Merge pull request #6847 from MicrosoftDocs/main

Merge main to live on 7/26 @ 10:30 am

.openpublishing.redirection.json

@@ -19584,6 +19584,11 @@
       "source_path": "smb/index.md",
       "redirect_url": "https://techcommunity.microsoft.com/t5/small-and-medium-business-blog/bg-p/Microsoft365BusinessBlog",
       "redirect_document_id": false
+     },
+     {
+      "source_path": "windows/whats-new/contribute-to-a-topic.md",
+      "redirect_url": "https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/CONTRIBUTING.md#editing-windows-it-professional-documentation",
+      "redirect_document_id": false
      }
   ]
 }

education/windows/TOC.yml

@@ -65,6 +65,8 @@
       href: s-mode-switch-to-edu.md
     - name: Change to Windows 10 Pro Education from Windows 10 Pro
       href: change-to-pro-education.md
+    - name: Upgrade Windows Home to Windows Education on student-owned devices
+      href: change-home-to-edu.md
     - name: Chromebook migration guide
       href: chromebook-migration-guide.md
     - name: Change history for Windows 10 for Education

education/windows/change-home-to-edu.md

@@ -0,0 +1,229 @@
+---
+title: Upgrade Windows Home to Windows Education on student-owned devices
+description: Learn how IT Pros can upgrade student-owned devices from Windows Home to Windows Education using Mobile Device Management or Kivuto OnTheHub with qualifying subscriptions.
+ms.date: 07/05/2021
+ms.prod: windows
+ms.technology: windows
+ms.topic: how-to
+ms.localizationpriority: medium
+author: scottbreenmsft
+ms.author: scbree
+ms.reviewer: paoloma
+manager: jeffbu
+ms.collection: highpri
+---
+
+# Upgrade Windows Home to Windows Education on student-owned devices
+
+## Overview
+
+Customers with qualifying subscriptions can upgrade student-owned and institution-owned devices from *Windows Home* to *Windows Education*, which is designed for both the classroom and remote learning. 
+
+> [!NOTE]
+> To be qualified for this process, customers must have a Windows Education subscription that includes the student use benefit and must have access to the Volume Licensing Service Center (VLSC) or the Microsoft 365 Admin Center.
+
+IT admins can upgrade student devices using a multiple activation key (MAK) manually or through Mobile Device Management (MDM). Alternatively, IT admins can set up a portal through [Kivuto OnTheHub](http://onthehub.com) where students can request a *Windows Pro Education* product key. The table below provides the recommended method depending on the scenario.
+
+| Method | Product key source | Device ownership | Best for |
+|-|-|-|-|
+| MDM | VLSC | Personal (student-owned) | IT admin initiated via MDM |
+| Kivuto | Kivuto | Personal (student-owned) | Initiated on device by student, parent or guardian |
+| Provisioning package | VLSC | Personal (student-owned) or Corporate (institution-owned) | IT admin initiated at first boot |
+
+These methods apply to devices with *Windows Home* installed; institution-owned devices can be upgraded from *Windows Professional* or *Windows Pro Edu* to *Windows Education* or *Windows Enterprise* using [Windows 10/11 Subscription Activation](/windows/deployment/windows-10-subscription-activation).
+
+## User Notifications
+
+Users aren't notified their device has been or will be upgraded to Windows Education when using MDM. It's the responsibility of the institution to notify their users. Institutions should notify their users that MDM will initiate an upgrade to Windows Education and this upgrade will give the institution extra capabilities, such as installing applications.
+
+Device users can disconnect from MDM in the Settings app, to prevent further actions from being taken on their personal device. For instructions on disconnecting from MDM, see [Remove your Windows device from management](/mem/intune/user-help/unenroll-your-device-from-intune-windows).
+
+## Why upgrade student-owned devices from Windows Home to Windows Education?
+
+Some school institutions want to streamline student onboarding for student-owned devices using MDM. Typical MDM requirements include installing certificates, configuring WiFi profiles and installing applications. On Windows, MDM uses Configuration Service Providers (CSPs) to configure settings. Some CSPs aren't available on Windows Home, which can limit the capabilities. Some of the CSPs not available in Windows Home that can affect typical student onboarding are:
+
+- [EnterpriseDesktopAppManagement](/windows/client-management/mdm/enterprisemodernappmanagement-csp) - which enables deployment of Windows installer or Win32 applications.
+- [DeliveryOptimization](/windows/client-management/mdm/policy-csp-deliveryoptimization) - which enables configuration of Delivery Optimization.
+
+A full list of CSPs are available at [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). For more information about enrolling devices into Microsoft Intune, see [Deployment guide: Enroll Windows devices in Microsoft Intune](/mem/intune/fundamentals/deployment-guide-enrollment-windows).
+
+## Requirements for using a MAK to upgrade from Windows Home to Windows Education
+
+- Access to Volume Licensing Service Center (VLSC) or the Microsoft 365 Admin Center.
+- A qualifying Windows subscription such as:
+  - Windows A3, or;
+  - Windows A5.
+- A pre-installed and activated instance of Windows 10 Home or Windows 11 Home.
+
+You can find more information in the [Microsoft Product Terms](https://www.microsoft.com/licensing/terms/productoffering).
+
+## How the upgrade process works
+
+IT admins with access to the VLSC or the Microsoft 365 Admin Center, can find their MAK for Windows Education and trigger an upgrade using Mobile Device Management or manually on devices.
+
+> [!WARNING]
+> The MAK is highly sensitive and should always be protected. Only authorized staff should be given access to the key and it should never be distributed to students or broadly to your organization in documentation or emails.
+
+### Recommended methods for using a MAK
+
+It's critical that MAKs are protected whenever they're used. The following processes provide the best protection for a MAK being applied to a device:
+
+- Provisioning package by institution approved staff;
+- Manual entry by institution approved staff (don't distribute the key via email);
+- Mobile Device Management (like Microsoft Intune) via [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp);
+    > [!IMPORTANT]
+    > If you are using a Mobile Device Management product other than Microsoft Intune, ensure the key isn't accessible by students.
+- Operating System Deployment processes with tools such as Microsoft Deployment Toolkit or Microsoft Endpoint Configuration Manager.
+
+For a full list of methods to perform a Windows edition upgrade and more details, see [Windows 10 edition upgrade](/windows/deployment/upgrade/windows-10-edition-upgrades).
+
+## Downgrading, resetting, reinstalling and graduation rights
+
+After upgrading from *Windows Home* to *Windows Education* there are some considerations for what happens during downgrade, reset or reinstall of the operating system.
+
+The table below highlights the differences by upgrade product key type:
+
+| Product Key Type | Downgrade (in-place) | Reset | Student reinstall |
+|-|-|-|-|
+| VLSC | No | Yes | No |
+| Kivuto OnTheHub | No | Yes | Yes |
+
+### Downgrade
+
+It isn't possible to downgrade to *Windows Home* from *Windows Education* without reinstalling Windows.
+
+### Reset
+
+If the computer is reset, Windows Education will be retained. 
+
+### Reinstall
+
+The Education upgrade doesn't apply to reinstalling Windows. Use the original Windows edition when reinstalling Windows. The original product key or [firmware-embedded product key](#what-is-a-firmware-embedded-activation-key) will be used to activate Windows.
+
+If students require a *Windows Pro Education* key that can work on a new install of Windows, they should use [Kivuto OnTheHub](http://onthehub.com) to request a key prior to graduation.
+
+For details on product keys and reinstalling Windows, see [Find your Windows product key](https://support.microsoft.com/windows/find-your-windows-product-key-aaa2bf69-7b2b-9f13-f581-a806abf0a886).
+
+### Resale
+
+The license will remain installed on the device if resold and the same conditions above apply for downgrade, reset or reinstall.
+
+## Step by step process for customers to upgrade student-owned devices using Microsoft Intune
+
+These steps provide instructions on how to use Microsoft Intune to upgrade devices from Home to Education. 
+
+### Step 1: Create a Windows Home edition filter
+
+These steps configure a filter that will only apply to devices running the *Windows Home edition*. This filter will ensure only devices running *Windows Home edition* are upgraded. For more information about filters, see [Create filters in Microsoft Intune](/mem/intune/fundamentals/filters).
+
+- Start in the [**Microsoft Endpoint Manager admin console**](https://endpoint.microsoft.com)
+- Select **Tenant administration** > **Filters**
+- Select **Create**
+  - Specify a name for the filter (for example *Windows Home edition*)
+  - Select the **platform** as **Windows 10 and later**
+  - Select **Next**
+- On the **Rules** screen, configure the following rules:
+  - **operatingSystemSKU** equals **Core (Windows 10/11 Home (101))**
+    - OR
+  - **operatingSystemSKU** equals **CoreN (Windows 10/11 Home N (98))**
+    - OR
+  - **operatingSystemSKU** equals **CoreSingleLanguage (Windows 10/11 Home single language (100))**
+
+    > [!NOTE]
+    > Ensure you've selected OR as the operator in the right And/Or column
+    
+    :::image type="content" source="images/change-home-to-edu-windows-home-edition-intune-filter.png" alt-text="Example of configuring the Windows Home filter":::
+
+- Optionally select scope tags as required
+- Save the filter by selecting **Create**
+
+### Step 2: Create a Windows edition upgrade policy
+
+These steps create and assign a Windows edition upgrade policy. For more information, see [Windows 10/11 device settings to upgrade editions or enable S mode in Intune](/mem/intune/configuration/edition-upgrade-windows-settings).
+
+- Start in the [**Microsoft Endpoint Manager admin console**](https://endpoint.microsoft.com)
+- Select **Devices** > **Configuration profiles**
+- Select **Create profile**
+  - Select the **Platform** as **Windows 10 or later**
+  - Select the **Profile type** as **Templates**
+  - Select the **Template** as **Edition upgrade and mode switch**
+  - Select **Create**
+- Specify a name for the policy (for example *Windows Education edition upgrade*), select **Next**
+- On the **Configuration settings** screen
+  - Expand **Edition Upgrade**
+  - Change **Edition to upgrade** to **Windows 10/11 Education**
+  - In the **Product Key**, enter your *Windows 10/11 Education MAK*
+  - Select **Next**
+  
+    :::image type="content" source="images/change-home-to-edu-windows-edition-upgrade-policy.png" alt-text="Example of configuring the Windows upgrade policy in Microsoft Intune":::
+
+- Optionally select scope tags as required and select **Next**
+- On the **assignments** screen;
+  - Select **Add all devices**
+  - Next to **All devices**, select **Edit filter**
+  
+      > [!NOTE]
+      > You can also target other security groups that contain a smaller scope of users or devices and apply the filter rather than All devices.
+
+  - Select to **Include filtered devices in assignment**
+  - Select the *Windows Home edition* filter you created earlier
+  - Choose **Select** to save the filter selection
+  - Select **Next** to progress to the next screen
+- Don't configure any applicability rules and select **next**
+- Review your settings and select **Create**
+
+The edition upgrade policy will now apply to all existing and new Windows Home edition devices targeted.
+
+### Step 3: Report on device edition
+
+You can check the Windows versions of managed devices in the Microsoft Endpoint Manager admin console.
+
+- Start in the **Microsoft Endpoint Manager admin console**
+- Select **Devices** > **Windows**
+- Select the **Columns** button
+- Select **Sku Family**
+- Select **Export**
+- Select **Only include the selected columns in the exported file** and select **Yes**
+- Open the file in Excel and filter on the Sku Family column to identify which devices are running the Home SKU
+
+## Frequently asked questions (FAQ)
+
+### My MAK key has run out of activations, how do I request a new one?
+
+Increases to MAK Activation quantity can be requested by contacting [VLSC support](/licensing/contact-us) and may be granted by exception. A request can be made by accounts with the VLSC Administrator, Key Administrator, or Key Viewer permissions. The request should include the following information:
+
+- Agreement/Enrollment Number or License ID and Authorization.
+- Product Name (includes version and edition).
+- Last five characters of the product key.
+- The number of host activations required.
+- Business Justification or Reason for Deployment.
+
+### What is a firmware-embedded activation key?
+
+A firmware-embedded activation key is a Windows product key that is installed into the firmware of your device. The embedded key makes it easier to install and activate Windows. To determine if the computer has a firmware-embedded activation key, type the following command at an elevated Windows PowerShell prompt:
+
+```powershell
+(Get-CimInstance -query 'select * from SoftwareLicensingService').OA3xOriginalProductKey
+```
+
+If the device has a firmware-embedded activation key, it will be displayed in the output. Otherwise, the device doesn't have a firmware embedded activation key. Most OEM-provided devices designed to run Windows 8 or later will have a firmware-embedded key.
+
+A firmware embedded key is only required to upgrade using Subscription Activation, a MAK upgrade doesn't require the firmware embedded key.
+
+### What is a multiple activation key and how does it differ from using KMS, Active Directory based activation or Subscription Activation?
+
+A multiple activation key activates either individual computers or a group of computers by connecting directly to servers over the internet or by telephone. KMS, Active Directory based activation and subscription activation are bulk activation methods that work based on network proximity or joining to Active Directory or Azure Active Directory. The table below shows which methods can be used for each scenario.
+
+| Scenario | Ownership | MAK | KMS | AD based activation | Subscription Activation |
+|-|-|:-:|:-:|:-:|:-:|
+| **Workplace join (add work or school account)** | Personal (or student-owned) | X | | | |
+| **Azure AD Join** | Organization | X | X | | X |
+| **Hybrid Azure AD Join** | Organization | X | X | X | X |
+
+## Related links
+
+- [Windows 10 edition upgrade (Windows 10)](/windows/deployment/upgrade/windows-10-edition-upgrades)
+- [Windows 10/11 Subscription Activation](/windows/deployment/windows-10-subscription-activation)
+- [Equip Your Students with Windows 11 Education - Kivuto](https://kivuto.com/windows-11-student-use-benefit/)
+- [Upgrade Windows Home to Windows Pro (microsoft.com)](https://support.microsoft.com/windows/upgrade-windows-home-to-windows-pro-ef34d520-e73f-3198-c525-d1a218cc2818)
+- [Partner Center: Upgrade Education customers from Windows 10 Home to Windows 10 Education](/partner-center/upgrade-windows-to-education)

windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml

@@ -79,8 +79,6 @@ sections:
           - Microsoft 365 Apps for enterprise updates: All devices registered for Windows Autopatch will receive updates from the Monthly Enterprise Channel.
           - Microsoft Edge: Windows Autopatch configures eligible devices to benefit from Microsoft Edge's progressive rollouts on the Stable channel and will provide support for issues with Microsoft Edge updates.
           - Microsoft Teams: Windows Autopatch allows eligible devices to benefit from the standard automatic update channels and will provide support for issues with Teams updates.
-      - question: What does Windows Autopatch do to ensure updates are done successfully?
-        answer: For information about the Microsoft Admin Center, see [Manage third-party app subscriptions for your organization](/microsoft-365/commerce/manage-saas-apps).
       - question: What does Windows Autopatch do to ensure updates are done successfully?
         answer: |
           For Windows quality updates, updates are applied to device in the Test ring first. The devices are evaluated, and then rolled out to the First, Fast then Broad rings. There's an evaluation period at each progression. This process is dependent on customer testing and verification of all updates during these rollout stages. The outcome is to ensure that registered devices are always up to date and disruption to business operations is minimized to free up your IT department from that ongoing task.

windows/security/information-protection/secure-the-windows-10-boot-process.md

@@ -85,7 +85,23 @@ These requirements help protect you from rootkits while allowing you to run any
 
 To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software can't change the Secure Boot settings.
 
-Like most mobile devices, ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot can't be turned off, and you can't load a different OS. Fortunately, there's a large market of ARM processor devices designed to run other operating systems.
+The default state of Secure Boot has a wide circle of trust which can result in customers trusting boot components they may not need. Since the Microsoft 3rd Party UEFI CA certificate signs the bootloaders for all Linux distributions, trusting the Microsoft 3rd Party UEFI CA signature in the UEFI database  increase  s the attack surface of systems. A customer who intended to only trust and boot a single Linux distribution will trust all distributions – much more than their desired configuration. A vulnerability in any of the bootloaders exposes the system and places the customer at risk of exploit for a bootloader they never intended to use, as seen in recent vulnerabilities, for example [with the GRUB bootloader](https://msrc.microsoft.com/security-guidance/advisory/ADV200011) or [firmware-level rootkit]( https://www.darkreading.com/threat-intelligence/researchers-uncover-dangerous-new-firmware-level-rootkit) affecting boot components. [Secured-core PCs](/windows-hardware/design/device-experiences/OEM-highly-secure-11) require Secure Boot to be enabled and configured to distrust the Microsoft 3rd Party UEFI CA signature, by default, to provide customers with the most secure configuration of their PCs possible. 
+
+To trust and boot operating systems, like Linux, and components signed by the UEFI signature, Secured-core PCs can be configured in the BIOS menu to add the signature in the UEFI database by following these steps:
+
+1. Open the firmware menu, either: 
+  
+  - Boot the PC, and press the manufacturer’s key to open the menus. Common keys used: Esc, Delete, F1, F2, F10, F11, or F12. On tablets, common buttons are Volume up or Volume down. During startup, there’s often a screen that mentions the key. If there’s not one, or if the screen goes by too fast to see it, check your manufacturer’s site.
+
+  - Or, if Windows is already installed, from either the Sign on screen or the Start menu, select Power ( ) > hold Shift while selecting Restart. Select Troubleshoot > Advanced options > UEFI Firmware settings.
+  
+2.	From the firmware menu navigate to Security > Secure Boot and select the option to trust the “3rd Party CA”. 
+
+3.	Save changes and exit. 
+ 
+Microsoft continues to collaborate with Linux and IHV ecosystem partners to design least privileged features to help you stay secure and opt-in trust for only the publishers and components you trust. 
+
+Like most mobile devices, Arm-based devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot can't be turned off, and you can't load a different OS. Fortunately, there's a large market of ARM processor devices designed to run other operating systems.
 
 ## Trusted Boot
 

windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md

@@ -88,6 +88,8 @@ Configuration Manager doesn't remove policies once deployed. To stop enforcement
 
 For more information on using Configuration Manager's native WDAC policies, see [Windows Defender Application Control management with Configuration Manager](/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager).
 
+Download the entire [WDAC in Configuration Manager lab paper](https://download.microsoft.com/download/c/f/d/cfd6227c-8ec4-442d-8c50-825550d412f6/WDAC-Deploy-WDAC-using-MEMCM.pdf).
+
 ## Deploy custom WDAC policies using Packages/Programs or Task Sequences
 
 Using Configuration Manager's built-in policies can be a helpful starting point, but customers may find the circle-of-trust options available in Configuration Manager too limiting. To define your own circle-of-trust, you can use Configuration Manager to deploy custom WDAC policies using [script-based deployment](deploy-wdac-policies-with-script.md) via Software Distribution Packages and Programs or Operating System Deployment Task Sequences.

windows/whats-new/contribute-to-a-topic.md

@@ -1,81 +0,0 @@
----
-title: Edit an existing topic using the Edit link
-description: Instructions about how to edit an existing topic by using the Edit link on docs.microsoft.com.
-ms.prod: w10
-ms.date: 10/13/2017
-ms.reviewer: 
-manager: dansimp
-ms.author: dansimp
-author: dansimp
-ms.topic: tutorial
----
-
-# Editing existing Windows IT professional documentation
-You can make suggestions and update existing, public content with just a GitHub account and a simple click of a link. You can use GitHub pull requests to edit the technical articles in the Windows IT libraries and then ask us to "pull" your changes into the published articles. 
-
->[!NOTE]
->At this time, you can only edit the English (en-us) content.
-
-Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner of an article, you can suggest changes to it. You can specifically edit articles in the following libraries:
-
-- [Windows 10](/windows/windows-10)
-- [Windows Server](/windows-server/)
-- [Microsoft Edge](/microsoft-edge/deploy)    
-- [Surface](/surface)
-- [Surface Hub](/surface-hub)
-- [HoloLens](/hololens)
-- [Microsoft Store](/microsoft-store)
-- [Windows 10 for Education](/education/windows)
-- [Windows 10 for SMB](/windows/smb)
-- [Internet Explorer 11](/internet-explorer)
-- [Microsoft Desktop Optimization Pack](/microsoft-desktop-optimization-pack)
-
-
-**To edit a topic**
-
-1. Go to the article that you want to update, and then click **Edit**.
-
-    ![GitHub Web, showing the Edit link.](images/contribute-link.png)
-
-2. Sign into (or sign up for) a GitHub account.
-    
-    You must have a GitHub account to get to the page that lets you edit a topic.
-
-3. Click the **Pencil** icon (in the red box) to edit the content.
-
-    ![GitHub Web, showing the Pencil icon in the red box.](images/pencil-icon.png)
-
-4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see:
-   - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring)
-    
-   - **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/) 
-
-5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct.
-
-      ![GitHub Web, showing the Preview Changes tab.](images/preview-changes.png)
-
-6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change**.
-
-    ![GitHub Web, showing the Propose file change button.](images/propose-file-change.png)
-
-    The **Comparing changes** screen shows the changes between your version of the article and the original content.
-
-7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. (Occasionally there are merge conflicts, where you've edited the file one way, while someone else edited the same lines in the same file in a different way. Before you can propose your changes, you need to fix those conflicts.)
-
-   If there are no problems, you’ll see the message, **Able to merge**.
-
-   ![GitHub Web, showing the Comparing changes screen.](images/compare-changes.png)
-
-8. Click **Create pull request**.
-
-9. Enter a title and description to let us know what’s in the request.
-
-10. Scroll to the bottom of the page, and make sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people.
-
-11. Click **Create pull request** again to actually submit your edits.
-
-12. If you aren't a Microsoft employee, you need to [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before updating or adding to any Microsoft repositories. A bot running in GitHub checks whether you've signed the CLA - if not, you'll be prompted, in the pull request, to sign it.
-
-    If you've previously contributed to topics in the Microsoft repositories, congratulations! You've already completed this step.
-
-Next, the pull request is sent to one of our writers to review your edits for technical and editorial accuracy. If we have any suggestions or questions, we'll add them to the pull request where we can discuss them with you. If we accept your edits, you'll see your changes the next time the article is published.