348,7 +2358,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2359,7 +2369,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2383,7 +2393,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2394,7 +2404,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2405,7 +2415,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2435,7 +2445,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2446,7 +2456,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2459,7 +2469,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2470,7 +2480,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2520,7 +2530,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2531,7 +2541,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2542,7 +2552,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2555,7 +2565,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2566,7 +2576,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2593,7 +2603,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2604,7 +2614,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2615,7 +2625,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2635,7 +2645,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2646,7 +2656,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2655,9 +2665,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2684,7 +2702,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2696,7 +2714,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2730,7 +2748,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2738,7 +2756,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2749,7 +2767,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -This event provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2767,7 +2785,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2778,7 +2796,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -This event includes the Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2804,7 +2822,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2815,7 +2833,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -Provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2830,7 +2848,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2838,7 +2856,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2849,7 +2867,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -This event list all installed Office products +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2864,7 +2882,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2875,7 +2893,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2889,7 +2907,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2900,7 +2918,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2931,7 +2949,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2939,7 +2957,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2950,7 +2968,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2958,7 +2976,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2969,7 +2987,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2980,7 +2998,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2995,7 +3013,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3003,7 +3021,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3011,7 +3029,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3021,7 +3039,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3032,7 +3050,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3040,7 +3058,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3060,7 +3078,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3087,19 +3105,19 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -3107,7 +3125,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3120,7 +3138,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3132,7 +3150,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3148,7 +3166,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3161,7 +3179,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3171,7 +3189,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3181,7 +3199,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3192,7 +3210,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3201,7 +3219,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3212,7 +3230,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3229,7 +3247,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -3241,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3253,7 +3271,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3265,7 +3283,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3279,7 +3297,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3326,7 +3344,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -3362,7 +3380,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -3499,7 +3517,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -3530,7 +3548,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3594,7 +3612,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3657,7 +3675,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3668,7 +3686,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3682,7 +3700,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3783,7 +3801,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3799,7 +3817,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3814,7 +3832,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -Error occurred during execution of the plugin. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3825,7 +3843,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3835,7 +3853,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3846,7 +3864,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3859,7 +3877,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3884,7 +3902,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3900,7 +3918,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3922,7 +3940,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3933,7 +3951,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3943,7 +3961,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3954,7 +3972,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3967,7 +3985,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4056,7 +4074,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4081,7 +4099,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4108,7 +4126,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4126,7 +4144,7 @@ The following fields are available: ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4142,7 +4160,7 @@ The following fields are available: ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4157,7 +4175,7 @@ The following fields are available: ### SIHEngineTelemetry.ServiceStateChange -This event reports the status of attempts to stop or start a service as part of executing an action. +This event reports the status of attempts to stop or start a service as part of executing an action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4174,7 +4192,7 @@ The following fields are available: ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4191,7 +4209,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4274,7 +4292,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -4305,7 +4323,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -4382,7 +4400,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4404,7 +4422,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4504,7 +4522,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4519,7 +4537,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4551,7 +4569,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4562,7 +4580,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -4575,7 +4593,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4587,7 +4605,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4598,7 +4616,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4608,7 +4626,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4622,7 +4640,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4636,7 +4654,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4663,7 +4681,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4679,7 +4697,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4697,7 +4715,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4713,7 +4731,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4729,7 +4747,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4744,7 +4762,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4761,7 +4779,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4777,7 +4795,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4809,7 +4827,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4829,7 +4847,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4845,7 +4863,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4863,7 +4881,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4879,7 +4897,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4895,7 +4913,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4921,7 +4939,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4941,7 +4959,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4957,7 +4975,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4975,7 +4993,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4992,7 +5010,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5015,7 +5033,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5062,7 +5080,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5078,7 +5096,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5094,7 +5112,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5111,7 +5129,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5127,7 +5145,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5152,13 +5170,13 @@ This event indicates whether devices received additional or critical supplementa ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. @@ -5206,7 +5224,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5354,19 +5372,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5406,16 +5424,25 @@ The following fields are available: ### Microsoft.Windows.WaaSAssessment.Error -This event returns the name of the missing setting needed to determine the Operating System build age. +This event returns the name of the missing setting needed to determine the Operating System build age. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **m** The WaaS (“Workspace as a Service”—cloud-based “workspace”) Assessment Error String. +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. + + ### Microsoft.Windows.WaaSMedic.RemediationFailed -This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5427,7 +5454,7 @@ The following fields are available: ### Microsoft.Windows.WaaSMedic.Summary -This event provides the results of the WaaSMedic diagnostic run +This event provides the results of the WaaSMedic diagnostic run. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5446,7 +5473,7 @@ The following fields are available: ### Microsoft.Windows.WaaSMedic.SummaryEvent -This event provides the results from the WaaSMedic engine +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5488,7 +5515,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5882,7 +5909,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5915,7 +5942,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5963,7 +5990,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5983,7 +6010,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6020,7 +6047,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6043,7 +6070,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6059,7 +6086,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6075,7 +6102,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6102,7 +6129,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6120,7 +6147,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6136,7 +6163,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6151,49 +6178,49 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -6211,25 +6238,25 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot -This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6239,7 +6266,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6251,7 +6278,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -6270,7 +6297,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6286,7 +6313,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -6303,7 +6330,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6319,7 +6346,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6330,7 +6357,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -6347,7 +6374,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -6372,7 +6399,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6385,7 +6412,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -6397,7 +6424,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -6414,13 +6441,13 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6429,7 +6456,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6448,7 +6475,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6460,7 +6487,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6470,7 +6497,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6484,9 +6511,20 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event indicates the data sent when the device pauses an in-progress update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6499,7 +6537,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6514,7 +6552,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6524,7 +6562,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6566,7 +6604,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6580,9 +6618,21 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event indicates that USO determined UUP needs to fall back. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6604,7 +6654,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6613,7 +6663,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6622,7 +6672,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6641,13 +6691,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6657,7 +6707,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6678,7 +6728,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6704,25 +6754,25 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 38c6834c3d..b9030aba9a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -123,7 +124,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -141,7 +142,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -152,7 +153,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -179,7 +180,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -190,7 +191,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -212,7 +213,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -223,7 +224,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -245,7 +246,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -256,7 +257,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -278,7 +279,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -289,7 +290,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -311,7 +312,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -322,7 +323,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -344,7 +345,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -355,7 +356,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -396,7 +397,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -407,7 +408,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -445,7 +446,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -456,7 +457,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -484,7 +485,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -495,7 +496,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -523,7 +524,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -534,7 +535,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -559,7 +560,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -570,7 +571,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -596,7 +597,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -607,7 +608,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -635,7 +636,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -646,7 +647,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -671,7 +672,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -682,7 +683,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -707,7 +708,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -736,7 +737,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -747,7 +748,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -771,7 +772,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -782,7 +783,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -811,7 +812,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -822,7 +823,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -833,7 +834,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -848,7 +849,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -859,7 +860,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -870,7 +871,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -895,7 +896,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -906,7 +907,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -917,7 +918,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -949,7 +950,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -960,7 +961,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -984,7 +985,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -995,7 +996,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1019,7 +1020,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1030,7 +1031,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1055,7 +1056,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1066,7 +1067,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1090,7 +1091,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1101,7 +1102,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1125,7 +1126,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1136,7 +1137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1160,7 +1161,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1171,7 +1172,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1195,7 +1196,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1206,7 +1207,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1230,13 +1231,13 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusEndSync -This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. +This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. The data collected with this event is used to help keep Windows up to date. ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1247,7 +1248,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1275,7 +1276,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1286,7 +1287,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1351,7 +1352,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1362,7 +1363,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1375,7 +1376,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1393,7 +1394,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1405,7 +1406,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1416,19 +1417,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1447,14 +1438,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1466,7 +1457,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1481,7 +1472,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1522,7 +1513,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1532,7 +1523,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1555,7 +1546,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1597,7 +1588,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1641,7 +1632,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1664,7 +1655,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1682,7 +1673,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1699,7 +1690,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1710,7 +1701,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1720,7 +1711,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1741,7 +1732,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1754,7 +1745,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1798,7 +1789,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1813,7 +1804,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2030,7 +2021,7 @@ The following fields are available: ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2066,7 +2057,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2193,7 +2184,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2207,7 +2198,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Initialize -This event indicates that the Deployment 360 APIs have been initialized for use. +This event indicates that the Deployment 360 APIs have been initialized for use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2220,7 +2211,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2233,7 +2224,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2247,7 +2238,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2261,7 +2252,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2280,7 +2271,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2312,6 +2303,21 @@ The following fields are available: - **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. +### TelClientSynthetic.ConnectivityHeartBeat_0 + +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. + +The following fields are available: + +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **LastFreeNetworkLossTime** The FILETIME at which the last free network loss occurred. +- **NetworkState** The network state of the device. +- **NoNetworkTimeSec** The total number of seconds without network during this heartbeat period. +- **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. + + ### TelClientSynthetic.HeartBeat_5 This event sends data about the health and quality of the diagnostic data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device. @@ -2402,7 +2408,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -This event indicates that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2415,7 +2421,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2428,7 +2434,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2441,7 +2447,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2453,7 +2459,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2466,7 +2472,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2478,7 +2484,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2491,7 +2497,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2504,7 +2510,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2516,7 +2522,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2529,7 +2535,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2541,7 +2547,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2554,7 +2560,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2566,7 +2572,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2579,7 +2585,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2592,7 +2598,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2604,7 +2610,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2630,7 +2636,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2655,7 +2661,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2668,7 +2674,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2681,7 +2687,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2693,7 +2699,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2707,7 +2713,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2720,7 +2726,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2733,7 +2739,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2747,7 +2753,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2760,7 +2766,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2773,7 +2779,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2787,7 +2793,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2800,7 +2806,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabAlreadyDownloaded -This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. +This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2812,7 +2818,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2826,7 +2832,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2838,7 +2844,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2851,7 +2857,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2863,7 +2869,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2877,7 +2883,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2890,7 +2896,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2903,7 +2909,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2915,7 +2921,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadyGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2928,7 +2934,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2940,7 +2946,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2953,7 +2959,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3127,7 +3133,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3137,7 +3143,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3179,7 +3185,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3213,7 +3219,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3223,7 +3229,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3252,7 +3258,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3264,7 +3270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3275,7 +3281,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3288,7 +3294,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3299,7 +3305,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3310,7 +3316,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3321,7 +3327,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3345,7 +3351,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3356,7 +3362,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3367,7 +3373,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3397,7 +3403,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3408,7 +3414,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3421,7 +3427,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3432,7 +3438,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3482,7 +3488,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3493,7 +3499,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3504,7 +3510,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3517,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3528,7 +3534,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3555,7 +3561,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3566,7 +3572,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3577,7 +3583,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3597,7 +3603,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3608,7 +3614,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3617,9 +3623,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3649,7 +3663,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3661,9 +3675,17 @@ The following fields are available: - **StartTime** UTC date and time at which this event was sent. +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3696,7 +3718,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3707,7 +3729,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3718,7 +3740,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3736,7 +3758,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3747,7 +3769,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3773,7 +3795,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3784,7 +3806,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3799,7 +3821,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3810,7 +3832,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3821,7 +3843,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3836,7 +3858,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3847,7 +3869,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3861,7 +3883,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3872,7 +3894,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3904,7 +3926,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3912,7 +3934,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3923,7 +3945,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3931,7 +3953,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3942,7 +3964,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3953,7 +3975,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3968,7 +3990,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3976,7 +3998,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3984,7 +4006,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3994,7 +4016,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4005,7 +4027,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4013,7 +4035,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4033,7 +4055,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4062,7 +4084,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event indicates an OS state change. +This event indicates an OS state change. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4183,7 +4205,104 @@ The following fields are available: ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -4203,6 +4322,8 @@ The following fields are available: - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. - **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. - **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. - **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. - **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. - **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. @@ -4250,49 +4371,26 @@ The following fields are available: - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. - **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. - - -### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config - -This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. - -The following fields are available: - -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). -- **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full -- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). -- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. -- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -4300,7 +4398,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4375,7 +4473,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4388,7 +4486,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4400,7 +4498,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4416,7 +4514,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4429,7 +4527,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4439,7 +4537,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4449,7 +4547,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4460,7 +4558,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4469,7 +4567,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4480,7 +4578,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4492,7 +4590,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentPrep -This event is used to determine whether the user needs to see the privacy consent experience or not. +This event is used to determine whether the user needs to see the privacy consent experience or not. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4502,7 +4600,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4515,7 +4613,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.wilActivity -This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. +This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4539,7 +4637,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4556,7 +4654,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -4568,7 +4666,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4580,7 +4678,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4592,7 +4690,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4606,7 +4704,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -4654,7 +4752,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -4690,7 +4788,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -4831,7 +4929,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -4863,7 +4961,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4932,7 +5030,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4995,7 +5093,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5006,7 +5104,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5080,7 +5178,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5096,7 +5194,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5111,7 +5209,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5124,7 +5222,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5140,7 +5238,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5162,7 +5260,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5239,7 +5337,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5264,7 +5362,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5289,15 +5387,45 @@ The following fields are available: ## SIH events +### SIHEngineTelemetry.EvalApplicability + +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ActionReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **AdditionalReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **CachedEngineVersion** The engine DLL version that is being used. +- **EventInstanceID** A unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **HandlerReasons** If an action has been assessed as inapplicable, the installer technology-specific logic prevented it. +- **IsExecutingAction** If the action is presently being executed. +- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). +- **SihclientVersion** The client version that is being used. +- **StandardReasons** If an action has been assessed as inapplicable, the standard logic the prevented it. +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateID** A unique identifier for the action being acted upon. +- **WuapiVersion** The Windows Update API version that is currently installed. +- **WuaucltVersion** The Windows Update client version that is currently installed. +- **WuauengVersion** The Windows Update engine version that is currently installed. +- **WUDeviceID** The unique identifier controlled by the software distribution client. + + ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. + + + +### SIHEngineTelemetry.PostRebootReport + +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5318,7 +5446,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5401,7 +5529,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5431,7 +5559,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5505,7 +5633,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5527,7 +5655,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5623,7 +5751,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5638,7 +5766,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5671,7 +5799,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5682,7 +5810,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -5695,7 +5823,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5706,7 +5834,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5718,7 +5846,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5728,7 +5856,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5741,7 +5869,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5754,7 +5882,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5771,7 +5899,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5787,7 +5915,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5819,7 +5947,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5839,7 +5967,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5855,7 +5983,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5873,7 +6001,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5891,7 +6019,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5907,7 +6035,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5933,7 +6061,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5953,7 +6081,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5969,7 +6097,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5987,7 +6115,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6003,13 +6131,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6032,7 +6160,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6079,7 +6207,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6095,7 +6223,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6111,7 +6239,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6128,7 +6256,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6144,7 +6272,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6177,7 +6305,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6187,7 +6315,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6245,7 +6373,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6409,7 +6537,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6434,7 +6562,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6453,7 +6581,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6492,9 +6620,45 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6547,7 +6711,7 @@ The following fields are available: ### Microsoft.Windows.WER.MTT.Value -This event is used for differential privacy. +This event is used for differential privacy to help keep Windows up to date. The following fields are available: @@ -6953,7 +7117,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed -This event sends basic telemetry on the failure of the Feature Rollback. +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6968,7 +7132,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable -This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6982,19 +7146,19 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureSucceeded -This event sends basic telemetry on the success of the rollback of feature updates. +This event sends basic telemetry on the success of the rollback of feature updates. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed -This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7009,7 +7173,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable -This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7023,13 +7187,13 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted -This event indicates that the Quality Rollback process has started. +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualitySucceeded -This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. @@ -7037,7 +7201,7 @@ This event sends basic telemetry on the success of the rollback of the Quality/L ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7069,7 +7233,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7118,7 +7282,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7138,7 +7302,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7177,7 +7341,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7199,7 +7363,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7215,7 +7379,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7239,7 +7403,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7255,7 +7419,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7282,7 +7446,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7300,7 +7464,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7316,7 +7480,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7331,7 +7495,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7357,7 +7521,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7373,7 +7537,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7389,7 +7553,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7405,7 +7569,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7421,7 +7585,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7437,7 +7601,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7453,7 +7617,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7469,7 +7633,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7485,7 +7649,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7507,7 +7671,7 @@ This event is sent when a second reminder dialog is displayed during Enhanced En ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7526,7 +7690,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7537,7 +7701,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7550,7 +7714,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7563,7 +7727,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7573,7 +7737,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7592,7 +7756,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -7614,7 +7778,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DetectionResult -This event runs when an update is detected. This helps ensure Windows is kept up to date. +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. The following fields are available: @@ -7627,7 +7791,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7643,7 +7807,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -7660,7 +7824,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7669,7 +7833,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7678,7 +7842,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7689,7 +7853,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Escalation -This event is sent when USO takes an Escalation action on a device. +This event is sent when USO takes an Escalation action on a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7702,7 +7866,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7719,7 +7883,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationsRefreshFailed -USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. +USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7730,7 +7894,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7746,7 +7910,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7757,7 +7921,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -7774,7 +7938,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -7799,7 +7963,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7812,7 +7976,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -7822,9 +7986,22 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data to device when Oobe Update download is in progress. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An update ID. +- **updateScenarioType** A type of update scenario. +- **wuDeviceid** A device ID associated with Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -7841,7 +8018,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7853,7 +8030,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7862,7 +8039,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Progress -This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. +This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7880,7 +8057,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -7899,7 +8076,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -7911,7 +8088,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -7921,7 +8098,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7939,7 +8116,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -7952,7 +8129,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -7965,7 +8142,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -7981,7 +8158,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7993,7 +8170,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8003,9 +8180,20 @@ The following fields are available: - **wuDeviceid** The device identifier. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event sends data when a device pauses an in-progress update, to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8018,7 +8206,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8033,7 +8221,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8043,7 +8231,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -8079,9 +8267,21 @@ The following fields are available: - **wuDeviceid** Unique ID for Device +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event sends data when UUP needs to fall back, to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8103,7 +8303,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8112,7 +8312,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8121,7 +8321,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8140,13 +8340,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8156,7 +8356,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8177,7 +8377,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8201,7 +8401,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8223,7 +8423,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8248,37 +8448,37 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 8be2e02435..12bf3f543c 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -303,7 +303,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -594,7 +594,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -612,7 +612,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -623,7 +623,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -655,7 +655,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -666,7 +666,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -688,7 +688,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -699,7 +699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -722,7 +722,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -733,7 +733,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -755,7 +755,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -766,7 +766,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -788,7 +788,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -799,7 +799,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -821,7 +821,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -832,7 +832,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -873,7 +873,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -884,7 +884,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -922,7 +922,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -933,7 +933,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -962,7 +962,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -973,7 +973,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1003,7 +1003,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1014,7 +1014,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1039,7 +1039,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1050,7 +1050,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1076,7 +1076,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1087,7 +1087,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1115,7 +1115,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1126,7 +1126,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1151,7 +1151,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1162,7 +1162,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1187,7 +1187,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1216,7 +1216,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1227,7 +1227,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1251,7 +1251,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1262,7 +1262,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1291,7 +1291,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1302,7 +1302,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1313,7 +1313,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1332,7 +1332,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1343,7 +1343,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1354,7 +1354,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1379,7 +1379,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1390,7 +1390,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1401,7 +1401,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1435,7 +1435,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1446,7 +1446,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1470,7 +1470,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1481,7 +1481,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1505,7 +1505,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1516,7 +1516,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1541,7 +1541,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1552,7 +1552,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1576,7 +1576,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1587,7 +1587,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1611,7 +1611,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1622,7 +1622,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1646,7 +1646,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1657,7 +1657,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1681,7 +1681,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1692,7 +1692,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1716,7 +1716,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1727,7 +1727,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1755,7 +1755,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1766,7 +1766,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1833,7 +1833,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1844,7 +1844,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1857,7 +1857,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1875,7 +1875,7 @@ The following fields are available: ### MicCoords -This event provides information about the location and orientation of the microphone element. +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1889,7 +1889,7 @@ The following fields are available: ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo -This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1914,7 +1914,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1932,7 +1932,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1943,7 +1943,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1954,19 +1954,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1985,14 +1975,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2004,7 +1994,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2019,7 +2009,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2062,7 +2052,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2072,7 +2062,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2095,7 +2085,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2137,7 +2127,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2183,7 +2173,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2206,7 +2196,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2224,7 +2214,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2243,7 +2233,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2255,7 +2245,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2268,7 +2258,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2289,7 +2279,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2302,7 +2292,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2348,7 +2338,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2364,7 +2354,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2470,7 +2460,6 @@ The following fields are available: - **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). - **ext_cs** Describes properties related to the schema of the event. See [Common Data Extensions.cs](#common-data-extensionscs). - **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). -- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a). - **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). - **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). - **ext_user** Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser). @@ -2483,14 +2472,6 @@ The following fields are available: - **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. - **ver** Represents the major and minor version of the extension. -### Common Data Extensions.m365a - -Describes the Microsoft 365-related fields. - -The following fields are available: - -- **enrolledTenantId** The enrolled tenant ID. -- **msp** A bitmask that lists the active programs. ### Common Data Extensions.os @@ -2570,8 +2551,7 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. - -## Common data fields +## Common Data Fields ### Ms.Device.DeviceInventoryChange @@ -2579,18 +2559,17 @@ Describes the installation state for all hardware and software components availa The following fields are available: -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. - +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. ## Compatibility events ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2626,7 +2605,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2763,7 +2742,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2777,7 +2756,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2790,7 +2769,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2804,7 +2783,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2818,7 +2797,7 @@ The following fields are available: ### TelClientSynthetic.AbnormalShutdown_0 -This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date. +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2887,7 +2866,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2906,7 +2885,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2925,15 +2904,15 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -3089,7 +3068,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -Event to indicate that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3105,7 +3084,7 @@ The following fields are available: - **IsDeviceNetworkMetered** Indicates whether the device is connected to a metered network. - **IsDeviceOobeBlocked** Indicates whether user approval is required to install updates on the device. - **IsDeviceRequireUpdateApproval** Indicates whether user approval is required to install updates on the device. -- **IsDeviceSccmManaged** Indicates whether the device is running the Configuration Manager client to keep the operating system and applications up to date. +- **IsDeviceSccmManaged** Indicates whether the device is running the Microsoft SCCM (System Center Configuration Manager) to keep the operating system and applications up to date. - **IsDeviceUninstallActive** Indicates whether the OS (operating system) on the device was recently updated. - **IsDeviceUpdateNotificationLevel** Indicates whether the device has a set policy to control update notifications. - **IsDeviceUpdateServiceManaged** Indicates whether the device uses WSUS (Windows Server Update Services). @@ -3116,7 +3095,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3129,7 +3108,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3142,7 +3121,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3154,7 +3133,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3167,7 +3146,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3179,7 +3158,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3192,7 +3171,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3205,7 +3184,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3217,7 +3196,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3230,7 +3209,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3242,7 +3221,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3255,7 +3234,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3267,7 +3246,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3280,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3293,7 +3272,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3305,7 +3284,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3318,7 +3297,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3330,7 +3309,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3343,7 +3322,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3356,7 +3335,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3368,7 +3347,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3382,7 +3361,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3395,7 +3374,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3408,7 +3387,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3422,7 +3401,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3435,7 +3414,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3449,7 +3428,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3462,7 +3441,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3476,7 +3455,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3488,7 +3467,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3501,7 +3480,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3513,7 +3492,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3527,7 +3506,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3540,7 +3519,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3553,7 +3532,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3565,7 +3544,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3577,7 +3556,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3590,7 +3569,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3602,9 +3581,83 @@ The following fields are available: ## DISM events +### Microsoft.Windows.StartRep.DISMLatesInstalledLCU + +This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM + + +### Microsoft.Windows.StartRep.DISMPendingInstall + +This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRep.DISMRevertPendingActions + +This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The result from the operation to revert pending packages. + + +### Microsoft.Windows.StartRep.DISMUninstallLCU + +This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is being reported by DISM. + + +### Microsoft.Windows.StartRep.SRTRepairActionEnd + +This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is reported. +- **SRTRepairAction** The action that was taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRepairActionStart + +This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRepairAction** The action that is being taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd + +This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The final result code for the root cause operation. +- **SRTRootCauseDiag** The name of the root cause operation that ran. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagStart + +This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRootCauseDiag** The name of a specific diagnostic. + + ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU -The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3613,16 +3666,49 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMPendingInstall -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **dismPendingInstallPackageName** The name of the pending package. +### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd + +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **failedUninstallCount** The number of driver updates that failed to uninstall. +- **failedUninstallFlightIds** The Flight IDs (identifiers of beta releases) of driver updates that failed to uninstall. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRepairAction** The scenario name for a repair. +- **successfulUninstallCount** The number of successfully uninstalled driver updates. +- **successfulUninstallFlightIds** The Flight IDs (identifiers of beta releases) of successfully uninstalled driver updates. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionStart + +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRepairAction** The scenario name for a repair. + + ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd -The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3634,7 +3720,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart -The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3645,7 +3731,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.DeviceInstall -This critical event sends information about the driver installation that took place. +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3699,7 +3785,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd -This event sends data about the driver installation once it is completed. +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3718,7 +3804,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart -This event sends data about the driver that the new driver installation is replacing. +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3910,7 +3996,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3952,7 +4038,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4005,7 +4091,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4013,9 +4099,27 @@ The following fields are available: - **devinv** The file version of the Device inventory component. +### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd + +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **CatalogSigners** Signers from catalog. Each signer starts with Chain. +- **DigestAlgorithm** The pseudonymizing (hashing) algorithm used when the file or package was signed. +- **DriverPackageStrongName** Optional. Available only if FileSigningInfo is collected on a driver package. +- **EmbeddedSigners** Embedded signers. Each signer starts with Chain. +- **FileName** The file name of the file whose signatures are listed. +- **FileType** Either exe or sys, depending on if a driver package or application executable. +- **InventoryVersion** The version of the inventory file generating the events. +- **Thumbprint** Comma separated hash of the leaf node of each signer. Semicolon is used to separate CatalogSigners from EmbeddedSigners. There will always be a trailing comma. + + ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4044,7 +4148,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4056,7 +4160,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4067,7 +4171,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4080,7 +4184,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4091,7 +4195,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4102,7 +4206,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4113,7 +4217,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4137,7 +4241,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4148,7 +4252,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4159,7 +4263,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4189,7 +4293,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4200,7 +4304,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4215,7 +4319,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4226,7 +4330,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4282,7 +4386,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4293,7 +4397,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4304,7 +4408,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4317,7 +4421,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4328,7 +4432,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4355,7 +4459,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4366,7 +4470,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4377,7 +4481,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4399,7 +4503,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4410,7 +4514,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4437,21 +4541,54 @@ The following fields are available: - **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4484,7 +4621,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4495,7 +4632,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4506,7 +4643,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4524,7 +4661,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4535,7 +4672,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4561,7 +4698,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4572,7 +4709,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4587,7 +4724,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4598,7 +4735,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4609,7 +4746,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4624,7 +4761,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4635,7 +4772,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4649,7 +4786,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4660,7 +4797,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4692,7 +4829,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4703,7 +4840,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4715,7 +4852,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4726,7 +4863,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4737,7 +4874,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4748,7 +4885,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4763,7 +4900,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4771,7 +4908,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4779,7 +4916,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4790,7 +4927,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4802,7 +4939,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4810,7 +4947,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4827,10 +4964,9 @@ The following fields are available: - **BytesRead** The total number of bytes read from or read by the OS upon system startup. - **BytesWritten** The total number of bytes written to or written by the OS upon system startup. - ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4861,7 +4997,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig -This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4886,7 +5022,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem -This event is sent when a problem code is cleared from a device. +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4901,7 +5037,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem -This event is sent when a new problem code is assigned to a device. +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4949,6 +5085,7 @@ This config event sends basic device connectivity and configuration information The following fields are available: +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). @@ -4974,6 +5111,7 @@ This config event sends basic device connectivity and configuration information The following fields are available: +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). @@ -5021,24 +5159,24 @@ The following fields are available: ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: -- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''. -- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. -- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). -- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). -- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. -- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. -- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. -- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. -- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). -- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. - **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. -- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. - **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. - **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. - **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. @@ -5046,24 +5184,24 @@ The following fields are available: - **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. - **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. -- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. - **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. -- **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). -- **appPingEventEventType** An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown). +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. - **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. - **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. -- **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. -- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. -- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. -- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. -- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. -- **appVersion** The version of the product install. Default: '0.0.0.0'. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **eventType** A string representation of appPingEventEventType indicating the type of the event. -- **hwHasAvx** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. @@ -5073,26 +5211,52 @@ The following fields are available: - **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. - **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. - **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. -- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. - **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. - **osVersion** The primary version of the operating system. '' if unknown. Default: ''. - **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. - **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. -- **requestDomainJoined** '1' if the device is part of a managed enterprise domain. Otherwise '0'. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. - **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. - **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. - **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. - **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. -- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. -- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. -- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + ### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -5166,7 +5330,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5178,7 +5342,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5189,7 +5353,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5203,7 +5367,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -5277,7 +5441,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5290,7 +5454,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5302,7 +5466,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5318,7 +5482,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5331,7 +5495,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5341,7 +5505,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5351,7 +5515,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5362,7 +5526,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5371,7 +5535,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5379,11 +5543,38 @@ The following fields are available: - **winInetError** The HResult of the operation. +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5395,7 +5586,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5409,26 +5600,11 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. - **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. - **threadId** The ID of the thread on which the activity is executing. @@ -5436,7 +5612,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5453,7 +5629,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -5470,7 +5646,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5487,7 +5663,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5507,7 +5683,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5662,7 +5838,7 @@ The following fields are available: - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. - **RemediationShellDeviceProSku** Indicates whether a Windows 10 Professional edition is detected. - **RemediationShellDeviceQualityUpdatesPaused** Indicates whether Quality Updates are paused on the device. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceSedimentMutexInUse** Indicates whether the Sediment Pack mutual exclusion object (mutex) is in use. - **RemediationShellDeviceSetupMutexInUse** Indicates whether device setup is in progress. - **RemediationShellDeviceWuRegistryBlocked** Indicates whether the Windows Update is blocked on the device via the registry. @@ -5874,7 +6050,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5912,7 +6088,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5930,7 +6106,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5945,7 +6121,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5958,7 +6134,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5976,7 +6152,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6000,7 +6176,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6021,6 +6197,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -6054,7 +6231,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6078,7 +6255,7 @@ The following fields are available: ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6098,7 +6275,7 @@ The following fields are available: ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6119,7 +6296,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -6204,7 +6381,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -6235,7 +6412,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -6326,7 +6503,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6348,7 +6525,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6423,6 +6600,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart. - **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation. - **MsiAction** The stage of MSI installation where it failed. - **MsiProductCode** The unique identifier of the MSI installer. @@ -6452,7 +6630,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6479,6 +6657,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -6497,7 +6676,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6513,7 +6692,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6557,7 +6736,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6572,7 +6751,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6633,7 +6812,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6651,7 +6830,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6667,7 +6846,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6704,7 +6883,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6724,7 +6903,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6740,7 +6919,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6758,7 +6937,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6776,7 +6955,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6793,7 +6972,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6819,7 +6998,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6839,7 +7018,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6855,7 +7034,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6873,7 +7052,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6882,14 +7061,16 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6908,7 +7089,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6932,7 +7113,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6948,7 +7129,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6964,7 +7145,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6998,7 +7179,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7008,7 +7189,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7066,7 +7247,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7230,7 +7411,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7255,7 +7436,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7274,7 +7455,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7313,9 +7494,65 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.DetectionsOnlyFailed + +Failed to apply the named diagnostic. + +The following fields are available: + +- **hResult** The error code from attempting the diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + +### Microsoft.Windows.WaaSMedic.RemediationsOnlyFailed + +This event indicates that some plugins failed to complete remediation. This data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **hResult** A resulting error code. +- **versionString** The string for which plugins failed. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7776,7 +8013,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. +This event sends data when the Windows System Kit is used to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7791,7 +8028,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCustomization -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. +This event sends data when the Windows System Kit is used to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7807,7 +8044,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskWorkspaceCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. +This event sends data when the Windows System Kit is used to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7825,15 +8062,29 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **wUfBConnected** Result of WUfB connection check. + + ## Windows Update Delivery Optimization events ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7867,7 +8118,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7922,7 +8173,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7942,7 +8193,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7978,7 +8229,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8000,7 +8251,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8016,7 +8267,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8040,7 +8291,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8056,7 +8307,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8083,7 +8334,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8101,7 +8352,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8117,7 +8368,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8132,7 +8383,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8158,7 +8409,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8174,7 +8425,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8190,7 +8441,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8206,7 +8457,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8222,7 +8473,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8238,7 +8489,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderToast -This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. +This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8254,7 +8505,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -8272,9 +8523,18 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8283,9 +8543,19 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot + +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **isOnAC** The power source for AC or battery power. +- **scanTriggerSource** The source of a triggered scan. + + ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8297,7 +8567,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8309,7 +8579,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8319,7 +8589,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8338,7 +8608,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -8380,7 +8650,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DetectionResult -This event runs when an update is detected. This helps ensure Windows is kept up to date. +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. The following fields are available: @@ -8393,7 +8663,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8409,7 +8679,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -8426,7 +8696,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8435,7 +8705,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8444,7 +8714,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8455,7 +8725,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8472,7 +8742,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8482,7 +8752,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8499,7 +8769,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -8516,7 +8786,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -8542,7 +8812,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8556,7 +8826,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -8566,9 +8836,22 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data when Oobe Update download is in progress, to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An ID associated with an update. +- **updateScenarioType** A type of USO session. +- **wuDeviceid** A device Id associated with Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -8585,7 +8868,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8594,7 +8877,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -8613,7 +8896,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -8625,7 +8908,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -8637,7 +8920,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8656,7 +8939,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -8669,7 +8952,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -8682,7 +8965,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8692,7 +8975,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -8708,7 +8991,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8720,7 +9003,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8732,7 +9015,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8742,7 +9025,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8755,7 +9038,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8770,7 +9053,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8780,7 +9063,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8796,7 +9079,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8818,7 +9101,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8827,7 +9110,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8847,7 +9130,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8857,7 +9140,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8875,9 +9158,192 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that updates have been blocked requiring intervention. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the required UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the device has completed the reboot after installing expected update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus -This event is received when there is status on a push notification. +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8891,11 +9357,33 @@ The following fields are available: - **UpdateHealthToolsPushCurrentStep** The current step for the push notification +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Windows Update mitigation events ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8919,7 +9407,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8941,7 +9429,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8962,11 +9450,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8976,7 +9485,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8989,7 +9498,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -9004,7 +9513,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -9014,13 +9523,13 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index adb454d3a2..1623bf2d24 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 --- @@ -38,7 +38,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -266,7 +266,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -486,6 +486,7 @@ The following fields are available: - **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. - **DecisionSystemProcessor_RS2** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1** The count of the number of this particular object type present on this device. - **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. - **DecisionTest_21H1** The count of the number of this particular object type present on this device. - **DecisionTest_21H1Setup** The count of the number of this particular object type present on this device. @@ -530,7 +531,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -548,7 +549,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -559,7 +560,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -578,12 +579,7 @@ The following fields are available: - **ActiveNetworkConnection** Indicates whether the device is an active network device. - **AppraiserVersion** The version of the appraiser file generating the events. -- **CosDeviceRating** An enumeration that indicates if there is a driver on the target operating system. -- **CosDeviceSolution** An enumeration that indicates how a driver on the target operating system is available. -- **CosDeviceSolutionUrl** Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd . Empty string -- **CosPopulatedFromId** The expected uplevel driver matching ID based on driver coverage data. - **IsBootCritical** Indicates whether the device boot is critical. -- **UplevelInboxDriver** Indicates whether there is a driver uplevel for this device. - **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update. - **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver. - **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update. @@ -591,7 +587,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -602,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -624,7 +620,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -635,7 +631,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -656,9 +652,20 @@ The following fields are available: - **ResolveAttempted** This will always be an empty string when sending diagnostic data. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove + +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -678,9 +685,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove + +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -700,9 +718,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove + +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -722,9 +751,20 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove + +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -765,7 +805,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -776,7 +816,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -814,7 +854,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -825,7 +865,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -847,14 +887,13 @@ The following fields are available: - **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? - **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block? - **DriverIsDriverBlocked** Is the driver package blocked because of a driver block? -- **DriverIsTroubleshooterBlocked** Indicates whether the driver package is blocked because of a troubleshooter block. - **DriverShouldNotMigrate** Should the driver package be migrated during upgrade? - **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -865,7 +904,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -893,9 +932,20 @@ The following fields are available: - **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove + +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -920,7 +970,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -944,9 +994,20 @@ The following fields are available: - **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove + +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -972,9 +1033,20 @@ The following fields are available: - **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center? +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove + +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -997,9 +1069,9 @@ The following fields are available: - **HasBiosBlock** Does the device have a BIOS block? -### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1008,6 +1080,30 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync + +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionTestAdd + +This event provides diagnostic data for testing decision add events. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser binary generating the events. +- **TestDecisionDataPoint1** Test data point 1. +- **TestDecisionDataPoint2** Test data point 2. + + ### Microsoft.Windows.Appraiser.General.DecisionTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -1046,7 +1142,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1075,7 +1171,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1086,7 +1182,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1110,7 +1206,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1121,7 +1217,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1150,7 +1246,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1161,7 +1257,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1172,7 +1268,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1185,9 +1281,20 @@ The following fields are available: - **Model** The model field from Win32_ComputerSystem. +### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove + +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1198,7 +1305,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemProcessorEndSync -This event indicates that a full set of InventorySystemProcessorAdd events has been sent. +This event indicates that a full set of InventorySystemProcessorAdd events has been sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1209,7 +1316,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemProcessorStartSync -This event indicates that a new set of InventorySystemProcessorAdd events will be sent. +This event indicates that a new set of InventorySystemProcessorAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1218,6 +1325,19 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. +### Microsoft.Windows.Appraiser.General.InventoryTestAdd + +This event provides diagnostic data for testing event adds. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the component sending the data. +- **TestInvDataPoint1** Test inventory data point 1. +- **TestInvDataPoint2** Test inventory data point 2. + + ### Microsoft.Windows.Appraiser.General.InventoryTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -1242,7 +1362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1267,7 +1387,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1278,7 +1398,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1289,7 +1409,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1321,9 +1441,20 @@ The following fields are available: - **virtualKB** The amount of virtual memory (in KB). +### Microsoft.Windows.Appraiser.General.SystemMemoryRemove + +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1345,9 +1476,20 @@ The following fields are available: - **CompareExchange128Support** Does the CPU support CompareExchange128? +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove + +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1369,9 +1511,20 @@ The following fields are available: - **LahfSahfSupport** Does the CPU support LAHF/SAHF? +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove + +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1394,9 +1547,20 @@ The following fields are available: - **NXProcessorSupport** Does the processor support NX? +### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove + +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1418,9 +1582,20 @@ The following fields are available: - **PrefetchWSupport** Does the processor support PrefetchW? +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove + +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1442,9 +1617,20 @@ The following fields are available: - **SSE2ProcessorSupport** Does the processor support SSE2? +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove + +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1466,9 +1652,20 @@ The following fields are available: - **MaximumTouches** The maximum number of touch points supported by the device hardware. +### Microsoft.Windows.Appraiser.General.SystemTouchRemove + +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1490,9 +1687,20 @@ The following fields are available: - **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. +### Microsoft.Windows.Appraiser.General.SystemWimRemove + +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1516,7 +1724,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1527,7 +1735,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1553,9 +1761,20 @@ The following fields are available: - **WlanNativeDriver** Does the device have a non-emulated WLAN driver? +### Microsoft.Windows.Appraiser.General.SystemWlanRemove + +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1576,6 +1795,8 @@ The following fields are available: - **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. - **AuxFinal** Obsolete, always set to false. - **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. +- **CountCustomSdbs** The number of custom Sdbs used by Appraiser. +- **CustomSdbGuids** Guids of the custom Sdbs used by Appraiser; Semicolon delimited list. - **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. - **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. - **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. @@ -1619,9 +1840,20 @@ The following fields are available: - **WmdrmPurchased** Indicates if the system has any files with permanent licenses. +### Microsoft.Windows.Appraiser.General.WmdrmRemove + +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1634,7 +1866,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1652,7 +1884,7 @@ The following fields are available: ### MicCoords -This event provides information about the location and orientation of the microphone element. +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1666,7 +1898,7 @@ The following fields are available: ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo -This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1702,7 +1934,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1720,7 +1952,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1731,7 +1963,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1742,19 +1974,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1774,14 +1996,14 @@ The following fields are available: - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. -- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1793,7 +2015,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1809,7 +2031,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1853,7 +2075,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1863,7 +2085,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1886,7 +2108,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1928,7 +2150,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1974,7 +2196,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1997,7 +2219,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2010,6 +2232,7 @@ The following fields are available: - **IsWdagFeatureEnabled** Indicates whether Windows Defender Application Guard is enabled. - **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security. - **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting. +- **ShadowStack** The bit fields of SYSTEM_SHADOW_STACK_INFORMATION representing the state of the Intel CET (Control Enforcement Technology) hardware security feature. - **SModeState** The Windows S mode trail state. - **SystemGuardState** Indicates the SystemGuard state. NotCapable (0), Capable (1), Enabled (2), Error (0xFF). - **TpmReadyState** Indicates the TPM ready state. NotReady (0), ReadyForStorage (1), ReadyForAttestation (2), Error (0xFF). @@ -2019,7 +2242,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2038,7 +2261,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2050,7 +2273,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2064,7 +2287,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2085,7 +2308,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2098,7 +2321,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2144,7 +2367,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2153,14 +2376,16 @@ The following fields are available: - **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present. - **IsVDI** Is the device using Virtual Desktop Infrastructure? - **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors. +- **IsWVDSessionHost** Indicates if this is a Windows Virtual Device session host. - **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware. - **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware. - **VMId** A string that identifies a virtual machine. +- **WVDEnvironment** Represents the WVD service environment to which this session host has been joined. ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2169,6 +2394,7 @@ The following fields are available: - **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured - **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting - **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. +- **IsHotPatchEnrolled** Represents the current state of the device in relation to enrollment in the hotpatch program. - **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it? - **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update? - **OSAssessmentForQualityUpdate** Is the device on the latest quality update? @@ -2185,6 +2411,7 @@ The following fields are available: - **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates. - **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades. - **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network. +- **WULCUVersion** Version of the LCU Installed on the machine. - **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier. - **WUPauseState** Retrieves WU setting to determine if updates are paused. - **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default). @@ -2243,7 +2470,6 @@ The following fields are available: - **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp). - **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). - **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). -- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a). - **ext_mscv** Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv). - **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). - **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). @@ -2255,14 +2481,6 @@ The following fields are available: - **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. - **ver** Represents the major and minor version of the extension. -### Common Data Extensions.m365a - -Describes the Microsoft 365-related fields. - -The following fields are available: - -- **enrolledTenantId** The enrolled tenant ID. -- **msp** A bitmask that lists the active programs. ### Common Data Extensions.mscv @@ -2403,7 +2621,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2546,7 +2764,7 @@ This event reports the results of deferring Windows Content to keep Windows up t ### TelClientSynthetic.AbnormalShutdown_0 -This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date. +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2617,7 +2835,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2635,7 +2853,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2653,15 +2871,15 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -2885,7 +3103,7 @@ This event is a low latency health alert that is part of the 4Nines device healt ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2901,7 +3119,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU -The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2910,7 +3128,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMPendingInstall -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2919,7 +3137,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2928,7 +3146,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMUninstallLCU -The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. +The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2937,7 +3155,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd -The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2952,7 +3170,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRepairActionStart -The SRT Repair Action Start event sends information to report repair operation started for given plug-in. +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2961,7 +3179,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd -The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2973,7 +3191,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart -The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2984,7 +3202,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.DeviceInstall -This critical event sends information about the driver installation that took place. +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3041,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd -This event sends data about the driver installation once it is completed. +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3060,7 +3278,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart -This event sends data about the driver that the new driver installation is replacing. +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3247,7 +3465,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3257,7 +3475,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3293,7 +3511,7 @@ The following fields are available: ### Microsoft.Windows.Holographic.Coordinator.HoloShellStateUpdated -This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. +This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3305,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Shell.HolographicFirstRun.AppActivated -This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. +This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3318,13 +3536,13 @@ The following fields are available: ### Microsoft.Windows.Shell.HolographicFirstRun.AppLifecycleService_Resuming -This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. +This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. ### TraceLoggingOasisUsbHostApiProvider.DeviceInformation -This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. +This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3366,7 +3584,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3407,7 +3625,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3417,7 +3635,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3435,7 +3653,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3448,6 +3666,7 @@ The following fields are available: - **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. - **InventoryVersion** The version of the inventory file generating the events. - **Language** The language code of the program. +- **MsiInstallDate** The install date recorded in the program's MSI package. - **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. - **MsiProductCode** A GUID that describe the MSI Product. - **Name** The name of the application. @@ -3464,7 +3683,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3476,7 +3695,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3513,7 +3732,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3526,7 +3745,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3537,7 +3756,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3548,9 +3767,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange) The following fields are available: @@ -3559,7 +3778,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3583,7 +3802,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3594,7 +3813,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3605,7 +3824,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3635,7 +3854,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3646,7 +3865,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3661,7 +3880,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3672,7 +3891,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3728,7 +3947,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3739,7 +3958,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3750,7 +3969,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3763,7 +3982,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3774,7 +3993,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3801,7 +4020,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3812,7 +4031,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3823,7 +4042,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3845,7 +4064,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3856,7 +4075,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3883,9 +4102,54 @@ The following fields are available: - **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration according to the DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3918,7 +4182,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3929,7 +4193,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3940,7 +4204,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3958,7 +4222,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3969,7 +4233,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3995,7 +4259,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4006,7 +4270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4021,7 +4285,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4032,7 +4296,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4043,7 +4307,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4058,7 +4322,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4069,7 +4333,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4083,7 +4347,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4094,7 +4358,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4126,7 +4390,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4137,7 +4401,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4149,7 +4413,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4160,7 +4424,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4171,7 +4435,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4182,7 +4446,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4197,7 +4461,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4205,7 +4469,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4213,7 +4477,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4224,7 +4488,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4235,7 +4499,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. This data helps ensure the device is up to date. +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4243,7 +4507,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4251,7 +4515,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4261,7 +4525,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.IoT.Client.CEPAL.MonitorStarted -This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. +This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. The data collected with this event is used to keep Windows performing properly. @@ -4279,7 +4543,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4310,7 +4574,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig -This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4335,7 +4599,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem -This event is sent when a problem code is cleared from a device. +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4348,7 +4612,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem -This event is sent when a new problem code is assigned to a device. +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4363,7 +4627,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.PreviousShutdownWasThermalShutdown -This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. +This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4484,7 +4748,7 @@ The following fields are available: ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -4584,7 +4848,7 @@ The following fields are available: ### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -4651,36 +4915,14 @@ The following fields are available: - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. - **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. -### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config - -This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. - -The following fields are available: - -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). -- **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full -- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). -- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. -- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4692,7 +4934,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4703,7 +4945,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4717,7 +4959,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4791,7 +5033,7 @@ The following fields are available: ### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceAdded -This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. +This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4809,7 +5051,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4823,11 +5065,386 @@ The following fields are available: - **SourceOSVersion** The source version of the operating system. +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + +## Surface events + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. + +## Update health events + +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted + +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted + +This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted + +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr + +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired + +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed + +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4839,7 +5456,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4851,672 +5468,11 @@ The following fields are available: - **userRegionCode** The current user's region setting -## Push Button Reset events - -### Microsoft.Windows.PBR.BitLockerWipeFinished - -This event sends error data after the BitLocker wipe finishes if there were any issues during the wipe. - -The following fields are available: - -- **error** The error code if there were any issues during the BitLocker wipe. -- **sessionID** This is the session ID. -- **succeeded** Indicates the BitLocker wipe successful completed. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.BootState - -This event sends data on the Windows Recovery Environment (WinRE) boot, which can be used to determine whether the boot was successful. - -The following fields are available: - -- **BsdSummaryInfo** Summary of the last boot. -- **sessionID** The ID of the push-button reset session. -- **timestamp** The timestamp of the boot state. - - -### Microsoft.Windows.PBR.ClearTPMStarted - -This event sends basic data about the recovery operation on the device to allow investigation. - -The following fields are available: - -- **sessionID** The ID for this push-button restart session. -- **timestamp** The time when the Trusted Platform Module will be erased. - - -### Microsoft.Windows.PBR.ClientInfo - -This event indicates whether push-button reset (PBR) was initiated while the device was online or offline. - -The following fields are available: - -- **name** Name of the user interface entry point. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The time when this event occurred. - - -### Microsoft.Windows.PBR.Completed - -This event sends data about the recovery operation on the device to allow for investigation. - -The following fields are available: - -- **sessionID** The ID of the push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.DataVolumeCount - -This event provides the number of additional data volumes that the push-button reset operation has detected. - -The following fields are available: - -- **count** The number of attached data drives. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.DiskSpaceRequired - -This event sends the peak disk usage required for the push-button reset operation. - -The following fields are available: - -- **numBytes** The number of bytes required for the reset operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.EnterAPI - -This event is sent at the beginning of each push-button reset (PRB) operation. - -The following fields are available: - -- **apiName** Name of the API command that is about to execute. -- **sessionID** The session ID. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.EnteredOOBE - -This event is sent when the push-button reset (PRB) process enters the Out Of Box Experience (OOBE). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.LeaveAPI - -This event is sent when the push-button reset operation is complete. - -The following fields are available: - -- **apiName** Name of the API command that completed. -- **errorCode** Error code if an error occurred during the API call. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation is successfully completed. -- **success** Indicates whether the API call was successful. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionFinished - -This event is sent when the OEM extensibility scripts have completed. - -The following fields are available: - -- **exitCode** The exit code from OEM extensibility scripts to push-button reset. -- **param** Parameters used for the OEM extensibility script. -- **phase** Name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the OEM extensibility script executed successfully. -- **timedOut** Indicates whether the OEM extensibility script timed out. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionStarted - -This event is sent when the OEM extensibility scripts start to execute. - -The following fields are available: - -- **param** The parameters used by the OEM extensibility script. -- **phase** The name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteFinished - -This event is sent at the end of a push-button reset (PBR) operation. - -The following fields are available: - -- **error** Indicates the result code of the event. -- **index** The operation index. -- **operation** The name of the operation. -- **phase** The name of the operation phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteStarted - -This event is sent at the beginning of a push-button reset operation. - -The following fields are available: - -- **index** The index of this operation. -- **operation** The name of this operation. -- **phase** The phase of this operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. -- **weight** The weight of the operation used to distribute the change in percentage. - - -### Microsoft.Windows.PBR.OperationQueueConstructFinished - -This event is sent when construction of the operation queue for push-button reset is finished. - -The following fields are available: - -- **error** The result code for operation queue construction. -- **errorCode** Represents any error code during the API call. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationQueueConstructStarted - -This event is sent when construction of the operation queue for push-button reset is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.PBRClearTPMFailed - -This event is sent when there was a failure while clearing the Trusted Platform Module (TPM). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionFailed - -This event is sent when the push-button reset operation fails to construct a new copy of the operating system. - -The following fields are available: - -- **HRESULT** Indicates the result code of the event. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. -- **SPErrorCode** The error code for the Setup Platform operation. -- **SPOperation** The last Setup Platform operation. -- **SPPhase** The last phase of the Setup Platform operation. - - -### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionSucceed - -This event is sent when the push-button reset operation succeeds in constructing a new copy of the operating system. - -The following fields are available: - -- **CBSPackageCount** The Component Based Servicing package count. -- **CustomizationPackageCount** The Customization package count. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFailed - -This event is sent when the push-button reset operation fails and rolls back to the previous state. - -The following fields are available: - -- **ErrorType** The result code for the push-button reset error. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFinalUserSelection - -This event is sent when the user makes the final selection in the user interface. - -The following fields are available: - -- **PBREraseData** Indicates whether the option to erase data is selected. -- **PBRRecoveryStrategy** The recovery strategy for the push-button reset operation. -- **PBRRepartitionDisk** Indicates whether the user has selected the option to repartition the disk. -- **PBRVariation** Indicates the push-button reset type. -- **PBRWipeDataDrives** Indicates whether the option to wipe the data drives is selected. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFormatOSVolumeSucceed - -This event is sent when the operation to format the operating system volume succeeds during push-button reset (PBR). - -The following fields are available: - -- **JustDeleteFiles** Indicates whether disk formatting was skipped. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRIOCTLErasureSucceed - -This event is sent when the erasure operation succeeds during push-button reset (PBR). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRLayoutImageFailed - -This event is sent when push-button reset fails to create a new image of Windows. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBROEM1Failed - -This event is sent when the first OEM extensibility operation is successfully completed. - -The following fields are available: - -- **HRESULT** The result error code from the OEM extensibility script. -- **Parameters** The parameters that were passed to the OEM extensibility script. -- **PBRType** The type of push-button reset. -- **ScriptName** The path to the OEM extensibility script. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReachedOOBE - -This event returns data when the PBR (Push Button Reset) process reaches the OOBE (Out of Box Experience). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReconstructionInitiated - -This event returns data when a PBR (Push Button Reset) reconstruction operation begins. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecks - -This event returns data when PBR (Push Button Reset) requirement checks begin. - -The following fields are available: - -- **DeploymentType** The type of deployment. -- **InstallType** The type of installation. -- **PBRType** The type of push-button reset. -- **SessionID** The ID for this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksFailed - -This event returns data when PBR (Push Button Reset) requirement checks fail. - -The following fields are available: - -- **DiskSpaceAvailable** The disk space available for the push-button reset. -- **DiskSpaceRequired** The disk space required for the push-button reset. -- **ErrorType** The type of error that occurred during the requirement checks phase of the push-button reset operation. -- **PBRImageVersion** The image version of the push-button reset tool. -- **PBRRecoveryStrategy** The recovery strategy for this phase of push-button reset. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **PBRType** The type of push-button reset specified by the user interface. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksPassed - -This event returns data when PBR (Push Button Reset) requirement checks are passed. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRImageType** The push-button reset image type. -- **PBRImageVersion** The version of the push-button reset image. -- **PBRRecoveryStrategy** The push-button reset recovery strategy. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRSucceed - -This event returns data when PBR (Push Button Reset) succeeds. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PhaseFinished - -This event returns data when a phase of PBR (Push Button Reset) has completed. - -The following fields are available: - -- **error** The result code for this phase of push-button reset. -- **phase** The name of this push-button reset phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether this phase of push-button reset executed successfully. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.PhaseStarted - -This event is sent when a phase of the push-button reset (PBR) operation starts. - -The following fields are available: - -- **phase** The name of this phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.ReconstructionInfo - -This event returns data about the PBR (Push Button Reset) reconstruction. - -The following fields are available: - -- **numPackagesAbandoned** The number of packages that were abandoned during the reconstruction operation of push-button reset. -- **numPackagesFailed** The number of packages that failed during the reconstruction operation of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **slowMode** The mode of reconstruction. -- **targetVersion** The target version of the OS for the reconstruction. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ResetOptions - -This event returns data about the PBR (Push Button Reset) reset options selected by the user. - -The following fields are available: - -- **overwriteSpace** Indicates whether the option was selected to erase data during push-button reset. -- **preserveWorkplace** Indicates whether the option was selected to reserve the workplace during push-button reset. -- **scenario** The selected scenario for the push-button on reset operation. -- **sessionID** The ID of this push-button on reset session. -- **timestamp** The timestamp of this push-button on reset event. -- **usePayload** Indicates whether Cloud PBR or Reconstruction was used. -- **wipeData** Indicates whether the option was selected to wipe additional drives during push-button reset. - - -### Microsoft.Windows.PBR.RetryQueued - -This event returns data about the retry count when PBR (Push Button Reset) is restarted due to a reboot. - -The following fields are available: - -- **attempt** The number of retry attempts that were made -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnedToOldOS - -This event returns data after PBR (Push Button Reset) has completed the rollback. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnTaskSchedulingFailed - -This event returns data when there is a failure scheduling a boot into WinRE (Windows Recovery). - -The following fields are available: - -- **errorCode** The error that occurred while scheduling the task. -- **sessionID** The ID of this push-button reset session. -- **taskName** The name of the task. -- **timestamp** The ID of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackFinished - -This event returns data when the PBR (Push Button Reset) rollback completes. - -The following fields are available: - -- **error** Any errors that occurred during rollback to the old operating system. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the rollback succeeded. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackStarted - -This event returns data when the PBR (Push Button Reset) rollback begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ScenarioNotSupported - -This event returns data when the PBR (Push Button Reset) scenario selected is not supported on the device. - -The following fields are available: - -- **errorCode** The error that occurred. -- **reason** The reason why this push-button reset scenario is not supported. -- **sessionID** The ID for this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionCreated - -This event returns data when the PRB (Push Button Reset) session is created at the beginning of the UI (user interface) process. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionResumed - -This event returns data when the PRB (Push Button Reset) session is resumed after reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionSaved - -This event returns data when the PRB (Push Button Reset) session is suspended between reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteFinished - -This event returns data when the PBR (Push Button Reset) setup finishes. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **systemState** Information about the system state of the Setup Platform operation. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteStarted - -This event returns data when the PBR (Push Button Reset) setup starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupFinalizeStarted - -This event returns data when the Finalize operation is completed by setup during PBR (Push Button Reset). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupOperationFailed - -This event returns data when a PRB (Push Button Reset) setup operation fails. - -The following fields are available: - -- **errorCode** An error that occurred during the setup phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **setupExecutionOperation** The name of the Setup Platform operation. -- **setupExecutionPhase** The phase of the setup operation that failed. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoField - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate reset options are shown to the user. - -The following fields are available: - -- **name** Name of the system information field. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. -- **value** The system information field value. - - -### Microsoft.Windows.PBR.SystemInfoListItem - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate options can be shown to the user. - -The following fields are available: - -- **index** The index number associated with the system information item. -- **name** The name of the list of system information items. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. -- **value** The value of the system information item. - - -### Microsoft.Windows.PBR.SystemInfoSenseFinished - -This event returns data when System Info Sense is finished. - -The following fields are available: - -- **error** The error code if an error occurred while querying for system information. -- **errorCode** Represents any error code during the API call. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the query for system information was successful. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoSenseStarted - -This event returns data when System Info Sense is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset event. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.UserAcknowledgeCleanupWarning - -This event returns data when the user acknowledges the cleanup warning pop-up after PRB (Push Button Reset) is complete. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserCancel - -This event returns data when the user confirms they wish to cancel PBR (Push Button Reset) from the user interface. - -The following fields are available: - -- **pageID** The page ID for the page the user canceled. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserConfirmStart - -This event returns data when the user confirms they wish to reset their device and PBR (Push Button Reset) begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallFinished - -This event returns data when WinRE (Windows Recovery) installation is complete. - -The following fields are available: - -- **errorCode** Any error that occurred during the Windows Recovery Environment (WinRE) installation. -- **sessionID** The ID of this push-button reset session. -- **success** Indicates whether the Windows Recovery Environment (WinRE) installation successfully completed. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallStarted - -This event returns data when WinRE (Windows Recovery) installation starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - ## Quality Update Assistant events ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -5532,7 +5488,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5547,7 +5503,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5566,7 +5522,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5591,7 +5547,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5623,6 +5579,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -5649,6 +5606,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. @@ -5656,7 +5614,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5743,7 +5701,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5774,7 +5732,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5865,7 +5823,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5887,7 +5845,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5990,7 +5948,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6037,7 +5995,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6053,7 +6011,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6080,6 +6038,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was then a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -6098,7 +6057,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6113,7 +6072,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6146,13 +6105,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallCancel -This event indicates the customer has cancelled uninstallation of Windows. +This event indicates the customer has cancelled uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallError -This event sends an error code when the Windows uninstallation fails. +This event sends an error code when the Windows uninstallation fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6161,19 +6120,19 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallReboot -This event is sent to signal an upcoming reboot during uninstallation of Windows. +This event is sent to signal an upcoming reboot during uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallStart -This event indicates that the Windows uninstallation has started. +This event indicates that the Windows uninstallation has started. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallUnavailable -This event sends diagnostic data when the Windows uninstallation is not available. +This event sends diagnostic data when the Windows uninstallation is not available. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6185,13 +6144,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.HasPendingActions -This event is sent when users have actions that will block the uninstall of the latest quality update. +This event is sent when users have actions that will block the uninstall of the latest quality update. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.IndicateLCUWasUninstalled -This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. +This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6200,7 +6159,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.LCUUninstall -This event is sent when the latest cumulative Windows update was uninstalled on a device. +This event is sent when the latest cumulative Windows update was uninstalled on a device. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6211,7 +6170,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRBlockedByPolicy -This event is sent when a push-button reset operation is blocked by the System Administrator. +This event is sent when a push-button reset operation is blocked by the System Administrator. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6221,7 +6180,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitFailed -This event signals a failed handoff between two recovery binaries. +This event signals a failed handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6230,7 +6189,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitSucceed -This event signals successful handoff between two recovery binaries. +This event signals successful handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6239,7 +6198,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRFailedOffline -This event reports the error code when recovery fails. +This event reports the error code when recovery fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6250,7 +6209,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.EsimPresentCheck -This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). +This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6261,7 +6220,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.PBRCorruptionRepairOption -This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. +This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6273,7 +6232,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.RepairNeeded -This event provides information about whether a system reset needs repair. +This event provides information about whether a system reset needs repair. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6285,7 +6244,7 @@ The following fields are available: ### Microsoft.Windows.UEFI.ESRT -This event sends basic data during boot about the firmware loaded or recently installed on the machine. This helps to keep Windows up to date. +This event sends basic data during boot about the firmware loaded or recently installed on the machine. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -6313,7 +6272,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6331,10 +6290,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **FlightId** Unique ID for each flight. - **ObjectId** Unique value for each Update Agent mode. @@ -6347,13 +6307,18 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean indicating whether a cancel was requested. - **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. - **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. - **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. +- **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. +- **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. +- **DownloadedSizePSFX** Cumulative size (in bytes) of downloaded PSFX content. - **DownloadRequests** Number of times a download was retried. - **ErrorCode** The error code returned for the current download request phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. @@ -6384,10 +6349,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether a cancel was requested. - **CanonicalRequestedOnError** Indicates if an error caused a reversion to a different type of compressed update (TRUE or FALSE). - **ElapsedTickCount** Time taken for expand phase. - **EndFreeSpace** Free space after expand phase. @@ -6405,7 +6371,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6423,10 +6389,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean to indicate whether a cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. - **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). @@ -6441,7 +6408,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6458,7 +6425,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6484,7 +6451,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6504,7 +6471,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6520,7 +6487,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6538,7 +6505,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6547,14 +6514,16 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6573,7 +6542,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6596,7 +6565,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6629,7 +6598,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6639,7 +6608,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6697,7 +6666,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6861,7 +6830,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6886,7 +6855,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6905,7 +6874,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6944,9 +6913,35 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6997,7 +6992,7 @@ The following fields are available: ### Value -This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. +This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7024,7 +7019,7 @@ The following fields are available: ### WheaProvider.WheaErrorRecord -This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. +This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -7045,7 +7040,7 @@ The following fields are available: ### Microsoft.Windows.Security.WSC.DatastoreMigratedVersion -This event provides information about the datastore migration and whether it was successful. +This event provides information about the datastore migration and whether it was successful. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7056,7 +7051,7 @@ The following fields are available: ### Microsoft.Windows.Security.WSC.GetCallerViaWdsp -This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. +This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. The data collected with this event is used to help keep Windows secure and performing properly. The following fields are available: @@ -7466,7 +7461,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed -This event sends basic telemetry on the failure of the Feature Rollback. +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7482,7 +7477,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable -This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7497,7 +7492,44 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed + +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure Error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Release Channel. +- **wUfBConnected** Result of Windows Update for Business connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Device in the semi-annual channel. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted + +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. @@ -7505,7 +7537,7 @@ This event sends basic information indicating that Feature Rollback has started. ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7539,7 +7571,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7595,7 +7627,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7615,7 +7647,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7652,7 +7684,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7674,7 +7706,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7690,7 +7722,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7714,7 +7746,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7730,7 +7762,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7757,7 +7789,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7775,7 +7807,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7791,7 +7823,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7806,7 +7838,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7832,7 +7864,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7849,7 +7881,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7866,7 +7898,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7883,7 +7915,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7900,7 +7932,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7918,9 +7950,36 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **callContext** List of telemetry activities containing this error. +- **currentContextId** Identifier for the newest telemetry activity containing this error. +- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any). +- **currentContextName** Name of the newest telemetry activity containing this error. +- **failureCount** Number of failures. +- **failureId** Id of the failure. +- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast). +- **fileName** Source code file name where the error occurred. +- **function** Function where the failure occurred. +- **hresult** Failure error code. +- **lineNumber** Line number within the source code file where the error occurred. +- **message** Custom message associated with the failure (if any). +- **module** Name of the binary where the error occurred. +- **originatingContextId** Identifier for the oldest telemetry activity containing this error +- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any). +- **originatingContextName** Name of the oldest telemetry activity containing this error. +- **PartA_PrivTags** Privacy tags. +- **threadId** Identifier of the thread the error occurred on. +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7931,7 +7990,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7943,7 +8002,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7955,7 +8014,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7974,7 +8033,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -8016,7 +8075,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8032,7 +8091,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -8047,9 +8106,30 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.DTUEnabled + +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wuDeviceid** Device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.DTUInitiated + +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **dtuErrorCode** Return code from creating the DTU Com Server. +- **isDtuApplicable** Determination of whether DTU is applicable to the machine it is running on. +- **utilizeDtuOverWu** Whether DTU should be utilized over Windows Update. +- **wuDeviceid** Device ID used by Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8066,7 +8146,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8076,7 +8156,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8093,7 +8173,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -8110,7 +8190,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -8136,7 +8216,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8150,7 +8230,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -8162,7 +8242,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8171,7 +8251,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -8190,7 +8270,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -8202,7 +8282,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -8214,7 +8294,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8231,7 +8311,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -8244,7 +8324,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -8257,7 +8337,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8267,7 +8347,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -8283,7 +8363,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8293,9 +8373,21 @@ The following fields are available: - **wuDeviceid** The device identifier. +### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel + +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** The current battery charge capacity. +- **batteryLevelThreshold** The battery capacity threshold to stop update activity. +- **updatePhase** The current state of the update process. +- **wuDeviceid** The device identifier. + + ### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorInvalidSignature -This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. +This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8306,7 +8398,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkInvalidCmd -This event indicates a critical error with the callback binary requested by the updater. +This event indicates a critical error with the callback binary requested by the updater. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8317,7 +8409,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8337,7 +8429,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8350,7 +8442,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdaterCallbackFailed -This event is sent when an updater failed to execute the registered callback. +This event is sent when an updater failed to execute the registered callback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8362,7 +8454,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8388,7 +8480,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8398,7 +8490,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8414,7 +8506,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8436,7 +8528,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8445,7 +8537,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8465,7 +8557,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8485,7 +8577,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8512,7 +8604,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8536,7 +8628,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8558,7 +8650,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8579,11 +8671,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.BeginScenario -This event is sent when the Update Reserve Manager is called to begin a scenario. +This event is sent when the Update Reserve Manager is called to begin a scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8599,7 +8712,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.ClearReserve -This event is sent when the Update Reserve Manager clears one of the reserves. +This event is sent when the Update Reserve Manager clears one of the reserves. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8610,7 +8723,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8620,7 +8733,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.EndScenario -This event is sent when the Update Reserve Manager ends an active scenario. +This event is sent when the Update Reserve Manager ends an active scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8636,7 +8749,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8649,7 +8762,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeReserves -This event is sent when reserves are initialized on the device. +This event is sent when reserves are initialized on the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8678,7 +8791,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8693,7 +8806,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8703,7 +8816,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.ReevaluatePolicy -This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. +This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8714,13 +8827,13 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.TurnOffReserves -This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. +This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8735,7 +8848,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index da656fd6ef..a1832d8486 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -1,6 +1,6 @@ --- description: Use this article to learn more about what required Windows diagnostic data is gathered. -title: Windows 10, version 2004 required diagnostic events and fields (Windows 10) +title: Windows 10, version 20H2 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 ms.mktglfcycl: manage @@ -13,11 +13,11 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 08/31/2020 +ms.date: 09/30/2020 --- -# Windows 10, version 2004 required Windows diagnostic events and fields +# Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields > [!IMPORTANT] @@ -26,6 +26,7 @@ ms.date: 08/31/2020 **Applies to** +- Windows 10, version 20H2 - Windows 10, version 2004 @@ -37,7 +38,6 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -1166,14 +1166,6 @@ The following fields are available: - **PrefetchWSupport** Does the processor support PrefetchW? -### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWEndSync - -Deprecated in RS3. This event indicates that a full set of SystemProcessorPrefetchWAdd events has been sent. The data collected with this event is used to help keep Windows up to date. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -1257,14 +1249,6 @@ The following fields are available: - **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. -### Microsoft.Windows.Appraiser.General.SystemWimEndSync - -Deprecated in RS3. This event indicates that a full set of SystemWimAdd events has been sent. The data collected with this event is used to help keep Windows up to date. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - ### Microsoft.Windows.Appraiser.General.SystemWimStartSync This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -1411,7 +1395,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2005,7 +1989,6 @@ The following fields are available: - **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp). - **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). - **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). -- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a). - **ext_mscv** Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv). - **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). - **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). @@ -2017,14 +2000,6 @@ The following fields are available: - **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. - **ver** Represents the major and minor version of the extension. -### Common Data Extensions.m365a - -Describes the Microsoft 365-related fields. - -The following fields are available: - -- **enrolledTenantId** The enrolled tenant ID. -- **msp** A bitmask that lists the active programs. ### Common Data Extensions.mscv @@ -2123,7 +2098,7 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. -## Common Data Fields +## Common data fields ### Ms.Device.DeviceInventoryChange @@ -2131,11 +2106,10 @@ Describes the installation state for all hardware and software components availa The following fields are available: -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. ## Component-based servicing events @@ -3167,6 +3141,7 @@ The following fields are available: - **Categories** A comma separated list of functional categories in which the container belongs. - **DiscoveryMethod** The discovery method for the device container. - **FriendlyName** The name of the device container. +- **Icon** Deprecated in RS3. The path or index to the icon file. - **InventoryVersion** The version of the inventory file generating the events. - **IsActive** Is the device connected, or has it been seen in the last 14 days? - **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link. @@ -3851,6 +3826,14 @@ The following fields are available: - **IndicatorValue** The indicator value. +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. @@ -4378,32 +4361,6 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Windows Admin Center events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - -The following fields are available: - -- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. -- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. -- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. -- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. -- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. -- **friendlyOsName** A user-friendly name describing the OS version. -- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. -- **gatewayVersion** The version string for this currently running Gateway application. -- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. -- **installationType** Identifies if the gateway was installed as a VM extension. -- **installedDate** The date on which this gateway was installed. -- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. -- **otherProperties** This is an empty string, but may be used for another purpose in the future. -- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. -- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID.. -- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -5238,6 +5195,18 @@ The following fields are available: - **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsCachedNotificationRetrieved + +This event is sent when a notification is received. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter that indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** A boolean that is true if the blob notification has valid content. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. @@ -5308,6 +5277,24 @@ The following fields are available: - **UpdateHealthToolsPushCurrentStep** The current step for the push notification +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails + +The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. +- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. +- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. +- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. +- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. +- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. +- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. @@ -5319,6 +5306,17 @@ The following fields are available: - **PackageVersion** Current package version of UpdateHealthTools. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin + +This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. +- **PackageVersion** The package version of the label. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. @@ -5955,6 +5953,32 @@ The following fields are available: - **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. +## Windows Admin Center events + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + +The following fields are available: + +- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. +- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. +- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. +- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. +- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. +- **friendlyOsName** A user-friendly name describing the OS version. +- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. +- **gatewayVersion** The version string for this currently running Gateway application. +- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. +- **installationType** Identifies if the gateway was installed as a VM extension. +- **installedDate** The date on which this gateway was installed. +- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. +- **otherProperties** This is an empty string, but may be used for another purpose in the future. +- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. +- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID. +- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. + + ## Windows as a Service diagnostic events ### Microsoft.Windows.WaaSMedic.DetectionFailed @@ -6929,29 +6953,6 @@ The following fields are available: - **updateId** ID of the update that is getting installed with this restart. - **wuDeviceid** Unique device ID used by Windows Update. -### wilActivity - -This event provides a Windows Internal Library context used for Product and Service diagnostics. - -The following fields are available: - -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. -- **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. -- **threadId** The ID of the thread on which the activity is executing. ### Microsoft.Windows.Update.Orchestrator.ActivityError @@ -7358,6 +7359,29 @@ The following fields are available: - **UpdateId** Unique ID for each Update. - **WuId** Unique ID for the Windows Update client. +### wilActivity + +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **callContext** The function where the failure occurred. +- **currentContextId** The ID of the current call context where the failure occurred. +- **currentContextMessage** The message of the current call context where the failure occurred. +- **currentContextName** The name of the current call context where the failure occurred. +- **failureCount** The number of failures for this failure ID. +- **failureId** The ID of the failure that occurred. +- **failureType** The type of the failure that occurred. +- **fileName** The file name where the failure occurred. +- **function** The function where the failure occurred. +- **hresult** The HResult of the overall activity. +- **lineNumber** The line number where the failure occurred. +- **message** The message of the failure that occurred. +- **module** The module where the failure occurred. +- **originatingContextId** The ID of the originating call context that resulted in the failure. +- **originatingContextMessage** The message of the originating call context that resulted in the failure. +- **originatingContextName** The name of the originating call context that resulted in the failure. +- **threadId** The ID of the thread on which the activity is executing. ## Windows Update Reserve Manager events @@ -7532,8 +7556,6 @@ The following fields are available: This event signals the completion of the setup process. It happens only once during the first logon. - - ## XDE events ### Microsoft.Emulator.Xde.RunTime.SystemReady @@ -7584,3 +7606,6 @@ The following fields are available: - **virtualMachineName** VM name. - **waitForClientConnection** True if we should wait for client connection. - **wp81NetworkStackDisabled** WP 8.1 networking stack disabled. + + + diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml index 6d801ea292..60bf83c118 100644 --- a/windows/privacy/toc.yml +++ b/windows/privacy/toc.yml @@ -15,9 +15,9 @@ href: Microsoft-DiagnosticDataViewer.md - name: Required Windows diagnostic data events and fields items: - - name: Windows 10, version 2004 required Windows diagnostic data events and fields + - name: Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic data events and fields href: required-windows-diagnostic-data-events-and-fields-2004.md - - name: Windows 10, version 1903 and Windows 10, version 1909 required level Windows diagnostic events and fields + - name: Windows 10, version 1909 and Windows 10, version 1903 required level Windows diagnostic events and fields href: basic-level-windows-diagnostic-events-and-fields-1903.md - name: Windows 10, version 1809 required Windows diagnostic events and fields href: basic-level-windows-diagnostic-events-and-fields-1809.md diff --git a/windows/privacy/windows-diagnostic-data.md b/windows/privacy/windows-diagnostic-data.md index 153c7ca114..150b4905bd 100644 --- a/windows/privacy/windows-diagnostic-data.md +++ b/windows/privacy/windows-diagnostic-data.md @@ -12,20 +12,21 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/04/2019 ms.reviewer: --- # Windows 10, version 1709 and newer optional diagnostic data Applies to: +- Windows 10, version 20H2 +- Windows 10, version 2004 - Windows 10, version 1909 - Windows 10, version 1903 - Windows 10, version 1809 - Windows 10, version 1803 - Windows 10, version 1709 -Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 2004 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). +Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 20H2 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. diff --git a/windows/security/threat-protection/microsoft-defender-atp/access-mssp-portal.md b/windows/security/threat-protection/microsoft-defender-atp/access-mssp-portal.md index acb5350c34..b6e3f60ba0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/access-mssp-portal.md +++ b/windows/security/threat-protection/microsoft-defender-atp/access-mssp-portal.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md index 3ef821e164..0fb5352742 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md +++ b/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md index 16e7db9ecf..938309f9f2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-assignedipaddress-function.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-assignedipaddress-function.md index b1576974be..f533aa5473 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-assignedipaddress-function.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-assignedipaddress-function.md @@ -24,7 +24,7 @@ ms.date: 09/20/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Use the `AssignedIPAddresses()` function in your advanced hunting queries to quickly obtain the latest IP addresses that have been assigned to a device. If you specify a timestamp argument, this function obtains the most recent IP addresses at the specified time. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md index 6ddbe3d3a1..89bace1c01 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md index 80b4736768..d8fa5a458c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md @@ -25,7 +25,7 @@ ms.date: 01/22/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md index 33fbf6118f..191dcbcb0e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md index e5a328a9db..427c9164c2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md @@ -25,7 +25,7 @@ ms.date: 01/14/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md index 246f3b70bd..ca50907f7c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md index 7cd8fd9ebe..65b9b2927c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md index b939d5ba59..652be88f72 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md index 17b769e2f3..fcdbc783c4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md index 77692cf8fe..ba1a43141f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md index 8d919d89c0..df10438741 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md index 3d7fc8a005..ea24aafcd0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md index 4ee7217b7c..5278fc3224 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md index 22e4e6aa6b..8b7ff40a50 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md index d2b7ab5de4..17aa063a7e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md index a61d3499dc..138d4d539a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md index 36a4097508..7cd66a3115 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md index 092f10cf8f..ec16f7a73d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-extend-data.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-extend-data.md index 371cfbed8c..a1cde2051e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-extend-data.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-extend-data.md @@ -24,7 +24,7 @@ ms.date: 10/10/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [Advanced hunting](advanced-hunting-overview.md) relies on data coming from across your organization. To get the most comprehensive data possible, ensure that you have the correct settings in the corresponding data sources. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-fileprofile-function.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-fileprofile-function.md index f2f93bf6a2..4d6f6bd635 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-fileprofile-function.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-fileprofile-function.md @@ -22,7 +22,7 @@ ms.date: 09/20/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) The `FileProfile()` function is an enrichment function in [advanced hunting](advanced-hunting-overview.md) that adds the following data to files found by the query. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-go-hunt.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-go-hunt.md index cab2d3160b..a2ad985d29 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-go-hunt.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-go-hunt.md @@ -23,7 +23,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) With the *go hunt* action, you can quickly investigate events and various entity types using powerful query-based [advanced hunting](advanced-hunting-overview.md) capabilities. This action automatically runs an advanced hunting query to find relevant information about the selected event or entity. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md index 66e8db56e7..84a36793d9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 19ef98383c..244c97c13f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md index 2d83c38459..bc86c4a7b6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md index b06237a57a..18ff2942b6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index c41443181f..7f93ba99d5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -24,7 +24,7 @@ ms.date: 01/14/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md index 46610a6772..96880e0c7e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-take-action.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-take-action.md index b06baf7444..915cbfa44b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-take-action.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-take-action.md @@ -21,7 +21,7 @@ ms.date: 09/20/2020 # Take action on advanced hunting query results **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md index 9bf8d26a01..d5bccbc7fc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md @@ -25,7 +25,7 @@ ms.date: 03/27/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-alertsq-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts.md b/windows/security/threat-protection/microsoft-defender-atp/alerts.md index 67ed2be93e..7a51bd90c7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md index 7bc13986b1..4985f37fda 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md @@ -25,7 +25,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) The Microsoft Defender ATP API Explorer is a tool that helps you explore various Microsoft Defender ATP APIs interactively. diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md b/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md index 3163df4fcb..a0330cfe3b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md b/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md index 8d06eb8f1b..572437217f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md index b8454c4935..cf2898f49f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md index 9ed52103d9..ae1fe49ed4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md b/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md index 09205163fe..34f925b4d8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md +++ b/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md b/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md index 6eeaf5c729..6c4428c439 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md @@ -26,7 +26,7 @@ ms.date: 11/28/2018 **Applies to:** - Azure Active Directory - Office 365 -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md b/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md index 4726e2223f..47af31878c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md @@ -25,7 +25,7 @@ ms.date: 11/20/2018 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-faq.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-faq.md index 0175049c55..6005a0a536 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-faq.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-faq.md @@ -23,7 +23,7 @@ ms.custom: asr **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## Is attack surface reduction (ASR) part of Windows? diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 45db3aa0c7..87e15b62f3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -24,7 +24,7 @@ ms.date: 10/08/2020 **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Your attack surface is the total number of places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means offering attackers fewer ways to perform attacks. diff --git a/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md b/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md index 8a4304b984..ee65565701 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md +++ b/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md @@ -22,7 +22,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) You can enable attack surface reduction rules, exploit protection, network protection, and controlled folder access in audit mode. Audit mode lets you see a record of what *would* have happened if you had enabled the feature. diff --git a/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md b/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md index 2d1aa8f368..82b023af7d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** - Azure Active Directory -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-basicaccess-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/behavioral-blocking-containment.md b/windows/security/threat-protection/microsoft-defender-atp/behavioral-blocking-containment.md index 8d29204276..b69250703a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/behavioral-blocking-containment.md +++ b/windows/security/threat-protection/microsoft-defender-atp/behavioral-blocking-containment.md @@ -27,7 +27,7 @@ ms.collection: **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## Overview diff --git a/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md b/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md index 9e38e27515..3e1124927b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md +++ b/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md @@ -24,7 +24,7 @@ ms.date: 04/24/2018 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-checksensor-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/client-behavioral-blocking.md b/windows/security/threat-protection/microsoft-defender-atp/client-behavioral-blocking.md index 52e97e1b70..0af5e1bb5c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/client-behavioral-blocking.md +++ b/windows/security/threat-protection/microsoft-defender-atp/client-behavioral-blocking.md @@ -27,7 +27,7 @@ ms.collection: **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## Overview diff --git a/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package.md b/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package.md index 398305b848..86fb26842c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package.md +++ b/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md b/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md index 3642376253..d4c8c750c8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for US Government Community Cloud High (GCC High) customers, built in the US Azure Government environment, uses the same underlying technologies as Microsoft Defender ATP in Azure Commercial. diff --git a/windows/security/threat-protection/microsoft-defender-atp/community.md b/windows/security/threat-protection/microsoft-defender-atp/community.md index 7a83827fc5..72fcf84f1e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/community.md +++ b/windows/security/threat-protection/microsoft-defender-atp/community.md @@ -25,7 +25,7 @@ ms.date: 04/24/2018 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md b/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md index edcabf4028..37f919486e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md b/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md index 2a2e4d3535..af6feb07a8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation.md index 6a3872d1b2..17ad143b5d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation.md @@ -27,7 +27,7 @@ ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs **Applies to** -- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) If your organization is using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/) (Microsoft Defender ATP), [automated investigation and remediation capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) can save your security operations team time and effort. As outlined in [this blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/enhance-your-soc-with-microsoft-defender-atp-automatic/ba-p/848946), these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats. [Learn more about automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations). diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md b/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md index 8946b66493..afca257675 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) This section guides you through all the steps you need to take to properly implement Conditional Access. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md b/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md index 18ba591b16..ed52fc4d30 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-emailconfig-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md index 36703ec3a4..246d324172 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md @@ -27,7 +27,7 @@ ms.date: 04/24/2018 - Group Policy -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md index 439c8e61f3..85c7a50ed2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index 2f52d63533..23aaa30171 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -26,7 +26,7 @@ ms.topic: article - macOS - Linux -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-nonwindows-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md index 2372dd38c5..0db0095e8e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md @@ -25,7 +25,7 @@ ms.date: 02/07/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Microsoft Endpoint Configuration Manager current branch - System Center 2012 R2 Configuration Manager diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md index 70821568d1..98ab531154 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md index b77d79c856..e4fff50bcb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md @@ -25,7 +25,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - [Microsoft 365 Endpoint data loss prevention (DLP)](/microsoft-365/compliance/endpoint-dlp-learn-about) Devices in your organization must be configured so that the Microsoft Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the devices in your organization. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md index db418af7ff..34cad32cfc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) > Want to experience Microsoft Defender ATP? [Sign up for a free trial](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink). diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md index eb72937f89..62caae5332 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md index d8200f1502..5540903d10 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md index 1b1b0495eb..163980b414 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md index 23f1b28355..d5e1655ca5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md @@ -26,7 +26,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## Before you begin > [!NOTE] diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-notifications.md b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-notifications.md index 4455735f4f..200173258f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-notifications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-notifications.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md index fa877ecd83..f5b7cb8755 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index 12c3637695..ff00737f9d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -26,7 +26,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 0ddcd8c630..fb0e253b2c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -30,7 +30,7 @@ ms.topic: article - Windows Server (SAC) version 1803 and later - Windows Server 2019 and later - Windows Server 2019 core edition -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md index 2767826ed6..aa9008f98a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md b/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md index 69775ff5c3..389002a969 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md @@ -23,7 +23,7 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Connected applications integrates with the Microsoft Defender ATP platform using APIs. diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index e4e8f5ec72..7687279880 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -24,7 +24,7 @@ ms.custom: asr **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## What is controlled folder access? diff --git a/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md b/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md index e02de4aa8b..887c5716d1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index 4edd3585e2..9135224d1c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -25,7 +25,7 @@ ms.date: 09/20/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Custom detection rules built from [advanced hunting](advanced-hunting-overview.md) queries let you proactively monitor various events and system states, including suspected breach activity and misconfigured devices. You can set them to run at regular intervals, generating alerts and taking response actions whenever there are matches. diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detections-manage.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detections-manage.md index 855bd65993..93b295e31b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detections-manage.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detections-manage.md @@ -24,7 +24,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Manage your existing [custom detection rules](custom-detection-rules.md) to ensure they are effectively finding threats and taking actions. Explore how to view the list of rules, check their previous runs, and review the alerts they have triggered. You can also run a rule on demand and modify it. diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md index 2773f28ed5..3ca15689d2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md @@ -21,7 +21,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) > [!IMPORTANT] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md index f35a4eefd9..d4f8aeab39 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md @@ -21,7 +21,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is supported on Windows Server 2019 and Windows 10 clients. diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md index 081c5218c3..6124ea2318 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md @@ -21,7 +21,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps. diff --git a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md index f1483165c4..51f62dd09c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-gensettings-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md b/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md index fa43e76e73..cae9259b66 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md @@ -27,7 +27,7 @@ ms.date: 04/24/2018 - Windows Defender -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id.md b/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id.md index 1dd2b90d07..5b8786d978 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id.md +++ b/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md b/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md index 000dafbddd..147eb07fb2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md +++ b/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md @@ -24,7 +24,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) There are three phases in deploying Microsoft Defender ATP: diff --git a/windows/security/threat-protection/microsoft-defender-atp/deployment-strategy.md b/windows/security/threat-protection/microsoft-defender-atp/deployment-strategy.md index cd066db719..526bb5375d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/deployment-strategy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/deployment-strategy.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-secopsdashboard-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/device-timeline-event-flag.md b/windows/security/threat-protection/microsoft-defender-atp/device-timeline-event-flag.md index 7b99cd69cd..bd99bff2fa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/device-timeline-event-flag.md +++ b/windows/security/threat-protection/microsoft-defender-atp/device-timeline-event-flag.md @@ -20,7 +20,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Event flags in the Microsoft Defender ATP device timeline help you filter and organize specific events when you're investigate potential attacks. diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index b5679d1756..be7793c044 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -28,7 +28,7 @@ ms.collection: **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## What is EDR in block mode? diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md index 2986e7ecf0..6f00213b3c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md @@ -22,7 +22,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [Controlled folder access](controlled-folders.md) helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is included with Windows 10 and Windows Server 2019. diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md index 5707cf67b8..2d44c8da7d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md @@ -21,7 +21,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [Exploit protection](exploit-protection.md) helps protect against malware that uses exploits to infect devices and spread. Exploit protection consists of a number of mitigations that can be applied to either the operating system or individual apps. diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md index 2d96393904..76fd837692 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md @@ -21,7 +21,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [Network protection](network-protection.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the internet. You can [audit network protection](evaluate-network-protection.md) in a test environment to view which apps would be blocked before you enable it. diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md b/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md index 8799a37ea2..c53ee2581c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-enablesiem-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp.md index 35dc0c89f1..49d937c1ed 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp.md @@ -23,7 +23,7 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. +[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. You can evaluate Microsoft Defender Advanced Threat Protection in your organization by [starting your free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp). diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction.md index 1c8621e5f2..ad4b38e29a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction.md @@ -21,7 +21,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Attack surface reduction rules help prevent actions typically used by malware to compromise devices or networks. Set attack surface reduction rules for devices running any of the following editions and versions of Windows: diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access.md index da54fddecf..4493d69e8f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access.md @@ -21,7 +21,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [Controlled folder access](controlled-folders.md) is a feature that helps protect your documents and files from modification by suspicious or malicious apps. Controlled folder access is supported on Windows Server 2019 and Windows 10 clients. diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md index 0b95bca029..caf0665673 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md @@ -23,7 +23,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices. Mitigation can be applied to either the operating system or to an individual app. Many of the features that were part of the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. (The EMET has reached its end of support.) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection.md index 17edc7d5e5..2dad3dd570 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection.md @@ -21,7 +21,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [Network protection](network-protection.md) helps prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index 2f57d47778..7ab9824a6d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -23,7 +23,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Conducting a comprehensive security product evaluation can be a complex process requiring cumbersome environment and device configuration before an end-to-end attack simulation can actually be done. Adding to the complexity is the challenge of tracking where the simulation activities, alerts, and results are reflected during the evaluation. diff --git a/windows/security/threat-protection/microsoft-defender-atp/event-error-codes.md b/windows/security/threat-protection/microsoft-defender-atp/event-error-codes.md index 54be37811e..977008bd93 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/event-error-codes.md +++ b/windows/security/threat-protection/microsoft-defender-atp/event-error-codes.md @@ -28,7 +28,7 @@ ms.date: 05/21/2018 - Event Viewer -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/event-views.md b/windows/security/threat-protection/microsoft-defender-atp/event-views.md index 926fa6beef..8aecca347e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/event-views.md +++ b/windows/security/threat-protection/microsoft-defender-atp/event-views.md @@ -21,7 +21,7 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Review attack surface reduction events in Event Viewer to monitor what rules or settings are working. You can also determine if any settings are too "noisy" or impacting your day to day workflow. diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md index 5cb1174b0a..74fad04acf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md @@ -24,7 +24,7 @@ ms.custom: asr **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Exploit Protection provides advanced protections for applications which the IT Pro can apply after the developer has compiled and distributed the software. diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md index e4174dddea..98738eb4aa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md @@ -24,7 +24,7 @@ ms.custom: asr **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Exploit protection automatically applies a number of exploit mitigation techniques to operating system processes and apps. Exploit protection is supported beginning with Windows 10, version 1709 and Windows Server, version 1803. diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md index 8f4d3dec0e..20194e3e9e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-partners.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-partners.md index 2b71b7c2cf..6e860b794b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-partners.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-partners.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md index e4a7458f08..2f0c92ed8d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md index 1ad142d2e4..bdb9fddc2c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md @@ -23,7 +23,7 @@ ms.date: 09/24/2018 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Full scenario using multiple APIs from Microsoft Defender ATP. diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md index d5115891d3..a226699cda 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md index e5f5fcad0b..3cbeec8462 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) If you are not familiar with OData queries, see: [OData V4 queries](https://www.odata.org/documentation/) diff --git a/windows/security/threat-protection/microsoft-defender-atp/feedback-loop-blocking.md b/windows/security/threat-protection/microsoft-defender-atp/feedback-loop-blocking.md index 0d0ee850c5..e65d2379cd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/feedback-loop-blocking.md +++ b/windows/security/threat-protection/microsoft-defender-atp/feedback-loop-blocking.md @@ -25,7 +25,7 @@ ms.collection: **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## Overview diff --git a/windows/security/threat-protection/microsoft-defender-atp/fetch-alerts-mssp.md b/windows/security/threat-protection/microsoft-defender-atp/fetch-alerts-mssp.md index d21ad49611..8d265f32ed 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/fetch-alerts-mssp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/fetch-alerts-mssp.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/files.md b/windows/security/threat-protection/microsoft-defender-atp/files.md index 2b27cae459..69f2d43120 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/files.md +++ b/windows/security/threat-protection/microsoft-defender-atp/files.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip.md b/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip.md index d0690e63d2..e7ecb972a1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip.md +++ b/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Find a device by internal IP. diff --git a/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip.md b/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip.md index e4a3b8ac99..86fc568017 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip.md +++ b/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors.md b/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors.md index 9afb49c31b..83511489cb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors.md +++ b/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors.md @@ -26,7 +26,7 @@ ms.date: 10/23/2017 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id.md b/windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id.md index d5ed580340..676cdf63f1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info.md b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info.md index 6b256610ed..eb2710fcca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info.md b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info.md index 5ac0f2d01a..2de0da3586 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info.md b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info.md index 9b841e71af..e56d99aabd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info.md b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info.md index 94132932d5..670802c075 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info.md b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info.md index 4c54267d9a..80df53a33e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/get-alerts.md index e0b7e0c358..eb855902a3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-alerts.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-all-recommendations.md b/windows/security/threat-protection/microsoft-defender-atp/get-all-recommendations.md index c49e958dfb..31af35af76 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-all-recommendations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-all-recommendations.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities-by-machines.md b/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities-by-machines.md index f3be9540c4..6bd9416f4b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities-by-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities-by-machines.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Retrieves a list of all the vulnerabilities affecting the organization per [machine](machine.md) and [software](software.md). - If the vulnerability has a fixing KB, it will appear in the response. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities.md b/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities.md index 262c80a1bf..84d316b8b5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-cvekbmap-collection.md b/windows/security/threat-protection/microsoft-defender-atp/get-cvekbmap-collection.md index d4dac32b7b..44275ce8f2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-cvekbmap-collection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-cvekbmap-collection.md @@ -25,7 +25,7 @@ ROBOTS: NOINDEX **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Retrieves a map of CVE's to KB's and CVE details. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md b/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md index 2c896a9943..3f79fbf1ce 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-discovered-vulnerabilities.md b/windows/security/threat-protection/microsoft-defender-atp/get-discovered-vulnerabilities.md index 10ff59d2ea..920d5431ca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-discovered-vulnerabilities.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-discovered-vulnerabilities.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Retrieves a collection of discovered vulnerabilities related to a given device ID. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts.md index 59c2587cda..1f9e3ec5e7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines.md b/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines.md index 662f9724e7..6170888f9c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics.md b/windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics.md index efb793f5cc..acc31acf8e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-exposure-score.md b/windows/security/threat-protection/microsoft-defender-atp/get-exposure-score.md index 77c92c030f..bad530e3d7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-exposure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-exposure-score.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-file-information.md b/windows/security/threat-protection/microsoft-defender-atp/get-file-information.md index db6f1f2f72..ff2d4103f1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-file-information.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-file-information.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts.md index 7ccb81730f..eb3a55ece2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines.md b/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines.md index 09aef678f7..82a5e5cf93 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-file-statistics.md b/windows/security/threat-protection/microsoft-defender-atp/get-file-statistics.md index 9f480df6b7..63001b875a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-file-statistics.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-file-statistics.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-installed-software.md b/windows/security/threat-protection/microsoft-defender-atp/get-installed-software.md index 79f263d9b0..58024c6bf6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-installed-software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-installed-software.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-investigation-collection.md b/windows/security/threat-protection/microsoft-defender-atp/get-investigation-collection.md index 676eba4bd3..8d24a9f9a7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-investigation-collection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-investigation-collection.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-investigation-object.md b/windows/security/threat-protection/microsoft-defender-atp/get-investigation-object.md index 99fd6a043d..b19d9dfb02 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-investigation-object.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-investigation-object.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts.md index c8a2ab1f94..21923ff2e0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics.md b/windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics.md index ffd9485045..56fee62325 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-kbinfo-collection.md b/windows/security/threat-protection/microsoft-defender-atp/get-kbinfo-collection.md index d41005cb74..0d6fa206a8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-kbinfo-collection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-kbinfo-collection.md @@ -25,7 +25,7 @@ ROBOTS: NOINDEX **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Retrieves a collection of KB's and KB details. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id.md b/windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id.md index 3cc89cd33b..6d0b2af750 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machine-group-exposure-score.md b/windows/security/threat-protection/microsoft-defender-atp/get-machine-group-exposure-score.md index 92b5fae137..fe34aeb59d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machine-group-exposure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machine-group-exposure-score.md @@ -16,12 +16,12 @@ ms.collection: M365-security-compliance ms.topic: article --- -# List exposure score by device group - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] +# List exposure score by device group + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users.md b/windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users.md index e673d96cf0..ea5713e42e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts.md index f47cdd76d2..6ab025120b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object.md b/windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object.md index b7a20c7b89..648f45ac9e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection.md b/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection.md index 5569002ec3..5118cc7b36 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md b/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md index ff88b78222..29b5b778f9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md @@ -25,7 +25,7 @@ ms.date: 10/07/2018 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Retrieves a collection of RBAC device groups. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machines-by-software.md b/windows/security/threat-protection/microsoft-defender-atp/get-machines-by-software.md index d3c3f50dca..fb992bb4c6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machines-by-software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machines-by-software.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machines-by-vulnerability.md b/windows/security/threat-protection/microsoft-defender-atp/get-machines-by-vulnerability.md index 02ea057f59..c8417e85f2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machines-by-vulnerability.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machines-by-vulnerability.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machines.md b/windows/security/threat-protection/microsoft-defender-atp/get-machines.md index 6f6c6177e9..56975a8e19 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machines.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machinesecuritystates-collection.md b/windows/security/threat-protection/microsoft-defender-atp/get-machinesecuritystates-collection.md index 0da42db679..b82da4fc0f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machinesecuritystates-collection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-machinesecuritystates-collection.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Retrieves a collection of devices security states. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md index 510c7516c2..ca4006fd78 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md index 6b6bf2db5f..a183d680fc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri.md b/windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri.md index a43102c733..e93088dc8e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-by-id.md b/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-by-id.md index b7bc3ab58f..beb27d8a20 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-by-id.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-by-id.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-machines.md b/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-machines.md index 2bdfb4a6e4..db0f71ea64 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-machines.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-software.md b/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-software.md index 449bb2bd1d..daee2d1737 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-software.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-vulnerabilities.md b/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-vulnerabilities.md index 156cef803c..3b88d5f028 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-vulnerabilities.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-recommendation-vulnerabilities.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-security-recommendations.md b/windows/security/threat-protection/microsoft-defender-atp/get-security-recommendations.md index dffd2a0613..710d652358 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-security-recommendations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-security-recommendations.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-software-by-id.md b/windows/security/threat-protection/microsoft-defender-atp/get-software-by-id.md index 0074439db0..155ec09b5d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-software-by-id.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-software-by-id.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-software-ver-distribution.md b/windows/security/threat-protection/microsoft-defender-atp/get-software-ver-distribution.md index e9b64f2ad1..2c652bc16f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-software-ver-distribution.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-software-ver-distribution.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-software.md b/windows/security/threat-protection/microsoft-defender-atp/get-software.md index e205e5f5b7..efe1c0e095 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-software.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-started-partner-integration.md b/windows/security/threat-protection/microsoft-defender-atp/get-started-partner-integration.md index 0b87266339..09c65fdff1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-started-partner-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-started-partner-integration.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) To become a Microsoft Defender ATP solution partner, you'll need to follow and complete the following steps. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection.md b/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection.md index 41c5a0ebdd..dcc4b02436 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-user-information.md b/windows/security/threat-protection/microsoft-defender-atp/get-user-information.md index 80617258d3..63d25e4217 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-user-information.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-user-information.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Retrieve a User entity by key (user name). diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md index 3d00668c3b..95225803d9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md index 28c129e51c..f3b126e12f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-vuln-by-software.md b/windows/security/threat-protection/microsoft-defender-atp/get-vuln-by-software.md index 4a5514ff10..17b79870dd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-vuln-by-software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-vuln-by-software.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-vulnerability-by-id.md b/windows/security/threat-protection/microsoft-defender-atp/get-vulnerability-by-id.md index 27b633e634..6afd9ee76f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-vulnerability-by-id.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-vulnerability-by-id.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/grant-mssp-access.md b/windows/security/threat-protection/microsoft-defender-atp/grant-mssp-access.md index 1feba6fc45..0f5a1d3e2a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/grant-mssp-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/grant-mssp-access.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/helpful-resources.md b/windows/security/threat-protection/microsoft-defender-atp/helpful-resources.md index 1b411df76d..f53f31390f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/helpful-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/helpful-resources.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Access helpful resources such as links to blogs and other resources related to Microsoft Defender Advanced Threat Protection. diff --git a/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates.md b/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates.md index cfff5ce687..5d641d0581 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates.md +++ b/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/indicator-file.md b/windows/security/threat-protection/microsoft-defender-atp/indicator-file.md index 8a5a15bf39..a1df7c41f2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/indicator-file.md +++ b/windows/security/threat-protection/microsoft-defender-atp/indicator-file.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md b/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md index 4769eb6666..5b3fb21a83 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md +++ b/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/indicator-manage.md b/windows/security/threat-protection/microsoft-defender-atp/indicator-manage.md index 54d2c70de6..02ad59046d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/indicator-manage.md +++ b/windows/security/threat-protection/microsoft-defender-atp/indicator-manage.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md index 17b7c51fcd..dd0b1fee80 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md index 4c595bdec5..14e024db46 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) A typical advanced persistent threat lifecycle involves data exfiltration. In a security incident, it's important to have the ability to prioritize investigations where sensitive files may be jeopardy so that corporate data and information are protected. diff --git a/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation.md index f464c54bde..e9818ac067 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md index 1b20360ecd..5dff12d03e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md @@ -27,7 +27,7 @@ ms.date: 04/24/2018 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md index 37ca52cd85..63c047b384 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md @@ -26,7 +26,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md index 7bd899fd9b..012d6fffcf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md @@ -27,7 +27,7 @@ ms.date: 04/24/2018 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md index f5c2fcb4ce..1eaa23ead2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md @@ -27,7 +27,7 @@ ms.date: 04/24/2018 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md index 419b64c153..06ed19033e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Investigate incidents that affect your network, understand what they mean, and collate evidence to resolve them. diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md index fb1109d764..d867eb7db4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md @@ -27,7 +27,7 @@ ms.date: 04/24/2018 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-investigateip-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md index 5419c76996..154d8b2cef 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md @@ -26,7 +26,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md index 7593f22e63..b8080fe72d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md @@ -26,7 +26,7 @@ ms.date: 04/24/2018 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-investigatgeuser-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigation.md b/windows/security/threat-protection/microsoft-defender-atp/investigation.md index 87bac34185..09ba3ad64f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigation.md @@ -23,7 +23,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md b/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md index c16a3f2448..5364748405 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md +++ b/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 35a1c20298..6157678090 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Live response gives security operations teams instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats—in real time. diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine-groups.md b/windows/security/threat-protection/microsoft-defender-atp/machine-groups.md index 678340162e..1ec1962585 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine-groups.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine-groups.md @@ -26,7 +26,7 @@ ms.topic: article - Azure Active Directory - Office 365 -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) In an enterprise scenario, security operation teams are typically assigned a set of devices. These devices are grouped together based on a set of attributes such as their domains, computer names, or designated tags. diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine-reports.md b/windows/security/threat-protection/microsoft-defender-atp/machine-reports.md index 3349058516..0f50126e3f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine-reports.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine-reports.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) The devices status report provides high-level information about the devices in your organization. The report includes trending information showing the sensor health state, antivirus status, OS platforms, and Windows 10 versions. diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine.md b/windows/security/threat-protection/microsoft-defender-atp/machine.md index 233c410881..4fbc97c8a3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/machineaction.md b/windows/security/threat-protection/microsoft-defender-atp/machineaction.md index 683d807480..19f660b07e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machineaction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machineaction.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md index ff9c54a53f..c4df93659f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-machinesview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md index c4d934024e..9a210d00da 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-managealerts-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index c086033e55..a0a93f2dc7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -28,7 +28,7 @@ ms.reviewer: chventou **Applies to:** -- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) We recommend using We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) (Intune) and [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) (Configuration Manager) to manage your organization's threat protection features for devices (also referred to as endpoints). - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 512edb5f3c..c9fe3f4c85 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -28,7 +28,7 @@ ms.reviewer: chventou **Applies to:** -- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) > [!NOTE] > We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem) to manage your organization's threat protection features for devices (also referred to as endpoints). Endpoint Manager includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction). **[Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview)**. diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index eb630aad88..36d77dce37 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -28,7 +28,7 @@ ms.reviewer: chventou **Applies to:** -- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), which includes Microsoft Intune (Intune) to manage your organization's threat protection features for devices (also referred to as endpoints). [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 111459747f..339857a351 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -28,7 +28,7 @@ ms.reviewer: chventou **Applies to:** -- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) > [!NOTE] > We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem) to manage your organization's threat protection features for devices (also referred to as endpoints). Endpoint Manager includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction). diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 246b542364..7d186a373a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -28,7 +28,7 @@ ms.reviewer: chventou **Applies to:** -- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender for Endpoint, your next step is to manage your features and capabilities. We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction), to manage your organization's devices and security settings. However, you can use other tools/methods, such as [Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy). diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md index 5dfefb6a2a..0b5d31597f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md index 056f3d9d05..29529c8847 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md index 04dc76e4e3..f0cd8403c1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Managing incidents is an important part of every cybersecurity operation. You can manage incidents by selecting an incident from the **Incidents queue** or the **Incidents management pane**. diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index b8a672c6a3..d5186273e9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules.md b/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules.md index 2db2ff913f..d13aa975d2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) There might be scenarios where you need to suppress alerts from appearing in the portal. You can create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization. For more information on how to suppress alerts, see [Suppress alerts](manage-alerts.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md index 45de6c024c..0a71770ee3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md +++ b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mgt-apis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md index 2049e0d9bd..06d2ab83cf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md index a6f03c17c5..a23303c507 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md @@ -24,7 +24,7 @@ ms.date: 10/18/2018 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md index 4aed901842..47fcaf8d7d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md @@ -25,7 +25,7 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Microsoft Threat Experts is a managed threat hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed. diff --git a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md index 3e712cd6f9..b659b20797 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md +++ b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) There are some minimum requirements for onboarding devices to the service. Learn about the licensing, hardware and software requirements, and other configuration settings to onboard devices to the service. diff --git a/windows/security/threat-protection/microsoft-defender-atp/mssp-list.md b/windows/security/threat-protection/microsoft-defender-atp/mssp-list.md index e04b5fd740..36d7f8db37 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mssp-list.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mssp-list.md @@ -21,7 +21,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Logo |Partner name | Description :---|:---|:--- diff --git a/windows/security/threat-protection/microsoft-defender-atp/mssp-support.md b/windows/security/threat-protection/microsoft-defender-atp/mssp-support.md index 6f1d18b0e5..6982d30ef4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mssp-support.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mssp-support.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index ea52e95529..eec4470439 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -25,7 +25,7 @@ ms.custom: asr **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Network protection helps reduce the attack surface of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. diff --git a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md index bfa0cb7041..2e96df8aa4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md +++ b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/non-windows.md index 36cab9ff28..2de422a306 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/non-windows.md @@ -23,7 +23,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Microsoft has been on a journey to extend its industry leading endpoint security diff --git a/windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api.md b/windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api.md index 6046e47262..19496bd97c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md b/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md index fdfda0129e..7d9a09d143 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md @@ -27,7 +27,7 @@ ms.topic: conceptual - Linux - Windows Server 2012 R2 - Windows Server 2016 -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-offboarddevices-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md b/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md index 3f37f66880..34ae68ed71 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel.md b/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel.md index 86e8968854..ca403709b0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel.md @@ -28,7 +28,7 @@ ms.topic: article - Windows 7 SP1 Pro - Windows 8.1 Pro - Windows 8.1 Enterprise -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-downlevel-abovefoldlink). diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md b/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md index cb3d0ee177..137f5c07bc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) To onboard devices without Internet access, you'll need to take the following general steps: diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard.md b/windows/security/threat-protection/microsoft-defender-atp/onboard.md index ca17dbdcd7..dc8e5dab0c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Configure and manage all the Microsoft Defender ATP capabilities to get the best security protection for your organization. diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-configuration-manager.md index c09d936fcd..4860a31a21 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-configuration-manager.md @@ -24,7 +24,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## Collection creation To onboard Windows 10 devices with Microsoft Endpoint Configuration Manager, the diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-manager.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-manager.md index 76f2c2c7e7..f30fe6cafa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-manager.md @@ -24,7 +24,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) In this section, we will be using Microsoft Endpoint Manager (MEM) to deploy @@ -72,11 +72,13 @@ needs.
2. Open **Groups > New Group**. - ![Image of Microsoft Endpoint Manager portal](images/66f724598d9c3319cba27f79dd4617a4.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/66f724598d9c3319cba27f79dd4617a4.png) 3. Enter details and create a new group. - ![Image of Microsoft Endpoint Manager portal](images/b1e0206d675ad07db218b63cd9b9abc3.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/b1e0206d675ad07db218b63cd9b9abc3.png) 4. Add your test user or device. @@ -86,7 +88,8 @@ needs.
7. Find your test user or device and select it. - ![Image of Microsoft Endpoint Manager portal](images/149cbfdf221cdbde8159d0ab72644cd0.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/149cbfdf221cdbde8159d0ab72644cd0.png) 8. Your testing group now has a member to test. @@ -103,40 +106,48 @@ different types of Endpoint security policies. 2. Navigate to **Endpoint security > Endpoint detection and response**. Click on **Create Profile**. - ![Image of Microsoft Endpoint Manager portal](images/58dcd48811147feb4ddc17212b7fe840.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/58dcd48811147feb4ddc17212b7fe840.png) 3. Under **Platform, select Windows 10 and Later, Profile - Endpoint detection and response > Create**. 4. Enter a name and description, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/a5b2d23bdd50b160fef4afd25dda28d4.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/a5b2d23bdd50b160fef4afd25dda28d4.png) 5. Select settings as required, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/cea7e288b5d42a9baf1aef0754ade910.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/cea7e288b5d42a9baf1aef0754ade910.png) - >[!NOTE] - >In this instance, this has been auto populated as Microsoft Defender ATP has already been integrated with Intune. For more information on the integration, see [Enable Microsoft Defender ATP in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection-configure#to-enable-microsoft-defender-atp).
- - - ![Image of Microsoft Endpoint Manager portal](images/2466460812371ffae2d19a10c347d6f4.png) + > [!NOTE] + > In this instance, this has been auto populated as Microsoft Defender ATP has already been integrated with Intune. For more information on the integration, see [Enable Microsoft Defender ATP in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection-configure#to-enable-microsoft-defender-atp). + > + > The following image is an example of what you'll see when Microsoft Defender ATP is NOT integrated with Intune: + > + > ![Image of Microsoft Endpoint Manager portal](images/2466460812371ffae2d19a10c347d6f4.png) 6. Add scope tags if necessary, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/ef844f52ec2c0d737ce793f68b5e8408.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/ef844f52ec2c0d737ce793f68b5e8408.png) 7. Add test group by clicking on **Select groups to include** and choose your group, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/fc3525e20752da026ec9f46ab4fec64f.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/fc3525e20752da026ec9f46ab4fec64f.png) 8. Review and accept, then select **Create**. - ![Image of Microsoft Endpoint Manager portal](images/289172dbd7bd34d55d24810d9d4d8158.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/289172dbd7bd34d55d24810d9d4d8158.png) 9. You can view your completed policy. - ![Image of Microsoft Endpoint Manager portal](images/5a568b6878be8243ea2b9d82d41ed297.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/5a568b6878be8243ea2b9d82d41ed297.png) ### Next-generation protection @@ -144,36 +155,43 @@ different types of Endpoint security policies. 2. Navigate to **Endpoint security > Antivirus > Create Policy**. - ![Image of Microsoft Endpoint Manager portal](images/6b728d6e0d71108d768e368b416ff8ba.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/6b728d6e0d71108d768e368b416ff8ba.png) 3. Select **Platform - Windows 10 and Later - Windows and Profile – Microsoft Defender Antivirus > Create**. 4. Enter name and description, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/a7d738dd4509d65407b7d12beaa3e917.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/a7d738dd4509d65407b7d12beaa3e917.png) 5. In the **Configuration settings page**: Set the configurations you require for Microsoft Defender Antivirus (Cloud Protection, Exclusions, Real-Time Protection, and Remediation). - ![Image of Microsoft Endpoint Manager portal](images/3840b1576d6f79a1d72eb14760ef5e8c.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/3840b1576d6f79a1d72eb14760ef5e8c.png) 6. Add scope tags if necessary, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/2055e4f9b9141525c0eb681e7ba19381.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/2055e4f9b9141525c0eb681e7ba19381.png) 7. Select groups to include, assign to your test group, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/48318a51adee06bff3908e8ad4944dc9.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/48318a51adee06bff3908e8ad4944dc9.png) 8. Review and create, then select **Create**. - ![Image of Microsoft Endpoint Manager portal](images/dfdadab79112d61bd3693d957084b0ec.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/dfdadab79112d61bd3693d957084b0ec.png) 9. You'll see the configuration policy you created. - ![Image of Microsoft Endpoint Manager portal](images/38180219e632d6e4ec7bd25a46398da8.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/38180219e632d6e4ec7bd25a46398da8.png) ### Attack Surface Reduction – Attack surface reduction rules @@ -186,37 +204,44 @@ different types of Endpoint security policies. 4. Select **Platform - Windows 10 and Later – Profile - Attack surface reduction rules > Create**. - ![Image of Microsoft Endpoint Manager portal](images/522d9bb4288dc9c1a957392b51384fdd.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/522d9bb4288dc9c1a957392b51384fdd.png) 5. Enter a name and description, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/a5a71fd73ec389f3cdce6d1a6bd1ff31.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/a5a71fd73ec389f3cdce6d1a6bd1ff31.png) 6. In the **Configuration settings page**: Set the configurations you require for Attack surface reduction rules, then select **Next**. - >[!NOTE] - >We will be configuring all of the Attack surface reduction rules to Audit. + > [!NOTE] + > We will be configuring all of the Attack surface reduction rules to Audit. + > + > For more information, see [Attack surface reduction rules](attack-surface-reduction.md). - For more information, see [Attack surface reduction rules](attack-surface-reduction.md). - - ![Image of Microsoft Endpoint Manager portal](images/dd0c00efe615a64a4a368f54257777d0.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/dd0c00efe615a64a4a368f54257777d0.png) 7. Add Scope Tags as required, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/6daa8d347c98fe94a0d9c22797ff6f28.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/6daa8d347c98fe94a0d9c22797ff6f28.png) 8. Select groups to include and assign to test group, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/45cefc8e4e474321b4d47b4626346597.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/45cefc8e4e474321b4d47b4626346597.png) 9. Review the details, then select **Create**. - ![Image of Microsoft Endpoint Manager portal](images/2c2e87c5fedc87eba17be0cdeffdb17f.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/2c2e87c5fedc87eba17be0cdeffdb17f.png) 10. View the policy. - ![Image of Microsoft Endpoint Manager portal](images/7a631d17cc42500dacad4e995823ffef.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/7a631d17cc42500dacad4e995823ffef.png) ### Attack Surface Reduction – Web Protection @@ -228,37 +253,44 @@ different types of Endpoint security policies. 4. Select **Windows 10 and Later – Web protection > Create**. - ![Image of Microsoft Endpoint Manager portal](images/cd7b5a1cbc16cc05f878cdc99ba4c27f.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/cd7b5a1cbc16cc05f878cdc99ba4c27f.png) 5. Enter a name and description, then select **Next**. - ![Image of Microsoft Endpoint Manager portal](images/5be573a60cd4fa56a86a6668b62dd808.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/5be573a60cd4fa56a86a6668b62dd808.png) 6. In the **Configuration settings page**: Set the configurations you require for Web Protection, then select **Next**. - >[!NOTE] - >We are configuring Web Protection to Block. + > [!NOTE] + > We are configuring Web Protection to Block. + > + > For more information, see [Web Protection](web-protection-overview.md). - For more information, see [Web Protection](web-protection-overview.md). - - ![Image of Microsoft Endpoint Manager portal](images/6104aa33a56fab750cf30ecabef9f5b6.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/6104aa33a56fab750cf30ecabef9f5b6.png) 7. Add **Scope Tags as required > Next**. - ![Image of Microsoft Endpoint Manager portal](images/6daa8d347c98fe94a0d9c22797ff6f28.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/6daa8d347c98fe94a0d9c22797ff6f28.png) 8. Select **Assign to test group > Next**. - ![Image of Microsoft Endpoint Manager portal](images/45cefc8e4e474321b4d47b4626346597.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/45cefc8e4e474321b4d47b4626346597.png) 9. Select **Review and Create > Create**. - ![Image of Microsoft Endpoint Manager portal](images/8ee0405f1a96c23d2eb6f737f11c1ae5.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/8ee0405f1a96c23d2eb6f737f11c1ae5.png) 10. View the policy. - ![Image of Microsoft Endpoint Manager portal](images/e74f6f6c150d017a286e6ed3dffb7757.png) + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager portal](images/e74f6f6c150d017a286e6ed3dffb7757.png) ## Validate configuration settings @@ -275,26 +307,31 @@ To confirm that the configuration policy has been applied to your test device, f 1. Open the MEM portal and navigate to the relevant policy as shown in the steps above. The following example shows the next generation protection settings. - ![Image of Microsoft Endpoint Manager portal](images/43ab6aa74471ee2977e154a4a5ef2d39.png) + > [!div class="mx-imgBorder"] + > [ ![Image of Microsoft Endpoint Manager portal](images/43ab6aa74471ee2977e154a4a5ef2d39.png) ](images/43ab6aa74471ee2977e154a4a5ef2d39.png#lightbox) 2. Select the **Configuration Policy** to view the policy status. - ![Image of Microsoft Endpoint Manager portal](images/55ecaca0e4a022f0e29d45aeed724e6c.png) + > [!div class="mx-imgBorder"] + > [ ![Image of Microsoft Endpoint Manager portal](images/55ecaca0e4a022f0e29d45aeed724e6c.png) ](images/55ecaca0e4a022f0e29d45aeed724e6c.png#lightbox) 3. Select **Device Status** to see the status. - ![Image of Microsoft Endpoint Manager portal](images/18a50df62cc38749000dbfb48e9a4c9b.png) + > [!div class="mx-imgBorder"] + > [ ![Image of Microsoft Endpoint Manager portal](images/18a50df62cc38749000dbfb48e9a4c9b.png) ](images/18a50df62cc38749000dbfb48e9a4c9b.png#lightbox) 4. Select **User Status** to see the status. - ![Image of Microsoft Endpoint Manager portal](images/4e965749ff71178af8873bc91f9fe525.png) + > [!div class="mx-imgBorder"] + > [ ![Image of Microsoft Endpoint Manager portal](images/4e965749ff71178af8873bc91f9fe525.png) ](images/4e965749ff71178af8873bc91f9fe525.png#lightbox) 5. Select **Per-setting status** to see the status. >[!TIP] >This view is very useful to identify any settings that conflict with another policy. - ![Image of Microsoft Endpoint Manager portal](images/42acc69d0128ed09804010bdbdf0a43c.png) + > [!div class="mx-imgBorder"] + > [ ![Image of Microsoft Endpoint Manager portal](images/42acc69d0128ed09804010bdbdf0a43c.png) ](images/42acc69d0128ed09804010bdbdf0a43c.png#lightbox) ### Endpoint detection and response @@ -302,33 +339,38 @@ To confirm that the configuration policy has been applied to your test device, f 1. Before applying the configuration, the Microsoft Defender ATP Protection service should not be started. - ![Image of Services panel](images/b418a232a12b3d0a65fc98248dbb0e31.png) + > [!div class="mx-imgBorder"] + > [ ![Image of Services panel](images/b418a232a12b3d0a65fc98248dbb0e31.png) ](images/b418a232a12b3d0a65fc98248dbb0e31.png#lightbox) 2. After the configuration has been applied, the Microsoft Defender ATP Protection Service should be started. - ![Image of Services panel](images/a621b699899f1b41db211170074ea59e.png) + > [!div class="mx-imgBorder"] + > [ ![Image of Services panel](images/a621b699899f1b41db211170074ea59e.png) ](images/a621b699899f1b41db211170074ea59e.png#lightbox) 3. After the services are running on the device, the device appears in Microsoft Defender Security Center. - ![Image of Microsoft Defender Security Center](images/df0c64001b9219cfbd10f8f81a273190.png) + > [!div class="mx-imgBorder"] + > [ ![Image of Microsoft Defender Security Center](images/df0c64001b9219cfbd10f8f81a273190.png) ](images/df0c64001b9219cfbd10f8f81a273190.png#lightbox) ### Next-generation protection 1. Before applying the policy on a test device, you should be able to manually manage the settings as shown below. - ![Image of setting page](images/88efb4c3710493a53f2840c3eac3e3d3.png) + > [!div class="mx-imgBorder"] + > ![Image of setting page](images/88efb4c3710493a53f2840c3eac3e3d3.png) 2. After the policy has been applied, you should not be able to manually manage the settings. - >[!NOTE] + > [!NOTE] > In the following image **Turn on cloud-delivered protection** and - **Turn on real-time protection** are being shown as managed. + > **Turn on real-time protection** are being shown as managed. - ![Image of setting page](images/9341428b2d3164ca63d7d4eaa5cff642.png) + > [!div class="mx-imgBorder"] + > ![Image of setting page](images/9341428b2d3164ca63d7d4eaa5cff642.png) ### Attack Surface Reduction – Attack surface reduction rules @@ -337,11 +379,11 @@ To confirm that the configuration policy has been applied to your test device, f 2. This should respond with the following lines with no content: - AttackSurfaceReductionOnlyExclusions: - - AttackSurfaceReductionRules_Actions: - - AttackSurfaceReductionRules_Ids: + > AttackSurfaceReductionOnlyExclusions: + > + > AttackSurfaceReductionRules_Actions: + > + > AttackSurfaceReductionRules_Ids: ![Image of command line](images/cb0260d4b2636814e37eee427211fe71.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md index 7052df6942..30c80bb608 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Create a notification rule so that when a local onboarding or offboardiing script is used, you'll be notified. diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md index 6ac048cf9d..233975b647 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md @@ -24,7 +24,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Deploying Microsoft Defender ATP is a three-phase process: diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction.md index 3996f745b3..6af7ba9c0f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction.md @@ -26,7 +26,7 @@ ms.topic: conceptual **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Help reduce your attack surfaces, by minimizing the places where your organization is vulnerable to cyberthreats and attacks. Use the following resources to configure protection for the devices and applications in your organization. diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md index a6bc0dc2a2..3e8077b6b8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md @@ -23,7 +23,7 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) With custom detections, you can proactively monitor for and respond to various events and system states, including suspected breach activity and misconfigured devices. You can do this with customizable detection rules that automatically trigger alerts and response actions. diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md index 4c1e39e0e5..0f3c036938 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md @@ -25,7 +25,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Microsoft Defender ATP endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation.md b/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation.md index cf352dd917..8b32269fe0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation.md @@ -22,7 +22,7 @@ ms.date: 09/07/2018 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Hardware-based isolation helps protect system integrity in Windows 10 and is integrated with Microsoft Defender ATP. diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index 40d005db5a..19b0432ed6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Microsoft Defender ATP supports third-party applications to help enhance the detection, investigation, and threat intelligence capabilities of the platform. diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-integration.md b/windows/security/threat-protection/microsoft-defender-atp/partner-integration.md index 7c6e64db5c..efb88424f7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-integration.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md b/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md index f8d7446a76..699cc87da7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md index 7525f68b6e..f74d49ee22 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md +++ b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preferences-setup.md b/windows/security/threat-protection/microsoft-defender-atp/preferences-setup.md index f5f432ad15..59653a5fc2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preferences-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preferences-setup.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-prefsettings-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment.md b/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment.md index 9e4e98ffb5..c0279badc8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment.md +++ b/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment.md @@ -26,7 +26,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview-settings.md b/windows/security/threat-protection/microsoft-defender-atp/preview-settings.md index f031b9edd9..0609532537 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview-settings.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-previewsettings-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index 4443433ac4..eca1e04388 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -27,7 +27,7 @@ ms.topic: conceptual >The preview versions are provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) The Microsoft Defender ATP service is constantly being updated to include new feature enhancements and capabilities. @@ -60,8 +60,6 @@ The following features are included in the preview release: - [Web Content Filtering](web-content-filtering.md)
Web content filtering is part of web protection capabilities in Microsoft Defender ATP. It enables your organization to track and regulate access to websites based on their content categories. Many of these websites, while not malicious, might be problematic because of compliance regulations, bandwidth usage, or other concerns. - - [Threat and vulnerability management supported operating systems and platforms](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os)
Ensure that you meet the operating system or platform requisites for Threat & Vulnerability Management so the activities in your devices are properly accounted for. Threat & Vulnerability Management supports Windows 7, Windows 10 1607-1703, Windows 10 1709+, Windows Server 2008R2, Windows Server 2012R2, Windows Server 2016, Windows Server 2019.

Secure Configuration Assessment (SCA) supports Windows 10 1709+, Windows Server 2008R2, Windows Server 2012R2, Windows Server 2016, and Windows Server 2019. - - [Device health and compliance report](machine-reports.md)
The device health and compliance report provides high-level information about the devices in your organization. - [Information protection](information-protection-in-windows-overview.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md b/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md index 4a974f0e24..3dc038ac75 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md +++ b/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md @@ -26,7 +26,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Deploying Microsoft Defender ATP is a three-phase process: diff --git a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md index 078b9f44ba..5ded65750b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md index 8dfa3de26f..3dd71c46a6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md +++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md index 136bd67acd..ae061aa91b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md +++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md index 70e5354db8..e5a93c9ecf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md +++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/rbac.md b/windows/security/threat-protection/microsoft-defender-atp/rbac.md index 6b595daea4..d0659c30a2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/rbac.md +++ b/windows/security/threat-protection/microsoft-defender-atp/rbac.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** - Azure Active Directory - Office 365 -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-rbac-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/recommendation.md index c094ae5bec..4e9bf9b693 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/recommendation.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index cad6f89bbe..b22362ce0a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) [!include[Prerelease information](../../includes/prerelease.md)] diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md index 62ea654ded..98a8d61680 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-respondmachine-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution.md b/windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution.md index f4b6552adb..7b9e53a6e8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution.md +++ b/windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md index 55fe2974c7..7188c9c212 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md @@ -25,12 +25,10 @@ ms.date: 5/1/2020 **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-managealerts-abovefoldlink) -[!include[Prerelease information](../../includes/prerelease.md)] - The new alert page in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) provides full context to the alert, by combining attack signals and alerts related to the selected alert, to construct a detailed alert story. Quickly triage, investigate, and take effective action on alerts that affect your organization. Understand why they were triggered, and their impact from one location. diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md index 1d8c035b5c..91772a215f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md index 00381d0550..c95d5dc155 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Run advanced queries using PowerShell, see [Advanced Hunting API](run-advanced-query-api.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md index 282cc94d06..ad9c61aa16 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Run advanced queries using Python, see [Advanced Hunting API](run-advanced-query-api.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-av-scan.md b/windows/security/threat-protection/microsoft-defender-atp/run-av-scan.md index 1219b9aa21..ac66c55986 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-av-scan.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-av-scan.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md b/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md index a40530476f..21efcfa495 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md @@ -30,7 +30,7 @@ ms.topic: article - Windows Server 2016 - Windows Server, version 1803 - Windows Server, 2019 -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) Run the following PowerShell script on a newly onboarded device to verify that it is properly reporting to the Microsoft Defender ATP service. diff --git a/windows/security/threat-protection/microsoft-defender-atp/score.md b/windows/security/threat-protection/microsoft-defender-atp/score.md index edeeea026b..e0d37c9adc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/score.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard.md b/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard.md index 608a4bedcf..c564eb22ec 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-secopsdashboard-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/service-status.md b/windows/security/threat-protection/microsoft-defender-atp/service-status.md index b9325d8184..b95ecdb603 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/service-status.md +++ b/windows/security/threat-protection/microsoft-defender-atp/service-status.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/set-device-value.md b/windows/security/threat-protection/microsoft-defender-atp/set-device-value.md index 4aab887418..eb081b2ce2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/set-device-value.md +++ b/windows/security/threat-protection/microsoft-defender-atp/set-device-value.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/software.md b/windows/security/threat-protection/microsoft-defender-atp/software.md index 514baa2899..bdd977b76d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/software.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file.md b/windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file.md index 60c046ee70..1d98b043e9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file.md +++ b/windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md b/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md index 2fa6615e6a..4158bfea2b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md +++ b/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) > [!TIP] > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md index bdb20dff52..7736f20b59 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md @@ -25,7 +25,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) With more sophisticated adversaries and new threats emerging frequently and prevalently, it's critical to be able to quickly: diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md index 9bdcb3b301..0e1e460db8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts.md b/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts.md index a4691bc3cc..a7fc785038 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts.md @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration.md b/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration.md index a8d1540ac2..937906e7a6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration.md @@ -25,7 +25,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## Integrate with other Microsoft solutions diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports.md b/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports.md index 3fff8e808b..6690a9a308 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) The threat protection report provides high-level information about alerts generated in your organization. The report includes trending information showing the detection sources, categories, severities, statuses, classifications, and determinations of alerts across time. diff --git a/windows/security/threat-protection/microsoft-defender-atp/ti-indicator.md b/windows/security/threat-protection/microsoft-defender-atp/ti-indicator.md index 039703000c..a527797436 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ti-indicator.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ti-indicator.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/time-settings.md b/windows/security/threat-protection/microsoft-defender-atp/time-settings.md index c2362f07ac..173c407eda 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/time-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/time-settings.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md index ba95b235f8..5869c9d23d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md @@ -24,7 +24,7 @@ ms.custom: asr **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) When you use [attack surface reduction rules](attack-surface-reduction.md) you may run into issues, such as: diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md index eecaf63643..30017b4ca8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-collect-support-log.md @@ -21,7 +21,7 @@ ms.topic: troubleshooting **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) When contacting support, you may be asked to provide the output package of the Microsoft Defender ATP Client Analyzer tool. diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md index 2773899fc2..aff164b095 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md @@ -23,7 +23,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) When you create a set of exploit protection mitigations (known as a configuration), you might find that the configuration export and import process does not remove all unwanted mitigations. diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-live-response.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-live-response.md index db3f3bee81..e6ed78f7f8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-live-response.md @@ -24,7 +24,7 @@ ms.topic: troubleshooting **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) This page provides detailed steps to troubleshoot live response issues. diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md index f925f8ec6f..bea92c57cf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md @@ -23,7 +23,7 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) * IT administrators diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md index 42a3ad5d0b..16f93645cd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md @@ -24,7 +24,7 @@ ms.topic: troubleshooting **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-troublshootonboarding-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md index d55165aaae..673f3f624c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md @@ -24,7 +24,7 @@ ms.topic: troubleshooting **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Windows Server 2012 R2 - Windows Server 2016 diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md index 0ac32a5707..765a21fe20 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md @@ -23,7 +23,7 @@ ms.topic: troubleshooting **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 14b16d1a11..debae585fc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md index f4e3899906..9d0f0c2f8a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md @@ -25,7 +25,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md index 9ed8b6cbca..694318d1d4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices.md index f388e2ec91..5bf4c26a63 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices.md @@ -25,7 +25,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >[!NOTE] > Configuration score is now part of threat and vulnerability management as Microsoft Secure Score for Devices. diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 441e815647..72f2ad5028 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -23,7 +23,7 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index caf6675ddd..613f488021 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) @@ -75,6 +75,9 @@ View recommendations, the number of weaknesses found, related components, threat The color of the **Exposed devices** graph changes as the trend changes. If the number of exposed devices is on the rise, the color changes into red. If there's a decrease in the number of exposed devices, the color of the graph will change into green. +>[!NOTE] +>Threat and vulnerability management shows devices that were in use up to **30 days** ago. This is different from the rest of Microsoft Defender for Endpoint, where if a device has not been in use for more than 7 days it has in an ‘Inactive’ status. + ![Example of the landing page for security recommendations.](images/tvmsecrec-updated.png) ### Icons diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md index 064ca53844..8ee0bcbe8c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md @@ -23,7 +23,7 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md index 8802d9cf10..f907cb50ed 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md @@ -25,7 +25,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index ae152f9f21..ef1dfe0096 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -23,7 +23,7 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/unisolate-machine.md b/windows/security/threat-protection/microsoft-defender-atp/unisolate-machine.md index c518418a7f..1833077b2c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/unisolate-machine.md +++ b/windows/security/threat-protection/microsoft-defender-atp/unisolate-machine.md @@ -22,7 +22,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution.md b/windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution.md index 50319acfe5..f05f9a4644 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution.md +++ b/windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/update-alert.md b/windows/security/threat-protection/microsoft-defender-atp/update-alert.md index 9c9268711b..8d2e4f9a6a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/update-alert.md +++ b/windows/security/threat-protection/microsoft-defender-atp/update-alert.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/use.md b/windows/security/threat-protection/microsoft-defender-atp/use.md index da8874d9ba..a2838a56d7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/use.md +++ b/windows/security/threat-protection/microsoft-defender-atp/use.md @@ -24,7 +24,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-usewdatp-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md index 3e7673cab5..4c08836f95 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md +++ b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md @@ -23,7 +23,7 @@ ms.topic: article **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-roles-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/user.md b/windows/security/threat-protection/microsoft-defender-atp/user.md index e94dd0bb1d..3a38c1edfc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/user.md +++ b/windows/security/threat-protection/microsoft-defender-atp/user.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md b/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md index a1fa8c6d8a..9742f5aa9e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md +++ b/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md @@ -23,7 +23,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) The **Incidents queue** shows a collection of incidents that were flagged from devices in your network. It helps you sort through incidents to prioritize and create an informed cybersecurity response decision. diff --git a/windows/security/threat-protection/microsoft-defender-atp/vulnerability.md b/windows/security/threat-protection/microsoft-defender-atp/vulnerability.md index 121df4f64b..d91dfe2c07 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/vulnerability.md +++ b/windows/security/threat-protection/microsoft-defender-atp/vulnerability.md @@ -21,7 +21,7 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index 38c6bd4b37..7e173b6a93 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -26,7 +26,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) The following features are generally available (GA) in the latest release of Microsoft Defender ATP as well as security features in Windows 10 and Windows Server. diff --git a/windows/whats-new/TOC.md b/windows/whats-new/TOC.md index edb6146667..9be4f860e1 100644 --- a/windows/whats-new/TOC.md +++ b/windows/whats-new/TOC.md @@ -1,11 +1,12 @@ # [What's new in Windows 10](index.md) +## [What's new in Windows 10, version 20H2](whats-new-windows-10-version-20H2.md) ## [What's new in Windows 10, version 2004](whats-new-windows-10-version-2004.md) ## [What's new in Windows 10, version 1909](whats-new-windows-10-version-1909.md) ## [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md) ## [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md) ## [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md) -## [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) ## Previous versions +### [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) ### [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md) ### [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md) ### [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index 7f2d33540e..559ab66233 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -18,12 +18,13 @@ Windows 10 provides IT professionals with advanced protection against modern sec ## In this section +- [What's new in Windows 10, version 20H2](whats-new-windows-10-version-20H2.md) - [What's new in Windows 10, version 2004](whats-new-windows-10-version-2004.md) - [What's new in Windows 10, version 1909](whats-new-windows-10-version-1909.md) - [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md) - [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md) - [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md) -- [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) + ## Learn more diff --git a/windows/whats-new/whats-new-windows-10-version-20H2.md b/windows/whats-new/whats-new-windows-10-version-20H2.md new file mode 100644 index 0000000000..8600af198f --- /dev/null +++ b/windows/whats-new/whats-new-windows-10-version-20H2.md @@ -0,0 +1,152 @@ +--- +title: What's new in Windows 10, version 20H2 +description: New and updated features in Windows 10, version 20H2 (also known as the Windows 10 October 2020 Update). +keywords: ["What's new in Windows 10", "Windows 10", "October 2020 Update"] +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.localizationpriority: high +ms.topic: article +--- + +# What's new in Windows 10, version 20H2 for IT Pros + +**Applies to** +- Windows 10, version 20H2 + +This article lists new and updated features and content that is of interest to IT Pros for Windows 10, version 20H2, also known as the Windows 10 October 2020 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 2004. + +> [!NOTE] +> With this release and future releases, the Windows 10 release nomenclature is changing from a year and month pattern (YYMM) to a year and half-year pattern (YYH1, YYH2). + +As with previous fall releases, Windows 10, version 20H2 is a scoped set of features for select performance improvements, enterprise features, and quality enhancements. As an [H2-targeted release](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet), 20H2 is serviced for 30 months from the release date for devices running Windows 10 Enterprise or Windows 10 Education editions. + +To download and install Windows 10, version 20H2, use Windows Update (**Settings > Update & Security > Windows Update**). For more information, including a video, see [How to get the Windows 10 October 2020 Update](https://community.windows.com/videos/how-to-get-the-windows-10-october-2020-update/7c7_mWN0wi8). + +## Microsoft Edge + +This release automatically includes the new Chromium-based [Microsoft Edge](https://www.microsoft.com/edge/business) browser instead of the legacy version of Edge. For more information, see the [Microsoft Edge documentation](https://docs.microsoft.com/microsoft-edge/). + +## Servicing + +### Windows Update + +There are several changes that help improve the security of devices that scan Windows Server Update Services (WSUS) for updates. For more information, see [Changes to improve security for Windows devices scanning WSUS](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/changes-to-improve-security-for-windows-devices-scanning-wsus/ba-p/1645547). + +Starting with Windows 10, version 20H2, LCUs and SSUs have been combined into a single cumulative monthly update, available via Microsoft Catalog or Windows Server Update Services. For more information, see [Simplifying on-premises deployment of servicing stack updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039). + +## Deployment + +New guidance is available to help prepare a [servicing strategy](https://docs.microsoft.com/windows/deployment/update/waas-servicing-strategy-windows-10-updates) and move your devices to the latest version of Windows 10 quickly and as seamlessly as possible. + +Activities are grouped into the following phases: **Plan** > **Prepare** > **Deploy**: + +**Plan** your deployment by evaluating and understanding essential activities: +- Create a [phased deployment plan](https://docs.microsoft.com/windows/deployment/update/create-deployment-plan) +- Assign [roles and responsibilities](https://docs.microsoft.com/windows/deployment/update/plan-define-readiness#process-manager) within your organization +- Set [criteria](https://docs.microsoft.com/windows/deployment/update/plan-define-readiness#set-criteria-for-rating-apps) to establish readiness for the upgrade process +- Evaluate your [infrastructure and tools](https://docs.microsoft.com/windows/deployment/update/eval-infra-tools) +- Determine [readiness](https://docs.microsoft.com/windows/deployment/update/plan-determine-app-readiness) for your business applications +- Create an effective, schedule-based [servicing strategy](https://docs.microsoft.com/windows/deployment/update/plan-define-strategy) + +**Prepare** your devices and environment for deployment by performing necessary actions: +- Update [infrastructure and tools](https://docs.microsoft.com/windows/deployment/update/prepare-deploy-windows#prepare-infrastructure-and-environment) +- Ensure the needed [services](https://docs.microsoft.com/windows/deployment/update/prepare-deploy-windows#prepare-applications-and-devices) are available +- Resolve issues with [unhealthy devices](https://docs.microsoft.com/windows/deployment/update/prepare-deploy-windows#address-unhealthy-devices) +- Ensure that [users are ready](https://docs.microsoft.com/windows/deployment/update/prepare-deploy-windows) for updates + +**Deploy** and manage Windows 10 strategically in your organization: +- Use [Windows Autopilot](https://docs.microsoft.com/mem/autopilot/windows-autopilot) to streamline the set up, configuration, and delivery of new devices +- Use [Configuration Manager](https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager) or [MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt) to deploy new devices and update existing devices +- Use [Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb) with Group Policy to [customize update settings](https://docs.microsoft.com/windows/deployment/update/waas-wufb-group-policy) for your devices +- [Deploy Windows updates](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus) with Windows Server Update Services (WSUS) +- Manage bandwidth for updates with [Delivery Optimization](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization) +- [Monitor Windows Updates](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor) with Update Compliance + +### Windows Autopilot + +Enhancements to Windows Autopilot since the last release of Windows 10 include: +- [Windows Autopilot for HoloLens](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-autopilot-for-hololens-2/ba-p/1371494): Set up HoloLens 2 devices with Windows Autopilot for HoloLens 2 self-deploying mode. +- [Windows Autopilot with co-management](https://docs.microsoft.com/mem/configmgr/comanage/quickstart-autopilot): Co-management and Autopilot together can help you reduce cost and improve the end user experience. +- Enhancements to Windows Autopilot deployment reporting are in preview. From the Microsoft Endpoint Manager admin center (endpoint.microsoft.com), select **Devices** > **Monitor** and scroll down to the **Enrollment** section. Click **Autopilot deployment (preview)**. + +### Windows Assessment and Deployment Toolkit (ADK) + +There is no new ADK for Windows 10, version 20H2. The ADK for Windows 10, version 2004 will also work with Windows 10, version 20H2. For more information, see [Download and install the Windows ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install). + +## Device management + +Modern Device Management (MDM) policy is extended with new [Local Users and Groups settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-localusersandgroups) that match the options available for devices managed through Group Policy. + +For more information about what's new in MDM, see [What's new in mobile device enrollment and management](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management) + +## Security + +### Microsoft Defender Advanced Threat Protection (ATP) + +This release includes improved support for non-ASCII file paths has been added for Microsoft Defender ATP Auto Incident Response (IR). + +The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) parameter is deprecated in this release. + +### Microsoft Defender Application Guard for Office + +Microsoft Defender Application Guard now supports Office: With [Microsoft Defender Application Guard for Office](https://docs.microsoft.com/microsoft-365/security/office-365-security/install-app-guard), you can launch untrusted Office documents (from outside the Enterprise) in an isolated container to prevent potentially malicious content from compromising your device. + +### Windows Hello + +With specialized hardware and software components available on devices shipping with Windows 10, version 20H2 configured out of factory, Windows Hello now offers added support for virtualization-based security with supporting fingerprint and face sensors. This feature isolates and secures a user's biometric authentication data. + +## Virtualization + +### Windows Sandbox + +New polices for [Windows Sandbox](https://docs.microsoft.com/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview) are available in this release. For more information, see [Policy CSP - WindowsSandbox](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowssandbox). + +### Windows Virtual Desktop (WVD) + +> **Note**: WVD is not tied directly to a Windows 10 release, but it is included here as an evolving capability of Windows. + +New capabilities in WVD were announced at Ignite 2020. For more information, see [Announcing new management, security, and monitoring capabilities in Windows Virtual Desktop](https://aka.ms/wvd-ignite2020-blogpost). + +In addition, [Windows Virtual Desktop is now generally available in the Azure Government cloud](https://azure.microsoft.com/updates/windows-virtual-desktop-is-now-generally-available-in-the-azure-government-cloud/). + +## Windows Shell + +Some enhancements to the Windows 10 user interface are implemented in this release: + +- With this release, the solid color behind tiles on the Start menu is replaced with a partially transparent background. Tiles are also theme-aware. +- Icons on the Start menu no longer have a square outline around each icon. +- Notifications are slightly updated in appearance. +- You can now change the monitor refresh rate on advanced display settings. +- Alt+Tab now shows Edge browser tabs by default. You can edit this setting under **Settings** > **System** > **Multitasking**: **Alt+Tab**. +- The System control panel under System and Security has been updated to the Settings > About page. Links to Device Manager, Remote desktop, System protection, Advanced system settings, and Rename this PC are moved to the About page. + +### 2-in-1 PCs + +On a 2-in-1 device, Windows will now automatically switch to tablet mode when you detach the screen. + +## Surface + +Windows 10 Pro and Enterprise are now [available on Surface Hub 2](https://techcommunity.microsoft.com/t5/surface-it-pro-blog/announcing-the-availability-of-windows-10-pro-and-enterprise-on/ba-p/1624107). For more information, see [What's new in Surface Hub 2S for IT admins](https://docs.microsoft.com/surface-hub/surface-hub-2s-whats-new). + +## Desktop Analytics + +[Desktop Analytics](https://docs.microsoft.com/configmgr/desktop-analytics/overview) is a cloud-connected service, integrated with Configuration Manager that provides data-driven insights to the management of Windows endpoints in your organization. Desktop Analytics requires a Windows E3 or E5 license, or a Microsoft 365 E3 or E5 license. + +For information about Desktop Analytics and this release of Windows 10, see [What's new in Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/whats-new). + +## See Also + +[What’s new for IT pros in Windows 10, version 20H2](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/what-s-new-for-it-pros-in-windows-10-version-20h2/ba-p/1800132)
+[Get started with the October 2020 update to Windows 10](https://www.linkedin.com/learning/windows-10-october-2020-update-new-features-2/get-started-with-the-october-2020-update-to-windows-10)
+[Learn Windows 10 with the October 2020 Update](https://www.linkedin.com/learning/windows-10-october-2020-update-essential-training/learn-windows-10-with-the-october-2020-update)
+[What's New in Windows Server](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.
+[Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
+[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
+[Announcing more ways we’re making app development easier on Windows](https://blogs.windows.com/windowsdeveloper/2020/09/22/kevin-gallo-microsoft-ignite-2020/): Simplifying app development in Windows.
+[Features and functionality removed in Windows 10](https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features): Removed features.
+[Windows 10 features we’re no longer developing](https://docs.microsoft.com/windows/deployment/planning/windows-10-deprecated-features): Features that are not being developed.