Merge branch 'sheshachary-5859198-3' of https://github.com/MicrosoftDocs/windows-docs-pr into sheshachary-5859198-3
@ -31,7 +31,7 @@ Organizations that use Windows Server Update Services (WSUS) must take action to
|
|||||||
1. Download the FOD .cab file:
|
1. Download the FOD .cab file:
|
||||||
|
|
||||||
- [Windows 11, version 21H2](https://software-download.microsoft.com/download/sg/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd_64~~.cab)
|
- [Windows 11, version 21H2](https://software-download.microsoft.com/download/sg/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd_64~~.cab)
|
||||||
- [Windows 10, version 2004](https://software-download.microsoft.com/download/pr/6cf73b63/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab)
|
- [Windows 10, version 2004](https://software-static.download.prss.microsoft.com/pr/download/6cf73b63/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab)
|
||||||
- [Windows 10, version 1903 and 1909](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab)
|
- [Windows 10, version 1903 and 1909](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab)
|
||||||
- [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab)
|
- [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab)
|
||||||
- [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab)
|
- [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab)
|
||||||
|
@ -1,94 +1,91 @@
|
|||||||
---
|
---
|
||||||
title: Secured-Core Configuration Lock
|
title: Secured-core configuration lock
|
||||||
description: A Secured-Core PC (SCPC) feature that prevents configuration drift from Secured-Core PC features (shown below) caused by unintentional misconfiguration.
|
description: A secured-core PC (SCPC) feature that prevents configuration drift from secured-core PC features caused by unintentional misconfiguration.
|
||||||
manager: dansimp
|
manager: dansimp
|
||||||
keywords: mdm,management,administrator,config lock
|
|
||||||
ms.author: v-lsaldanha
|
ms.author: v-lsaldanha
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
ms.prod: w11
|
ms.prod: w11
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: lovina-saldanha
|
author: lovina-saldanha
|
||||||
ms.date: 03/14/2022
|
ms.date: 05/24/2022
|
||||||
---
|
---
|
||||||
|
|
||||||
# Secured-Core PC Configuration Lock
|
# Secured-core PC configuration lock
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 11
|
- Windows 11
|
||||||
|
|
||||||
In an enterprise organization, IT administrators enforce policies on their corporate devices to keep the devices in a compliant state and protect the OS by preventing users from changing configurations and creating config drift. Config drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Windows 11 with Config Lock enables IT administrators to prevent config drift and keep the OS configuration in the desired state. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds.
|
In an enterprise organization, IT administrators enforce policies on their corporate devices to keep the devices in a compliant state and protect the OS by preventing users from changing configurations and creating config drift. Config drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Windows 11 with config lock enables IT administrators to prevent config drift and keep the OS configuration in the desired state. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds.
|
||||||
|
|
||||||
Secured-Core Configuration Lock (Config Lock) is a new [Secured-Core PC (SCPC)](/windows-hardware/design/device-experiences/oem-highly-secure) feature that prevents configuration drift from Secured-Core PC features caused by unintentional misconfiguration. In short, it ensures a device intended to be a Secured-Core PC remains a Secured-Core PC.
|
Secured-core configuration lock (config lock) is a new [secured-core PC (SCPC)](/windows-hardware/design/device-experiences/oem-highly-secure) feature that prevents configuration drift from secured-core PC features caused by unintentional misconfiguration. In short, it ensures a device intended to be a secured-core PC remains a secured-core PC.
|
||||||
|
|
||||||
To summarize, Config Lock:
|
To summarize, config lock:
|
||||||
|
|
||||||
- Enables IT to “lock” Secured-Core PC features when managed through MDM
|
- Enables IT to "lock" secured-core PC features when managed through MDM
|
||||||
- Detects drift remediates within seconds
|
- Detects drift remediates within seconds
|
||||||
- DOES NOT prevent malicious attacks
|
- Doesn't prevent malicious attacks
|
||||||
|
|
||||||
## Configuration Flow
|
## Configuration Flow
|
||||||
|
|
||||||
After a Secured-Core PC reaches the desktop, Config Lock will prevent configuration drift by detecting if the device is a Secured-Core PC or not. When the device isn't a Secured-Core PC, the lock won't apply. If the device is a Secured-Core PC, config lock will lock the policies listed under [List of locked policies](#list-of-locked-policies).
|
After a secured-core PC reaches the desktop, config lock will prevent configuration drift by detecting if the device is a secured-core PC or not. When the device isn't a secured-core PC, the lock won't apply. If the device is a secured-core PC, config lock will lock the policies listed under [List of locked policies](#list-of-locked-policies).
|
||||||
|
|
||||||
## System Requirements
|
## System Requirements
|
||||||
|
|
||||||
Config Lock will be available for all Windows Professional and Enterprise Editions running on [Secured-Core PCs](/windows-hardware/design/device-experiences/oem-highly-secure).
|
Config lock will be available for all Windows Professional and Enterprise Editions running on [secured-core PCs](/windows-hardware/design/device-experiences/oem-highly-secure).
|
||||||
|
|
||||||
## Enabling Config Lock using Microsoft Intune
|
## Enabling config lock using Microsoft Intune
|
||||||
|
|
||||||
Config Lock isn't enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it on.
|
Config lock isn't enabled by default, or turned on by the OS during boot. Rather, you need to turn it on.
|
||||||
|
|
||||||
The steps to turn on Config Lock using Microsoft Endpoint Manager (Microsoft Intune) are as follows:
|
The steps to turn on config lock using Microsoft Endpoint Manager (Microsoft Intune) are as follows:
|
||||||
|
|
||||||
1. Ensure that the device to turn on Config Lock is enrolled in Microsoft Intune.
|
1. Ensure that the device to turn on config lock is enrolled in Microsoft Intune.
|
||||||
1. From the Microsoft Intune portal main page, select **Devices** > **Configuration Profiles** > **Create a profile**.
|
1. From the Microsoft Intune portal main page, select **Devices** > **Configuration Profiles** > **Create a profile**.
|
||||||
1. Select the following and press **Create**:
|
1. Select the following and press **Create**:
|
||||||
- **Platform**: Windows 10 and later
|
- **Platform**: Windows 10 and later
|
||||||
- **Profile type**: Templates
|
- **Profile type**: Templates
|
||||||
- **Template name**: Custom
|
- **Template name**: Custom
|
||||||
|
|
||||||
:::image type="content" source="images/configlock-mem-createprofile.png" alt-text="In Configuration profiles, the Create a profile page is showing, with the Platform set to Windows 10 and later, and a Profile Type of Templates":::
|
:::image type="content" source="images/configlock-mem-createprofile.png" alt-text="In Configuration profiles, the Create a profile page is showing, with the Platform set to Windows 10 and later, and a Profile Type of Templates.":::
|
||||||
|
|
||||||
1. Name your profile.
|
1. Name your profile.
|
||||||
1. When you reach the Configuration Settings step, select “Add” and add the following information:
|
1. When you reach the Configuration Settings step, select "Add" and add the following information:
|
||||||
- **OMA-URI**: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock
|
- **OMA-URI**: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock
|
||||||
- **Data type**: Integer
|
- **Data type**: Integer
|
||||||
- **Value**: 1 </br>
|
- **Value**: 1 </br>
|
||||||
To turn off Config Lock, change the value to 0.
|
To turn off config lock, change the value to 0.
|
||||||
|
|
||||||
:::image type="content" source="images/configlock-mem-editrow.png" alt-text="In the Configuration settings step, the Edit Row page is shown with a Name of Config Lock, a Description of Turn on Config Lock and the OMA-URI set as above, along with a Data type of Integer set to a Value of 1":::
|
:::image type="content" source="images/configlock-mem-editrow.png" alt-text="In the Configuration settings step, the Edit Row page is shown with a Name of config lock, a Description of Turn on config lock and the OMA-URI set as above, along with a Data type of Integer set to a Value of 1.":::
|
||||||
|
|
||||||
1. Select the devices to turn on Config Lock. If you're using a test tenant, you can select “+ Add all devices”.
|
1. Select the devices to turn on config lock. If you're using a test tenant, you can select "+ Add all devices".
|
||||||
1. You'll not need to set any applicability rules for test purposes.
|
1. You'll not need to set any applicability rules for test purposes.
|
||||||
1. Review the Configuration and select “Create” if everything is correct.
|
1. Review the Configuration and select "Create" if everything is correct.
|
||||||
1. After the device syncs with the Microsoft Intune server, you can confirm if the Config Lock was successfully enabled.
|
1. After the device syncs with the Microsoft Intune server, you can confirm if the config lock was successfully enabled.
|
||||||
|
|
||||||
:::image type="content" source="images/configlock-mem-dev.png" alt-text="The Profile assignment status dashboard when viewing the Config Lock device configuration profile, showing one device has succeeded in having this profile applied":::
|
:::image type="content" source="images/configlock-mem-dev.png" alt-text="The Profile assignment status dashboard when viewing the config lock device configuration profile, showing one device has succeeded in having this profile applied.":::
|
||||||
|
|
||||||
:::image type="content" source="images/configlock-mem-devstatus.png" alt-text="The Device Status for the Config Lock Device Configuration Profile, showing one device with a Deployment Status as Succeeded and two with Pending":::
|
:::image type="content" source="images/configlock-mem-devstatus.png" alt-text="The Device Status for the config lock Device Configuration Profile, showing one device with a Deployment Status as Succeeded and two with Pending.":::
|
||||||
|
|
||||||
## Configuring Secured-Core PC features
|
## Configuring secured-core PC features
|
||||||
|
|
||||||
Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally misconfigured. IT Admins retain the ability to change (enable/disable) SCPC features (for example Firmware protection) via Group Policies and/or mobile device management (MDM) tools, such as Microsoft Intune.
|
Config lock is designed to ensure that a secured-core PC isn't unintentionally misconfigured. You keep the ability to enable or disable SCPC features, for example, firmware protection. You can make these changes with group policies or MDM services like Microsoft Intune.
|
||||||
|
|
||||||
:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="The Defender Firmware protection setting, with a description of Windows Defender System Guard protects your device from compromised firmware. The setting is set to Off":::
|
:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="The Defender Firmware protection setting, with a description of Windows Defender System Guard protects your device from compromised firmware. The setting is set to Off.":::
|
||||||
|
|
||||||
## FAQ
|
## FAQ
|
||||||
|
|
||||||
**Can an IT admins disable Config Lock ?** </br>
|
- Can I disable config lock? Yes. You can use MDM to turn off config lock completely or put it in temporary unlock mode for helpdesk activities.
|
||||||
Yes. IT admins can use MDM to turn off Config Lock completely or put it in temporary unlock mode for helpdesk activities.</br>
|
|
||||||
|
|
||||||
### List of locked policies
|
### List of locked policies
|
||||||
|
|
||||||
|**CSPs** |
|
|**CSPs** |
|
||||||
|-----|
|
|-----|
|
||||||
|[BitLocker ](bitlocker-csp.md) |
|
|[BitLocker](bitlocker-csp.md) |
|
||||||
|[PassportForWork](passportforwork-csp.md) |
|
|[PassportForWork](passportforwork-csp.md) |
|
||||||
|[WindowsDefenderApplicationGuard](windowsdefenderapplicationguard-csp.md) |
|
|[WindowsDefenderApplicationGuard](windowsdefenderapplicationguard-csp.md) |
|
||||||
|[ApplicationControl](applicationcontrol-csp.md)
|
|[ApplicationControl](applicationcontrol-csp.md)
|
||||||
|
|
||||||
|
|
||||||
|**MDM policies** | **Supported by Group Policy** |
|
|**MDM policies** | **Supported by Group Policy** |
|
||||||
|-----|-----|
|
|-----|-----|
|
||||||
|[DataProtection/AllowDirectMemoryAccess](policy-csp-dataprotection.md) | No |
|
|[DataProtection/AllowDirectMemoryAccess](policy-csp-dataprotection.md) | No |
|
||||||
|
Before Width: | Height: | Size: 14 KiB After Width: | Height: | Size: 20 KiB |
@ -1,30 +1,31 @@
|
|||||||
---
|
---
|
||||||
title: Use Quick Assist to help users
|
title: Use Quick Assist to help users
|
||||||
description: How IT Pros can use Quick Assist to help users
|
description: How IT Pros can use Quick Assist to help users.
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.sitesec: library
|
ms.technology: windows
|
||||||
ms.topic: article
|
ms.topic: how-to
|
||||||
author: aczechowski
|
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
|
author: aczechowski
|
||||||
ms.author: aaroncz
|
ms.author: aaroncz
|
||||||
manager: dougeby
|
manager: dougeby
|
||||||
|
ms.reviewer: pmadrigal
|
||||||
ms.collection: highpri
|
ms.collection: highpri
|
||||||
---
|
---
|
||||||
|
|
||||||
# Use Quick Assist to help users
|
# Use Quick Assist to help users
|
||||||
|
|
||||||
Quick Assist is a Windows application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user’s device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices.
|
Quick Assist is a Windows application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user's device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices.
|
||||||
|
|
||||||
## Before you begin
|
## Before you begin
|
||||||
|
|
||||||
All that's required to use Quick Assist is suitable network and internet connectivity. No particular roles, permissions, or policies are involved. Neither party needs to be in a domain. The helper must have a Microsoft account. The sharer doesn’t have to authenticate.
|
All that's required to use Quick Assist is suitable network and internet connectivity. No particular roles, permissions, or policies are involved. Neither party needs to be in a domain. The helper must have a Microsoft account. The sharer doesn't have to authenticate.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> In case the helper and sharer use different keyboard layouts or mouse settings, the ones from the sharer are used during the session.
|
> In case the helper and sharer use different keyboard layouts or mouse settings, the ones from the sharer are used during the session.
|
||||||
|
|
||||||
### Authentication
|
### Authentication
|
||||||
|
|
||||||
The helper can authenticate when they sign in by using a Microsoft Account (MSA) or Azure Active Directory. Local Active Directory authentication is not supported at this time.
|
The helper can authenticate when they sign in by using a Microsoft Account (MSA) or Azure Active Directory (Azure AD). Local Active Directory authentication isn't currently supported.
|
||||||
|
|
||||||
### Network considerations
|
### Network considerations
|
||||||
|
|
||||||
@ -32,18 +33,21 @@ Quick Assist communicates over port 443 (https) and connects to the Remote Assis
|
|||||||
|
|
||||||
Both the helper and sharer must be able to reach these endpoints over port 443:
|
Both the helper and sharer must be able to reach these endpoints over port 443:
|
||||||
|
|
||||||
| Domain/Name | Description |
|
| Domain/Name | Description |
|
||||||
|-----------------------------------|-------------------------------------------------------|
|
|--|--|
|
||||||
| \*.support.services.microsoft.com | Primary endpoint used for Quick Assist application |
|
| `*.support.services.microsoft.com` | Primary endpoint used for Quick Assist application |
|
||||||
| \*.resources.lync.com | Required for the Skype framework used by Quick Assist |
|
| `*.login.microsoftonline.com` | Required for logging in to the application (MSA) |
|
||||||
| \*.infra.lync.com | Required for the Skype framework used by Quick Assist |
|
| `*.channelwebsdks.azureedge.net` | Used for chat services within Quick Assist |
|
||||||
| \*.latest-swx.cdn.skype.com | Required for the Skype framework used by Quick Assist |
|
| `*.aria.microsoft.com` | Used for accessibility features within the app |
|
||||||
| \*.login.microsoftonline.com | Required for logging in to the application (MSA) |
|
| `*.api.support.microsoft.com` | API access for Quick Assist |
|
||||||
| \*.channelwebsdks.azureedge.net | Used for chat services within Quick Assist |
|
| `*.vortex.data.microsoft.com` | Used for diagnostic data |
|
||||||
| \*.aria.microsoft.com | Used for accessibility features within the app |
|
| `*.channelservices.microsoft.com` | Required for chat services within Quick Assist |
|
||||||
| \*.api.support.microsoft.com | API access for Quick Assist |
|
| `*.skype.com` | Skype requests may vary based on geography. If connection issues persist, test this endpoint. |
|
||||||
| \*.vortex.data.microsoft.com | Used for diagnostic data |
|
| `*.remoteassistanceprodacs.communication.azure.com` | Azure Communication Services (ACS) technology the Quick Assist app uses. |
|
||||||
| \*.channelservices.microsoft.com | Required for chat services within Quick Assist |
|
| `*.turn.azure.com` | Protocol used to help endpoint. |
|
||||||
|
| `browser.pipe.aria.microsoft.com` | Required diagnostic data for client and services used by Quick Assist. |
|
||||||
|
| `browser.events.data.microsoft.com` | Required diagnostic data for client and services used by Quick Assist. |
|
||||||
|
| `ic3.events.data.microsoft.com` | Required diagnostic data for client and services used by Quick Assist. |
|
||||||
|
|
||||||
## How it works
|
## How it works
|
||||||
|
|
||||||
@ -73,9 +77,9 @@ Microsoft logs a small amount of session data to monitor the health of the Quick
|
|||||||
|
|
||||||
- Features used inside the app such as view only, annotation, and session pause
|
- Features used inside the app such as view only, annotation, and session pause
|
||||||
|
|
||||||
No logs are created on either the helper’s or sharer’s device. Microsoft cannot access a session or view any actions or keystrokes that occur in the session.
|
No logs are created on either the helper's or sharer's device. Microsoft can't access a session or view any actions or keystrokes that occur in the session.
|
||||||
|
|
||||||
The sharer sees only an abbreviated version of the helper’s name (first name, last initial) and no other information about them. Microsoft does not store any data about either the sharer or the helper for longer than three days.
|
The sharer sees only an abbreviated version of the helper's name (first name, last initial) and no other information about them. Microsoft doesn't store any data about either the sharer or the helper for longer than three days.
|
||||||
|
|
||||||
In some scenarios, the helper does require the sharer to respond to application permission prompts (User Account Control), but otherwise the helper has the same permissions as the sharer on the device.
|
In some scenarios, the helper does require the sharer to respond to application permission prompts (User Account Control), but otherwise the helper has the same permissions as the sharer on the device.
|
||||||
|
|
||||||
@ -83,8 +87,7 @@ In some scenarios, the helper does require the sharer to respond to application
|
|||||||
|
|
||||||
Either the support staff or a user can start a Quick Assist session.
|
Either the support staff or a user can start a Quick Assist session.
|
||||||
|
|
||||||
|
1. Support staff ("helper") starts Quick Assist in any of a few ways:
|
||||||
1. Support staff (“helper”) starts Quick Assist in any of a few ways:
|
|
||||||
|
|
||||||
- Type *Quick Assist* in the search box and press ENTER.
|
- Type *Quick Assist* in the search box and press ENTER.
|
||||||
- From the Start menu, select **Windows Accessories**, and then select **Quick Assist**.
|
- From the Start menu, select **Windows Accessories**, and then select **Quick Assist**.
|
||||||
@ -94,15 +97,15 @@ Either the support staff or a user can start a Quick Assist session.
|
|||||||
|
|
||||||
3. Helper shares the security code with the user over the phone or with a messaging system.
|
3. Helper shares the security code with the user over the phone or with a messaging system.
|
||||||
|
|
||||||
4. Quick Assist opens on the sharer’s device. The user enters the provided code in the **Code from assistant** box, and then selects **Share screen**.
|
4. Quick Assist opens on the sharer's device. The user enters the provided code in the **Code from assistant** box, and then selects **Share screen**.
|
||||||
|
|
||||||
5. The helper receives a dialog offering the opportunity to take full control of the device or just view its screen. After choosing, the helper selects **Continue**.
|
5. The helper receives a dialog offering the opportunity to take full control of the device or just view its screen. After they choose an option, the helper selects **Continue**.
|
||||||
|
|
||||||
6. The sharer receives a dialog asking for permission to show their screen or allow access. The sharer gives permission by selecting the **Allow** button.
|
6. The sharer receives a dialog asking for permission to show their screen or allow access. The sharer gives permission by selecting the **Allow** button.
|
||||||
|
|
||||||
## If Quick Assist is missing
|
## If Quick Assist is missing
|
||||||
|
|
||||||
If for some reason a user doesn't have Quick Assist on their system or it's not working properly, they might need to uninstall and reinstall it.
|
If for some reason a user doesn't have Quick Assist on their system or it's not working properly, try to uninstall and reinstall it.
|
||||||
|
|
||||||
### Uninstall Quick Assist
|
### Uninstall Quick Assist
|
||||||
|
|
||||||
@ -122,4 +125,4 @@ If for some reason a user doesn't have Quick Assist on their system or it's not
|
|||||||
|
|
||||||
## Next steps
|
## Next steps
|
||||||
|
|
||||||
If you have any problems, questions, or suggestions for Quick Assist, contact us by using the [Feedback Hub app](https://www.microsoft.com/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0&rtc=1#activetab=pivot:overviewtab).
|
If you have any problems, questions, or suggestions for Quick Assist, contact us by using the [Feedback Hub app](https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332).
|
||||||
|
Before Width: | Height: | Size: 15 KiB After Width: | Height: | Size: 37 KiB |
Before Width: | Height: | Size: 32 KiB After Width: | Height: | Size: 70 KiB |
Before Width: | Height: | Size: 40 KiB After Width: | Height: | Size: 57 KiB |
Before Width: | Height: | Size: 41 KiB After Width: | Height: | Size: 62 KiB |
Before Width: | Height: | Size: 14 KiB After Width: | Height: | Size: 57 KiB |
Before Width: | Height: | Size: 33 KiB After Width: | Height: | Size: 47 KiB |
Before Width: | Height: | Size: 35 KiB After Width: | Height: | Size: 30 KiB |
Before Width: | Height: | Size: 7.6 KiB After Width: | Height: | Size: 16 KiB |
Before Width: | Height: | Size: 325 KiB After Width: | Height: | Size: 18 KiB |
Before Width: | Height: | Size: 7.2 KiB After Width: | Height: | Size: 7.7 KiB |
Before Width: | Height: | Size: 206 KiB After Width: | Height: | Size: 140 KiB |
Before Width: | Height: | Size: 53 KiB After Width: | Height: | Size: 54 KiB |
Before Width: | Height: | Size: 313 KiB |
Before Width: | Height: | Size: 243 KiB After Width: | Height: | Size: 222 KiB |
BIN
windows/deployment/do/images/imcc54.png
Normal file
After Width: | Height: | Size: 63 KiB |
BIN
windows/deployment/do/images/imcc55.PNG
Normal file
After Width: | Height: | Size: 114 KiB |
@ -40,7 +40,7 @@ The features described below are no longer being actively developed, and might b
|
|||||||
| Dynamic Disks | The [Dynamic Disks](/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](/windows-server/storage/storage-spaces/overview) in a future release.| 2004 |
|
| Dynamic Disks | The [Dynamic Disks](/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](/windows-server/storage/storage-spaces/overview) in a future release.| 2004 |
|
||||||
| Language Community tab in Feedback Hub | The Language Community tab will be removed from the Feedback Hub. The standard feedback process: [Feedback Hub - Feedback](feedback-hub://?newFeedback=true&feedbackType=2) is the recommended way to provide translation feedback. | 1909 |
|
| Language Community tab in Feedback Hub | The Language Community tab will be removed from the Feedback Hub. The standard feedback process: [Feedback Hub - Feedback](feedback-hub://?newFeedback=true&feedbackType=2) is the recommended way to provide translation feedback. | 1909 |
|
||||||
| My People / People in the Shell | My People is no longer being developed. It may be removed in a future update. | 1909 |
|
| My People / People in the Shell | My People is no longer being developed. It may be removed in a future update. | 1909 |
|
||||||
| Package State Roaming (PSR) | PSR will be removed in a future update. PSR allows non-Microsoft developers to access roaming data on devices, enabling developers of UWP applications to write data to Windows and synchronize it to other instantiations of Windows for that user. <br> <br>The recommended replacement for PSR is [Azure App Service](/azure/app-service/). Azure App Service is widely supported, well documented, reliable, and supports cross-platform/cross-ecosystem scenarios such as iOS, Android and web. | 1909 |
|
| Package State Roaming (PSR) | PSR will be removed in a future update. PSR allows non-Microsoft developers to access roaming data on devices, enabling developers of UWP applications to write data to Windows and synchronize it to other instantiations of Windows for that user. <br> <br>The recommended replacement for PSR is [Azure App Service](/azure/app-service/). Azure App Service is widely supported, well documented, reliable, and supports cross-platform/cross-ecosystem scenarios such as iOS, Android and web. <br> <br>PSR was removed in Windows 11.| 1909 |
|
||||||
| XDDM-based remote display driver | Starting with this release, the Remote Desktop Services uses a Windows Display Driver Model (WDDM) based Indirect Display Driver (IDD) for a single session remote desktop. The support for Windows 2000 Display Driver Model (XDDM) based remote display drivers will be removed in a future release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information on implementing remote display indirect display driver, check out [Updates for IddCx versions 1.4 and later](/windows-hardware/drivers/display/iddcx1.4-updates). | 1903 |
|
| XDDM-based remote display driver | Starting with this release, the Remote Desktop Services uses a Windows Display Driver Model (WDDM) based Indirect Display Driver (IDD) for a single session remote desktop. The support for Windows 2000 Display Driver Model (XDDM) based remote display drivers will be removed in a future release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information on implementing remote display indirect display driver, check out [Updates for IddCx versions 1.4 and later](/windows-hardware/drivers/display/iddcx1.4-updates). | 1903 |
|
||||||
| Taskbar settings roaming | Roaming of taskbar settings is no longer being developed and we plan to remove this capability in a future release. | 1903 |
|
| Taskbar settings roaming | Roaming of taskbar settings is no longer being developed and we plan to remove this capability in a future release. | 1903 |
|
||||||
| Wi-Fi WEP and TKIP | Since the 1903 release, a warning message has appeared when connecting to Wi-Fi networks secured with WEP or TKIP (which are not as secure as those using WPA2 or WPA3). In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | 1903 |
|
| Wi-Fi WEP and TKIP | Since the 1903 release, a warning message has appeared when connecting to Wi-Fi networks secured with WEP or TKIP (which are not as secure as those using WPA2 or WPA3). In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | 1903 |
|
||||||
|
@ -12,7 +12,6 @@ manager: kaushika
|
|||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: Windows Security Technologies\BitLocker
|
ms.collection: Windows Security Technologies\BitLocker
|
||||||
ms.topic: troubleshooting
|
ms.topic: troubleshooting
|
||||||
ms.date: 10/7/2019
|
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
---
|
---
|
||||||
|
|
||||||
@ -36,7 +35,11 @@ You can use the following steps on computers that have either x64 or x32 UEFI sy
|
|||||||
1. Open an elevated Command Prompt window and run the following command:
|
1. Open an elevated Command Prompt window and run the following command:
|
||||||
|
|
||||||
```cmd
|
```cmd
|
||||||
manage-bde protectors get <Drive>
|
manage-bde -protectors -get <Drive>
|
||||||
|
```
|
||||||
|
|
||||||
|
```cmd
|
||||||
|
manage-bde -protectors -get C:
|
||||||
```
|
```
|
||||||
|
|
||||||
where \<*Drive*> is the drive letter, followed by a colon (:), of the bootable drive.
|
where \<*Drive*> is the drive letter, followed by a colon (:), of the bootable drive.
|
||||||
|
@ -15,7 +15,6 @@ ms.reviewer: isbrahm
|
|||||||
ms.author: dansimp
|
ms.author: dansimp
|
||||||
manager: dansimp
|
manager: dansimp
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
ms.date: 10/14/2020
|
|
||||||
ms.technology: windows-sec
|
ms.technology: windows-sec
|
||||||
---
|
---
|
||||||
|
|
||||||
@ -30,26 +29,26 @@ ms.technology: windows-sec
|
|||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
|
> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
|
||||||
|
|
||||||
The Windows Defender Application Control (WDAC) policy Wizard is an open-source Windows desktop application written in C# and bundled as an MSIX package. The Wizard was built to provide security architects with security, and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](/powershell/module/configci) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical.
|
The Windows Defender Application Control (WDAC) policy wizard is an open-source Windows desktop application written in C# and bundled as an MSIX package. The wizard was built to provide security architects with security, and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The wizard desktop application uses the [ConfigCI PowerShell Cmdlets](/powershell/module/configci) in the backend so the output policy of the wizard and PowerShell cmdlets is identical.
|
||||||
|
|
||||||
## Downloading the application
|
## Downloading the application
|
||||||
|
|
||||||
The WDAC Wizard can be downloaded from the official [Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. The Wizard's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit).
|
The WDAC wizard can be downloaded from the official [WDAC Wizard installer website](https://webapp-wdac-wizard.azurewebsites.net) as an MSIX packaged application. The wizard's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit).
|
||||||
|
|
||||||
**Supported Clients**
|
**Supported Clients**
|
||||||
|
|
||||||
As the WDAC Wizard uses the cmdlets in the background, the Wizard is functional on clients only where the cmdlets are supported as outlined in [WDAC feature availability](feature-availability.md). Specifically, the tool will verify that the client meets one of the following requirements:
|
As the WDAC wizard uses the cmdlets in the background, the wizard is functional on clients only where the cmdlets are supported as outlined in [WDAC feature availability](feature-availability.md). Specifically, the tool will verify that the client meets one of the following requirements:
|
||||||
|
|
||||||
- Windows builds 1909+
|
- Windows builds 1909+
|
||||||
- For pre-1909 builds, the Enterprise SKU of Windows is installed
|
- For pre-1909 builds, the Enterprise SKU of Windows is installed
|
||||||
|
|
||||||
If neither requirement is satisfied, the Wizard will throw an error as the cmdlets are not available.
|
If neither requirement is satisfied, the wizard will throw an error as the cmdlets are not available.
|
||||||
|
|
||||||
## In this section
|
## Resources to learn more
|
||||||
|
|
||||||
| Topic | Description |
|
| Topic | Description |
|
||||||
| - | - |
|
| - | - |
|
||||||
| [Creating a new base policy](wdac-wizard-create-base-policy.md) | This article describes how to create a new base policy using one of the supplied policy templates. |
|
| [Creating a new base policy](wdac-wizard-create-base-policy.md) | This article describes how to create a new base policy using one of the supplied policy templates. |
|
||||||
| [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This article describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. |
|
| [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This article describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. |
|
||||||
| [Editing a base or supplemental policy](wdac-wizard-editing-policy.md) | This article demonstrates how to modify an existing policy and the Wizard's editing capabilities. |
|
| [Editing a base or supplemental policy](wdac-wizard-editing-policy.md) | This article demonstrates how to modify an existing policy and the wizard's editing capabilities. |
|
||||||
| [Merging policies](wdac-wizard-merging-policies.md) | This article describes how to merge policies into a single application control policy. |
|
| [Merging policies](wdac-wizard-merging-policies.md) | This article describes how to merge policies into a single application control policy. |
|