diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index d6f6446385..31d8d2cd74 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -11487,7 +11487,7 @@ }, { "source_path": "windows/plan/windows-10-compatibility.md", - "redirect_url": "/windows/deployment/planning/windows-10-compatibility", + "redirect_url": "/windows/compatibility/", "redirect_document_id": false }, { diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json index b5f046f434..abeb93b128 100644 --- a/.openpublishing.redirection.windows-configuration.json +++ b/.openpublishing.redirection.windows-configuration.json @@ -37,7 +37,7 @@ }, { "source_path": "windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields.md", - "redirect_url": "/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields", + "redirect_url": "https://techcommunity.microsoft.com/t5/windows-it-pro-blog/preview-app-and-driver-compatibility-insights-in-endpoint/ba-p/3482136", "redirect_document_id": false }, { diff --git a/.openpublishing.redirection.windows-deployment.json b/.openpublishing.redirection.windows-deployment.json index 44cd5fae11..9fe31073d2 100644 --- a/.openpublishing.redirection.windows-deployment.json +++ b/.openpublishing.redirection.windows-deployment.json @@ -1179,6 +1179,16 @@ "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview", "redirect_document_id": true + }, + { + "source_path": "windows/deployment/planning/windows-10-compatibility.md", + "redirect_url": "/windows/compatibility/", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/plan-determine-app-readiness.md", + "redirect_url": "/windows/compatibility/windows-11/testing-guidelines", + "redirect_document_id": false } ] } diff --git a/.openpublishing.redirection.windows-privacy.json b/.openpublishing.redirection.windows-privacy.json index 3bbff994f7..e280e5a7ba 100644 --- a/.openpublishing.redirection.windows-privacy.json +++ b/.openpublishing.redirection.windows-privacy.json @@ -54,6 +54,11 @@ "source_path": "windows/privacy/windows-personal-data-services-configuration.md", "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", "redirect_document_id": false + }, + { + "source_path": "windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md", + "redirect_url": "https://techcommunity.microsoft.com/t5/windows-it-pro-blog/preview-app-and-driver-compatibility-insights-in-endpoint/ba-p/3482136", + "redirect_document_id": false } ] } diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 471c829ed5..93967da44e 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -52,7 +52,12 @@ }, { "source_path": "windows/security//threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md", - "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension", + "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md", + "redirect_url": "/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview", "redirect_document_id": false }, { diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index 2a00963aef..73dbb919ae 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -5,7 +5,7 @@ author: aczechowski ms.author: aaroncz manager: aaroncz ms.date: 10/03/2017 -ms.topic: article +ms.topic: conceptual ms.service: windows-client ms.subservice: itpro-apps ms.localizationpriority: medium diff --git a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md index 90281afcd3..d6b6444c8d 100644 --- a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md +++ b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md @@ -5,7 +5,7 @@ author: aczechowski ms.author: aaroncz manager: aaroncz ms.date: 04/04/2023 -ms.topic: article +ms.topic: conceptual ms.service: windows-client ms.subservice: itpro-apps ms.localizationpriority: medium diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 1dea6a8e0c..fbc47a783d 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -429,6 +429,10 @@ Specifies whether device lock is enabled. > - DevicePasswordHistory > - MaxDevicePasswordFailedAttempts > - MaxInactivityTimeDeviceLock + +> [!NOTE] +> DevicePasswordExpiration isn't supported through MDMWinsOverGP. + diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index 040365664e..c0d23cc517 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -17,6 +17,13 @@ The table below shows the applicability of Windows: |Enterprise|Yes|Yes| |Education|Yes|Yes| +> [!IMPORTANT] +> Windows 11 Home devices that have been upgraded to one of the below mentioned applicable editions might require you to run the following command before onboarding: +> +> `DISM /online /Add-Capability /CapabilityName:Microsoft.Windows.Sense.Client~~~~` +> +> For more information about edition upgrades and features, see [Customize Windows features](/windows-hardware/manufacture/desktop/windows-features?view=windows-11&preserve-view=true). + The Windows Defender Advanced Threat Protection (WDATP) configuration service provider (CSP) allows IT Admins to onboard, determine configuration and health status, and offboard endpoints for WDATP. The following example shows the WDATP configuration service provider in tree format as used by the Open Mobile Alliance (OMA) Device Management (DM). diff --git a/windows/configuration/wcd/wcd-policies.md b/windows/configuration/wcd/wcd-policies.md index 68c83b8121..dda5503d8b 100644 --- a/windows/configuration/wcd/wcd-policies.md +++ b/windows/configuration/wcd/wcd-policies.md @@ -455,7 +455,7 @@ ConfigureTelemetryOptInSettingsUx | This policy setting determines whether peopl | DisableDeviceDelete | Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page. | ✅ | | | | | DisableDataDiagnosticViewer | Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page. | ✅ | | | | | [DisableOneDriveFileSync](/windows/client-management/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | ✅ | | | | -| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus other events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus other enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or don't configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | ✅ | | | | +| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus other events that are required for Windows Analytics are sent to Microsoft. Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus other enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or don't configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | ✅ | | | | ## TextInput diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 88851f15ff..339f7151c3 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -36,8 +36,6 @@ href: update/plan-define-readiness.md - name: Evaluate infrastructure and tools href: update/eval-infra-tools.md - - name: Determine application readiness - href: update/plan-determine-app-readiness.md - name: Define your servicing strategy href: update/plan-define-strategy.md - name: Delivery Optimization for Windows client updates @@ -53,6 +51,8 @@ href: planning/windows-10-infrastructure-requirements.md - name: Plan for volume activation href: volume-activation/plan-for-volume-activation-client.md + - name: Windows compatibility cookbook + href: /windows/compatibility/ - name: Features removed or planned for replacement items: - name: Windows client features lifecycle diff --git a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md index 8afd2c00f8..4b8d904b2e 100644 --- a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md +++ b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium author: frankroj manager: aaroncz ms.author: frankroj -ms.topic: article +ms.topic: conceptual ms.date: 11/23/2022 ms.subservice: itpro-deploy --- diff --git a/windows/deployment/customize-boot-image.md b/windows/deployment/customize-boot-image.md index e03de452cb..f49b063823 100644 --- a/windows/deployment/customize-boot-image.md +++ b/windows/deployment/customize-boot-image.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium author: frankroj manager: aaroncz ms.author: frankroj -ms.topic: article +ms.topic: conceptual ms.date: 05/09/2024 ms.subservice: itpro-deploy appliesto: diff --git a/windows/deployment/deploy-m365.md b/windows/deployment/deploy-m365.md index c2a4d9ce76..d125b76faf 100644 --- a/windows/deployment/deploy-m365.md +++ b/windows/deployment/deploy-m365.md @@ -6,7 +6,7 @@ description: Learn about deploying Windows with Microsoft 365 and how to use a f ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.date: 02/13/2024 ms.subservice: itpro-deploy appliesto: diff --git a/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md index c5ed56316b..078191014f 100644 --- a/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md index 40fdcea0df..3e07ef2858 100644 --- a/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md index da7c70c515..cee1940d35 100644 --- a/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt.md b/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt.md index af5baf8233..1f1fdf0411 100644 --- a/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt.md +++ b/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md index 7159edcbe3..da0da8612c 100644 --- a/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md index 648a274ad0..1d0ee23b79 100644 --- a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md index 4929876f5a..ceea5b0432 100644 --- a/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md index 19bb081501..e6876a705b 100644 --- a/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md index b13078046f..e26d5695c1 100644 --- a/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager.md index bddc7bf6cb..ad22f1ed1a 100644 --- a/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/27/2022 --- diff --git a/windows/deployment/do/images/elixir_ux/readme-elixir-ux-files.md b/windows/deployment/do/images/elixir_ux/readme-elixir-ux-files.md index bc36a395ef..8b132e7d76 100644 --- a/windows/deployment/do/images/elixir_ux/readme-elixir-ux-files.md +++ b/windows/deployment/do/images/elixir_ux/readme-elixir-ux-files.md @@ -5,7 +5,7 @@ description: Elixir images read me file ms.service: windows-client author: nidos ms.author: nidos -ms.topic: article +ms.topic: conceptual ms.date: 12/31/2017 ms.subservice: itpro-updates robots: noindex diff --git a/windows/deployment/do/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md index ed6006bb65..904981a5fa 100644 --- a/windows/deployment/do/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -87,8 +87,8 @@ All cached files have to be above a set minimum size. This size is automatically More options available that control the impact Delivery Optimization has on your network include the following settings: - [Minimum Background QoS](#minimum-background-qos) lets administrators guarantee a minimum download speed for Windows updates. This setting adjusts the amount of data downloaded directly from HTTP sources, rather than other peers in the network. -- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the maximum foreground download bandwidth*hat Delivery Optimization uses, across all concurrent download activities, as a percentage of available download bandwidth. -- [Maximum Background Download Bandwidth](#maximum-background-download-bandwidth) specifies the **maximum background download bandwidth** that Delivery Optimization uses, across all concurrent download activities, as a percentage of available download bandwidth. +- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the maximum foreground download bandwidth that Delivery Optimization uses, across all concurrent download activities, as a percentage of available download bandwidth. +- [Maximum Background Download Bandwidth](#maximum-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses, across all concurrent download activities, as a percentage of available download bandwidth. - [Set Business Hours to Limit Background Download Bandwidth](#set-business-hours-to-limit-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - [Set Business Hours to Limit Foreground Download Bandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - [Select a method to restrict Peer Selection](#select-a-method-to-restrict-peer-selection) restricts peer selection by the options you select. diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 5e60b0c3c0..3f5ea288b1 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -15,7 +15,7 @@ metadata: author: aczechowski ms.author: aaroncz manager: aaroncz - ms.date: 04/01/2024 + ms.date: 07/12/2024 localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -34,10 +34,10 @@ landingContent: url: update/plan-define-readiness.md - text: Define your servicing strategy url: update/plan-define-strategy.md - - text: Determine application readiness - url: update/plan-determine-app-readiness.md - text: Plan for volume activation url: volume-activation/plan-for-volume-activation-client.md + - text: Windows compatibility cookbook + url: /windows/compatibility/ - title: Prepare linkLists: diff --git a/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md b/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md index e592664ec5..34bf0d7f22 100644 --- a/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md +++ b/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md index 1d4df56098..1b714e4247 100644 --- a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md +++ b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/compatibility-administrator-users-guide.md b/windows/deployment/planning/compatibility-administrator-users-guide.md index 853283a0cc..4e8ee9cb22 100644 --- a/windows/deployment/planning/compatibility-administrator-users-guide.md +++ b/windows/deployment/planning/compatibility-administrator-users-guide.md @@ -5,7 +5,7 @@ ms.author: frankroj description: The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows. ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/28/2022 --- diff --git a/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md b/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md index dd2905355f..acd338e940 100644 --- a/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md +++ b/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md @@ -6,7 +6,7 @@ description: Learn how to deploy your compatibility fixes into an application-in ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md index e37a77e25a..6148602a62 100644 --- a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md +++ b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md index c1946e6941..d008653378 100644 --- a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md @@ -5,7 +5,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/28/2022 --- diff --git a/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md index 9e8137b12b..ffbac4b896 100644 --- a/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md b/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md index a77208735d..5ba7a9cf41 100644 --- a/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md index e37786a9a6..1767d6c21b 100644 --- a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md +++ b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md @@ -5,7 +5,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/28/2022 --- diff --git a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md index 7155581ea8..ebb8501b13 100644 --- a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md +++ b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md b/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md index a50feb249b..e7265156ef 100644 --- a/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md +++ b/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md b/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md index 69b7bd6cd3..6f9d7dae92 100644 --- a/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md +++ b/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md index aa27616363..a65742c0f2 100644 --- a/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md +++ b/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md index 847fb0731b..c7cd8de1b8 100644 --- a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md +++ b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md @@ -5,7 +5,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/28/2022 --- diff --git a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md index cb8a3ebc82..53428226ac 100644 --- a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md +++ b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/sua-users-guide.md b/windows/deployment/planning/sua-users-guide.md index 47b4ffba5c..3933f9c2d5 100644 --- a/windows/deployment/planning/sua-users-guide.md +++ b/windows/deployment/planning/sua-users-guide.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md index c6af910322..6c189c6d79 100644 --- a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md +++ b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/testing-your-application-mitigation-packages.md b/windows/deployment/planning/testing-your-application-mitigation-packages.md index 481d2ce883..fcc32044a3 100644 --- a/windows/deployment/planning/testing-your-application-mitigation-packages.md +++ b/windows/deployment/planning/testing-your-application-mitigation-packages.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md index 7327ff75b9..6fa5f46c8c 100644 --- a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md +++ b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md @@ -5,7 +5,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/28/2022 --- diff --git a/windows/deployment/planning/using-the-compatibility-administrator-tool.md b/windows/deployment/planning/using-the-compatibility-administrator-tool.md index d3c2f77b38..d938b218f9 100644 --- a/windows/deployment/planning/using-the-compatibility-administrator-tool.md +++ b/windows/deployment/planning/using-the-compatibility-administrator-tool.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md index 2ae090b3f3..d9152b5782 100644 --- a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md +++ b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/using-the-sua-tool.md b/windows/deployment/planning/using-the-sua-tool.md index 043d002305..c67a5ba90a 100644 --- a/windows/deployment/planning/using-the-sua-tool.md +++ b/windows/deployment/planning/using-the-sua-tool.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/using-the-sua-wizard.md b/windows/deployment/planning/using-the-sua-wizard.md index 8f7ed9170b..5107afeb74 100644 --- a/windows/deployment/planning/using-the-sua-wizard.md +++ b/windows/deployment/planning/using-the-sua-wizard.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 10/28/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy --- diff --git a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md index 38b8b8cf10..cf1a19004e 100644 --- a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md +++ b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md @@ -5,7 +5,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/28/2022 --- diff --git a/windows/deployment/planning/windows-10-compatibility.md b/windows/deployment/planning/windows-10-compatibility.md deleted file mode 100644 index 83227970dd..0000000000 --- a/windows/deployment/planning/windows-10-compatibility.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Windows 10 compatibility (Windows 10) -description: Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. -manager: aaroncz -ms.author: frankroj -ms.service: windows-client -ms.localizationpriority: medium -author: frankroj -ms.topic: article -ms.subservice: itpro-deploy -ms.date: 10/28/2022 ---- - -# Windows 10 compatibility - -**Applies to** - -- Windows 10 - -Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. - -For full system requirements, see [Windows 10 specifications](https://go.microsoft.com/fwlink/p/?LinkId=625077). Some driver updates may be required for Windows 10. - -Existing desktop (Win32) application compatibility is also expected to be strong, with most existing applications working without any changes. Those applications that interface with Windows at a low level, those applications that use undocumented APIs, or those that do not follow recommended coding practices could experience issues. - -Existing Windows Store (WinRT) apps created for Windows 8 and Windows 8.1 should also continue to work, because compatibility can be validated against all the apps that have been submitted to the Windows Store. - -For web apps and sites, modern HTML5-based sites should also have a high degree of compatibility and excellent performance through the new Microsoft Edge browser, while older web apps and sites can continue to use Internet Explorer 11 and the Enterprise Mode features that were first introduced in Windows 7 and Windows 8.1 and are still present in Windows 10. For more information about Internet Explorer and Enterprise Mode, see the [Internet Explorer 11 Deployment Guide for IT Pros.](/internet-explorer/ie11-deploy-guide/) - -## Recommended application testing process - -Historically, organizations have performed extensive, and often exhaustive, testing of the applications they use before deployment of a new Windows version, service pack, or any other significant update. With Windows 10, organizations are encouraged to use more optimized testing processes, which reflect the higher levels of compatibility that are expected. At a high level: - -- Identify mission-critical applications and websites, those applications and websites that are essential to the organization's operations. Focus testing efforts on this subset of applications, early in the Windows development cycle (for example, with Windows Insider Program builds) to identify potential issues. Report any issues you encounter with the Windows Feedback tool, so that these issues can be addressed prior to the next Windows release. - -- For less critical applications, apply an "internal flighting" or pilot-based approach, by deploying new Windows upgrades to groups of machines, growing gradually in size and potential impact, to verify compatibility with hardware and software. Reactively address issues before you expand the pilot to more machines. - -## Related articles - - -[Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md) - -[Windows 10 deployment considerations](windows-10-deployment-considerations.md) - -[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) \ No newline at end of file diff --git a/windows/deployment/planning/windows-10-deployment-considerations.md b/windows/deployment/planning/windows-10-deployment-considerations.md index 434b7da17f..4de089d98f 100644 --- a/windows/deployment/planning/windows-10-deployment-considerations.md +++ b/windows/deployment/planning/windows-10-deployment-considerations.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/28/2022 --- @@ -69,7 +69,7 @@ In either of these scenarios, you can make various configuration changes to the For computers using the [General Availability Channel](../update/waas-overview.md#general-availability-channel), you can deploy these upgrades by using various methods: - Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet. -- Windows Server Update Services (WSUS), for devices configured to pull updates from internal servers after they're approved (deploying like an update). +- Windows Server Update Services (WSUS), for devices configured to pull updates from internal servers after they're approved (deploying like an update). - Configuration Manager task sequences. - Configuration Manager software update capabilities (deploying like an update). @@ -79,5 +79,4 @@ The upgrade process is also optimized to reduce the overall time and network ban ## Related articles -[Windows 10 compatibility](windows-10-compatibility.md)
[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) diff --git a/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml b/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml index 9bf7a86f35..3d8e2f154e 100644 --- a/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml +++ b/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml @@ -61,11 +61,6 @@ sections: answer: | Many existing Win32 and Win64 applications already run reliably on Windows 10 without any changes. You can also expect strong compatibility and support for Web apps and devices. - - question: | - Is there an easy way to assess if my organization's devices are ready to upgrade to Windows 10? - answer: | - [Desktop Analytics](/mem/configmgr/desktop-analytics/overview) provides powerful insights and recommendations about the computers, applications, and drivers in your organization, at no extra cost and without other infrastructure requirements. This service guides you through your upgrade and feature update projects using a workflow based on Microsoft recommended practices. Up-to-date inventory data allows you to balance cost and risk in your upgrade projects. - - name: Administration and deployment questions: - question: | diff --git a/windows/deployment/planning/windows-10-infrastructure-requirements.md b/windows/deployment/planning/windows-10-infrastructure-requirements.md index 06a835b0ba..f6e34ac694 100644 --- a/windows/deployment/planning/windows-10-infrastructure-requirements.md +++ b/windows/deployment/planning/windows-10-infrastructure-requirements.md @@ -6,7 +6,7 @@ ms.author: frankroj ms.service: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 10/28/2022 --- @@ -97,4 +97,3 @@ Windows 10 Enterprise and Windows 10 Enterprise LTSC installations use different [Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md)
[Windows 10 deployment considerations](windows-10-deployment-considerations.md)
-[Windows 10 compatibility](windows-10-compatibility.md)
\ No newline at end of file diff --git a/windows/deployment/update/eval-infra-tools.md b/windows/deployment/update/eval-infra-tools.md index d12a78f404..920952b771 100644 --- a/windows/deployment/update/eval-infra-tools.md +++ b/windows/deployment/update/eval-infra-tools.md @@ -3,7 +3,7 @@ title: Evaluate infrastructure and tools description: Review the steps to ensure your infrastructure is ready to deploy updates to clients in your organization. ms.service: windows-client ms.subservice: itpro-updates -ms.topic: article +ms.topic: conceptual author: mestew ms.author: mstewart manager: aaroncz diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md index 080e86b6ad..3794cdf447 100644 --- a/windows/deployment/update/media-dynamic-update.md +++ b/windows/deployment/update/media-dynamic-update.md @@ -13,7 +13,7 @@ appliesto: - ✅ Windows 11 - ✅ Windows 10 - ✅ Windows Server -ms.date: 12/05/2023 +ms.date: 07/10/2024 --- # Update Windows installation media with Dynamic Update @@ -38,10 +38,10 @@ Devices must be able to connect to the internet to obtain Dynamic Updates. In so ## Acquire Dynamic Update packages -You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https://catalog.update.microsoft.com). At that site, use the search bar in the upper right to find the Dynamic Update packages for a particular release. The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. Check various parts of the results to be sure you've identified the needed files. The following tables show the key values to search for or look for in the results. +You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https://catalog.update.microsoft.com). At that site, use the search bar in the upper right to find the Dynamic Update packages for a particular release. The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. Check various parts of the results to be sure you've identified the files needed. The following tables show the key values to search for or look for in the results. -### Windows 11, version 22H2 Dynamic Update packages -**Title** can distinguish each Dynamic Package. Cumulative updates have the servicing stack embedded. The servicing stack is published only if necessary for a given cumulative update. +### Windows 11, version 22H2 and later Dynamic Update packages +**Title** can distinguish each Dynamic Package. Latest cumulative updates have the servicing stack embedded. The servicing stack is published only if necessary for a given cumulative update.Titles below are for Windows 11, version 22H2. Windows 11, version 23H2 and 24H2 have a similar format. | Update packages |Title | |-----------------------------------|---------------------------------------------------------------| @@ -61,7 +61,7 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https |Latest cumulative update | YYYY-MM Cumulative Update for Windows 11 | | | |Servicing stack Dynamic Update | YYYY-MM Servicing Stack Update for Windows 11 Version 21H2 | | | -### For Windows 10, version 22H2 Dynamic Update packages +### Windows 10, version 22H2 Dynamic Update packages **Title**, **Product** and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update. | Update packages |Title |Product |Description | @@ -75,7 +75,7 @@ If you want to customize the image with additional languages or Features on Dema ## Update Windows installation media -Properly updating the installation media involves a large number of actions operating on several different targets (image files). Some actions are repeated on different targets. The target images files include: +Properly updating the installation media involves many actions operating on several different targets (image files). Some actions are repeated on different targets. The target images files include: - Windows Preinstallation Environment (WinPE): a small operating system used to install, deploy, and repair Windows operating systems - Windows Recovery Environment (WinRE): repairs common causes of unbootable operating systems. WinRE is based on WinPE and can be customized with additional drivers, languages, optional packages, and other troubleshooting or diagnostic tools. @@ -86,7 +86,7 @@ This table shows the correct sequence for applying the various tasks to the file |Task |WinRE (winre.wim) |Operating system (install.wim) | WinPE (boot.wim) | New media | |-----------------------------------|-------------------|--------------------------------|------------------|-----------| -|Add servicing stack Dynamic Update | 1 | 9 | 17 | | +|Add servicing stack Dynamic Update | 1 | 9 | 17 | | |Add language pack | 2 | 10 | 18 | | |Add localized optional packages | 3 | | 19 | | |Add font support | 4 | | 20 | | @@ -119,6 +119,13 @@ You don't have to add more languages and features to the image to accomplish the Optional Components, along with the .NET feature, can be installed offline, however doing so creates pending operations that require the device to restart. As a result, the call to perform image cleanup would fail. There are two options to avoid the cleanup failure. One option is to skip the image cleanup step, though that results in a larger install.wim. Another option is to install the .NET and Optional Components in a step after cleanup but before export. This is the option in the sample script. By doing this, you'll have to start with the original install.wim (with no pending actions) when you maintain or update the image the next time (for example, the next month). + +### Checkpoint cumulative updates +Starting with Windows 11, version 24H2, the latest cumulative update may have a prerequisite cumulative update that is required to be installed first. These are known as checkpoint cumulative updates. In these cases, the cumulative update file level differentials are based on a previous cumulative update instead of the Windows RTM release. The benefit is a smaller update package and faster installation. When you obtain the latest cumulative update from the [Microsoft Update Catalog](https://catalog.update.microsoft.com), checkpoint cumulative updates will be available from the download button. In addition, the knowledge base article for the cumulative update will provide additional information. + +To install the checkpoint(s) when servicing the Windows OS (steps 9 & 12) and WinPE (steps 17 & 23), call `Add-WindowsPackage` with the target cumulative update. The folder from `-PackagePath` will be used to discover and install one or more checkpoints as needed. Only the target cumulative update and checkpoint cumulative updates should be in the `-PackagePath` folder. Cumulative update packages with a revision <= the target cumulative update will be processed. If you are not customizing the image with additional languages and/or optional features, then separate calls to `Add-WindowsPackage` (checkpoint cumulative updates first) can be used for steps 9 & 17 above. Separate calls cannot be used for steps 12 and 23. + + ## Windows PowerShell scripts to apply Dynamic Updates to an existing image These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages are stored locally in this folder structure: @@ -150,12 +157,13 @@ $LANG_FONT_CAPABILITY = "jpan" # If you are using this script for Windows 10, modify to mount and use the LANGPACK ISO. $FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso" -# Declare Dynamic Update packages -$LCU_PATH = "C:\mediaRefresh\packages\LCU.msu" -$SSU_PATH = "C:\mediaRefresh\packages\SSU_DU.msu" -$SETUP_DU_PATH = "C:\mediaRefresh\packages\Setup_DU.cab" -$SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\SafeOS_DU.cab" -$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu" +# Declare Dynamic Update packages. A dedicated folder is used for the latest cumulative update, and as needed +# checkpoint cumulative updates. +$LCU_PATH = "C:\mediaRefresh\packages\CU\LCU.msu" +$SSU_PATH = "C:\mediaRefresh\packages\Other\SSU_DU.msu" +$SETUP_DU_PATH = "C:\mediaRefresh\packages\Other\Setup_DU.cab" +$SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\Other\SafeOS_DU.cab" +$DOTNET_CU_PATH = "C:\mediaRefresh\packages\Other\DotNet_CU.msu" # Declare folders for mounted images and temp files $MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia" @@ -211,14 +219,14 @@ This process is repeated for each edition of Windows within the main operating s # Update each main OS Windows image including the Windows Recovery Environment (WinRE) # -# Get the list of images contained within WinPE +# Get the list of images contained within the main OS $WINOS_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" Foreach ($IMAGE in $WINOS_IMAGES) { # first mount the main OS image Write-Output "$(Get-TS): Mounting main OS, image index $($IMAGE.ImageIndex)" - Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index $IMAGE.ImageIndex -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null + Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index $IMAGE.ImageIndex -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null if ($IMAGE.ImageIndex -eq "1") { @@ -237,19 +245,22 @@ Foreach ($IMAGE in $WINOS_IMAGES) { # Windows 11, version 22H2 are examples. In these cases, the servicing stack update is not published seperately; the combined # cumulative update should be used for this step. However, in hopefully rare cases, there may breaking change in the combined # cumulative update format, that requires a standalone servicing stack update to be published, and installed first before the - # combined cumulative update can be installed. + # combined cumulative update can be installed. # This is the code to handle the rare case that the SSU is published and required for the combined cumulative update # Write-Output "$(Get-TS): Adding package $SSU_PATH" - # Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null + # Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null # Now, attempt the combined cumulative update. # There is a known issue where the servicing stack update is installed, but the cumulative update will fail. This error should # be caught and ignored, as the last step will be to apply the Safe OS update and thus the image will be left with the correct # packages installed. + + Write-Output "$(Get-TS): Adding package $LCU_PATH to WinRE" try { + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $LCU_PATH | Out-Null } Catch @@ -270,29 +281,27 @@ Foreach ($IMAGE in $WINOS_IMAGES) { # update. This second approach is commented out below. # Write-Output "$(Get-TS): Adding package $SSU_PATH" - # Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null + # Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null # # Optional: Add the language to recovery environment # # Install lp.cab cab - Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH" - Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null + Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH to WinRE" + Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null # Install language cabs for each optional package installed $WINRE_INSTALLED_OC = Get-WindowsPackage -Path $WINRE_MOUNT Foreach ($PACKAGE in $WINRE_INSTALLED_OC) { - if ( ($PACKAGE.PackageState -eq "Installed") ` - -and ($PACKAGE.PackageName.startsWith("WinPE-")) ` - -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) { + if ( ($PACKAGE.PackageState -eq "Installed") -and ($PACKAGE.PackageName.startsWith("WinPE-")) -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) { $INDEX = $PACKAGE.PackageName.IndexOf("-Package") if ($INDEX -ge 0) { $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB - Write-Output "$(Get-TS): Adding package $OC_CAB_PATH" + Write-Output "$(Get-TS): Adding package $OC_CAB_PATH to WinRE" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null } } @@ -301,7 +310,7 @@ Foreach ($IMAGE in $WINOS_IMAGES) { # Add font support for the new language if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { - Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH to WinRE" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null } @@ -309,16 +318,16 @@ Foreach ($IMAGE in $WINOS_IMAGES) { if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { - Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH to WinRE" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null - Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH to WinRE" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null } } # Add Safe OS - Write-Output "$(Get-TS): Adding package $SAFE_OS_DU_PATH" + Write-Output "$(Get-TS): Adding package $SAFE_OS_DU_PATH to WinRE" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SAFE_OS_DU_PATH -ErrorAction stop | Out-Null # Perform image cleanup @@ -347,54 +356,54 @@ Foreach ($IMAGE in $WINOS_IMAGES) { # includes the servicing stack updates (i.e. SSU + LCU are combined). Windows 11, version 21H2 and Windows 11, version 22H2 are examples. In these # cases, the servicing stack update is not published seperately; the combined cumulative update should be used for this step. However, in hopefully # rare cases, there may breaking change in the combined cumulative update format, that requires a standalone servicing stack update to be published, - # and installed first before the combined cumulative update can be installed. + # and installed first before the combined cumulative update can be installed. # This is the code to handle the rare case that the SSU is published and required for the combined cumulative update # Write-Output "$(Get-TS): Adding package $SSU_PATH" - # Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null + # Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null # Now, attempt the combined cumulative update. Unlike WinRE and WinPE, we don't need to check for error 0x8007007e - Write-Output "$(Get-TS): Adding package $LCU_PATH" - Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH | Out-Null + Write-Output "$(Get-TS): Adding package $LCU_PATH to main OS, index $($IMAGE.ImageIndex)" + Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH | Out-Null # The second approach for Step 18 is for Windows releases that have not adopted the combined cumulative update # but instead continue to have a seperate servicing stack update published. In this case, we'll install the SSU # update. This second approach is commented out below. - # Write-Output "$(Get-TS): Adding package $SSU_PATH" - # Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null + # Write-Output "$(Get-TS): Adding package $SSU_PATH to main OS, index $($IMAGE.ImageIndex)" + # Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null # Optional: Add language to main OS - Write-Output "$(Get-TS): Adding package $OS_LP_PATH" - Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null + Write-Output "$(Get-TS): Adding package $OS_LP_PATH to main OS, index $($IMAGE.ImageIndex)" + Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null # Optional: Add a Features on Demand to the image - Write-Output "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0" + Write-Output "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)" Add-WindowsCapability -Name "Language.Fonts.$LANG_FONT_CAPABILITY~~~und-$LANG_FONT_CAPABILITY~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null - Write-Output "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0" + Write-Output "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)" Add-WindowsCapability -Name "Language.Basic~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null - Write-Output "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0" + Write-Output "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)" Add-WindowsCapability -Name "Language.OCR~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null - Write-Output "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0" + Write-Output "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)" Add-WindowsCapability -Name "Language.Handwriting~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null - Write-Output "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0" + Write-Output "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)" Add-WindowsCapability -Name "Language.TextToSpeech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null - Write-Output "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0" + Write-Output "$(Get-TS): Adding language FOD: Language.Speech~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)" Add-WindowsCapability -Name "Language.Speech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null # Note: If I wanted to enable additional Features on Demand, I'd add these here. # Add latest cumulative update - Write-Output "$(Get-TS): Adding package $LCU_PATH" + Write-Output "$(Get-TS): Adding package $LCU_PATH to main OS, index $($IMAGE.ImageIndex)" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null # Perform image cleanup - Write-Output "$(Get-TS): Performing image cleanup on main OS" + Write-Output "$(Get-TS): Performing image cleanup on main OS, index $($IMAGE.ImageIndex)" DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null # @@ -403,11 +412,11 @@ Foreach ($IMAGE in $WINOS_IMAGES) { # the image to be booted, and thus if we tried to cleanup after installation, it would fail. # - Write-Output "$(Get-TS): Adding NetFX3~~~~" + Write-Output "$(Get-TS): Adding NetFX3~~~~ to main OS, index $($IMAGE.ImageIndex)" Add-WindowsCapability -Name "NetFX3~~~~" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null # Add .NET Cumulative Update - Write-Output "$(Get-TS): Adding package $DOTNET_CU_PATH" + Write-Output "$(Get-TS): Adding package $DOTNET_CU_PATH to main OS, index $($IMAGE.ImageIndex)" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $DOTNET_CU_PATH -ErrorAction stop | Out-Null # Dismount @@ -420,6 +429,7 @@ Foreach ($IMAGE in $WINOS_IMAGES) { } Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sources\install.wim" -Force -ErrorAction stop | Out-Null + ``` ### Update WinPE @@ -438,7 +448,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) { # update WinPE Write-Output "$(Get-TS): Mounting WinPE, image index $($IMAGE.ImageIndex)" - Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null + Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null # Add servicing stack update (Step 9 from the table) @@ -448,11 +458,11 @@ Foreach ($IMAGE in $WINPE_IMAGES) { # Windows 11, version 22H2 are examples. In these cases, the servicing stack update is not published separately; the combined # cumulative update should be used for this step. However, in hopefully rare cases, there may breaking change in the combined # cumulative update format, that requires a standalone servicing stack update to be published, and installed first before the - # combined cumulative update can be installed. + # combined cumulative update can be installed. # This is the code to handle the rare case that the SSU is published and required for the combined cumulative update # Write-Output "$(Get-TS): Adding package $SSU_PATH" - # Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null + # Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null # Now, attempt the combined cumulative update. # There is a known issue where the servicing stack update is installed, but the cumulative update will fail. @@ -461,6 +471,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) { try { + Write-Output "$(Get-TS): Adding package $LCU_PATH to WinPE, image index $($IMAGE.ImageIndex)" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH | Out-Null } Catch @@ -481,19 +492,17 @@ Foreach ($IMAGE in $WINPE_IMAGES) { # update. This second approach is commented out below. # Write-Output "$(Get-TS): Adding package $SSU_PATH" - # Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null + # Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null # Install lp.cab cab - Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH" - Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null + Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH to WinPE, image index $($IMAGE.ImageIndex)" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null # Install language cabs for each optional package installed $WINPE_INSTALLED_OC = Get-WindowsPackage -Path $WINPE_MOUNT Foreach ($PACKAGE in $WINPE_INSTALLED_OC) { - if ( ($PACKAGE.PackageState -eq "Installed") ` - -and ($PACKAGE.PackageName.startsWith("WinPE-")) ` - -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) { + if ( ($PACKAGE.PackageState -eq "Installed") -and ($PACKAGE.PackageName.startsWith("WinPE-")) -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) { $INDEX = $PACKAGE.PackageName.IndexOf("-Package") if ($INDEX -ge 0) { @@ -501,7 +510,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) { $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB - Write-Output "$(Get-TS): Adding package $OC_CAB_PATH" + Write-Output "$(Get-TS): Adding package $OC_CAB_PATH to WinPE, image index $($IMAGE.ImageIndex)" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null } } @@ -510,7 +519,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) { # Add font support for the new language if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { - Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH to WinPE, image index $($IMAGE.ImageIndex)" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null } @@ -518,10 +527,10 @@ Foreach ($IMAGE in $WINPE_IMAGES) { if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { - Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH to WinPE, image index $($IMAGE.ImageIndex)" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null - Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH to WinPE, image index $($IMAGE.ImageIndex)" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null } } @@ -533,11 +542,11 @@ Foreach ($IMAGE in $WINPE_IMAGES) { } # Add latest cumulative update - Write-Output "$(Get-TS): Adding package $LCU_PATH" - Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null + Write-Output "$(Get-TS): Adding package $LCU_PATH to WinPE, image index $($IMAGE.ImageIndex)" + Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null # Perform image cleanup - Write-Output "$(Get-TS): Performing image cleanup on WinPE" + Write-Output "$(Get-TS): Performing image cleanup on WinPE, image index $($IMAGE.ImageIndex)" DISM /image:$WINPE_MOUNT /cleanup-image /StartComponentCleanup /ResetBase /Defer | Out-Null if ($IMAGE.ImageIndex -eq "2") { @@ -545,6 +554,18 @@ Foreach ($IMAGE in $WINPE_IMAGES) { # Save setup.exe for later use. This will address possible binary mismatch with the version in the main OS \sources folder Copy-Item -Path $WINPE_MOUNT"\sources\setup.exe" -Destination $WORKING_PATH"\setup.exe" -Force -ErrorAction stop | Out-Null + # Save setuphost.exe for later use. This will address possible binary mismatch with the version in the main OS \sources folder + # This is only required starting with Windows 11 version 24H2 + $TEMP = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex + if ([System.Version]$TEMP.Version -ge [System.Version]"10.0.26100") { + + Copy-Item -Path $WINPE_MOUNT"\sources\setuphost.exe" -Destination $WORKING_PATH"\setuphost.exe" -Force -ErrorAction stop | Out-Null + } + else { + + Write-Output "$(Get-TS): Skipping copy of setuphost.exe; image version $($TEMP.Version)" + } + # Save serviced boot manager files later copy to the root media. Copy-Item -Path $WINPE_MOUNT"\Windows\boot\efi\bootmgfw.efi" -Destination $WORKING_PATH"\bootmgfw.efi" -Force -ErrorAction stop | Out-Null Copy-Item -Path $WINPE_MOUNT"\Windows\boot\efi\bootmgr.efi" -Destination $WORKING_PATH"\bootmgr.efi" -Force -ErrorAction stop | Out-Null @@ -580,21 +601,26 @@ cmd.exe /c $env:SystemRoot\System32\expand.exe $SETUP_DU_PATH -F:* $MEDIA_NEW_PA Write-Output "$(Get-TS): Copying $WORKING_PATH\setup.exe to $MEDIA_NEW_PATH\sources\setup.exe" Copy-Item -Path $WORKING_PATH"\setup.exe" -Destination $MEDIA_NEW_PATH"\sources\setup.exe" -Force -ErrorAction stop | Out-Null +# Copy setuphost.exe from boot.wim, saved earlier. +if (Test-Path -Path $WORKING_PATH"\setuphost.exe") { + + Write-Output "$(Get-TS): Copying $WORKING_PATH\setuphost.exe to $MEDIA_NEW_PATH\sources\setuphost.exe" + Copy-Item -Path $WORKING_PATH"\setuphost.exe" -Destination $MEDIA_NEW_PATH"\sources\setuphost.exe" -Force -ErrorAction stop | Out-Null +} # Copy bootmgr files from boot.wim, saved earlier. $MEDIA_NEW_FILES = Get-ChildItem $MEDIA_NEW_PATH -Force -Recurse -Filter b*.efi Foreach ($File in $MEDIA_NEW_FILES){ - if (($File.Name -ieq "bootmgfw.efi") -or ` - ($File.Name -ieq "bootx64.efi") -or ` - ($File.Name -ieq "bootia32.efi") -or ` - ($File.Name -ieq "bootaa64.efi")) + if (($File.Name -ieq "bootmgfw.efi") -or ($File.Name -ieq "bootx64.efi") -or ($File.Name -ieq "bootia32.efi") -or ($File.Name -ieq "bootaa64.efi")) { + Write-Output "$(Get-TS): Copying $WORKING_PATH\bootmgfw.efi to $($File.FullName)" Copy-Item -Path $WORKING_PATH"\bootmgfw.efi" -Destination $File.FullName -Force -ErrorAction stop | Out-Null } elseif ($File.Name -ieq "bootmgr.efi") { + Write-Output "$(Get-TS): Copying $WORKING_PATH\bootmgr.efi to $($File.FullName)" Copy-Item -Path $WORKING_PATH"\bootmgr.efi" -Destination $File.FullName -Force -ErrorAction stop | Out-Null } diff --git a/windows/deployment/update/plan-determine-app-readiness.md b/windows/deployment/update/plan-determine-app-readiness.md deleted file mode 100644 index 6801a4cca8..0000000000 --- a/windows/deployment/update/plan-determine-app-readiness.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Determine application readiness -description: How to test your apps to identify which need attention prior to deploying an update in your organization. -ms.service: windows-client -ms.subservice: itpro-updates -ms.topic: conceptual -ms.author: mstewart -author: mestew -manager: aaroncz -ms.localizationpriority: medium -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 -ms.date: 12/31/2017 ---- - -# Determine application readiness - -Before you deploy a Windows client update, you should know which apps will continue to work without problems, which need their own updates, and which just won't work and must be replaced. If you haven't already, it's worth [classifying your apps](plan-define-readiness.md) with respect to their criticality in your organization. - -## Validation methods - -You can choose from various methods to validate apps. Exactly which ones to use depends on the specifics of your environment. - - -|Validation method |Description | -|---------|---------| -|Full regression | A full quality assurance probing. Staff that know the application well and can validate its core functionality should do this validation. | -|Smoke testing | The application goes through formal validation. That is, a user validates the application following a detailed plan, ideally with limited, or no knowledge of the application they're validating. | -|Automated testing | Software performs tests automatically. The software lets you know whether the tests have passed or failed, and provides detailed reporting for you automatically. | -|Test in pilot | You preselect users to be in the pilot deployment group and carry out the same tasks they do on a day-to-day basis to validate the application. Normally you use this method in addition to one of the other validation types. | -|Reactive response | Applications are validated in late pilot, and no specific users are selected. These applications normally aren't installed on many devices and aren't handled by enterprise application distribution. | - -Combining the various validation methods with the app classifications you've previously established might look like this: - - -|Validation method |Critical apps |Important apps |Not important apps | -|---------|---------|---------|---------| -|Full regression | x | | | -|Smoke testing | | x | | -|Automated testing | x | x | x | -|Test in pilot | x | x | x | - - -### Identify users - -Since your organization no doubt has a wide variety of users, each with different background and regular tasks, you have to choose which users are best suited for validation testing. Some factors to consider include: - -- **Location**: If users are in different physical locations, can you support them and get validation feedback from the region they're in? -- **Application knowledge**: Do the users have appropriate knowledge of how the app is supposed to work? -- **Technical ability**: Do the users have enough technical competence to provide useful feedback from various test scenarios? - -You could seek volunteers who enjoy working with new features and include them in the pilot deployment. You might want to avoid using core users like department heads or project managers. Current application owners, operations personnel, and developers can help you identify the most appropriate pilot users. - -### Identify and set up devices for validation - -In addition to users, it's important to carefully choose devices to participate in app validation as well. For example, ideally, your selection includes devices representing all of the hardware models in your environment. - -There's more than one way to choose devices for app validation: - -- **Existing pilot devices**: You might already have a list of devices that you regularly use for testing updates as part of release cycles. -- **Manual selection**: Some internal groups like operations have expertise to help choose devices manually based on specifications, usage, or records of past support problems. -- **Data-driven analysis**: With appropriate tools, you can use diagnostic data from devices to inform your choices. diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md index 732aab35e3..def7222a70 100644 --- a/windows/deployment/update/prepare-deploy-windows.md +++ b/windows/deployment/update/prepare-deploy-windows.md @@ -1,14 +1,14 @@ --- title: Prepare to deploy Windows -description: Final steps to get ready to deploy Windows, including preparing infrastructure, environment, applications, devices, network, capability, and users +description: Final steps to get ready to deploy Windows, including preparing infrastructure, environment, applications, devices, network, capability, and users. ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: medium -appliesto: +appliesto: - ✅ Windows 11 - ✅ Windows 10 ms.date: 12/31/2017 @@ -19,7 +19,7 @@ ms.date: 12/31/2017 Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows client. The planning phase left you with these useful items: - A clear understanding of necessary personnel and their roles and criteria for [rating app readiness](plan-define-readiness.md) -- A plan for [testing and validating](plan-determine-app-readiness.md) apps +- A plan for [testing and validating](/windows/compatibility/windows-11/testing-guidelines) apps - An assessment of your [deployment infrastructure](eval-infra-tools.md) and definitions for operational readiness - A [deployment plan](create-deployment-plan.md) that defines the rings you want to use @@ -35,7 +35,7 @@ Your infrastructure probably includes many different components and tools. You n 1. Review all of the infrastructure changes that you've identified in your plan. It's important to understand the changes that need to be made and to detail how to implement them. This process prevents problems later on. -2. Validate your changes. You validate the changes for your infrastructure's components and tools, to help you understand how your changes could affect your production environment. +2. Validate your changes. You validate the changes for your infrastructure's components and tools, to help you understand how your changes could affect your production environment. 3. Implement the changes. Once the changes have been validated, you can implement the changes across the wider infrastructure. @@ -166,11 +166,11 @@ You can also create and run scripts to perform additional cleanup actions on dev In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You need to complete these higher-level tasks to gain those new capabilities: -- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions come with new policies that you use to update ADMX templates. +- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions come with new policies that you use to update ADMX templates. - Validate new changes to understand how they affect the wider environment. -- Remediate any potential problems that have been identified through validation. +- Remediate any potential problems that have been identified through validation. ## Prepare users diff --git a/windows/deployment/update/waas-quick-start.md b/windows/deployment/update/waas-quick-start.md index adc84ef341..d9c09992b1 100644 --- a/windows/deployment/update/waas-quick-start.md +++ b/windows/deployment/update/waas-quick-start.md @@ -44,10 +44,10 @@ For more information, see [Assign devices to servicing channels for Windows clie ## Staying up to date -To stay up to date, deploy feature updates at an appropriate time after their release. You can use various management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, Microsoft Configuration Manager, and non-Microsoft products to help with this process. [Upgrade Readiness](/windows/deployment/upgrade/upgrade-readiness-get-started), a free tool to streamline Windows upgrade projects, is another important tool to help. +To stay up to date, deploy feature updates at an appropriate time after their release. You can use various management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, Microsoft Configuration Manager, and non-Microsoft products to help with this process. Extensive advanced testing isn't required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin. This process repeats with each new feature update. These are small deployment projects, compared to the large projects that were necessary with the old three-to-five-year Windows release cycles. -Other technologies such as BranchCache and Delivery Optimization, both peer-to-peer distribution tools, can help with the distribution of the feature update installation files. +Other technologies such as [BranchCache](waas-branchcache.md) and [Delivery Optimization](../do/waas-delivery-optimization-setup.md), both peer-to-peer distribution tools, can help with the distribution of the feature update installation files. diff --git a/windows/deployment/update/wufb-reports-help.md b/windows/deployment/update/wufb-reports-help.md index 6e7c31a485..4561a0045f 100644 --- a/windows/deployment/update/wufb-reports-help.md +++ b/windows/deployment/update/wufb-reports-help.md @@ -4,7 +4,7 @@ titleSuffix: Windows Update for Business reports description: Windows Update for Business reports support, feedback, and troubleshooting information. ms.service: windows-client ms.subservice: itpro-updates -ms.topic: article +ms.topic: conceptual author: mestew ms.author: mstewart manager: aaroncz diff --git a/windows/deployment/upgrade/resolve-windows-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md index db42df75b3..da72341ab0 100644 --- a/windows/deployment/upgrade/resolve-windows-upgrade-errors.md +++ b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md @@ -5,7 +5,7 @@ ms.author: frankroj description: Resolve Windows upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. author: frankroj ms.localizationpriority: medium -ms.topic: article +ms.topic: conceptual ms.service: windows-client ms.subservice: itpro-deploy ms.date: 01/18/2024 diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index 16cae375b4..48726194a2 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -6,7 +6,7 @@ description: Download the Feedback Hub app, and then submit Windows upgrade erro ms.service: windows-client author: frankroj ms.localizationpriority: medium -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 01/18/2024 appliesto: diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index 6bf70a9220..c7251d75b2 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -6,7 +6,7 @@ description: Learn how to review the events generated by Windows Error Reporting ms.service: windows-client author: frankroj ms.localizationpriority: medium -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 01/18/2024 appliesto: diff --git a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md index 90b71af916..4e016e066d 100644 --- a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md +++ b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md @@ -5,7 +5,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 08/09/2023 --- @@ -37,13 +37,13 @@ You can use USMT to automate migration during large deployments of the Windows o > [!IMPORTANT] > -> USMT only supports devices that are joined to a local Active Directory domain. USMT doesn't support Microsoft Entra joined devices. +> USMT only supports devices that are joined to a local Active Directory domain. USMT doesn't support Microsoft Entra joined devices. ## Upgrade and migration considerations Whether you're upgrading or migrating to a new version of Windows, you must be aware of the following issues and considerations: ### Application compatibility -For more information about application compatibility in Windows, see [Use Upgrade Readiness to manage Windows upgrades](/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades). +For more information about application compatibility in Windows, see [Windows compatibility cookbook](/windows/compatibility/). ### Multilingual Windows image upgrades When performing multilingual Windows upgrades, cross-language upgrades aren't supported by USMT. If you're upgrading or migrating an operating system with multiple language packs installed, you can upgrade or migrate only to the system default user interface (UI) language. For example, if English is the default but you have a Spanish language pack installed, you can upgrade or migrate only to English. @@ -58,11 +58,9 @@ During the configuration pass of Windows Setup, the root access control list (AC Changing the ACLs may affect the performance of Windows Setup if the default Windows XP ACLs are applied to a partition with a large amount of data. Because of these performance concerns, you can change the following registry value to disable this feature: -``` syntax -Key: HKLM\System\Setup -Type: REG_DWORD -Value: "DDACLSys_Disabled" = 1 -``` +`Key: HKLM\System\Setup` +`Type: REG_DWORD` +`Value: "DDACLSys_Disabled" = 1` This feature is disabled if this registry key value exists and is configured to `1`. diff --git a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md index 398bf0db0c..fda2e72b83 100644 --- a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md +++ b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md @@ -6,7 +6,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 01/09/2024 appliesto: diff --git a/windows/deployment/usmt/migrate-application-settings.md b/windows/deployment/usmt/migrate-application-settings.md index 0c0c0cd136..9d79558fac 100644 --- a/windows/deployment/usmt/migrate-application-settings.md +++ b/windows/deployment/usmt/migrate-application-settings.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/migration-store-types-overview.md b/windows/deployment/usmt/migration-store-types-overview.md index a78ca35e20..f0fdf74531 100644 --- a/windows/deployment/usmt/migration-store-types-overview.md +++ b/windows/deployment/usmt/migration-store-types-overview.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/offline-migration-reference.md b/windows/deployment/usmt/offline-migration-reference.md index 37d0ee09aa..8e72361a5d 100644 --- a/windows/deployment/usmt/offline-migration-reference.md +++ b/windows/deployment/usmt/offline-migration-reference.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md index a0a19e6b05..3adb68387b 100644 --- a/windows/deployment/usmt/understanding-migration-xml-files.md +++ b/windows/deployment/usmt/understanding-migration-xml-files.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-best-practices.md b/windows/deployment/usmt/usmt-best-practices.md index 389249762f..4ebf6ff55f 100644 --- a/windows/deployment/usmt/usmt-best-practices.md +++ b/windows/deployment/usmt/usmt-best-practices.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-choose-migration-store-type.md b/windows/deployment/usmt/usmt-choose-migration-store-type.md index 3fa1d56d53..1847cce5d9 100644 --- a/windows/deployment/usmt/usmt-choose-migration-store-type.md +++ b/windows/deployment/usmt/usmt-choose-migration-store-type.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-command-line-syntax.md b/windows/deployment/usmt/usmt-command-line-syntax.md index 7910d461e3..4844937b52 100644 --- a/windows/deployment/usmt/usmt-command-line-syntax.md +++ b/windows/deployment/usmt/usmt-command-line-syntax.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-common-migration-scenarios.md b/windows/deployment/usmt/usmt-common-migration-scenarios.md index 3cd5309aed..1685667185 100644 --- a/windows/deployment/usmt/usmt-common-migration-scenarios.md +++ b/windows/deployment/usmt/usmt-common-migration-scenarios.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-configxml-file.md b/windows/deployment/usmt/usmt-configxml-file.md index 4e57000ce6..c0e4682965 100644 --- a/windows/deployment/usmt/usmt-configxml-file.md +++ b/windows/deployment/usmt/usmt-configxml-file.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-conflicts-and-precedence.md b/windows/deployment/usmt/usmt-conflicts-and-precedence.md index 3bcd0d7bad..f9874a4d2f 100644 --- a/windows/deployment/usmt/usmt-conflicts-and-precedence.md +++ b/windows/deployment/usmt/usmt-conflicts-and-precedence.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-custom-xml-examples.md b/windows/deployment/usmt/usmt-custom-xml-examples.md index 18b3331ea4..130f3031c8 100644 --- a/windows/deployment/usmt/usmt-custom-xml-examples.md +++ b/windows/deployment/usmt/usmt-custom-xml-examples.md @@ -6,7 +6,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 01/09/2024 appliesto: diff --git a/windows/deployment/usmt/usmt-customize-xml-files.md b/windows/deployment/usmt/usmt-customize-xml-files.md index 33c3120090..8eefa733d4 100644 --- a/windows/deployment/usmt/usmt-customize-xml-files.md +++ b/windows/deployment/usmt/usmt-customize-xml-files.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-determine-what-to-migrate.md b/windows/deployment/usmt/usmt-determine-what-to-migrate.md index 68e87f678b..bad57314e9 100644 --- a/windows/deployment/usmt/usmt-determine-what-to-migrate.md +++ b/windows/deployment/usmt/usmt-determine-what-to-migrate.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-estimate-migration-store-size.md b/windows/deployment/usmt/usmt-estimate-migration-store-size.md index 8db55b2eae..014e48a76e 100644 --- a/windows/deployment/usmt/usmt-estimate-migration-store-size.md +++ b/windows/deployment/usmt/usmt-estimate-migration-store-size.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-exclude-files-and-settings.md b/windows/deployment/usmt/usmt-exclude-files-and-settings.md index 221ef98e11..354badb01a 100644 --- a/windows/deployment/usmt/usmt-exclude-files-and-settings.md +++ b/windows/deployment/usmt/usmt-exclude-files-and-settings.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md index c39ac18b5a..59234776e5 100644 --- a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md +++ b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-general-conventions.md b/windows/deployment/usmt/usmt-general-conventions.md index f0e8b6df67..38b66a02b6 100644 --- a/windows/deployment/usmt/usmt-general-conventions.md +++ b/windows/deployment/usmt/usmt-general-conventions.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md index fb1b03a426..d2cae89bc7 100644 --- a/windows/deployment/usmt/usmt-hard-link-migration-store.md +++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-how-it-works.md b/windows/deployment/usmt/usmt-how-it-works.md index 7008393b54..591b1d3804 100644 --- a/windows/deployment/usmt/usmt-how-it-works.md +++ b/windows/deployment/usmt/usmt-how-it-works.md @@ -6,7 +6,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy ms.date: 01/09/2024 appliesto: diff --git a/windows/deployment/usmt/usmt-how-to.md b/windows/deployment/usmt/usmt-how-to.md index 5356e4e408..c3589124d1 100644 --- a/windows/deployment/usmt/usmt-how-to.md +++ b/windows/deployment/usmt/usmt-how-to.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-identify-application-settings.md b/windows/deployment/usmt/usmt-identify-application-settings.md index 588764266d..feca874008 100644 --- a/windows/deployment/usmt/usmt-identify-application-settings.md +++ b/windows/deployment/usmt/usmt-identify-application-settings.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md index db8587a5a5..e5b15c352d 100644 --- a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md +++ b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-identify-operating-system-settings.md b/windows/deployment/usmt/usmt-identify-operating-system-settings.md index 5d8c14a899..cedbe8d1f9 100644 --- a/windows/deployment/usmt/usmt-identify-operating-system-settings.md +++ b/windows/deployment/usmt/usmt-identify-operating-system-settings.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index 6f3195fe0a..736881d3b3 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -6,7 +6,7 @@ manager: aaroncz ms.author: frankroj ms.service: windows-client author: frankroj -ms.topic: article +ms.topic: conceptual ms.localizationpriority: medium ms.subservice: itpro-deploy ms.date: 01/09/2024 diff --git a/windows/deployment/usmt/usmt-include-files-and-settings.md b/windows/deployment/usmt/usmt-include-files-and-settings.md index aa89ea14d0..f4d79a27f2 100644 --- a/windows/deployment/usmt/usmt-include-files-and-settings.md +++ b/windows/deployment/usmt/usmt-include-files-and-settings.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md index c13a48e0c7..a4bf1f2eeb 100644 --- a/windows/deployment/usmt/usmt-loadstate-syntax.md +++ b/windows/deployment/usmt/usmt-loadstate-syntax.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 04/30/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md index 53b4df1789..70f159b544 100644 --- a/windows/deployment/usmt/usmt-log-files.md +++ b/windows/deployment/usmt/usmt-log-files.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md index eeb1b3c15f..39944f9a6a 100644 --- a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md +++ b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-migrate-user-accounts.md b/windows/deployment/usmt/usmt-migrate-user-accounts.md index 898de489c6..41f319446d 100644 --- a/windows/deployment/usmt/usmt-migrate-user-accounts.md +++ b/windows/deployment/usmt/usmt-migrate-user-accounts.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-migration-store-encryption.md b/windows/deployment/usmt/usmt-migration-store-encryption.md index 17d6643a94..b5dc3eb5fe 100644 --- a/windows/deployment/usmt/usmt-migration-store-encryption.md +++ b/windows/deployment/usmt/usmt-migration-store-encryption.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-plan-your-migration.md b/windows/deployment/usmt/usmt-plan-your-migration.md index 806b4afc87..20bbc09ad5 100644 --- a/windows/deployment/usmt/usmt-plan-your-migration.md +++ b/windows/deployment/usmt/usmt-plan-your-migration.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-reference.md b/windows/deployment/usmt/usmt-reference.md index e81d243feb..9581170803 100644 --- a/windows/deployment/usmt/usmt-reference.md +++ b/windows/deployment/usmt/usmt-reference.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md index cdb3d41096..26b5f86f7a 100644 --- a/windows/deployment/usmt/usmt-requirements.md +++ b/windows/deployment/usmt/usmt-requirements.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 04/30/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-reroute-files-and-settings.md b/windows/deployment/usmt/usmt-reroute-files-and-settings.md index 247311e3eb..f002c6d337 100644 --- a/windows/deployment/usmt/usmt-reroute-files-and-settings.md +++ b/windows/deployment/usmt/usmt-reroute-files-and-settings.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-resources.md b/windows/deployment/usmt/usmt-resources.md index 18a09528cb..239d7be582 100644 --- a/windows/deployment/usmt/usmt-resources.md +++ b/windows/deployment/usmt/usmt-resources.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md index 82d4e9ada4..24f73b72d1 100644 --- a/windows/deployment/usmt/usmt-scanstate-syntax.md +++ b/windows/deployment/usmt/usmt-scanstate-syntax.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 04/30/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-technical-reference.md b/windows/deployment/usmt/usmt-technical-reference.md index 6a7de9fd90..1254f4fef0 100644 --- a/windows/deployment/usmt/usmt-technical-reference.md +++ b/windows/deployment/usmt/usmt-technical-reference.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-test-your-migration.md b/windows/deployment/usmt/usmt-test-your-migration.md index b4a39f6bfd..57767aecf4 100644 --- a/windows/deployment/usmt/usmt-test-your-migration.md +++ b/windows/deployment/usmt/usmt-test-your-migration.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-topics.md b/windows/deployment/usmt/usmt-topics.md index 8b868f1fec..e3be3d8fd0 100644 --- a/windows/deployment/usmt/usmt-topics.md +++ b/windows/deployment/usmt/usmt-topics.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md index e3c14bf619..3e85b84a37 100644 --- a/windows/deployment/usmt/usmt-troubleshooting.md +++ b/windows/deployment/usmt/usmt-troubleshooting.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md index 2ccde56d88..20c70db094 100644 --- a/windows/deployment/usmt/usmt-utilities.md +++ b/windows/deployment/usmt/usmt-utilities.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index b069f9ac46..e03e8db9c0 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/18/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md index 7e06dffcf9..a4694c75a9 100644 --- a/windows/deployment/usmt/usmt-xml-elements-library.md +++ b/windows/deployment/usmt/usmt-xml-elements-library.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/usmt-xml-reference.md b/windows/deployment/usmt/usmt-xml-reference.md index 4bc9ba48e0..3b1f32fc27 100644 --- a/windows/deployment/usmt/usmt-xml-reference.md +++ b/windows/deployment/usmt/usmt-xml-reference.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md index 2f66da5edc..818a24659e 100644 --- a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md +++ b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/usmt/xml-file-requirements.md b/windows/deployment/usmt/xml-file-requirements.md index 3182faf447..7d1969ad11 100644 --- a/windows/deployment/usmt/xml-file-requirements.md +++ b/windows/deployment/usmt/xml-file-requirements.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 01/09/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md index 4c3cae83e2..fcf91e9502 100644 --- a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/activate-forest-vamt.md b/windows/deployment/volume-activation/activate-forest-vamt.md index 82278ce278..128068b07c 100644 --- a/windows/deployment/volume-activation/activate-forest-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/activate-windows-clients-vamt.md b/windows/deployment/volume-activation/activate-windows-clients-vamt.md index 46d76cbe54..7f95ef225e 100644 --- a/windows/deployment/volume-activation/activate-windows-clients-vamt.md +++ b/windows/deployment/volume-activation/activate-windows-clients-vamt.md @@ -8,7 +8,7 @@ ms.service: windows-client author: frankroj ms.localizationpriority: medium ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals appliesto: - ✅ Windows 11 diff --git a/windows/deployment/volume-activation/active-directory-based-activation-overview.md b/windows/deployment/volume-activation/active-directory-based-activation-overview.md index 3d293922bf..ed01a87d85 100644 --- a/windows/deployment/volume-activation/active-directory-based-activation-overview.md +++ b/windows/deployment/volume-activation/active-directory-based-activation-overview.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/add-manage-products-vamt.md b/windows/deployment/volume-activation/add-manage-products-vamt.md index f4fc72f1ab..e4f655dbf7 100644 --- a/windows/deployment/volume-activation/add-manage-products-vamt.md +++ b/windows/deployment/volume-activation/add-manage-products-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/add-remove-computers-vamt.md b/windows/deployment/volume-activation/add-remove-computers-vamt.md index 4ee747359f..9878980a5d 100644 --- a/windows/deployment/volume-activation/add-remove-computers-vamt.md +++ b/windows/deployment/volume-activation/add-remove-computers-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/add-remove-product-key-vamt.md b/windows/deployment/volume-activation/add-remove-product-key-vamt.md index 89439e87f0..af1131f23a 100644 --- a/windows/deployment/volume-activation/add-remove-product-key-vamt.md +++ b/windows/deployment/volume-activation/add-remove-product-key-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md index 4346a5ce67..7fce96b052 100644 --- a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md +++ b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md @@ -9,7 +9,7 @@ ms.service: windows-client ms.subservice: itpro-fundamentals ms.localizationpriority: medium ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md index 5b39a2996e..c3c6e47154 100644 --- a/windows/deployment/volume-activation/configure-client-computers-vamt.md +++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.service: windows-client ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/install-configure-vamt.md b/windows/deployment/volume-activation/install-configure-vamt.md index fa8087423a..aee189d31f 100644 --- a/windows/deployment/volume-activation/install-configure-vamt.md +++ b/windows/deployment/volume-activation/install-configure-vamt.md @@ -8,7 +8,7 @@ ms.service: windows-client author: frankroj ms.localizationpriority: medium ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/install-kms-client-key-vamt.md b/windows/deployment/volume-activation/install-kms-client-key-vamt.md index 0c65b30992..80a5fc67e1 100644 --- a/windows/deployment/volume-activation/install-kms-client-key-vamt.md +++ b/windows/deployment/volume-activation/install-kms-client-key-vamt.md @@ -8,7 +8,7 @@ ms.service: windows-client author: frankroj ms.localizationpriority: medium ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/install-product-key-vamt.md b/windows/deployment/volume-activation/install-product-key-vamt.md index fec886a0b7..2b9d727184 100644 --- a/windows/deployment/volume-activation/install-product-key-vamt.md +++ b/windows/deployment/volume-activation/install-product-key-vamt.md @@ -8,7 +8,7 @@ ms.service: windows-client author: frankroj ms.localizationpriority: medium ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 8c43c6cda6..3b3b7746fa 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -8,7 +8,7 @@ ms.service: windows-client author: frankroj ms.localizationpriority: medium ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals appliesto: - ✅ Windows 11 diff --git a/windows/deployment/volume-activation/kms-activation-vamt.md b/windows/deployment/volume-activation/kms-activation-vamt.md index 97e5bcca16..1890da7caf 100644 --- a/windows/deployment/volume-activation/kms-activation-vamt.md +++ b/windows/deployment/volume-activation/kms-activation-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/local-reactivation-vamt.md b/windows/deployment/volume-activation/local-reactivation-vamt.md index 277342a97d..2bee6093d1 100644 --- a/windows/deployment/volume-activation/local-reactivation-vamt.md +++ b/windows/deployment/volume-activation/local-reactivation-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/manage-activations-vamt.md b/windows/deployment/volume-activation/manage-activations-vamt.md index 9216ff075c..49cbc84db3 100644 --- a/windows/deployment/volume-activation/manage-activations-vamt.md +++ b/windows/deployment/volume-activation/manage-activations-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/manage-product-keys-vamt.md b/windows/deployment/volume-activation/manage-product-keys-vamt.md index 15579d3b82..fb18c65aa6 100644 --- a/windows/deployment/volume-activation/manage-product-keys-vamt.md +++ b/windows/deployment/volume-activation/manage-product-keys-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/manage-vamt-data.md b/windows/deployment/volume-activation/manage-vamt-data.md index de933e88c8..3946fc1c63 100644 --- a/windows/deployment/volume-activation/manage-vamt-data.md +++ b/windows/deployment/volume-activation/manage-vamt-data.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/monitor-activation-client.md b/windows/deployment/volume-activation/monitor-activation-client.md index 8a59c549bd..3720919a25 100644 --- a/windows/deployment/volume-activation/monitor-activation-client.md +++ b/windows/deployment/volume-activation/monitor-activation-client.md @@ -7,7 +7,7 @@ description: Understand the most common methods to monitor the success of the ac ms.service: windows-client author: frankroj ms.localizationpriority: medium -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals ms.date: 03/29/2024 appliesto: diff --git a/windows/deployment/volume-activation/online-activation-vamt.md b/windows/deployment/volume-activation/online-activation-vamt.md index 537f46d71e..3e6a04568d 100644 --- a/windows/deployment/volume-activation/online-activation-vamt.md +++ b/windows/deployment/volume-activation/online-activation-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md index 7702949941..89dab1ef39 100644 --- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md +++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.localizationpriority: medium -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals ms.date: 03/29/2024 appliesto: diff --git a/windows/deployment/volume-activation/proxy-activation-vamt.md b/windows/deployment/volume-activation/proxy-activation-vamt.md index 9e14cf5631..57c242d69c 100644 --- a/windows/deployment/volume-activation/proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/proxy-activation-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/remove-products-vamt.md b/windows/deployment/volume-activation/remove-products-vamt.md index 2b49facf89..cad9428d5a 100644 --- a/windows/deployment/volume-activation/remove-products-vamt.md +++ b/windows/deployment/volume-activation/remove-products-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md index 0dc03e90e0..4ba48b833b 100644 --- a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/scenario-online-activation-vamt.md b/windows/deployment/volume-activation/scenario-online-activation-vamt.md index 1f573be911..7af76c4c7a 100644 --- a/windows/deployment/volume-activation/scenario-online-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-online-activation-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md index 654a67b2b3..74a59bbd9d 100644 --- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/update-product-status-vamt.md b/windows/deployment/volume-activation/update-product-status-vamt.md index 0a077e39bb..f47584757f 100644 --- a/windows/deployment/volume-activation/update-product-status-vamt.md +++ b/windows/deployment/volume-activation/update-product-status-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md index 3ee35bd266..3e1e4a1657 100644 --- a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md +++ b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md @@ -8,7 +8,7 @@ ms.service: windows-client author: frankroj ms.localizationpriority: medium ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals appliesto: - ✅ Windows 11 diff --git a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md index 0add9fe565..b9633b62d2 100644 --- a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md +++ b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/vamt-known-issues.md b/windows/deployment/volume-activation/vamt-known-issues.md index a11eb40946..5244254c65 100644 --- a/windows/deployment/volume-activation/vamt-known-issues.md +++ b/windows/deployment/volume-activation/vamt-known-issues.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 11/07/2022 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/vamt-requirements.md b/windows/deployment/volume-activation/vamt-requirements.md index 4a92b44341..8b82d6ae68 100644 --- a/windows/deployment/volume-activation/vamt-requirements.md +++ b/windows/deployment/volume-activation/vamt-requirements.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/vamt-step-by-step.md b/windows/deployment/volume-activation/vamt-step-by-step.md index 59c883df3c..375ebad9fa 100644 --- a/windows/deployment/volume-activation/vamt-step-by-step.md +++ b/windows/deployment/volume-activation/vamt-step-by-step.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.service: windows-client author: frankroj ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals --- diff --git a/windows/deployment/volume-activation/volume-activation-windows.md b/windows/deployment/volume-activation/volume-activation-windows.md index 8891a74db2..701785bf9e 100644 --- a/windows/deployment/volume-activation/volume-activation-windows.md +++ b/windows/deployment/volume-activation/volume-activation-windows.md @@ -8,7 +8,7 @@ ms.service: windows-client author: frankroj ms.localizationpriority: medium ms.date: 03/29/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-fundamentals appliesto: - ✅ Windows 11 diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index ef124c0497..182f55c874 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -6,8 +6,8 @@ ms.localizationpriority: medium author: frankroj ms.author: frankroj manager: aaroncz -ms.topic: article -ms.date: 04/25/2024 +ms.topic: conceptual +ms.date: 07/19/2024 ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 @@ -21,48 +21,56 @@ appliesto: The operating system deployment functionality of [Windows Deployment Services](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831764(v=ws.11)) (WDS) is being partially deprecated. Starting with Windows 11, workflows that rely on **boot.wim** from installation media or on running Windows Setup in WDS mode is no longer supported. -When you PXE-boot from a WDS server that uses the **boot.wim** file from installation media as its boot image, Windows Setup automatically launches in WDS mode. This workflow is deprecated for Windows 11 and newer boot images. The following deprecation message is displayed: +When PXE booting from a WDS server that uses the **boot.wim** file from installation media as its boot image, Windows Setup automatically launches in WDS mode. This workflow is deprecated for Windows 11 and newer boot images. The following deprecation message is displayed: > Windows Setup > -> Windows Deployment Services client functionality is being partly deprecated. Please visit https://aka.ms/WDSSupport for more details on what is deprecated and what will continue to be supported. +> Windows Deployment Services client functionality is being partly deprecated. Please visit https://aka.ms/WDSSupport for more details on what is deprecated and what is still supported. ## Deployment scenarios affected The following table provides support details for specific deployment scenarios. Boot.wim is the `boot.wim` file obtained from the Windows source files for each specified version of Windows. -|Windows Version being deployed |Boot.wim from Windows 10|Boot.wim from Windows Server 2016|Boot.wim from Windows Server 2019|Boot.wim from Windows Server 2022|Boot.wim from Windows 11| -|--- |--- |--- |--- |--- |--- | -|**Windows 11**|Not supported, blocked.|Not supported, blocked.|Not supported, blocked.|Not supported, blocked.|Not supported, blocked.| -|**Windows 10**|Supported, using a boot image from matching or newer version.|Supported, using a boot image from Windows 10, version 1607 or later.|Supported, using a boot image from Windows 10, version 1809 or later.|Not supported.|Not supported.| -|**Windows Server 2022**|Deprecated, with a warning message.|Deprecated, with a warning message.|Deprecated, with a warning message.|Deprecated, with a warning message.|Not supported.| -|**Windows Server 2019**|Supported, using a boot image from Windows 10, version 1809 or later.|Supported.|Supported.|Not supported.|Not supported.| -|**Windows Server 2016**|Supported, using a boot image from Windows 10, version 1607 or later.|Supported.|Not supported.|Not supported.|Not supported.| - -## Reason for the change - -Alternatives to WDS, such as [Microsoft Configuration Manager](/mem/configmgr/) and [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) provide a better, more flexible, and feature-rich experience for deploying Windows images. +| Windows Version being deployed | Boot.wim from Windows 10 | Boot.wim from Windows Server 2016 | Boot.wim from Windows Server 2019 | Boot.wim from Windows Server 2022 | Boot.wim from Windows 11 | +| --- | --- | --- | --- | --- | --- | +| **Windows 11** | Not supported, blocked. | Not supported, blocked. | Not supported, blocked. |Not supported, blocked. | Not supported, blocked. | +| **Windows 10** | Supported, using a boot image from matching or newer version. | Supported, using a boot image from a [currently supported version of Windows 10](/windows/release-health/supported-versions-windows-client#windows-10-supported-versions). | Supported, using a boot image from a [currently supported version of Windows 10](/windows/release-health/supported-versions-windows-client#windows-10-supported-versions).| Not supported. | Not supported. | +| **Windows Server 2025** | Not supported. | Not supported. | Not supported. | Not supported. | Not supported. | +| **Windows Server 2022** | Deprecated, with a warning message. | Deprecated, with a warning message. | Deprecated, with a warning message. | Deprecated, with a warning message. | Not supported. | +| **Windows Server 2019** | Supported, using a boot image from a [currently supported version of Windows 10](/windows/release-health/supported-versions-windows-client#windows-10-supported-versions). | Supported. | Supported. | Not supported. | Not supported. | +| **Windows Server 2016** | Supported, using a boot image from a [currently supported version of Windows 10](/windows/release-health/supported-versions-windows-client#windows-10-supported-versions). |Supported. | Not supported. | Not supported. | Not supported. | > [!NOTE] > -> [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) only supports deployment of Windows 10. It doesn't support deployment of Windows 11. For more information, see [Supported platforms](/mem/configmgr/mdt/release-notes#supported-platforms). +> The following error message might be displayed when attempting to use **boot.wim** on WDS running on Windows Server 2025: +> +> `A media driver your computer needs is missing. This could be a DVD, USB or Hard disk driver. If you have a CD, DVD, or USB flash drive with the driver on it, please insert it now.` +> +> An error message is expected since using **boot.wim** on WDS running on Windows Server 2025 isn't supported. + +## Reason for the change + +Alternatives to WDS, such as [Microsoft Configuration Manager](/mem/configmgr/osd/understand/introduction-to-operating-system-deployment), provide a better, more flexible, and feature-rich experience for deploying Windows images. ## Not affected -This change doesn’t affect WDS PXE boot. You can still use WDS to PXE boot devices with custom boot images, but you can't use **boot.wim** as the boot image and run Windows Setup in WDS mode. +This change doesn't affect WDS PXE boot. WDS can still be used to PXE boot devices with custom boot images, but **boot.wim** can't be used as the boot image and run Windows Setup in WDS mode. -You can still run Windows Setup from a network share. This change doesn't change Workflows that use a custom boot.wim, such as MDT or Configuration Manager. +Windows Setup can still run from a network share. This change doesn't change Workflows that use a custom boot.wim, such as Microsoft Deployment Toolkit (MDT) or Microsoft Configuration Manager. ## Summary -- Windows 11 workflows that rely on **boot.wim** from installation media are blocked. You can't perform an end to end deployment of Windows 11 using only WDS. +- Windows 11 workflows that rely on **boot.wim** from installation media are blocked. An end to end deployment of Windows 11 using only WDS can't be performed. + - This change doesn't affect Windows 10, Windows Server 2019, and previous operating system versions. + - Windows Server 2022 workflows that rely on **boot.wim** from installation media show a non-blocking deprecation notice. The notice can be dismissed, and currently the workflow isn't blocked. + - Windows Server workflows after Windows Server 2022 that rely on **boot.wim** from installation media are blocked. -If you currently use WDS with **boot.wim** from installation media for end-to-end operating system deployment, and your OS version isn't supported, deprecated, or blocked, it's recommended that you use deployment tools such as MDT, Configuration Manager, or a non-Microsoft solution with a custom boot.wim image. +If WDS is being used with **boot.wim** from installation media for end-to-end operating system deployment, and the OS version isn't supported, deprecated, or blocked, Microsoft recommends using deployment tools such as Microsoft Configuration Manager, or a non-Microsoft solution that uses a custom boot.wim image. -## Also see +## Related content -- [Features removed or no longer developed starting with Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server-2022#features-were-no-longer-developing) -- [Create a custom Windows PE boot image with Configuration Manager](deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md) +- [Features removed or no longer developed starting with Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server-2022#features-were-no-longer-developing). +- [Customize boot images with Configuration Manager](/mem/configmgr/osd/get-started/customize-boot-images). diff --git a/windows/deployment/windows-10-pro-in-s-mode.md b/windows/deployment/windows-10-pro-in-s-mode.md index 82bb386aa3..f4b7f66792 100644 --- a/windows/deployment/windows-10-pro-in-s-mode.md +++ b/windows/deployment/windows-10-pro-in-s-mode.md @@ -6,7 +6,7 @@ ms.author: frankroj manager: aaroncz ms.localizationpriority: medium ms.service: windows-client -ms.topic: article +ms.topic: conceptual ms.date: 11/23/2022 ms.subservice: itpro-deploy --- diff --git a/windows/deployment/windows-adk-scenarios-for-it-pros.md b/windows/deployment/windows-adk-scenarios-for-it-pros.md index 2c3b28dac0..cf038aa4a9 100644 --- a/windows/deployment/windows-adk-scenarios-for-it-pros.md +++ b/windows/deployment/windows-adk-scenarios-for-it-pros.md @@ -7,7 +7,7 @@ manager: aaroncz ms.service: windows-client ms.localizationpriority: medium ms.date: 02/13/2024 -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md index dd113afcfc..3b2702240b 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md @@ -4,7 +4,7 @@ description: This article provides an overview on how to register devices in Aut ms.date: 02/15/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md index 030de871bb..acdf9129ce 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md @@ -4,7 +4,7 @@ description: This article explains what Autopatch groups are ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md index bbed3ec3b1..922580d930 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md @@ -4,7 +4,7 @@ description: This article details how post-device registration readiness checks ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-edge.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-edge.md index 66650fb27b..e72d188447 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-edge.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-edge.md @@ -4,7 +4,7 @@ description: This article explains how Microsoft Edge updates are managed in Win ms.date: 09/15/2023 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: how-to ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan @@ -30,9 +30,9 @@ For a device to be eligible for Microsoft Edge updates as a part of Windows Auto ## Update release schedule -Microsoft Edge will check for updates every 10 hours. Quality updates occur weekly by default. Feature updates occur automatically every four weeks and are rolled out [progressively](/deployedge/microsoft-edge-update-progressive-rollout) by the Microsoft Edge product group to ensure the best experience for customers. All users will see the update within a few days of the initial release. +Microsoft Edge checks for updates every 10 hours. Quality updates occur weekly by default. Feature updates occur automatically every four weeks and are rolled out [progressively](/deployedge/microsoft-edge-update-progressive-rollout) by the Microsoft Edge product group to ensure the best experience for customers. The update is available within a few days of the initial release. -Browser updates with critical security fixes will have a faster rollout cadence than updates that don't have critical security fixes to ensure prompt protection from vulnerabilities. +Browser updates with critical security fixes have a faster rollout cadence than updates that don't have critical security fixes to ensure fast protection from vulnerabilities. Devices in the Test device group receive feature updates from the [Beta Channel](/deployedge/microsoft-edge-channels#beta-channel). This channel is fully supported and automatically updated with new features approximately every four weeks. diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md index 1a03d4c08b..7d66ce8a49 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md @@ -4,7 +4,7 @@ description: This article provides an overview of how updates are handled with A ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: overview +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-windows-feature-update-releases.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-windows-feature-update-releases.md index 0ed4a2cdb6..8c21ff7513 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-windows-feature-update-releases.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-windows-feature-update-releases.md @@ -4,7 +4,7 @@ description: This article explains how you can manage Windows feature updates wi ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: how-to ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-teams.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-teams.md index b474ff2498..3945ea4bca 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-teams.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-teams.md @@ -4,7 +4,7 @@ description: This article explains how Microsoft Teams updates are managed in Wi ms.date: 09/15/2023 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: how-to ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index 2bf45427ed..24c4fc7e02 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -4,7 +4,7 @@ description: This article explains how Windows feature updates are managed with ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: overview ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview.md index c556fca641..7d2cb8b29e 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview.md @@ -4,7 +4,7 @@ description: This article details the types of reports available and info about ms.date: 07/10/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: overview ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md index 4c86c00301..139508380f 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md @@ -4,7 +4,7 @@ description: This article explains Windows quality update communications ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md index c2aadef998..267c55bde3 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md @@ -4,7 +4,7 @@ description: This article provides details about the data platform and privacy c ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: reference +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md index b62bc5627b..f7e85f6135 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md @@ -4,7 +4,7 @@ description: This article describes the roles and responsibilities provided by W ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index c5a7d98976..eaccb006f5 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -4,7 +4,7 @@ description: This article details the prerequisites needed for Windows Autopatch ms.date: 01/11/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md index 13ccf4e8ec..b91a7f24ed 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md @@ -4,7 +4,7 @@ description: This reference article details the changes made to your tenant when ms.date: 12/13/2023 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: reference +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-conflicting-configurations.md b/windows/deployment/windows-autopatch/references/windows-autopatch-conflicting-configurations.md index cbd7fc1142..afcb34afdb 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-conflicting-configurations.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-conflicting-configurations.md @@ -4,7 +4,7 @@ description: This article explains how to remediate conflicting configurations a ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-driver-and-firmware-updates-public-preview-addendum.md b/windows/deployment/windows-autopatch/references/windows-autopatch-driver-and-firmware-updates-public-preview-addendum.md index 8cbed6ce25..9023597983 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-driver-and-firmware-updates-public-preview-addendum.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-driver-and-firmware-updates-public-preview-addendum.md @@ -4,7 +4,7 @@ description: This article explains how driver and firmware updates are managed ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: legal ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md b/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md index 56d474d0f9..fab099ab47 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md @@ -4,7 +4,7 @@ description: This article explains the Microsoft 365 Apps for enterprise policie ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md index 5e6dfd39cc..708985a6bf 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md @@ -4,7 +4,7 @@ description: This article explains Windows update policies in Windows Autopatch ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: concept-article ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index 89a7b65ab6..876e0dec6c 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -5,7 +5,7 @@ manager: aaroncz ms.author: frankroj author: frankroj ms.service: windows-client -ms.topic: article +ms.topic: conceptual ms.date: 11/23/2022 ms.subservice: itpro-deploy --- diff --git a/windows/deployment/windows-deployment-scenarios.md b/windows/deployment/windows-deployment-scenarios.md index 7666f71041..622b83b41b 100644 --- a/windows/deployment/windows-deployment-scenarios.md +++ b/windows/deployment/windows-deployment-scenarios.md @@ -6,7 +6,7 @@ ms.author: frankroj author: frankroj ms.service: windows-client ms.localizationpriority: medium -ms.topic: article +ms.topic: conceptual ms.date: 02/13/2024 ms.subservice: itpro-deploy appliesto: diff --git a/windows/deployment/windows-enterprise-e3-overview.md b/windows/deployment/windows-enterprise-e3-overview.md index 292858c4fb..43bfc59332 100644 --- a/windows/deployment/windows-enterprise-e3-overview.md +++ b/windows/deployment/windows-enterprise-e3-overview.md @@ -7,7 +7,7 @@ ms.date: 02/13/2024 author: frankroj ms.author: frankroj manager: aaroncz -ms.topic: article +ms.topic: conceptual ms.subservice: itpro-deploy appliesto: - ✅ Windows 11 diff --git a/windows/deployment/windows-missing-fonts.md b/windows/deployment/windows-missing-fonts.md index 6cee49fa4f..eabee6f44f 100644 --- a/windows/deployment/windows-missing-fonts.md +++ b/windows/deployment/windows-missing-fonts.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium author: frankroj ms.author: frankroj manager: aaroncz -ms.topic: article +ms.topic: conceptual ms.date: 03/28/2024 ms.subservice: itpro-deploy zone_pivot_groups: windows-versions-11-10 diff --git a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md deleted file mode 100644 index c31afd7cdc..0000000000 --- a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md +++ /dev/null @@ -1,424 +0,0 @@ ---- -title: Enhanced diagnostic data required by Windows Analytics (Windows 10) -description: Use this article to learn more about the limit enhanced diagnostic data events policy used by Desktop Analytics -ms.service: windows-client -ms.subservice: itpro-privacy -ms.localizationpriority: high -author: DHB-MSFT -ms.author: danbrown -manager: laurawi -ms.date: 10/12/2017 -ms.topic: reference ---- - - -# Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy - - **Applies to** - -- Windows 10, version 1709 and newer - -> [!IMPORTANT] -> - The Upgrade Readiness and Device Health solutions of Windows Analytics were retired on January 31, 2020. -> - Desktop Analytics is deprecated and was retired on November 30, 2022. - -Desktop Analytics reports are powered by diagnostic data not included in the Basic level. - -In Windows 10, version 1709, we introduced a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only the events described below. The Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). - -With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data. - -## KernelProcess.AppStateChangeSummary -This event summarizes application usage and performance characteristics to help Microsoft improve performance and reliability. Organizations can use this event with Desktop Analytics to gain insights into application reliability. - -The following fields are available: - -- **CommitChargeAtExit_Sum:** Total memory commit charge for a process when it exits -- **CommitChargePeakAtExit_Sum**: Total peak memory commit charge for a process when it exits -- **ContainerId:** Server Silo Container ID -- **CrashCount:** Number of crashes for a process instance -- **CycleCountAtExit_Sum:** Total processor cycles for a process when it exited -- **ExtraInfoFlags:** Flags indicating internal states of the logging -- **GhostCount_Sum:** Total number of instances where the application stopped responding -- **HandleCountAtExit_Sum:** Total handle count for a process when it exits -- **HangCount_Max:** Maximum number of hangs detected -- **HangCount_Sum:** Total number of application hangs that are detected -- **HardFaultCountAtExit_Sum:** Total number of hard page faults detected for a process when it exits -- **HeartbeatCount:** Heartbeats logged for this summary -- **HeartbeatSuspendedCount:** Heartbeats logged for this summary where the process was suspended -- **LaunchCount:** Number of process instances started -- **LicenseType:** Reserved for future use -- **ProcessDurationMS_Sum:** Total duration of wall clock process instances -- **ReadCountAtExit_Sum:** Total IO reads for a process when it exited -- **ReadSizeInKBAtExit_Sum:** Total IO read size for a process when it exited -- **ResumeCount:** Number of times a process instance has resumed -- **RunningDurationMS_Sum:** Total uptime -- **SuspendCount:** Number of times a process instance was suspended -- **TargetAppId:** Application identifier -- **TargetAppType:** Application type -- **TargetAppVer:** Application version -- **TerminateCount:** Number of times a process terminated -- **WriteCountAtExit_Sum:** Total number of IO writes for a process when it exited -- **WriteSizeInKBAtExit_Sum:** Total size of IO writes for a process when it exited - -## Microsoft.Office.TelemetryEngine.IsPreLaunch -Applicable for Office UWP applications. This event is fired when an Office application is initiated for the first-time post upgrade/install from the store. It's part of basic diagnostic data. It's used to track whether a particular session is a launch session or not. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **SessionID:** ID of the session - -## Microsoft.Office.SessionIdProvider.OfficeProcessSessionStart -This event sends basic information upon the start of a new Office session. It's used to count the number of unique sessions seen on a given device. The event is used as a heartbeat event to ensure that the application is running on a device. In addition, it serves as a critical signal for overall application reliability. - -- **AppSessionGuid:** ID of the session that maps to the process of the application -- **processSessionId:** ID of the session that maps to the process of the application - -## Microsoft.Office.TelemetryEngine.SessionHandOff -Applicable to Win32 Office applications. This event helps us understand whether there was a new session created to handle a user-initiated file open event. It is a critical diagnostic information that is used to derive reliability signal and ensure that the application is working as expected. - -- **appVersionBuild:** Third part Build version of the application *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **childSessionID:** ID of the session that was created to handle the user initiated file open -- **parentSessionId:** ID of the session that was already running - -## Microsoft.Office.CorrelationMetadata.UTCCorrelationMetadata -Collects Office metadata through UTC to compare with equivalent data collected through the Office telemetry pipeline to check correctness and completeness of data. - -- **abConfigs:** List of features enabled for this session -- **abFlights:** List of features enabled for this session -- **AppSessionGuid:** ID of the session -- **appVersionBuild:** Third part Build version of the application *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRevision:** Fourth part of the version *.*.*.XXXXX -- **audienceGroup:** Is this group part of the insiders or production? -- **audienceId:** ID of the audience setting -- **channel:** Are you part of Semi annual channel or Semi annual channel-Targeted? -- **deviceClass:** Is this device a desktop device or a mobile device? -- **impressionId:** What features were available to you in this session -- **languageTag:** Language of the app -- **officeUserID:** A unique identifier tied to the office installation on a particular device. -- **osArchitecture:** Is the machine 32 bit or 64 bit? -- **osEnvironment:** Is this app a win32 app or a UWP app? -- **osVersionString:** Version of the OS -- **sessionID:** ID of the session - -## Microsoft.Office.ClickToRun.UpdateStatus -Applicable to all Win32 applications. Helps us understand the status of the update process of the office suite (Success or failure with error details). - -- **build:** App version -- **channel:** Is this part of GA Channel? -- **errorCode:** What error occurred during the upgrade process? -- **errorMessage:** what was the error message during the upgrade process? -- **status:** Was the upgrade successful or not? -- **targetBuild:** What app version were we trying to upgrade to? - -## Microsoft.Office.TelemetryEngine.FirstIdle -This event is fired when the telemetry engine within an office application is ready to send telemetry. Used for understanding whether there are issues in telemetry. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **SessionID:** ID of the session - -## Microsoft.Office.TelemetryEngine.FirstProcessed -This event is fired when the telemetry engine within an office application has processed the rules or the list of events that we need to collect. Used for understanding whether there are issues in telemetry. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **SessionID:** ID of the session - -## Microsoft.Office.TelemetryEngine.FirstRuleRequest -This event is fired when the telemetry engine within an office application has received the first rule or list of events that need to be sent by the app. Used for understanding whether there are issues in telemetry. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **SessionID:** ID of the session - -## Microsoft.Office.TelemetryEngine.Init -This event is fired when the telemetry engine within an office application has been initialized or not. Used for understanding whether there are issues in telemetry. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **SessionID:** ID of the session - -## Microsoft.Office.TelemetryEngine.Resume -This event is fired when the application resumes from sleep state. Used for understanding whether there are issues in the application life cycle. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? -- **SessionID:** ID of the session - -## Microsoft.Office.TelemetryEngine.RuleRequestFailed -This event is fired when the telemetry engine within an office application fails to retrieve the rules containing the list of telemetry events. Used for understanding whether there are issues in telemetry. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **SessionID:** ID of the session - -## Microsoft.Office.TelemetryEngine.RuleRequestFailedDueToClientOffline -This event is fired when the telemetry engine within an office application fails to retrieve the rules containing the list of telemetry events, when the device is offline. Used for understanding whether there are issues in telemetry. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **SessionID:** ID of the session - -## Microsoft.Office.TelemetryEngine.ShutdownComplete -This event is fired when the telemetry engine within an office application has processed the rules or the list of events that we need to collect. Useful for understanding whether a particular crash is happening during an app-shutdown, and could potentially lead in data loss or not. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? -- **SessionID:** ID of the session - -## Microsoft.Office.TelemetryEngine.ShutdownStart -This event is fired when the telemetry engine within an office application has been uninitialized, and the application is shutting down. Useful for understanding whether a particular crash is happening during an app-shutdown, and could potentially lead in data loss or not. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? -- **SessionID:** ID of the session - -## Microsoft.Office.TelemetryEngine.SuspendComplete -This event is fired when the telemetry engine within an office application has processed the rules or the list of events that we need to collect. Used for understanding whether there are issues in telemetry. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? -- **SessionID:** ID of the session -- **SuspendType:** Type of suspend - -## Microsoft.Office.TelemetryEngine.SuspendStart -This event is fired when the office application suspends as per app life-cycle change. Used for understanding whether there are issues in the application life cycle. - -- **appVersionBuild:** Third part of the version *.*.XXXXX.* -- **appVersionMajor:** First part of the version X.*.*.* -- **appVersionMinor:** Second part of the version *.X.*.* -- **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user -- **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? -- **SessionID:** ID of the session -- **SuspendType:** Type of suspend - -## Microsoft.OSG.OSS.CredProvFramework.ReportResultStop -This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve sign-in reliability. Using this event with Desktop Analytics can help organizations monitor and improve sign-in success for different methods (for example, biometric) on managed devices. - -The following fields are available: - -- **CredTileProviderId:** ID of the Credential Provider -- **IsConnectedUser:** Flag indicating whether a user is connected or not -- **IsPLAPTile:** Flag indicating whether this credential tile is a pre-logon access provider or not -- **IsRemoteSession:** Flag indicating whether the session is remote or not -- **IsV2CredProv:** Flag indicating whether the credential provider of V2 or not -- **OpitonalStatusText:** Status text -- **ProcessImage:** Image path to the process -- **ProviderId:** Credential provider ID -- **ProviderStatusIcon:** Indicates which status icon should be displayed -- **ReturnCode:** Output of the ReportResult function -- **SessionId:** Session identifier -- **Sign-in error status:** The sign-in error status -- **SubStatus:** Sign-in error substatus -- **UserTag:** Count of the number of times a user has selected a provider - -## Microsoft.Windows.Kernel.Power.OSStateChange -This event denotes the transition between operating system states (On, Off, Sleep, etc.). By using this event with Desktop Analytics, organizations can monitor reliability and performance of managed devices. - -The following fields are available: - -- **AcPowerOnline:** If "TRUE," the device is using AC power. If "FALSE," the device is using battery power. -- **ActualTransitions:** The number of transitions between operating system states since the last system boot -- **BatteryCapacity:** Maximum battery capacity in mWh -- **BatteryCharge:** Current battery charge as a percentage of total capacity -- **BatteryDischarging:** Flag indicating whether the battery is discharging or charging -- **BootId:** Total boot count since the operating system was installed -- **BootTimeUTC:** Date and time of a particular boot event (identified by BootId) -- **EnergyChangeV2:** A snapshot value in mWh reflecting a change in power usage -- **EnergyChangeV2Flags:** Flags for disambiguating EnergyChangeV2 context -- **EventSequence:** A sequential number used to evaluate the completeness of the data -- **LastStateTransition:** ID of the last operating system state transition -- **LastStateTransitionSub:** ID of the last operating system substate transition -- **StateDurationMS:** Number of milliseconds spent in the last operating system state -- **StateTransition:** ID of the operating system state the system is transitioning to -- **StateTransitionSub:** ID of the operating system substate the system is transitioning to -- **TotalDurationMS:** Total time (in milliseconds) spent in all states since the last boot -- **TotalUptimeMS:** Total time (in milliseconds) the device was in Up or Running states since the last boot -- **TransitionsToOn:** Number of transitions to the Powered On state since the last boot -- **UptimeDeltaMS:** Total time (in milliseconds) added to Uptime since the last event - -## Microsoft.Windows.LogonController.LogonAndUnlockSubmit -Sends details of the user attempting to sign into or unlock the device. - -The following fields are available: - -- **isSystemManagedAccount:** Indicates if the user's account is System Managed -- **isUnlockScenario:** Flag indicating whether the event is a Logon or an Unlock -- **userType:** Indicates the user type: 0 = unknown; 1 = local; 2 = Active Directory domain user; 3 = Microsoft Account; 4 = Azure Active Directory user - -## Microsoft.Windows.LogonController.SignInFailure -Sends details about any error codes detected during a failed sign-in. - -The following fields are available: - -- **ntsStatus:** The NTSTATUS error code status returned from an attempted sign-in -- **ntsSubstatus:** The NTSTATUS error code substatus returned from an attempted sign-in - -## Microsoft.Windows.Security.Biometrics.Service.BioServiceActivityCapture -Indicates that a biometric capture was compared to known templates - -The following fields are available: - -- **captureDetail:** Result of biometric capture, either matched to an enrollment or an error -- **captureSuccessful:** Indicates whether a biometric capture was successfully matched or not -- **hardwareId:** ID of the sensor that collected the biometric capture -- **isSecureSensor:** Flag indicating whether a biometric sensor was in enhanced security mode -- **isTrustletRunning:** Indicates whether an enhanced security component is currently running -- **isVsmCfg:** Flag indicating whether virtual secure mode is configured or not - -## Microsoft.Windows.Security.Winlogon.SystemBootStop -System boot has completed. - -The following field is available: - -- **ticksSinceBoot:** Duration of boot event (milliseconds) - -## Microsoft.Windows.Shell.Desktop.LogonFramework.AllLogonTasks -This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Desktop Analytics, organizations can help identify logon problems on managed devices. - -The following fields are available: - -- **isAadUser:** Indicates whether the current logon is for an Azure Active Directory account -- **isDomainUser:** Indicates whether the current logon is for a domain account -- **isMSA:** Indicates whether the current logon is for a Microsoft Account -- **logonOptimizationFlags:** Flags indicating optimization settings for this logon session -- **logonTypeFlags:** Flags indicating logon type (first logon vs. a later logon) -- **systemManufacturer:** Device manufacturer -- **systemProductName:** Device product name -- **wilActivity:** Indicates errors in the task to help Microsoft improve reliability. - -## Microsoft.Windows.Shell.Desktop.LogonFramework.LogonTask -This event describes system tasks that are part of the user logon sequence and helps Microsoft to improve reliability. - -The following fields are available: - -- **isStartWaitTask:** Flag indicating whether the task starts a background task -- **isWaitMethod:** Flag indicating the task is waiting on a background task -- **logonTask:** Indicates which logon step is currently occurring -- **wilActivity:** Indicates errors in the task to help Microsoft improve reliability. - -## Microsoft.Windows.Shell.Explorer.DesktopReady -Initialization of Explorer is complete. - -## Microsoft-Windows-Security-EFS-EDPAudit-ApplicationLearning.EdpAuditLogApplicationLearning -For a device subject to Windows Information Protection policy, learning events are generated when an app encounters a policy boundary (for example, trying to open a work document from a personal app). These events help the Windows Information Protection administrator tune policy rules and prevent unnecessary user disruption. - -The following fields are available: - -- **actiontype:** Indicates what type of resource access the app was attempting (for example, opening a local document vs. a network resource) when it encountered a policy boundary. Useful for Windows Information Protection administrators to tune policy rules. -- **appIdType:** Based on the type of application, this field indicates what type of app rule a Windows Information Protection administrator would need to create for this app. -- **appname:** App that triggered the event -- **status:** Indicates whether errors occurred during Windows Information Protection learning events - -## Win32kTraceLogging.AppInteractivitySummary -Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Desktop Analytics) to understand and improve application reliability on managed devices. - -The following fields are available: - -- **AggregationDurationMS:** Actual duration of aggregation period (in milliseconds) -- **AggregationFlags:** Flags denoting aggregation settings -- **AggregationPeriodMS:** Intended duration of aggregation period (in milliseconds) -- **AggregationStartTime:** Start date and time of AppInteractivity aggregation -- **AppId:** Application ID for usage -- **AppSessionId:** GUID identifying the application's usage session -- **AppVersion:** Version of the application that produced this event -- **AudioInMS:** Audio capture duration (in milliseconds) -- **AudioOutMS:** Audio playback duration (in milliseconds) -- **BackgroundMouseSec:** Indicates that there was a mouse hover event while the app was in the background -- **BitPeriodMS:** Length of the period represented by InFocusBitmap -- **CommandLineHash:** A hash of the command line -- **CompositionDirtyGeneratedSec:** Represents the amount of time (in seconds) during which the active app reported that it had an update -- **CompositionDirtyPropagatedSec:** Total time (in seconds) that a separate process with visuals hosted in an app signaled updates -- **CompositionRenderedSec:** Time (in seconds) that an app's contents were rendered -- **EventSequence:** [need more info] -- **FocusLostCount:** Number of times that an app lost focus during the aggregation period -- **GameInputSec:** Time (in seconds) there was user input using a game controller -- **HidInputSec:** Time (in seconds) there was user input using devices other than a game controller -- **InFocusBitmap:** Series of bits representing application having and losing focus -- **InFocusDurationMS:** Total time (in milliseconds) the application had focus -- **InputSec:** Total number of seconds during which there was any user input -- **InteractiveTimeoutPeriodMS:** Total time (in milliseconds) that inactivity expired interactivity sessions -- **KeyboardInputSec:** Total number of seconds during which there was keyboard input -- **MonitorFlags:** Flags indicating app use of individual monitor(s) -- **MonitorHeight:** Number of vertical pixels in the application host monitor resolution -- **MonitorWidth:** Number of horizontal pixels in the application host monitor resolution -- **MouseInputSec:** Total number of seconds during which there was mouse input -- **NewProcessCount:** Number of new processes contributing to the aggregate -- **PartATransform_AppSessionGuidToUserSid:** Flag that influences how other parts of the event are constructed -- **PenInputSec:** Total number of seconds during which there was pen input -- **SpeechRecognitionSec:** Total number of seconds of speech recognition -- **SummaryRound:** Incrementing number indicating the round (batch) being summarized -- **TargetAsId:** Flag that influences how other parts of the event are constructed -- **TotalUserOrDisplayActiveDurationMS:** Total time the user or the display was active (in milliseconds) -- **TouchInputSec:** Total number of seconds during which there was touch input -- **UserActiveDurationMS:** Total time that the user was active including all input methods -- **UserActiveTransitionCount:** Number of transitions in and out of user activity -- **UserOrDisplayActiveDurationMS:** Total time the user was using the display -- **ViewFlags:** Flags denoting  properties of an app view (for example, special VR view or not) -- **WindowFlags:** Flags denoting runtime properties of an app window -- **WindowHeight:** Number of vertical pixels in the application window -- **WindowWidth:** Number of horizontal pixels in the application window - -## Revisions - -### PartA_UserSid removed -A previous revision of this list stated that a field named PartA_UserSid was a member of the event Microsoft.Windows.LogonController.LogonAndUnlockSubmit. This statement was incorrect. The list has been updated to reflect that no such field is present in the event. - -### Office events added -In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 16 events were added, describing Office app launch and availability. These events were added to improve the precision of Office data in Windows Analytics. - -> [!NOTE] -> Office data will no longer be provided through this policy in Desktop Analytics. - -### CertAnalytics events removed -In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 3 "CertAnalytics" events were removed, as they are no longer required for Desktop Analytics. - ->[!NOTE] ->You can use the Windows Diagnostic Data Viewer to observe and review events and their fields as described in this topic. diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml index b6ad626c23..a90650c92d 100644 --- a/windows/privacy/toc.yml +++ b/windows/privacy/toc.yml @@ -37,8 +37,6 @@ href: windows-diagnostic-data.md - name: Windows 10, version 1703 optional diagnostic data href: windows-diagnostic-data-1703.md - - name: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy - href: enhanced-diagnostic-data-windows-analytics-events-and-fields.md - name: Manage Windows connected experiences items: - name: Manage connections from Windows operating system components to Microsoft services diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/TOC.yml b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/TOC.yml index e235cf65ec..74c7012d07 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/TOC.yml +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/TOC.yml @@ -1,6 +1,6 @@ - name: Microsoft Defender Application Guard href: md-app-guard-overview.md - items: + items: - name: System requirements href: reqs-md-app-guard.md - name: Install Application Guard @@ -9,10 +9,5 @@ href: configure-md-app-guard.md - name: Test scenarios href: test-scenarios-md-app-guard.md - - name: Microsoft Defender Application Guard Extension - href: md-app-guard-browser-extension.md - name: Application Guard FAQ - href: faq-md-app-guard.yml -- name: Windows security - href: /windows/security/ - + href: faq-md-app-guard.yml \ No newline at end of file diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard.md index 2a40f36ead..e5279d14fa 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard.md @@ -2,7 +2,7 @@ title: Configure the Group Policy settings for Microsoft Defender Application Guard description: Learn about the available Group Policy settings for Microsoft Defender Application Guard. ms.localizationpriority: medium -ms.date: 12/12/2023 +ms.date: 07/11/2024 ms.topic: how-to --- @@ -17,11 +17,11 @@ Application Guard uses both network isolation and application-specific settings. [!INCLUDE [microsoft-defender-application-guard-mdag-for-edge-enterprise-mode-and-enterprise-management](../../../../../includes/licensing/microsoft-defender-application-guard-mdag-for-edge-enterprise-mode-and-enterprise-management.md)] -For more information about Microsoft Defender Application Guard (MDAG) for Edge in stand-alone mode, see [Microsoft Defender Application Guard overview](md-app-guard-overview.md). +For more information about Microsoft Defender Application Guard (MDAG) for Microsoft Edge in stand-alone mode, see [Microsoft Defender Application Guard overview](md-app-guard-overview.md). ## Network isolation settings -These settings, located at `Computer Configuration\Administrative Templates\Network\Network Isolation`, help you define and manage your organization's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container. +These settings, located at `Computer Configuration\Administrative Templates\Network\Network Isolation`, help you define and manage your organization's network boundaries. Application Guard uses this information to automatically transfer any requests to access the noncorporate resources into the Application Guard container. > [!NOTE] > For Windows 10, if you have KB5014666 installed, and for Windows 11, if you have KB5014668 installed, you don't need to configure network isolation policy to enable Application Guard for Microsoft Edge in managed mode. @@ -33,7 +33,7 @@ These settings, located at `Computer Configuration\Administrative Templates\Netw |-----------|------------------|-----------| |Private network ranges for apps | At least Windows Server 2012, Windows 8, or Windows RT| A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| |Enterprise resource domains hosted in the cloud| At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (`|`) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.

This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| -|Domains categorized as both work and personal| At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment.

This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| +|Domains categorized as both work and personal| At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Microsoft Edge environment.

This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| ## Network isolation settings wildcards @@ -52,7 +52,7 @@ These settings, located at `Computer Configuration\Administrative Templates\Wind |Configure Microsoft Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher

Windows 10 Education, 1809 or higher

Windows 11 Enterprise and Education|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** This is effective only in managed mode. Turns on the clipboard functionality and lets you choose whether to additionally:
- Disable the clipboard functionality completely when Virtualization Security is enabled.
- Enable copying of certain content from Application Guard into Microsoft Edge.
- Enable copying of certain content from Microsoft Edge into Application Guard. **Important:** Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.

**Disabled or not configured.** Completely turns off the clipboard functionality for Application Guard.| |Configure Microsoft Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher

Windows 10 Education, 1809 or higher

Windows 11 Enterprise and Education|Determines whether Application Guard can use the print functionality.|**Enabled.** This is effective only in managed mode. Turns on the print functionality and lets you choose whether to additionally:
- Enable Application Guard to print into the XPS format.
- Enable Application Guard to print into the PDF format.
- Enable Application Guard to print to locally attached printers.
- Enable Application Guard to print from previously connected network printers. Employees can't search for other printers.

**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.| |Allow Persistence|Windows 10 Enterprise, 1709 or higher

Windows 10 Education, 1809 or higher

Windows 11 Enterprise and Education|Determines whether data persists across different sessions in Microsoft Defender Application Guard.|**Enabled.** This is effective only in managed mode. Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.

**Disabled or not configured.** All user data within Application Guard is reset between sessions.

**NOTE**: If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.

**To reset the container:**
1. Open a command-line program and navigate to `Windows/System32`.
2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.
3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data.| -|Turn on Microsoft Defender Application Guard in Managed Mode|Windows 10 Enterprise, 1709 or higher

Windows 10 Education, 1809 or higher

Windows 11 Enterprise and Education|Determines whether to turn on Application Guard for Microsoft Edge and Microsoft Office.|**Enabled.** Turns on Application Guard for Microsoft Edge and/or Microsoft Office, honoring the network isolation settings, rendering untrusted content in the Application Guard container. Application Guard won't actually be turned on unless the required prerequisites and network isolation settings are already set on the device. Available options:
- Enable Microsoft Defender Application Guard only for Microsoft Edge
- Enable Microsoft Defender Application Guard only for Microsoft Office
- Enable Microsoft Defender Application Guard for both Microsoft Edge and Microsoft Office

**Disabled.** Turns off Application Guard, allowing all apps to run in Microsoft Edge and Microsoft Office.

**Note:** For Windows 10, if you have KB5014666 installed, and for Windows 11, if you have KB5014668 installed, you are no longer required to configure network isolation policy to enable Application Guard for Edge.| +|Turn on Microsoft Defender Application Guard in Managed Mode|Windows 10 Enterprise, 1709 or higher

Windows 10 Education, 1809 or higher

Windows 11 Enterprise and Education|Determines whether to turn on Application Guard for Microsoft Edge and Microsoft Office.|**Enabled.** Turns on Application Guard for Microsoft Edge and/or Microsoft Office, honoring the network isolation settings, rendering untrusted content in the Application Guard container. Application Guard won't actually be turned on unless the required prerequisites and network isolation settings are already set on the device. Available options:
- Enable Microsoft Defender Application Guard only for Microsoft Edge
- Enable Microsoft Defender Application Guard only for Microsoft Office
- Enable Microsoft Defender Application Guard for both Microsoft Edge and Microsoft Office

**Disabled.** Turns off Application Guard, allowing all apps to run in Microsoft Edge and Microsoft Office.

**Note:** For Windows 10, if you have KB5014666 installed, and for Windows 11, if you have KB5014668 installed, you're no longer required to configure network isolation policy to enable Application Guard for Microsoft Edge.| |Allow files to download to host operating system|Windows 10 Enterprise or Pro, 1803 or higher

Windows 10 Education, 1809 or higher

Windows 11 Enterprise or Pro or Education|Determines whether to save downloaded files to the host operating system from the Microsoft Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Microsoft Defender Application Guard container to the host operating system. This action creates a share between the host and container that also allows for uploads from the host to the Application Guard container.

**Disabled or not configured.** Users aren't able to save downloaded files from Application Guard to the host operating system.| |Allow hardware-accelerated rendering for Microsoft Defender Application Guard|Windows 10 Enterprise, 1709 or higher

Windows 10 Education, 1809 or higher

Windows 11 Enterprise and Education|Determines whether Microsoft Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** This is effective only in managed mode. Microsoft Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Microsoft Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Microsoft Defender Application Guard will automatically revert to software-based (CPU) rendering. **Important:** Enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.

**Disabled or not configured.** Microsoft Defender Application Guard uses software-based (CPU) rendering and won't load any third-party graphics drivers or interact with any connected graphics hardware.| |Allow camera and microphone access in Microsoft Defender Application Guard|Windows 10 Enterprise, 1709 or higher

Windows 10 Education, 1809 or higher

Windows 11 Enterprise and Education|Determines whether to allow camera and microphone access inside Microsoft Defender Application Guard.|**Enabled.** This is effective only in managed mode. Applications inside Microsoft Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

**Disabled or not configured.** Applications inside Microsoft Defender Application Guard are unable to access the camera and microphone on the user's device.| diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml index 43f2f31197..b539097c6d 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml @@ -4,7 +4,7 @@ metadata: description: Learn about the commonly asked questions and answers for Microsoft Defender Application Guard. ms.localizationpriority: medium ms.topic: faq - ms.date: 12/12/2023 + ms.date: 07/11/2024 title: Frequently asked questions - Microsoft Defender Application Guard summary: | @@ -211,7 +211,7 @@ sections: - question: | What does the _Allow users to trust files that open in Microsoft Defender Application Guard_ option in the Group policy do? answer: | - This policy was present in Windows 10 prior to version 2004. It was removed from later versions of Windows as it doesn't enforce anything for either Edge or Office. + This policy was present in Windows 10 prior to version 2004. It was removed from later versions of Windows as it doesn't enforce anything for either Microsoft Edge or Office. - question: | How do I open a support ticket for Microsoft Defender Application Guard? @@ -220,9 +220,9 @@ sections: - Under the Product Family, select Windows. Select the product and the product version you need help with. For the category that best describes the issue, select, **Windows Security Technologies**. In the final option, select **Windows Defender Application Guard**. - question: | - Is there a way to enable or disable the behavior where the host Edge tab auto-closes when navigating to an untrusted site? + Is there a way to enable or disable the behavior where the host Microsoft Edge tab auto-closes when navigating to an untrusted site? answer: | - Yes. Use this Edge flag to enable or disable this behavior: `--disable-features="msWdagAutoCloseNavigatedTabs"` + Yes. Use this Microsoft Edge flag to enable or disable this behavior: `--disable-features="msWdagAutoCloseNavigatedTabs"` additionalContent: | diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md index 33375dd2a1..beefaa14bb 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md @@ -1,7 +1,7 @@ --- title: Enable hardware-based isolation for Microsoft Edge description: Learn about the Microsoft Defender Application Guard modes (Standalone or Enterprise-managed), and how to install Application Guard in your enterprise. -ms.date: 12/12/2023 +ms.date: 07/11/2024 ms.topic: how-to --- @@ -31,7 +31,7 @@ Standalone mode is applicable for: ## Enterprise-managed mode -You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to add non-enterprise domain(s) in the container. +You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to add nonenterprise domain(s) in the container. Enterprise-managed mode is applicable for: @@ -93,7 +93,7 @@ Application Guard functionality is turned off by default. However, you can quick To learn more about scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags). -1. In the **Assignments** page, select the users or groups that will receive the policy. Select **Next**. +1. In the **Assignments** page, select the users or groups that receive the policy. Select **Next**. To learn more about assigning policies, see [Assign policies in Microsoft Intune](/mem/intune/configuration/device-profile-assign). diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md deleted file mode 100644 index f841705678..0000000000 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Microsoft Defender Application Guard Extension -description: Learn about the Microsoft Defender Application Guard browser extension, which extends Application Guard's protection to more web browsers. -ms.localizationpriority: medium -ms.date: 12/12/2023 -ms.topic: conceptual ---- - -# Microsoft Defender Application Guard Extension - -[!INCLUDE [mdag-edge-deprecation-notice](../../../includes/mdag-edge-deprecation-notice.md)] - -[Microsoft Defender Application Guard Extension](https://www.microsoft.com/security/blog/2019/05/23/new-browser-extensions-for-integrating-microsofts-hardware-based-isolation/) is a web browser add-on available for [Chrome](https://chrome.google.com/webstore/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj/) and [Firefox](https://addons.mozilla.org/en-US/firefox/addon/application-guard-extension/). - -[Microsoft Defender Application Guard](md-app-guard-overview.md) provides Hyper-V isolation on Windows 10 and Windows 11, to protect users from potentially harmful content on the web. The extension helps Application Guard protect users running other web browsers. - -> [!TIP] -> Application Guard, by default, offers [native support](/deployedge/microsoft-edge-security-windows-defender-application-guard) to both Microsoft Edge and Internet Explorer. These browsers do not need the extension described here for Application Guard to protect them. - -Microsoft Defender Application Guard Extension defends devices in your organization from advanced attacks, by redirecting untrusted websites to an isolated version of [Microsoft Edge](https://www.microsoft.com/edge). If an untrusted website turns out to be malicious, it remains within Application Guard's secure container, keeping the device protected. - -## Prerequisites - -Microsoft Defender Application Guard Extension works with the following editions of Windows 10, version 1809 or later: - -- Windows 10 Professional -- Windows 10 Enterprise -- Windows 10 Education -- Windows 11 - -Application Guard itself is required for the extension to work. It has its own set of [requirements](reqs-md-app-guard.md). Check the Application Guard [installation guide](install-md-app-guard.md) for further steps, if you don't have it installed already. - -## Installing the extension - -Application Guard can be run under [managed mode](install-md-app-guard.md#enterprise-managed-mode) or [standalone mode](install-md-app-guard.md#standalone-mode). The main difference between the two modes is whether policies have been set to define the organization's boundaries. - -Enterprise administrators running Application Guard under managed mode should first define Application Guard's [network isolation settings](configure-md-app-guard.md#network-isolation-settings), so a set of enterprise sites is already in place. - -From there, the steps for installing the extension are similar whether Application Guard is running in managed or standalone mode. - -1. On the local device, download and install the Application Guard extension for Google [Chrome](https://chrome.google.com/webstore/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj/) and/or Mozilla [Firefox](https://addons.mozilla.org/en-US/firefox/addon/application-guard-extension/). -1. Install the [Microsoft Defender Application Guard companion app](https://www.microsoft.com/p/windows-defender-application-guard-companion/9n8gnlc8z9c8#activetab=pivot:overviewtab) from the Microsoft Store. This companion app enables Application Guard to work with web browsers other than Microsoft Edge or Internet Explorer. -1. Restart the device. - -### Recommended browser group policies - -Both Chrome and Firefox have their own browser-specific group policies. We recommend that admins use the following policy settings. - -#### Chrome policies - -These policies can be found along the filepath, `Software\Policies\Google\Chrome\`, with each policy name corresponding to the file name. For example, `IncognitoModeAvailability` is located at `Software\Policies\Google\Chrome\IncognitoModeAvailability`. - -Policy name | Values | Recommended setting | Reason --|-|-|- -[IncognitoModeAvailability](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=IncognitoModeAvailability) | `0` = Enabled
`1` = Disabled
`2` = Forces pages to only open in Incognito mode | Disabled | This policy allows users to start Chrome in Incognito mode. In this mode, all extensions are turned off by default. -[BrowserGuestModeEnabled](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=BrowserGuestModeEnabled) | `false` or `0` = Disabled
`true`, `1`, or not configured = Enabled | Disabled | This policy allows users to sign in as *Guest*, which opens a session in Incognito mode. In this mode, all extensions are turned off by default. -[BackgroundModeEnabled](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=BackgroundModeEnabled) | `false` or `0` = Disabled
`true` or `1` = Enabled

**Note:** If this policy isn't set, the user can enable or disable background mode through local browser settings. | Enabled | This policy keeps Chrome running in the background, ensuring that navigation is always passed to the extension. -[ExtensionSettings](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionSettings) | This policy accepts a dictionary that configures multiple other management settings for Chrome. See the [Google Cloud documentation](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionSettings) for complete schema. | Include an entry for `force_installed` | This policy prevents users from manually removing the extension. - -#### Firefox policies - -These policies can be found along the filepath, `Software\Policies\Mozilla\Firefox\`, with each policy name corresponding to the file name. Foe example, `DisableSafeMode` is located at `Software\Policies\Mozilla\Firefox\DisableSafeMode`. - -Policy name | Values | Recommended setting | Reason --|-|-|- -[DisableSafeMode](https://github.com/mozilla/policy-templates/blob/master/README.md#DisableSafeMode) | `false` or `0` = Safe mode is enabled
`true` or `1` = Safe mode is disabled | The policy is enabled and Safe mode isn't allowed to run. | Safe mode can allow users to circumvent Application Guard -[BlockAboutConfig](https://github.com/mozilla/policy-templates/blob/master/README.md#BlockAboutConfig) | `false` or `0` = User access to `about:config` is allowed
`true` or `1` = User access to `about:config` isn't allowed | The policy is enabled and access to `about:config` isn't allowed. | `About:config` is a special page within Firefox that offers control over many settings that may compromise security -[Extensions - Locked](https://github.com/mozilla/policy-templates/blob/master/README.md#Extensions) | This setting accepts a list of UUIDs for extensions. You can find these extensions by searching `extensions.webextensions.uuids` within the `about:config` page) | Software\Policies\Mozilla\Firefox\Extensions\Locked\1 = "`ApplicationGuardRel@microsoft.com`" | This setting allows you to lock the extension, so the user can't disable or uninstall it. - -## Troubleshooting guide - - - -Error message | Cause | Actions --|-|- -Application Guard undetermined state | The extension was unable to communicate with the companion app during the last information request. | 1. Install the [companion app](https://www.microsoft.com/p/windows-defender-application-guard-companion/9n8gnlc8z9c8?activetab=pivot:overviewtab) and reboot
2. If the companion app is already installed, reboot and see if that resolves the error
3. If you still see the error after rebooting, uninstall and reinstall the companion app
4. Check for updates in both the Microsoft store and the respective web store for the affected browser -ExceptionThrown | An unexpected exception was thrown. | 1. [File a bug](https://aka.ms/wdag-fb)
2. Retry the operation -Failed to determine if Application Guard is enabled | The extension was able to communicate with the companion app, but the information request failed in the app. | 1. Restart the browser
2. Check for updates in both the Microsoft store and the respective web store for the affected browser -Launch in WDAG failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This error can be caused by the companion app being uninstalled while Chrome was running. | 1. Make sure the companion app is installed
2. If the companion app is installed, reboot and see if that resolves the error
3. If you still see the error after rebooting, uninstall and reinstall the companion app
4. Check for updates in both the Microsoft store and the respective web store for the affected browser -Main page navigation caught an unexpected error | An unexpected exception was thrown during the main page navigation. | 1. [File a bug](https://aka.ms/wdag-fb)
2. Retry the operation -Process trust response failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This error can be caused by the companion app being uninstalled while Chrome was running.| 1. Make sure the companion app is installed.
2. If the companion app is installed, reboot and see if that resolves the error
3. If you still see the error after rebooting, uninstall and reinstall the companion app
4. Check for updates in both the Microsoft store and the respective web store for the affected browser -Protocol out of sync | The extension and native app can't communicate with each other. This error is likely caused by one being updated without supporting the protocol of the other. | Check for updates in both the Microsoft store, and the web store for the affected browser -Security patch level doesn't match | Microsoft determined that there was a security issue with either the extension or the companion app, and has issued a mandatory update. | Check for updates in both the Microsoft store, and the web store for the affected browser -Unexpected response while processing trusted state | The extension was able to communicate with the companion app, but the API failed and a failure response code was sent back to the extension. | 1. [File a bug](https://aka.ms/wdag-fb)
2. Check if Microsoft Edge is working
3. Retry the operation - -## Related articles - -- [Microsoft Defender Application Guard overview](md-app-guard-overview.md) -- [Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md) diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md index 109331df35..cc5f471678 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md @@ -1,7 +1,7 @@ --- title: Microsoft Defender Application Guard description: Learn about Microsoft Defender Application Guard and how it helps combat malicious content and malware out on the Internet. -ms.date: 12/12/2023 +ms.date: 07/11/2024 ms.topic: conceptual --- @@ -15,7 +15,7 @@ Microsoft Defender Application Guard (MDAG) is designed to help prevent old and For Microsoft Edge, Application Guard helps to isolate enterprise-defined untrusted sites, protecting your company while your employees browse the Internet. As an enterprise administrator, you define what is among trusted web sites, cloud resources, and internal networks. Everything not on your list is considered untrusted. If an employee goes to an untrusted site through either Microsoft Edge or Internet Explorer, Microsoft Edge opens the site in an isolated Hyper-V-enabled container. -For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint and Excel files from accessing trusted resources. Application Guard opens untrusted files in an isolated Hyper-V-enabled container. The isolated Hyper-V container is separate from the host operating system. This container isolation means that if the untrusted site or file turns out to be malicious, the host device is protected, and the attacker can't get to your enterprise data. For example, this approach makes the isolated container anonymous, so an attacker can't get to your employee's enterprise credentials. +For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint, and Excel files from accessing trusted resources. Application Guard opens untrusted files in an isolated Hyper-V-enabled container. The isolated Hyper-V container is separate from the host operating system. This container isolation means that if the untrusted site or file turns out to be malicious, the host device is protected, and the attacker can't get to your enterprise data. For example, this approach makes the isolated container anonymous, so an attacker can't get to your employee's enterprise credentials. ![Hardware isolation diagram.](images/appguard-hardware-isolation.png) @@ -33,7 +33,7 @@ Application Guard has been created to target several types of devices: [!INCLUDE [microsoft-defender-application-guard-mdag-for-edge-standalone-mode](../../../../../includes/licensing/microsoft-defender-application-guard-mdag-for-edge-standalone-mode.md)] -For more information about Microsoft Defender Application Guard (MDAG) for Edge enterprise mode, [Configure Microsoft Defender Application Guard policy settings.](configure-md-app-guard.md) +For more information about Microsoft Defender Application Guard (MDAG) for Microsoft Edge enterprise mode, [Configure Microsoft Defender Application Guard policy settings.](configure-md-app-guard.md) ## Related articles @@ -43,7 +43,6 @@ For more information about Microsoft Defender Application Guard (MDAG) for Edge |[Prepare and install Microsoft Defender Application Guard](install-md-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.| |[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.| |[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| -| [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a troubleshooting guide | | [Microsoft Defender Application Guard for Microsoft Office](/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration, and a troubleshooting guide | |[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.yml)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| |[Use a network boundary to add trusted sites on Windows devices in Microsoft Intune](/mem/intune/configuration/network-boundary-windows)|Network boundary, a feature that helps you protect your environment from sites that aren't trusted by your organization.| diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/reqs-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/reqs-md-app-guard.md index ff5414fd19..f8e31a69f9 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/reqs-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/reqs-md-app-guard.md @@ -3,7 +3,7 @@ title: System requirements for Microsoft Defender Application Guard description: Learn about the system requirements for installing and running Microsoft Defender Application Guard. ms.topic: overview ms.localizationpriority: medium -ms.date: 12/12/2023 +ms.date: 07/11/2024 --- # System requirements for Microsoft Defender Application Guard @@ -24,8 +24,8 @@ Your environment must have the following hardware to run Microsoft Defender Appl | Hardware | Description | |--------|-----------| -| 64-bit CPU|A 64-bit computer with minimum four cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| -| CPU virtualization extensions|Extended page tables, also called _Second Level Address Translation (SLAT)_

**AND**

One of the following virtualization extensions for VBS:
VT-x (Intel)
**OR**
AMD-V | +| 64-bit CPU|A 64-bit computer with minimum four cores (logical processors) is required for hypervisor and Virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| +| CPU virtualization extensions|Extended page tables, also called _Second Level Address Translation (SLAT)_

**AND**

One of the following virtualization extensions for VBS:
VT-x (Intel)
**OR**
AMD-V | | Hardware memory | Microsoft requires a minimum of 8-GB RAM | | Hard disk | 5-GB free space, solid state disk (SSD) recommended | | Input/Output Memory Management Unit (IOMMU) support| Not required, but recommended | @@ -38,4 +38,4 @@ Your environment must have the following hardware to run Microsoft Defender Appl |--------|-----------| | Operating system | Windows 10 Enterprise or Education editions, version 1809 or later
Windows 10 Professional edition, version 1809 or later (only [standalone mode](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard#standalone-mode) is supported)
Windows 11 Education or Enterprise editions
Windows 11 Professional edition (only [Standalone mode](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard#standalone-mode) is supported) | | Browser | Microsoft Edge | -| Management system
(only for managed devices)| [Microsoft Intune](/intune/)

**OR**

[Microsoft Configuration Manager](/configmgr/)

**OR**

[Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11))

**OR**

Your current, company-wide, non-Microsoft mobile device management (MDM) solution. For info about non-Microsoft MDM solutions, see the documentation that came with your product. | +| Management system
(only for managed devices)| [Microsoft Intune](/intune/)

**OR**

[Microsoft Configuration Manager](/configmgr/)

**OR**

[Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11))

**OR**

Your current, company-wide, non-Microsoft mobile device management (MDM) solution. For info about non-Microsoft MDM solutions, see the documentation that came with your product. | diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/test-scenarios-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/test-scenarios-md-app-guard.md index f63bfb9f1f..275a28dd9e 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/test-scenarios-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/test-scenarios-md-app-guard.md @@ -2,7 +2,7 @@ title: Testing scenarios with Microsoft Defender Application Guard description: Suggested testing scenarios for Microsoft Defender Application Guard, showing how it works in both Standalone and Enterprise-managed mode. ms.localizationpriority: medium -ms.date: 12/12/2023 +ms.date: 07/11/2024 ms.topic: conceptual --- @@ -26,8 +26,8 @@ You can see how an employee would use standalone mode with Application Guard. 3. Wait for Application Guard to set up the isolated environment. - >[!NOTE] - >Starting Application Guard too quickly after restarting the device might cause it to take a bit longer to load. However, subsequent starts should occur without any perceivable delays. + > [!NOTE] + > Starting Application Guard too quickly after restarting the device might cause it to take a bit longer to load. However, subsequent starts should occur without any perceivable delays. 4. Go to an untrusted, but safe URL (for this example, we used msn.com) and view the new Microsoft Edge window, making sure you see the Application Guard visual cues. @@ -39,7 +39,7 @@ How to install, set up, turn on, and configure Application Guard for Enterprise- ### Install, set up, and turn on Application Guard -Before you can use Application Guard in managed mode, you must install Windows 10 Enterprise edition, version 1709, and Windows 11 which includes the functionality. Then, you must use Group Policy to set up the required settings. +Before you can use Application Guard in managed mode, you must install Windows 10 Enterprise edition, version 1709, and Windows 11, which includes the functionality. Then, you must use Group Policy to set up the required settings. 1. [Install Application Guard](install-md-app-guard.md#install-application-guard). @@ -47,19 +47,19 @@ Before you can use Application Guard in managed mode, you must install Windows 1 3. Set up the Network Isolation settings in Group Policy: - a. Select the **Windows** icon, type `Group Policy`, and then select **Edit Group Policy**. + 1. Select the **Windows** icon, type `Group Policy`, and then select **Edit Group Policy**. - b. Go to the **Administrative Templates\Network\Network Isolation\Enterprise resource domains hosted in the cloud** setting. + 1. Go to the **Administrative Templates\Network\Network Isolation\Enterprise resource domains hosted in the cloud** setting. - c. For the purposes of this scenario, type `.microsoft.com` into the **Enterprise cloud resources** box. + 1. For the purposes of this scenario, type `.microsoft.com` into the **Enterprise cloud resources** box. - ![Group Policy editor with Enterprise cloud resources setting.](images/appguard-gp-network-isolation.png) + ![Group Policy editor with Enterprise cloud resources setting.](images/appguard-gp-network-isolation.png) - d. Go to the **Administrative Templates\Network\Network Isolation\Domains categorized as both work and personal** setting. + 1. Go to the **Administrative Templates\Network\Network Isolation\Domains categorized as both work and personal** setting. - e. For the purposes of this scenario, type `bing.com` into the **Neutral resources** box. + 1. For the purposes of this scenario, type `bing.com` into the **Neutral resources** box. - ![Group Policy editor with Neutral resources setting.](images/appguard-gp-network-isolation-neutral.png) + ![Group Policy editor with Neutral resources setting.](images/appguard-gp-network-isolation-neutral.png) 4. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Turn on Microsoft Defender Application Guard in Managed Mode** setting. @@ -67,8 +67,8 @@ Before you can use Application Guard in managed mode, you must install Windows 1 ![Group Policy editor with Turn On/Off setting.](images/appguard-gp-turn-on.png) - >[!NOTE] - >Enabling this setting verifies that all the necessary settings are properly configured on your employee devices, including the network isolation settings set earlier in this scenario. + > [!NOTE] + > Enabling this setting verifies that all the necessary settings are properly configured on your employee devices, including the network isolation settings set earlier in this scenario. 6. Start Microsoft Edge and type `https://www.microsoft.com`. @@ -207,7 +207,7 @@ You have the option to change each of these settings to work with your enterpris 3. Sign out and back in to your device, opening Microsoft Edge in Application Guard again. -4. Open an application with video or audio capability in Edge. +4. Open an application with video or audio capability in Microsoft Edge. 5. Check that the camera and microphone work as expected. @@ -223,17 +223,20 @@ You have the option to change each of these settings to work with your enterpris ## Application Guard Extension for third-party web browsers -The [Application Guard Extension](md-app-guard-browser-extension.md) available for Chrome and Firefox allows Application Guard to protect users even when they are running a web browser other than Microsoft Edge or Internet Explorer. +The [Application Guard Extension](md-app-guard-browser-extension.md) available for Chrome and Firefox allows Application Guard to protect users even when they're running a web browser other than Microsoft Edge or Internet Explorer. Once a user has the extension and its companion app installed on their enterprise device, you can run through the following scenarios. 1. Open either Firefox or Chrome, whichever browser you have the extension installed on. 2. Navigate to an organizational website. In other words, an internal website maintained by your organization. You might see this evaluation page for an instant before the site is fully loaded. + ![The evaluation page displayed while the page is being loaded, explaining that the user must wait.](images/app-guard-chrome-extension-evaluation-page.png) -3. Navigate to a non-enterprise, external website site, such as [www.bing.com](https://www.bing.com). The site should be redirected to Microsoft Defender Application Guard Edge. +3. Navigate to a nonenterprise, external website site, such as [www.bing.com](https://www.bing.com). The site should be redirected to Microsoft Defender Application Guard Edge. + ![A non-enterprise website being redirected to an Application Guard container -- the text displayed explains that the page is being opened in Application Guard for Microsoft Edge.](images/app-guard-chrome-extension-launchIng-edge.png) -4. Open a new Application Guard window, by selecting the Microsoft Defender Application Guard icon, then **New Application Guard Window** +4. Open a new Application Guard window, by selecting the Microsoft Defender Application Guard icon, then **New Application Guard Window**. + ![The "New Application Guard Window" option is highlighted in red](images/app-guard-chrome-extension-new-app-guard-page.png) diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md index adf405569f..8d8f873a38 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md @@ -35,8 +35,8 @@ Windows Sandbox has the following properties: - At least two CPU cores (four cores with hyper-threading recommended) > [!NOTE] -> Windows Sandbox is currently not supported on Windows Home edition - +> Windows Sandbox is currently not supported on Windows Home edition. +> Beginning in Windows 11, version 24H2, all inbox store apps like calculator, photos, notepad and terminal are not available inside Windows Sandbox. Ability to use these apps will be added soon. ## Installation 1. Ensure that your machine is using Windows 10 Pro or Enterprise, build version 18305 or Windows 11. diff --git a/windows/security/hardware-security/pluton/microsoft-pluton-security-processor.md b/windows/security/hardware-security/pluton/microsoft-pluton-security-processor.md index 66feedfe73..dfdb572272 100644 --- a/windows/security/hardware-security/pluton/microsoft-pluton-security-processor.md +++ b/windows/security/hardware-security/pluton/microsoft-pluton-security-processor.md @@ -9,7 +9,7 @@ ms.date: 07/10/2024 Microsoft Pluton security processor is a chip-to-cloud security technology built with [Zero Trust](/security/zero-trust/zero-trust-overview) principles at the core. Microsoft Pluton provides hardware-based root of trust, secure identity, secure attestation, and cryptographic services. Pluton technology is a combination of a secure subsystem, which is part of the System on Chip (SoC) and Microsoft authored software that runs on this integrated secure subsystem. -Microsoft Pluton is currently available on devices with Ryzen 6000 and Qualcomm Snapdragon® 8cx Gen 3 series processors. Microsoft Pluton can be enabled on devices with Pluton capable processors running Windows 11, version 22H2. +Microsoft Pluton is currently available on devices with AMD Ryzen® 6000, 7000, 8000, Ryzen AI and Qualcomm Snapdragon® 8cx Gen 3 and Snapdragon X series processors. Microsoft Pluton can be enabled on devices with Pluton capable processors running Windows 11, version 22H2 and later. ## What is Microsoft Pluton? @@ -19,6 +19,25 @@ Microsoft Pluton is designed to provide the functionality of the Trusted Platfor Pluton is built on proven technology used in Xbox and Azure Sphere, and provides hardened integrated security capabilities to Windows 11 devices in collaboration with leading silicon partners. For more information, see [Meet the Microsoft Pluton processor – The security chip designed for the future of Windows PCs](https://www.microsoft.com/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs/). +## How can Pluton help customers? + +Pluton is built with the goal of providing customers with better end-to-end security experiences. It does so by doing three things: + +1. **Zero-trust security and reliability**: Customer security scenarios often span devices and cloud services. Windows PCs and services like Microsoft Entra and Intune need to work harmoniously together to provide frictionless security. Pluton is designed, built and maintained in close collaboration with teams across Microsoft to ensure that customers get both high security and reliability. +1. **Innovation**: Pluton platform and the functionality it provides is informed by customer feedback and Microsoft’s threat intelligence. As an example, Pluton platforms in 2024 AMD and Intel systems will start to use a Rust-based firmware foundation given the importance of memory safety. +1. **Continuous improvement**: Pluton platform supports loading new firmware delivered through operating system updates. This functionality is supported alongside the typical mechanism of UEFI capsule updates that update the Pluton firmware that is resident on the system’s SPI flash and loaded during early system boot. The additional support for dynamically loading valid new Pluton firmware through operating system updates facilitates continuous improvements both for bug fixes and new features. + +### A practical example: zero-trust security with device-based conditional access policies + +An increasingly important zero-trust workflow is conditional access – gating access to resources like Sharepoint documents based on verifying whether requests are coming from a valid, healthy source. Microsoft Intune, for example, supports different workflows for conditional access including [device-based conditional access](/mem/intune/protect/create-conditional-access-intune) which allows organizations to set policies that ensure that managed devices are healthy and compliant before granting access to the organization’s apps and services. + +To ensure that Intune gets an accurate picture about the device’s health as part of enforcing these policies, ideally it has tamper-resistant logs on the state of the relevant security capabilities. This is where hardware security is critical as any malicious software running on the device could attempt to provide false signals to the service. One of the core benefits of a hardware security technology like the TPM, is that it has a tamper-resistant log of the state of the system. Services can cryptographically validate that logs and the associated system state reported by the TPM truly come from the TPM. + +For the end-to-end scenario to be truly successful at scale, the hardware-based security is not enough. Since access to enterprise assets is being gated based on security settings that are being reported by the TPM logs, it is critical that these logs are available reliably. Zero-trust security essentially requires high reliability. + +With Pluton, when it is configured as the TPM for the system, customers using conditional access get the benefits of Pluton’s security architecture and implementation with the reliability that comes from the tight integration and collaboration between Pluton and other Microsoft components and services. + + ## Microsoft Pluton security architecture overview ![Diagram showing the Microsoft Pluton security processor architecture](../images/pluton/pluton-security-architecture.png) diff --git a/windows/security/includes/mdag-edge-deprecation-notice.md b/windows/security/includes/mdag-edge-deprecation-notice.md index cf4028ac1c..150cffe43f 100644 --- a/windows/security/includes/mdag-edge-deprecation-notice.md +++ b/windows/security/includes/mdag-edge-deprecation-notice.md @@ -1,10 +1,10 @@ --- author: vinaypamnani-msft ms.author: vinpa -ms.date: 04/23/2024 +ms.date: 07/11/2024 ms.topic: include --- > [!NOTE] > - Microsoft Defender Application Guard, including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), will be deprecated for Microsoft Edge for Business and [will no longer be updated](/windows/whats-new/feature-lifecycle). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities. -> - Because Application Guard is deprecated there will not be a migration to Edge Manifest V3. The corresponding extensions and associated [Windows Store app](https://apps.microsoft.com/detail/9N8GNLC8Z9C8) will not be available after May 2024. This affects the following browsers: [*Application Guard Extension - Chrome*](https://chromewebstore.google.com/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj) and [*Application Guard Extension - Firefox*](https://addons.mozilla.org/firefox/addon/application-guard-extension/). If you want to block unprotected browsers until you are ready to retire MDAG usage in your enterprise, we recommend using AppLocker policies or [Microsoft Edge management service](/deployedge/microsoft-edge-management-service). For more information, see [Microsoft Edge and Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard). \ No newline at end of file +> - Because Application Guard is deprecated there will not be a migration to Edge Manifest V3. The corresponding browser extensions and associated Windows Store app are no longer available. If you want to block unprotected browsers until you are ready to retire MDAG usage in your enterprise, we recommend using AppLocker policies or [Microsoft Edge management service](/deployedge/microsoft-edge-management-service). For more information, see [Microsoft Edge and Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard). \ No newline at end of file diff --git a/windows/security/operating-system-security/data-protection/bitlocker/countermeasures.md b/windows/security/operating-system-security/data-protection/bitlocker/countermeasures.md index 13b8fb7c50..2b7377479e 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/countermeasures.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/countermeasures.md @@ -92,9 +92,23 @@ Therefore, organizations that use BitLocker might want to use Hibernate instead ### Tricking BitLocker to pass the key to a rogue operating system -An attacker might modify the boot manager configuration database (BCD), which is stored on a nonencrypted partition and add an entry point to a rogue operating system on a different partition. During the boot process, BitLocker code makes sure that the operating system that the encryption key obtained from the TPM is given to, is cryptographically verified to be the intended recipient. Because this strong cryptographic verification already exists, we don't recommend storing a hash of a disk partition table in Platform Configuration Register (PCR) 5. +An attacker might modify the boot manager configuration database (BCD), which is stored on a nonencrypted partition and add an entry point to a rogue operating system on a different partition. During the boot process, BitLocker code makes sure that the operating system that the encryption key obtained from the TPM is given to, is cryptographically verified to be the intended recipient. Because this strong cryptographic verification already exists, we don't recommend storing a hash of a disk partition table in PCR 5. -An attacker might also replace the entire operating system disk while preserving the platform hardware and firmware and could then extract a protected BitLocker key blob from the metadata of the victim OS partition. The attacker could then attempt to unseal that BitLocker key blob by calling the TPM API from an operating system under their control. This can't succeed because when Windows seals the BitLocker key to the TPM, it does it with a PCR 11 value of 0. To successfully unseal the blob, PCR 11 in the TPM must have a value of 0. However, when the boot manager passes the control to any boot loader (legitimate or rogue) it always changes PCR 11 to a value of 1. Since the PCR 11 value is guaranteed to be different after exiting the boot manager, the attacker can't unlock the BitLocker key. +An attacker might also replace the entire operating system disk while preserving the platform hardware and firmware, and could then extract a protected BitLocker key blob from the metadata of the victim OS partition. The attacker could then attempt to unseal that BitLocker key blob by calling the TPM API from an operating system under their control. This can't succeed because when Windows seals the BitLocker key to the TPM, it does it with a PCR 11 value of 0. To successfully unseal the blob, PCR 11 in the TPM must have a value of 0. However, when the boot manager passes the control to any boot loader (legitimate or rogue), it always changes PCR 11 to a value of 1. Since the PCR 11 value is guaranteed to be different after exiting the boot manager, the attacker can't unlock the BitLocker key. + +To prevent boot manger roll-back attacks, Windows updates released on and after July 2024 changed the default PCR Validation Profile for **UEFI with Secure Boot** from `7, 11` to `4, 7, 11`. + +The PCR values map to: + +- `PCR 4: Boot Manager` +- `PCR 7: Secure Boot State` +- `PCR 11: BitLocker access control` + +> [!TIP] +> To check what PCRs are in use, execute the following command: +> ```cmd +> manage-bde.exe -protectors -get c: +> ``` ## Attacker countermeasures diff --git a/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-secure-boot-for-integrity-validation.md b/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-secure-boot-for-integrity-validation.md index 853270403b..fbcf599ccc 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-secure-boot-for-integrity-validation.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-secure-boot-for-integrity-validation.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 10/30/2023 +ms.date: 07/18/2024 ms.topic: include --- @@ -26,3 +26,6 @@ When this policy is enabled and the hardware is capable of using Secure Boot for |--|--| | **CSP** | Not available | | **GPO** | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** | + +> [!NOTE] +> To prevent boot manger roll-back attacks, Windows updates released on and after July 2024 changed the default PCR Validation Profile for **UEFI with Secure Boot** from `7, 11` to `4, 7, 11`. diff --git a/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-tpm-platform-validation-profile-for-native-uefi-firmware-configurations.md b/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-tpm-platform-validation-profile-for-native-uefi-firmware-configurations.md index cb43d10a8c..fd61b353fa 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-tpm-platform-validation-profile-for-native-uefi-firmware-configurations.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-tpm-platform-validation-profile-for-native-uefi-firmware-configurations.md @@ -26,6 +26,8 @@ A platform validation profile consists of a set of PCR indices ranging from 0 to > [!NOTE] > When Secure Boot State (PCR7) support is available, the default platform validation profile secures the encryption key using Secure Boot State (PCR 7) and the BitLocker access control (PCR 11). +> +> To prevent boot manger roll-back attacks, Windows updates released on and after July 2024 changed the default PCR Validation Profile for **UEFI with Secure Boot** from `7, 11` to `4, 7, 11`. The following list identifies all of the available PCRs: diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md index d6e0f76716..b2d83e651b 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md @@ -2,7 +2,7 @@ title: BitLocker recovery process description: Learn how to obtain BitLocker recovery information for Microsoft Entra joined, Microsoft Entra hybrid joined, and Active Directory joined devices, and how to restore access to a locked drive. ms.topic: how-to -ms.date: 07/08/2024 +ms.date: 07/18/2024 --- # BitLocker recovery process @@ -72,7 +72,7 @@ The following list can be used as a template for creating a recovery process for There are a few Microsoft Entra ID roles that allow a delegated administrator to read BitLocker recovery passwords from the devices in the tenant. While it's common for organizations to use the existing Microsoft Entra ID *[Cloud Device Administrator][ENTRA-2]* or *[Helpdesk Administrator][ENTRA-3]* built-in roles, you can also [create a custom role][ENTRA-5], delegating access to BitLocker keys using the `microsoft.directory/bitlockerKeys/key/read` permission. Roles can be delegated to access BitLocker recovery passwords for devices in specific Administrative Units. > [!NOTE] -> When devices including [Windows Autopilot](/mem/autopilot/windows-autopilot) are reused to join to Entra, **and there is a new device owner**, that new device owner must contact an administrator to acquire the BitLocker recovery key for that device. Administrative unit scoped administrators will lose access to BitLocker recovery keys after device ownership changes. These scoped administrators will need to contact a non-scoped administrator for the recovery keys. For more information, see the article [Find the primary user of an Intune device](/mem/intune/remote-actions/find-primary-user#change-a-devices-primary-user). +> When devices that utilize [Windows Autopilot](/mem/autopilot/windows-autopilot) are reused to join to Entra, **and there is a new device owner**, that new device owner must contact an administrator to acquire the BitLocker recovery key for that device. Custom role or administrative unit scoped administrators will lose access to BitLocker recovery keys for those devices that have undergone device ownership changes. These scoped administrators will need to contact a non-scoped administrator for the recovery keys. For more information, see the article [Find the primary user of an Intune device](/mem/intune/remote-actions/find-primary-user#change-a-devices-primary-user). The [Microsoft Entra admin center][ENTRA] allows administrators to retrieve BitLocker recovery passwords. To learn more about the process, see [View or copy BitLocker keys][ENTRA-4]. Another option to access BitLocker recovery passwords is to use the Microsoft Graph API, which might be useful for integrated or scripted solutions. For more information about this option, see [Get bitlockerRecoveryKey][GRAPH-1]. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2016.md b/windows/whats-new/ltsc/whats-new-windows-10-2016.md index df08af61c1..315ac95603 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2016.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2016.md @@ -34,29 +34,6 @@ Windows ICD now includes simplified workflows for creating provisioning packages [Learn more about using provisioning packages in Windows 10.](/windows/configuration/provisioning-packages/provisioning-packages) -### Windows Upgrade Readiness - ->[!IMPORTANT] ->Upgrade Readiness will not allow you to assess an upgrade to an LTSC release (LTSC builds are not available as target versions). However, you can enroll devices running LTSC to plan for an upgrade to a General Availability Channel release. - -Microsoft developed Upgrade Readiness in response to demand from enterprise customers looking for more direction and details about upgrading to Windows 10. Upgrade Readiness was built taking into account multiple channels of customer feedback, testing, and Microsoft's experience upgrading millions of devices to Windows 10. - -With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they're known to Microsoft. - -Use Upgrade Readiness to get: - -- A visual workflow that guides you from pilot to production -- Detailed computer and application inventory -- Powerful computer level search and drill-downs -- Guidance and insights into application and driver compatibility issues, with suggested fixes -- Data driven application rationalization tools -- Application usage information, allowing targeted validation; workflow to track validation progress and decisions -- Data export to commonly used software deployment tools - -The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are upgrade-ready. - -[Learn more about planning and managing Windows upgrades with Windows Upgrade Readiness.](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness) - ## Security ### Credential Guard and Device Guard diff --git a/windows/whats-new/windows-11-plan.md b/windows/whats-new/windows-11-plan.md index a32a7baeb6..c3887cd926 100644 --- a/windows/whats-new/windows-11-plan.md +++ b/windows/whats-new/windows-11-plan.md @@ -1,18 +1,18 @@ --- title: Plan for Windows 11 -description: Windows 11 deployment planning, IT Pro content. +description: This article provides guidance to help you plan for Windows 11 in your organization. ms.service: windows-client author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: high -ms.topic: conceptual +ms.topic: get-started ms.collection: - highpri - tier1 - essentials-get-started ms.subservice: itpro-fundamentals -ms.date: 02/06/2024 +ms.date: 07/12/2024 appliesto: - ✅ Windows 11 --- @@ -20,98 +20,102 @@ appliesto: # Plan for Windows 11 This article provides guidance to help you plan for Windows 11 in your organization. + ## Deployment planning -Since Windows 11 is built on the same foundation as Windows 10, you can use the same deployment capabilities, scenarios, and tools—and the same basic deployment strategy that you use today for Windows 10. You'll need to review and update your servicing strategy to adjust for changes in [Servicing and support](#servicing-and-support) for Windows 11. +Since Windows 11 is built on the same foundation as Windows 10, you can use the same deployment capabilities, scenarios, and tools. You can also use the same basic deployment strategy that you use today for Windows 10. Make sure that you review and update your servicing strategy to adjust for changes in [servicing and support](#servicing-and-support) for Windows 11. At a high level, this strategy should include the following steps: + - [Create a deployment plan](/windows/deployment/update/create-deployment-plan) - [Define readiness criteria](/windows/deployment/update/plan-define-readiness) - [Evaluate infrastructure and tools](/windows/deployment/update/eval-infra-tools) -- [Determine application readiness](/windows/deployment/update/plan-determine-app-readiness) +- [Test applications](/windows/compatibility/windows-11/testing-guidelines) - [Define your servicing strategy](/windows/deployment/update/plan-define-strategy) -If you're looking for ways to optimize your approach to deploying Windows 11, or if deploying a new version of an operating system isn't a familiar process for you, some items to consider are provided below: +If you're looking for ways to optimize your approach to deploying Windows 11, or if deploying a new version of Windows isn't a familiar process for you, consider the factors in the following sections. ## Determine eligibility -As a first step, you'll need to know which of your current devices meet the Windows 11 hardware requirements. Most devices purchased in the last 18-24 months will be compatible with Windows 11. Verify that your device meets or exceeds [Windows 11 requirements](windows-11-requirements.md) to ensure it's compatible. +As a first step, determine which of your current devices meet the Windows 11 hardware requirements. To ensure compatibility, verify that your device meets or exceeds [Windows 11 requirements](windows-11-requirements.md). -Microsoft is currently developing analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. When Windows 11 reaches general availability, users running Windows 10 Home, Pro, and Pro for Workstations will be able to use the [PC Health Check](https://www.microsoft.com/windows/windows-11#pchealthcheck) app to determine their eligibility for Windows 11. Users running Windows 10 Enterprise and Education editions should rely on their IT administrators to let them know when they're eligible for the upgrade.  - -Enterprise organizations looking to evaluate device readiness in their environments can expect this capability to be integrated into existing Microsoft tools, such as Endpoint analytics and Update Compliance. This capability will be available when Windows 11 is generally available. Microsoft is also working with software publishing partners to facilitate adding Windows 11 device support into their solutions. +Microsoft has analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. If you're running Windows 10 Home, Pro, or Pro for Workstations editions, you can use the [PC Health Check](https://www.microsoft.com/windows/windows-11#pchealthcheck) app to determine Windows 11 eligibility. Users running Windows 10 Enterprise and Education editions should rely on their IT administrators to let them know when they're eligible for the upgrade. + +Enterprise organizations looking to evaluate device readiness in their environments can expect this capability to be integrated into existing Microsoft tools, such as [Endpoint analytics](/mem/analytics/). ## Windows 11 availability -The availability of Windows 11 will vary according to a device's hardware and whether the device receives updates directly, or from a management solution that is maintained by an IT administrator. +The availability of Windows 11 varies according to a device's hardware and whether the device receives updates directly from Microsoft, or from a management solution that's maintained by an IT administrator. -##### Managed devices +For more information, see [Defining Windows update-managed devices](/windows/deployment/update/update-managed-unmanaged-devices). -Managed devices are devices that are under organizational control. Managed devices include those devices managed by Microsoft Intune, Microsoft Configuration Manager, or other endpoint management solutions. +### Managed devices -If you manage devices on behalf of your organization, you'll be able to upgrade eligible devices to Windows 11 using your existing deployment and management tools at no cost when the upgrade reaches general availability. Organizations that use Windows Update for Business will have added benefits, such as: +Managed devices are devices that are under organizational control. Managed devices include those devices managed by Microsoft Intune, Microsoft Configuration Manager, or other endpoint management solutions. -- Ensuring that devices that don't meet the minimum hardware requirements aren't automatically offered the Windows 11 upgrade. -- More insight into safeguard holds. While safeguard holds will function for Windows 11 devices just as they do for Windows 10 today, administrators using Windows Update for Business will have access to information on which safeguard holds are preventing individual devices from taking the upgrade to Windows 11. +If you manage devices on behalf of your organization, you can upgrade eligible devices to Windows 11 using your existing deployment and management tools. + +Organizations that use Windows Update for Business also have the following benefits: + +- Ensuring that devices that don't meet the minimum hardware requirements aren't automatically offered the Windows 11 upgrade. +- More insight into safeguard holds. While safeguard holds function for Windows 11 devices just as they do for Windows 10 today, administrators using Windows Update for Business have access to information on which safeguard holds are preventing individual devices from taking the upgrade to Windows 11. > [!NOTE] -> Also, Windows 11 has new Microsoft Software License Terms. If you are deploying with Windows Update for Business or Windows Server Update Services, you are accepting these new license terms on behalf of the users in your organization. +> Also, Windows 11 has new Microsoft Software License Terms. If you deploy with Windows Update for Business or Windows Server Update Services, you accept these new license terms on behalf of the users in your organization. -##### Unmanaged devices +### Unmanaged devices -Unmanaged devices are devices that aren't managed by an IT administrator on behalf of an organization. For operating system (OS) deployment, these devices aren't subject to organizational policies that manage upgrades or updates. +Unmanaged devices are devices that an IT administrator doesn't manage on behalf of an organization. For OS deployment, these devices aren't subject to organizational policies that manage upgrades or updates. -Windows 11 will be offered to eligible Windows 10 devices beginning later in the 2021 calendar year. Messaging on new devices will vary by PC manufacturer, but users will see labels such as **This PC will upgrade to Windows 11 once available** on products that are available for purchase. +Windows 11 was offered to eligible Windows 10 devices in 2021. Messaging on new devices varies by PC manufacturer. -The Windows 11 upgrade will be available initially on eligible, unmanaged devices to users who manually seek the upgrade through Windows Update. As with all Windows Update managed devices, the **Windows Update Settings** page will confirm when a device is eligible, and users can upgrade if they choose to. +The Windows 11 upgrade is available on eligible, unmanaged devices to users who manually seek the upgrade through Windows Update. As with all Windows Update-managed devices, the **Windows Update** settings page confirms when a device is eligible. -Just like Windows 10, the machine learning-based [intelligent rollout](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/using-machine-learning-to-improve-the-windows-10-update/ba-p/877860) process will be used when rolling out upgrades. Machine learning uses a combination of testing, close partner engagement, feedback, diagnostic data, and real-life insights to manage quality. This process improves the update experience and ensures that devices first nominated for updates are the devices likely to have a seamless experience. Devices that might have compatibility issues with the upgrade get the benefit of resolving these issues before the upgrade is offered. +Just like Windows 10, the machine learning-based [intelligent rollout](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/using-machine-learning-to-improve-the-windows-10-update/ba-p/877860) process is used when rolling out upgrades. Machine learning uses a combination of testing, close partner engagement, feedback, diagnostic data, and real-life insights to manage quality. This process improves the update experience and ensures that devices first nominated for updates are the devices likely to have a seamless experience. Devices that might have compatibility issues with the upgrade get the benefit of resolving these issues before the upgrade is offered. -## Windows 11 readiness considerations +## Windows 11 readiness considerations -The recommended method to determine if your infrastructure, deployment processes, and management tools are ready for Windows 11 is to join the [Windows Insider Program for Business](https://insider.windows.com/for-business). As a participant in the [Release Preview Channel](/windows-insider/business/validate-Release-Preview-Channel), you can validate that your devices and applications work as expected, and explore new features. +The recommended method to determine if your infrastructure, deployment processes, and management tools are ready for Windows 11 is to join the [Windows Insider Program for Business](https://insider.windows.com/for-business). As a participant in the [release preview channel](/windows-insider/business/validate-Release-Preview-Channel), you can validate that your devices and applications work as expected, and explore new features. As you plan your endpoint management strategy for Windows 11, consider moving to cloud-based mobile device management (MDM), such as [Microsoft Intune](/mem/intune/fundamentals/what-is-intune). If a cloud-only approach isn't right for your organization yet, you can still modernize and streamline essential pieces of your endpoint management strategy as follows: -- Create a [cloud management gateway](/mem/configmgr/core/clients/manage/cmg/overview) (CMG) to manage Configuration Manager clients over the internet. -- Attach your existing Configuration Management estate to the cloud with [tenant attach](/mem/configmgr/tenant-attach/device-sync-actions) so you can manage all devices from within the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -- Use [co-management](/mem/configmgr/comanage/overview) to concurrently manage devices using both Configuration Manager and Microsoft Intune. This concurrent management allows you to take advantage of cloud-powered capabilities like [Conditional Access](/azure/active-directory/conditional-access/overview). -For more information on the benefits of these approaches, see [Cloud Attach Your Future: The Big 3](https://techcommunity.microsoft.com/t5/configuration-manager-blog/cloud-attach-your-future-part-ii-quot-the-big-3-quot/ba-p/1750664). +- To manage Configuration Manager clients over the internet, create a [cloud management gateway](/mem/configmgr/core/clients/manage/cmg/overview) (CMG). +- Attach your existing Configuration Management estate to the cloud with [tenant attach](/mem/configmgr/tenant-attach/device-sync-actions) so you can manage all devices from within the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +- Use [co-management](/mem/configmgr/comanage/overview) to concurrently manage devices using both Configuration Manager and Microsoft Intune. This concurrent management allows you to take advantage of cloud-powered capabilities like [conditional access](/azure/active-directory/conditional-access/overview). + +For more information on the benefits of these approaches, see [Cloud Attach Your Future: The Big 3](https://techcommunity.microsoft.com/t5/configuration-manager-blog/cloud-attach-your-future-part-ii-quot-the-big-3-quot/ba-p/1750664). The introduction of Windows 11 is also a good time to review your hardware refresh plans and prioritize eligible devices to ensure an optimal experience for your users. ## Servicing and support -Along with user experience and security improvements, Windows 11 introduces enhancements to Microsoft's servicing approach based on your suggestions and feedback. +Along with user experience and security improvements, Windows 11 introduces enhancements to Microsoft's servicing approach based on your suggestions and feedback. -**Quality updates**: Windows 11 and Windows 10 devices will receive regular monthly quality updates to provide security updates and bug fixes. +- **Quality updates**: Windows 11 and Windows 10 devices receive regular monthly quality updates to provide security updates and bug fixes. -**Feature updates**: Microsoft will provide a single Windows 11 feature update annually, targeted for release in the second half of each calendar year. +- **Feature updates**: Microsoft provides a single Windows 11 feature update annually, targeted for release in the second half of each calendar year. -**Lifecycle**: -- Home, Pro, Pro for Workstations, and Pro for Education editions of Windows 11 will receive 24 months of support from the general availability date. -- Enterprise and Education editions of Windows 11 will be supported for 36 months from the general availability date. +- **Lifecycle**: -When Windows 11 reaches general availability, a consolidated [Windows 11 update history](https://support.microsoft.com/topic/59875222-b990-4bd9-932f-91a5954de434) is available, similar to what is [available today for Windows 10](https://support.microsoft.com/topic/windows-10-update-history-1b6aac92-bf01-42b5-b158-f80c6d93eb11). Similarly, the [Windows release health](/windows/release-health/) hub will offer quick access to Windows 11 servicing announcements, known issues, and safeguard holds. + - Home, Pro, Pro for Workstations, and Pro for Education editions of Windows 11 receive 24 months of support from the general availability date. + - Enterprise and Education editions of Windows 11 are supported for 36 months from the general availability date. -It's important that organizations have adequate time to plan for Windows 11. Microsoft also recognizes that many organizations will have a mix of Windows 11 and Windows 10 devices across their ecosystem. Devices on in-service versions of Windows 10 will continue to receive monthly Windows 10 security updates through 2025, and incremental improvements to Windows 10 to support ongoing Microsoft 365 deployments. For more information, see the [Windows 10 release information](/windows/release-health/release-information) page, which offers information about the Windows 10 General Availability Channel and Long-term Servicing Channel (LTSC) releases. +A consolidated [Windows 11 update history](https://support.microsoft.com/topic/59875222-b990-4bd9-932f-91a5954de434) is available. Similarly, the [Windows release health](/windows/release-health/) hub offers quick access to Windows 11 servicing announcements, known issues, and safeguard holds. + +It's important that organizations have adequate time to plan for Windows 11. Microsoft also recognizes that many organizations have a mix of Windows 11 and Windows 10 devices across their ecosystem. Devices on in-service versions of Windows 10 continue to receive monthly Windows 10 security updates, and incremental improvements to Windows 10 to support ongoing Microsoft 365 deployments. For more information, see the [Windows 10 release information](/windows/release-health/release-information) page. ## Application compatibility Microsoft's compatibility promise for Windows 10 is maintained for Windows 11. Data from the App Assure program shows that Windows 10 compatibility rates are over 99.7% for enterprise organizations, including line of business (LOB) apps. Microsoft remains committed to ensuring that the apps you rely upon continue to work as expected when you upgrade. Windows 11 is subject to the same app compatibility validation requirements that are in place for Windows 10 today, for both feature and quality updates. -#### App Assure +For more information, see [Windows compatibility cookbook](/windows/compatibility/). -If you run into compatibility issues or want to ensure that your organization's applications are compatible from day one, App Assure can help. +### App Assure -- **App Assure**: With enrollment in the [App Assure](/windows/compatibility/app-assure) service, any app compatibility issues that you find with Windows 11 can be resolved. Microsoft will help you remedy application issues at no cost. Since 2018, App Assure has evaluated almost 800,000 apps, and subscriptions are free for eligible customers with 150+ seats. - -You might already be using App Assure in your Windows 10 environment. The tool will continue to function with Windows 11. +If you run into compatibility issues or want to ensure that your organization's applications are compatible from day one, App Assure can help. With enrollment in the [App Assure](/windows/compatibility/app-assure) service, any app compatibility issues that you find with Windows 11 can be resolved. Microsoft helps you remedy application issues at no cost. Since 2018, App Assure has evaluated almost 800,000 apps, and subscriptions are free for eligible customers with more than 150 devices. ## Next steps [Prepare for Windows 11](windows-11-prepare.md) -## Also see - [Plan to deploy updates for Windows 10 and Microsoft 365 Apps](/training/modules/windows-plan/) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index e5852e8ce3..a26ceffb43 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -1,17 +1,17 @@ --- title: Prepare for Windows 11 -description: Prepare your infrastructure and tools to deploy Windows 11, IT Pro content. +description: Prepare your infrastructure and tools to deploy Windows 11. ms.service: windows-client author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: high -ms.topic: conceptual +ms.topic: concept-article ms.collection: - highpri - tier1 ms.subservice: itpro-fundamentals -ms.date: 12/31/2017 +ms.date: 07/16/2024 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -21,87 +21,89 @@ appliesto: Windows 10 and Windows 11 are designed to coexist so that you can use the same familiar tools and processes to manage both operating systems. Using a single management infrastructure that supports common applications across both Windows 10 and Windows 11 helps to simplify the migration process. You can analyze endpoints, determine application compatibility, and manage Windows 11 deployments in the same way that you do with Windows 10. -After you evaluate your hardware to see if it meets [requirements](windows-11-requirements.md) for Windows 11, it's a good time to review your deployment infrastructure, tools, and overall endpoint and update management processes and look for opportunities to simplify and optimize. This article provides some helpful guidance to accomplish these tasks. +After you evaluate your hardware to see if it meets [requirements](windows-11-requirements.md) for Windows 11, it's a good time to review your deployment infrastructure, tools, and overall endpoint and update management processes. Use this review time to look for opportunities to simplify and optimize. This article provides some helpful guidance to accomplish these tasks. ## Infrastructure and tools -The tools that you use for core workloads during Windows 10 deployments can still be used for Windows 11. A few nuanced differences are described below. +The tools that you use for core workloads during Windows 10 deployments can still be used for Windows 11. - > [!IMPORTANT] - > Be sure to check with the providers of any non-Microsoft solutions that you use. Verify compatibility of these tools with Windows 11, particularly if they provide security or data loss prevention capabilities. +> [!IMPORTANT] +> Be sure to check with the providers of any non-Microsoft solutions that you use. Verify compatibility of these tools with Windows 11, particularly if they provide security or data loss prevention capabilities. -#### On-premises solutions +### On-premises solutions -- If you use [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you'll need to sync the new Windows 11 product category. After you sync the product category, you'll see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. +- If you use [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you need to sync the Windows 11 product category. After you sync the product category, you'll see Windows 11 offered as an option. If you want to validate Windows 11 builds before their broad release, you can also sync the **Windows Insider Pre-release** category. > [!NOTE] - > During deployment, you will be prompted to agree to the Microsoft Software License Terms on behalf of your users. Additionally, you will not see an x86 option because Windows 11 is not supported on 32-bit architecture. + > During deployment, you'll be prompted to agree to the Microsoft Software License Terms on behalf of your users. Additionally, you won't see an x86 option because Windows 11 isn't supported on 32-bit architecture. -- If you use [Microsoft Configuration Manager](/mem/configmgr/), you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. +- If you use [Microsoft Configuration Manager](/mem/configmgr/), you can sync the **Windows 11** product category and begin upgrading eligible devices. If you want to validate Windows 11 builds before their broad release, you can also sync the **Windows Insider Pre-release** category. > [!NOTE] - > Configuration Manager will prompt you to accept the Microsoft Software License Terms on behalf of the users in your organization. + > Configuration Manager will prompt you to accept the Microsoft Software License Terms on behalf of the users in your organization. -#### Cloud-based solutions +### Cloud-based solutions -- If you use Windows Update for Business policies, you'll need to use the **Target Version** capability (either through policy or the Windows Update for Business deployment service) rather than using feature update deferrals alone to upgrade from Windows 10 to Windows 11. Feature update deferrals are great for moving to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but won't automatically move devices between products (Windows 10 to **Windows 11**). - - If you use Microsoft Intune and have a Microsoft 365 E3 license, you'll be able to use the [feature update deployments](/mem/intune/protect/windows-10-feature-updates) page to select **Windows 11, version 21H2** and upgrade Windows 10 devices to Windows 11. You can also continue using the same update experience controls to manage Windows 10 and Windows 11 on the **Update Rings** page in Intune. If you aren’t ready to move to Windows 11, keep the feature update version set at the version you're currently on. When you're ready to start upgrading devices, change the feature update deployment setting to specify Windows 11. - - In Group Policy, **Select target Feature Update version** has two entry fields after taking the 9/1/2021 optional update ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)) or a later update: **Product Version** and **Target Version**. +- If you use [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb) policies, you need to use the **Target Version** capability. This option is either through policy or the Windows Update for Business deployment service. You need to use this option instead of only using feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great for moving to newer versions of your current product. For example, Windows 10, version 21H2 to version 22H2. They don't automatically move devices between products, for example Windows 10 to Windows 11. - - The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only the target version field is configured, the device will be offered matching versions of the same product. - - For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version Windows 10, version 21H1, even if multiple products have a 21H1 version. -- Quality update deferrals will continue to work the same across both Windows 10 and Windows 11, which is true regardless of which management tool you use to configure Windows Update for Business policies. -- If you use Microsoft Intune and have a Microsoft 365 E3 license, you'll be able to use [feature update deployments](/mem/intune/protect/windows-10-feature-updates) to easily update devices from one release of Windows 10 to another, or to upgrade Windows 10 devices to Windows 11. You can also continue using the same update experience controls to manage Windows 10 and Windows 11. If you aren’t ready to move to Windows 11, keep the feature update version set at the version you're currently on. When you're ready to start upgrading devices, change the feature update deployment setting to specify **Windows 11**. + - If you use [Microsoft Intune](/mem/intune/) and have a Microsoft 365 E3 license, use the [feature update deployments](/mem/intune/protect/windows-10-feature-updates) page to select the latest version of Windows 11 and upgrade Windows 10 devices to Windows 11. You can also continue using the same update experience controls to manage Windows 10 and Windows 11 on the **Update Rings** page in Intune. If you aren't ready to move to Windows 11, keep the feature update version set at the version you're currently on. When you're ready to start upgrading devices, change the feature update deployment setting to specify Windows 11. + + - In group policy, **Select target Feature Update version** has two entry fields: **Product Version** and **Target Version**. + + - The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only the target version field is configured, the service offers the device matching versions of the same product. + +- Quality update deferrals continue to work the same across both Windows 10 and Windows 11. This behavior is true regardless of which management tool you use to configure Windows Update for Business policies. > [!NOTE] - > Endpoints managed by Windows Update for Business will not automatically upgrade to Windows 11 unless an administrator explicitly configures a **Target Version** using the [TargetReleaseVersion](/windows/client-management/mdm/policy-csp-update#update-targetreleaseversion) setting using a Windows CSP, a [feature update profile](/mem/intune/protect/windows-10-feature-updates) in Intune, or the [Select target Feature Update version setting](/windows/deployment/update/waas-wufb-group-policy#i-want-to-stay-on-a-specific-version) in a group policy. + > Endpoints managed by Windows Update for Business don't automatically upgrade to Windows 11 unless an administrator explicitly configures a **Target Version** using the [TargetReleaseVersion](/windows/client-management/mdm/policy-csp-update#update-targetreleaseversion) setting using a Windows CSP, a [feature update profile](/mem/intune/protect/windows-10-feature-updates) in Intune, or the [Select target Feature Update version setting](/windows/deployment/update/waas-wufb-group-policy#i-want-to-stay-on-a-specific-version) group policy. ## Cloud-based management -If you aren’t already taking advantage of cloud-based management capabilities, like those available in the [Microsoft Intune family of products](/mem/endpoint-manager-overview), it's worth considering. In addition to consolidating device management and endpoint security into a single platform, Microsoft Intune can better support the diverse bring-your-own-device (BYOD) ecosystem that is increasingly the norm with hybrid work scenarios. It can also enable you to track your progress against compliance and business objectives while protecting user privacy. +The cloud-based management capabilities of the [Microsoft Intune family of products](/mem/endpoint-manager-overview) help consolidate device management and endpoint security into a single platform. Microsoft Intune also supports the diverse bring-your-own-device (BYOD) ecosystem that's common with hybrid work scenarios. It can also enable you to track your progress against compliance and business objectives while protecting user data. -The following are some common use cases and the corresponding [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) capabilities that support them: +The following are some common use cases and the corresponding [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) capabilities that support them: -- **Provision and pre-configure new Windows 11 devices**: [Windows Autopilot](/mem/autopilot/windows-autopilot) enables you to deploy new Windows 11 devices in a “business-ready” state that includes your desired applications, settings, and policies. It can also be used to change the edition of Windows. For example, you can upgrade from Professional to Enterprise edition and gain the use of advanced features. The [Windows Autopilot diagnostics page](/mem/autopilot/windows-autopilot-whats-new#preview-windows-autopilot-diagnostics-page) is a new feature that is available when you use in Windows Autopilot to deploy Windows 11. -- **Configure rules and control settings for users, apps, and devices**: When you enroll devices in [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), administrators have full control over apps, settings, features, and security for both Windows 11 and Windows 10. You can also use app protection policies to require multifactor authentication (MFA) for specific apps. -- **Streamline device management for frontline, remote, and onsite workers**: Introduced with Windows 10, [cloud configuration](/mem/intune/fundamentals/cloud-configuration) is a standard, easy-to-manage, device configuration that is cloud-optimized for users with specific workflow needs. It can be deployed to devices running the Pro, Enterprise, and Education editions of Windows 11 by using Microsoft Intune. +- **Provision and pre-configure new Windows 11 devices**: [Windows Autopilot](/autopilot/) enables you to deploy new Windows 11 devices in a business-ready state that includes your desired applications, settings, and policies. It can also be used to change the edition of Windows. For example, you can upgrade from Professional to Enterprise edition and gain the use of advanced features. -If you're exclusively using an on-premises device management solution (for example, Configuration Manager), you can still use the [cloud management gateway](/mem/configmgr/core/clients/manage/cmg/overview), enable [tenant attach](/mem/configmgr/tenant-attach/device-sync-actions), or enable [co-management](/mem/configmgr/comanage/overview) with Microsoft Intune. These solutions can make it easier to keep devices secure and up-to-date. +- **Configure rules and control settings for users, apps, and devices**: When you enroll devices in Microsoft Intune, you have full control over apps, settings, features, and security for both Windows 11 and Windows 10. You can also use app protection policies to require multifactor authentication (MFA) for specific apps. + +- **Streamline device management for frontline, remote, and onsite workers**: [Cloud configuration](/mem/intune/fundamentals/cloud-configuration) is a standard, easy-to-manage, device configuration that is cloud-optimized for users with specific workflow needs. You can use Microsoft Intune to deploy it to devices running the Pro, Enterprise, and Education editions of Windows 11. + +If you're exclusively using an on-premises device management solution like Configuration Manager, you can still use the [cloud management gateway](/mem/configmgr/core/clients/manage/cmg/overview), enable [tenant attach](/mem/configmgr/tenant-attach/device-sync-actions), or enable [co-management](/mem/configmgr/comanage/overview) with Microsoft Intune. These solutions can make it easier to keep devices secure and up-to-date. ## Review servicing approach and policies -Every organization will transition to Windows 11 at its own pace. Microsoft is committed to supporting you through your migration to Windows 11, whether you're a fast adopter or will make the transition over the coming months or years. +Every organization transitions to Windows 11 at its own pace. Microsoft is committed to supporting you through your migration to Windows 11, whether you're a fast adopter or will make the transition over the coming months or years. -When you think of operating system updates as an ongoing process, you'll automatically improve your ability to deploy updates. This approach enables you to stay current with less effort, and less impact on productivity. To begin, think about how you roll out Windows feature updates today: which devices, and at what pace. +When you think of OS updates as an ongoing process, you improve your ability to deploy updates. This approach enables you to stay current with less effort, and less effect on productivity. To begin, think about how you roll out Windows feature updates today: which devices, and at what pace. -Next, craft a deployment plan for **Windows 11** that includes deployment groups, rings, users, or devices. There are no absolute rules for exactly how many rings to have for your deployments, but a common structure is: -- Preview (first or canary): Planning and development -- Limited (fast or early adopters): Pilot and validation -- Broad (users or critical): Wide deployment +Next, craft a deployment plan for Windows 11 that includes deployment groups, rings, users, or devices. There are no absolute rules for exactly how many rings to have for your deployments, but the following example is a common structure: -For detailed information, see [Create a deployment plan](/windows/deployment/update/create-deployment-plan). +- Preview (first or canary): Planning and development +- Limited (fast or early adopters): Pilot and validation +- Broad (users or critical): Wide deployment -#### Review policies +For more information, see [Create a deployment plan](/windows/deployment/update/create-deployment-plan). -Review deployment-related policies, taking into consideration your organization's security objectives, update compliance deadlines, and device activity. Apply changes where you can gain a clear improvement, particularly regarding the speed of the update process or security. +### Review policies -#### Validate apps and infrastructure +Review deployment-related policies, and take into consideration your organization's security objectives, update compliance deadlines, and device activity. Apply changes where you can gain a clear improvement, particularly regarding the speed of the update process or security. -To validate that your apps, infrastructure, and deployment processes are ready for Windows 11, join the [Windows Insider Program for Business](https://insider.windows.com/for-business-getting-started), and opt into the [Release Preview Channel](/windows-insider/business/validate-Release-Preview-Channel). +### Validate apps and infrastructure -If you use [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you can deploy directly from the Windows Insider Pre-release category using one of the following processes: +To validate that your apps, infrastructure, and deployment processes are ready for Windows 11, join the [Windows Insider Program for Business](https://insider.windows.com/for-business-getting-started). Then opt into the [Release Preview Channel](/windows-insider/business/validate-Release-Preview-Channel). -- Set **Manage Preview Builds** to **Release Preview** in Windows Update for Business. -- Use Azure Virtual Desktop and Azure Marketplace images. -- Download and deploy ISOs from Microsoft’s Windows Insider Program ISO Download page. +If you use [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you can deploy directly from the Windows Insider Prerelease category using one of the following processes: -Regardless of the method you choose, you have the benefit of free Microsoft support when validating pre-release builds. Free support is available to any commercial customer deploying Windows 10 or Windows 11 Preview Builds, once they become available through the Windows Insider Program. +- Set **Manage Preview Builds** to **Release Preview** in Windows Update for Business. +- Use Azure Virtual Desktop and Azure Marketplace images. +- Download and deploy ISOs from Microsoft's Windows Insider Program ISO download page. -#### Analytics and assessment tools +Regardless of the method you choose, you have the benefit of free Microsoft support when validating prerelease builds. Free support is available to any commercial customer deploying Windows 10 or Windows 11 Preview Builds, once they become available through the Windows Insider Program. -If you use Microsoft Intune and have onboarded devices to Endpoint analytics, you'll have access to a hardware readiness assessment later this year. This tool enables you to quickly identify which of your managed devices are eligible for the Windows 11 upgrade. +### Analytics and assessment tools -[Desktop Analytics](/mem/configmgr/desktop-analytics/overview) doesn't support Windows 11. You must use [Endpoint analytics](/mem/analytics/overview). +If you use Microsoft Intune and have onboarded devices to [Endpoint analytics](/mem/analytics/overview), you have access to a hardware readiness assessment. This tool enables you to quickly identify which of your managed devices are eligible for the Windows 11 upgrade. ## Prepare a pilot deployment @@ -119,19 +121,18 @@ At a high level, the tasks involved are: ## User readiness -Don't overlook the importance of user readiness to deliver an effective, enterprise-wide deployment of Windows 11. Windows 11 has a familiar design, but your users will see several enhancements to the overall user interface. They'll also need to adapt to changes in menus and settings pages. Therefore, consider the following tasks to prepare users and your IT support staff for Windows 11: +Don't overlook the importance of user readiness to deliver an effective, enterprise-wide deployment of Windows 11. Windows 11 has a familiar design, but your users will see several enhancements to the overall user interface. They'll also need to adapt to changes in menus and settings pages. Therefore, consider the following tasks to prepare users and IT support staff for Windows 11: - Create a communications schedule to ensure that you provide the right message at the right time to the right groups of users, based on when they'll see the changes. - Draft concise emails that inform users of what changes they can expect to see. Offer tips on how to use or customize their experience. Include information about support and help desk options. - Update help desk manuals with screenshots of the new user interface, the out-of-box experience for new devices, and the upgrade experience for existing devices. -## Learn more - -See the [Stay current with Windows 10 and Microsoft 365 Apps](/training/paths/m365-stay-current/) learning path. - -- The learning path was created for Windows 10, but the basic principles and tasks outlined for the plan, prepare, and deploy phases also apply to your deployment of Windows 11. +For more information and resources, see the [Meet Windows 11](https://support.microsoft.com/meetwindows11) video series. ## See also -[Plan for Windows 11](windows-11-plan.md)
-[Windows help & learning](https://support.microsoft.com/windows) +[Stay current with Windows devices and Microsoft 365 Apps](/training/paths/m365-stay-current/) + +[Plan for Windows 11](windows-11-plan.md) + +[Windows help & learning for users](https://support.microsoft.com/windows)