Merge remote-tracking branch 'refs/remotes/origin/master' into 6641851

.gitignore

@@ -9,3 +9,4 @@ Tools/NuGet/
 .openpublishing.build.mdproj
 .openpublishing.buildcore.ps1
 packages.config
+browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md

.localization-config

@@ -1,8 +0,0 @@
-{
-  "locales": [ "zh-cn" ],
-  "files": ["!/*.md", "**/**/*.md", "**/*.md"],
-  "includeDependencies": true,
-  "autoPush": true,
-  "xliffVersion": "2.0",
-  "useJavascriptMarkdownTransformer": true
-}

README.md

@@ -1,2 +1,6 @@
 # win-cpub-itpro-docs
 This repo hosts the WDG ITPro content that is published to TechNet.
+
+This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
+
+English Handoff Folder Structure Demo!

browsers/edge/TOC.md

@@ -1,5 +1,5 @@
 #[Microsoft Edge - Deployment Guide for IT Pros](index.md)
-##[Change History for Microsoft Edge](change-history-for-microsoft-edge.md)
+##[Change history for Microsoft Edge](change-history-for-microsoft-edge.md)
 ##[Microsoft Edge requirements and language support](hardware-and-software-requirements.md)
 ##[Available policies for Microsoft Edge](available-policies.md)
 ##[Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md)

browsers/edge/available-policies.md

@@ -65,25 +65,25 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
 |-------------|-------------------|-----------------|--------|
 |AllowAutofill|Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowAutofill</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Autofill to complete form fields.</li><li>**1 (default).** Employees can use Autofill to complete form fields.</li></ul></li></ul>
 |AllowBrowser |Windows 10 or later |Mobile |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowBrowser</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Microsoft Edge.</li><li>**1 (default).** Employees can use Microsoft Edge.</li></ul></li></ul>|
+|AllowCookies |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowCookies</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Allows all cookies from all sites.</li><li>**1.** Blocks only cookies from 3rd party websites</li><li>**2.** Blocks all cookies from all sites.</li></ul></li></ul> |
 |AllowDeveloperTools |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowDeveloperTools</li><li>**Data type:** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can't use the F12 Developer Tools</li><li>**1 (default).** Employees can use the F12 Developer Tools</li></ul></li></ul> |
 |AllowDoNotTrack |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowDoNotTrack</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Stops employees from sending Do Not Track headers to websites requesting tracking info.</li><li>**1.** Employees can send Do Not Track headers to websites requesting tracking info.</li></ul></li></ul> |
 |AllowExtensions |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowExtensions</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Edge Extensions.</li><li>**1 (default).** Employees can use Edge Extensions.</li></ul></li></ul> |
 |AllowInPrivate |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowInPrivate</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use InPrivate browsing.</li><li>**1 (default).** Employees can use InPrivate browsing.</li></ul></li></ul> |
 |AllowPasswordManager |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPasswordManager</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can't use Password Manager to save passwords locally.</li><li>**1.** Employees can use Password Manager to save passwords locally.</li></ul></li></ul> |
 |AllowPopups |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPopups</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Turns off Pop-up Blocker, allowing pop-up windows.</li><li>**1.** Turns on Pop-up Blocker, stopping pop-up windows.</li></ul></li></ul> |
-|AllowSearchSuggestions<br>inAddressBar |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar/</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can’t see search suggestions in the Address bar of Microsoft Edge.</li><li>**1.** Employees can see search suggestions in the Address bar of Microsoft Edge.</li></ul></li></ul> |
+|AllowSearchSuggestionsinAddressBar |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can’t see search suggestions in the Address bar of Microsoft Edge.</li><li>**1.** Employees can see search suggestions in the Address bar of Microsoft Edge.</li></ul></li></ul> |
 |AllowSmartScreen |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Turns off SmartScreen Filter.</li><li>**1.** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software.</li></ul></li></ul> |
-|Cookies |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/Cookies</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Allows all cookies from all sites.</li><li>**1.** Blocks only cookies from 3rd party websites</li><li>**2.** Blocks all cookies from all sites.</li></ul></li></ul> |
 |EnterpriseModeSiteList |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/EnterpriseModeSiteList</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Not configured.</li><li>**1 (default).** Use the Enterprise Mode Site List, if configured.</li><li>**2.** Specify the location to the site list.</li></ul></li></ul> |
 |Favorites |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/Favorites</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the **Favorite** URLs for your employees.<p>**Example:**<br>`<contoso.com>`<br>`<fabrikam.com>`<p>**Note**<br> URLs must be on separate lines and aren't shared between Microsoft Edge and Internet Explorer 11.</li></ul> |
 |FirstRunURL |Windows 10, Version 1511 or later |Mobile |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/FirstRunURL</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the first run URL for your employees.<p>**Example:**<br>`<contoso.one>`</li></ul></li></ul> |
 |HomePages |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/HomePages</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the Home page URLs for your employees.<p>**Example:**<br>`<contoso.com/support><fabrikam.com/support>`</li></ul></li></ul> |
-|PreventAccessToAbout<br>FlagsInMicrosoftEdge |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventAccessToAboutFlagsInMicrosoftEdge</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can access the about:flags page in Microsoft Edge.</li><li>**1.** Employees can't access the about:flags page in Microsoft Edge.</li></ul></li></ul> |
+|PreventAccessToAboutFlagsInMicrosoftEdge |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventAccessToAboutFlagsInMicrosoftEdge</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can access the about:flags page in Microsoft Edge.</li><li>**1.** Employees can't access the about:flags page in Microsoft Edge.</li></ul></li></ul> |
-|PreventSmartScreen<br>PromptOverride |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings.</li><li>**1.** Employees can't ignore SmartScreen warnings.</li></ul></li></ul> |
+|PreventSmartScreenPromptOverride |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings.</li><li>**1.** Employees can't ignore SmartScreen warnings.</li></ul></li></ul> |
-|PreventSmartScreen<br>PromptOverrideForFiles |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles </li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings for files.</li><li>**1.** Employees can't ignore SmartScreen warnings for files.</li></ul></li></ul> |
+|PreventSmartScreenPromptOverrideForFiles |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles </li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings for files.</li><li>**1.** Employees can't ignore SmartScreen warnings for files.</li></ul></li></ul> |
-|PreventUsingLocalHostIP<br>AddressForWebRTC |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocalHostIPAddressForWebRTC</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Shows an employee's LocalHost IP address while using the WebRTC protocol.</li><li>**1.** Doesn't show an employee's LocalHost IP address while using the WebRTC protocol.</li></ul></li></ul> |
+|PreventUsingLocalHostIPAddressForWebRTC |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocalHostIPAddressForWebRTC</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Shows an employee's LocalHost IP address while using the WebRTC protocol.</li><li>**1.** Doesn't show an employee's LocalHost IP address while using the WebRTC protocol.</li></ul></li></ul> |
-|SendIntranetTraffic<br>toInternetExplorer |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer/</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Automatically opens all websites, including intranet sites, using Microsoft Edge.</li><li>**1.** Automatically opens all intranet sites using Internet Explorer 11.</li></ul></li></ul> |
+|SendIntranetTraffictoInternetExplorer |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Automatically opens all websites, including intranet sites, using Microsoft Edge.</li><li>**1.** Automatically opens all intranet sites using Internet Explorer 11.</li></ul></li></ul> |
-|ShowMessageWhenOpening<br>InteretExplorerSites |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/ShowMessageWhenOpeningSitesInInteretExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li><li>**1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li></ul></li></ul> |
+|ShowMessageWhenOpeningInteretExplorerSites |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/ShowMessageWhenOpeningSitesInInteretExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li><li>**1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li></ul></li></ul> |
 
 ## Microsoft Edge and Windows 10-specific Group Policy settings
 These are additional Windows 10-specific Group Policy settings that work with Microsoft Edge.

browsers/edge/change-history-for-microsoft-edge.md

@@ -9,6 +9,9 @@ ms.sitesec: library
 # Change history for Microsoft Edge
 This topic lists new and updated topics in the Microsoft Edge documentation for both Windows 10 and Windows 10 Mobile.
 
+For a detailed feature list of what's in the current Microsoft Edge releases, the Windows Insider Preview builds, and what was introduced in previous releases, see the [Microsoft Edge changelog](https://developer.microsoft.com/en-us/microsoft-edge/platform/changelog/).
+
+
 ## June 2016
 |New or changed topic | Description |
 |----------------------|-------------|

browsers/edge/emie-to-improve-compatibility.md

@@ -14,8 +14,6 @@ title: Use Enterprise Mode to improve compatibility (Microsoft Edge for IT Pros)
 **Applies to:**
 
 -   Windows 10
--   Windows 10 Mobile
-
 
 If you have specific web sites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the web sites will automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work properly with Microsoft Edge, you can set all intranet sites to automatically open using IE11.
 

browsers/internet-explorer/TOC.md

@@ -1,4 +1,5 @@
 #[IE11 Deployment Guide for IT Pros](ie11-deploy-guide/index.md)
+##[Change history for the Internet Explorer 11 (IE11) Deployment Guide](ie11-deploy-guide/change-history-for-internet-explorer-11.md)
 ##[System requirements and language support for Internet Explorer 11](ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md)
 ##[List of updated features and tools - Internet Explorer 11 (IE11)](ie11-deploy-guide/updated-features-and-tools-with-ie11.md)
 ##[Install and Deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/install-and-deploy-ie11.md)

browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md

@@ -1,6 +1,6 @@
 ---
-title: Change history for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
+title: Change history for Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros)
-description: This topic lists new and updated topics in the Internet Explorer 11 documentation for Windows 10 and Windows 10 Mobile.
+description: This topic lists new and updated topics in the Internet Explorer 11 Deployment Guide documentation for Windows 10 and Windows 10 Mobile.
 ms.prod: ie11
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -9,8 +9,18 @@ ms.sitesec: library
 # Change history for Internet Explorer 11
 This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile.
 
-## May 2016
+##July 2016
+|New or changed topic | Description |
+|----------------------|-------------|
+|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to include the comprehensive list of Group Policies that were added with Internet Explorer 11. |
 
+## June 2016
+|New or changed topic | Description |
+|----------------------|-------------|
+|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated with 2 new policies, Send all sites not included in the Enterprise Mode Site List to Microsoft Edge and Show message when opening sites in Microsoft Edge using Enterprise Mode. |
+
+
+## May 2016
 |New or changed topic | Description |
 |----------------------|-------------|
 |[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. |

browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md

@@ -12,22 +12,65 @@ title: New group policy settings for Internet Explorer 11 (Internet Explorer 11
 # New group policy settings for Internet Explorer 11
 Internet Explorer 11 gives you some new Group Policy settings to help you manage your company's web browser configurations, including:
 
-|Policy                     |Category path                 |Supported on |Explanation                        |
+|Policy |Category Path |Supported on |Explanation |
-|---------------------------|------------------------------|-------------|-----------------------------------|
+|-------|--------------|-------------|------------|
-|Turn off loading websites and content in the background to optimize performance |`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page` |IE11 |This policy setting determines whether Internet Explorer preemptively loads websites and content in the background, speeding up performance such that when the user clicks a hyperlink, the background page seamlessly switches into view.<p>If you enable this policy setting, IE doesn't load any websites or content in the background.<p>If you disable this policy setting, IE preemptively loads websites and content in the background.<p>If you don’t configure this policy setting, users can turn this behavior on or off, using IE settings. This feature is turned on by default. |
+|Turn off loading websites and content in the background to optimize performance |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether Internet Explorer preemptively loads websites and content in the background, speeding up performance such that when the user clicks a hyperlink, the background page seamlessly switches into view.<p>If you enable this policy setting, IE doesn't load any websites or content in the background.<p>If you disable this policy setting, IE preemptively loads websites and content in the background.<p>If you don’t configure this policy setting, users can turn this behavior on or off, using IE settings. This feature is turned on by default. |
-|Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar |`Administrative Templates\Windows Components\Internet Explorer` |IE11 |This policy setting allows IE to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user’s keystrokes are sent to Microsoft through Microsoft services.<p>If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.<p>If you disable this policy setting, users won’t receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.<p>If you don’t configure this policy setting, users can change the **Suggestions** setting on the **Settings** charm. |
+|Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10 |This policy setting allows IE to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user’s keystrokes are sent to Microsoft through Microsoft services.<p>If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.<p>If you disable this policy setting, users won’t receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.<p>If you don’t configure this policy setting, users can change the **Suggestions** setting on the **Settings** charm. |
-|Turn off phone number detection |`Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Advanced settings\Browsing` |IE11 |This policy setting determines whether phone numbers are recognized and turned into hyperlinks, which can be used to invoke the default phone application on the system.<p>If you enable this policy setting, phone number detection is turned off. Users won’t be able to modify this setting.<p>If you disable this policy setting, phone number detection is turned on. Users won’t be able to modify this setting.<p>If you don't configure this policy setting, users can turn this behavior on or off, using IE settings. The default is on. |
+|Turn off phone number detection |Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Advanced settings\Browsing |IE11 on Windows 10 |This policy setting determines whether phone numbers are recognized and turned into hyperlinks, which can be used to invoke the default phone application on the system.<p>If you enable this policy setting, phone number detection is turned off. Users won’t be able to modify this setting.<p>If you disable this policy setting, phone number detection is turned on. Users won’t be able to modify this setting.<p>If you don't configure this policy setting, users can turn this behavior on or off, using IE settings. The default is on. |
-|Allow IE to use the HTTP2 network protocol |`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page` |IE11 on Windows 8.1 |This policy setting determines whether IE uses the HTTP2 network protocol. HTTP2 works with HTTP requests to optimize the latency of network requests through compression, multiplexing, and prioritization.<p>If you enable this policy setting, IE uses the HTTP2 network protocol.<p>If you disable this policy setting, IE won't use the HTTP2 network protocol.<p>If you don't configure this policy setting, users can turn this behavior on or off, using IE Advanced Internet Options settings. The default is on. |
+|Allow IE to use the SPDY/3 network protocol |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether Internet Explorer uses the SPDY/3 network protocol. SPDY/3 works with HTTP requests to optimize the latency of network requests through compression, multiplexing and prioritization.<p>If you enable this policy setting, Internet Explorer uses the SPDY/3 network protocol.<p>If you disable this policy setting, Internet Explorer won't use the SPDY/3 network protocol.<p>If you don't configure this policy setting, users can turn this behavior on or off, on the **Advanced* tab of the **Internet Options** dialog box. The default is on.<p>**Note**<br>We've replaced the SPDY/3 protocol with the HTTP2 protocol in Windows 10. You can configure the HTTP2 protocol by using the **Allow IE to use the HTTP2 network protocol** setting. |
-|Don't run antimalware programs against ActiveX controls<br>(Internet, Restricted Zones) |<ul><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone`</li><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone`</li><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone`</li><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone`</li></ul> |IE11 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.<p>If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.<p>If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.<p>If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using IE Security settings. |
+|Allow IE to use the HTTP2 network protocol |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether IE uses the HTTP2 network protocol. HTTP2 works with HTTP requests to optimize the latency of network requests through compression, multiplexing, and prioritization.<p>If you enable this policy setting, IE uses the HTTP2 network protocol.<p>If you disable this policy setting, IE won't use the HTTP2 network protocol.<p>If you don't configure this policy setting, users can turn this behavior on or off, using the **Internet Explorer Advanced Internet Options** settings. The default is on. |
-|Don't run antimalware programs against ActiveX controls<br>(Intranet, Trusted, Local Machine Zones) |<ul><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone`</li><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone`</li><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone`</li><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone`</li><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone`</li><li>`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone`</li></ul> |IE11 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.<p>If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.<p>If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.<p>If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using IE Security settings. |
+|Don't run antimalware programs against ActiveX controls<br>(Internet, Restricted Zones) |<ul><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone</li></ul> |IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.<p>If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.<p>If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.<p>If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings. |
-|Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows |`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page` |IE11 |This policy setting determines whether IE11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.<p>**Important:**<br> Some ActiveX controls and toolbars may not be available when 64-bit processes are used.<p>If you enable this policy setting, IE11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.<p>If you disable this policy setting, IE11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.<p>If you don't configure this policy setting, users can turn this feature on or off using IE settings. This feature is turned off by default. |
+|Don't run antimalware programs against ActiveX controls<br>(Intranet, Trusted, Local Machine Zones) |<ul><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone</li></ul> |IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.<p>If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.<p>If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.<p>If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings. |
-|Turn off sending UTF-8 query strings for URLs |`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page` |IE11 |This policy setting determines whether IE uses 8-bit Unicode Transformation Format (UTF-8) to encode query strings in URLs before sending them to servers or to proxy servers.<p>If you enable this policy setting, you must specify when to use UTF-8 to encode query strings:<ul><li><b>0.</b> Never encode query strings.</li><li><b>1.</b> Only encode query strings for URLs that aren't in the Intranet zone.</li><li><b>2.</b> Only encode query strings for URLs that are in the Intranet zone.</li><li><b>3.</b> Always encode query strings.</li></ul>If you disable or don't configure this policy setting, users can turn this behavior on or off, using IE Advanced Options settings. The default is to encode all query strings in UTF-8. |
+|Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether IE11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.<p>If you enable this policy setting, IE11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.<p>If you disable this policy setting, IE11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.<p>If you don't configure this policy setting, users can turn this feature on or off using IE settings. This feature is turned off by default.<p>**Important**<br>When using 64-bit processes, some ActiveX controls and toolbars might not be available. |
-|Turn off sending URL path as UTF-8 |`User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\URL Encoding` |At least Windows Internet Explorer 7 |This policy setting determines whether to let IE send the path portion of a URL using the UTF-8 standard. This standard defines characters so they're readable in any language and lets you exchange Internet addresses (URLs) with characters included in any language.<p>If you enable this policy setting, UTF-8 is not allowed. Users won't be able to change this setting.<p>If you disable this policy setting, UTF-8 is allowed. Users won't be able to change this setting.<p>If you don't configure this policy setting, users can turn this behavior on or off. |
+|Turn off sending UTF-8 query strings for URLs |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether IE uses 8-bit Unicode Transformation Format (UTF-8) to encode query strings in URLs before sending them to servers or to proxy servers.<p>If you enable this policy setting, you must specify when to use UTF-8 to encode query strings:<ul><li>**0.** Never encode query strings.</li><li>**1.** Only encode query strings for URLs that aren't in the Intranet zone.</li><li>**2.** Only encode query strings for URLs that are in the Intranet zone.</li><li>**3.** Always encode query strings.</li></ul><p>If you disable or don't configure this policy setting, users can turn this behavior on or off, using IE Advanced Options settings. The default is to encode all query strings in UTF-8. |
-|Turn off the flip ahead with page prediction feature |`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page` |At least Internet Explorer 10 on Windows 8 |This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.<p>Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn’t available for Internet Explorer for the desktop.<p>If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn’t loaded into the background.<p>If you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.<p>If you don’t configure this setting, users can turn this behavior on or off, using the **Settings** charm. |
+|Turn off sending URL path as UTF-8 |User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\URL Encoding |At least Windows Internet Explorer 7 |This policy setting determines whether to let IE send the path portion of a URL using the UTF-8 standard. This standard defines characters so they're readable in any language and lets you exchange Internet addresses (URLs) with characters included in any language.<p>If you enable this policy setting, UTF-8 is not allowed. Users won't be able to change this setting.<p>If you disable this policy setting, UTF-8 is allowed. Users won't be able to change this setting.<p>If you don't configure this policy setting, users can turn this behavior on or off. |
-|Prevent deleting ActiveX Filtering, Tracking Protection and Do Not Track data |`Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History` |At least Windows Internet Explorer 9 |**In Internet Explorer 9 and Internet Explorer 10:**<br>This policy setting prevents users from deleting ActiveX Filtering and Tracking Protection data, which includes the list of websites for which the user has chosen to disable ActiveX Filtering or Tracking Protection. In addition, Tracking Protection data is also collected if users turn on the Personalized Tracking Protection List, which blocks third-party items while the user is browsing.<p>**In IE11:**<br>This policy setting prevents users from deleting ActiveX Filtering, Tracking Protection data, and Do Not Track exceptions stored for visited website.<p>This feature is available in the **Delete Browsing History** dialog box.<p>If you enable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is preserved when the user clicks **Delete**.<p>If you disable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is deleted when the user clicks **Delete**.<p>If you don’t configure this policy setting, users can turn this feature on and off, determining whether to delete ActiveX Filtering, Tracking Protection, and Do Not Track data when clicking **Delete**. |
+|Turn off the flip ahead with page prediction feature |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |At least Internet Explorer 10 on Windows 8 |This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.<p>If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn’t loaded into the background.<p>If you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.<p>If you don’t configure this setting, users can turn this behavior on or off, using the **Settings** charm.<p>**Note**<br>Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn’t available for Internet Explorer for the desktop. |
-|Always send Do Not Track header |`Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page` |At least Internet Explorer 10 |This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.<p>If you enable this policy setting, IE sends a DNT:1 header with all HTTP and HTTPS requests. The DNT:1 header signals to the servers not to track the user.<p>**In Internet Explorer 9 and 10:**<br>If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.<p>**In at least IE11:**<br>If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.<p>If you don't configure the policy setting, users can select the Always send Do Not Track header option on the Advanced tab of the Internet Options dialog box. By selecting this option, IE sends a DNT:1 header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a DNT:0 header. By default, this option is enabled. |
+|Prevent deleting ActiveX Filtering, Tracking Protection and Do Not Track data |Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History |At least Windows Internet Explorer 9 |**In Internet Explorer 9 and Internet Explorer 10:**<br>This policy setting prevents users from deleting ActiveX Filtering and Tracking Protection data, which includes the list of websites for which the user has chosen to disable ActiveX Filtering or Tracking Protection. In addition, Tracking Protection data is also collected if users turn on the **Personalized Tracking Protection List**, which blocks third-party items while the user is browsing.<p>**In IE11:**<br>This policy setting prevents users from deleting ActiveX Filtering, Tracking Protection data, and Do Not Track exceptions, stored in the **Delete Browsing History** dialog box, for visited websites.<p>If you enable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is preserved when the user clicks **Delete**.<p>If you disable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is deleted when the user clicks **Delete**.<p>If you don’t configure this policy setting, users can turn this feature on and off, determining whether to delete ActiveX Filtering, Tracking Protection, and Do Not Track data when clicking **Delete**. |
-|Let users turn on and use Enterprise Mode from the **Tools** menu |`Administrative Templates\Windows Components\Internet Explorer` |IE11 |This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.<p>If you turn this setting on, users can see and use the Enterprise Mode option from the **Tools** menu. If you turn this setting on, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.<p>If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. |
+|Always send Do Not Track header |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |At least Internet Explorer 10 |This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.<p>If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.<p>**In Internet Explorer 9 and 10:**<br>If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.<p>**In at least IE11:**<br>If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.<p>If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced* tab of the **Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled. |
-|Use the Enterprise Mode IE website list |`Administrative Templates\Windows Components\Internet Explorer` |IE11 |This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode, instead of Standard mode, because of compatibility issues. Users can’t edit this list.<p>If you enable this policy setting, IE downloads the website list from `HKCU` or `HKLM\Software\policies\Microsoft\Internet Explorer\Main\EnterpriseMode`, opening all included websites using Enterprise Mode. We recommend storing and downloading your list from a secure web server (https://), to help protect against data tampering.<p>If you disable or don’t configure this policy setting, IE opens all websites using Standard mode. |
+|Turn off the ability to launch report site problems using a menu option |Administrative Templates\Windows Components\Internet Explorer\Browser menus |Internet Explorer 11 |This policy setting allows you to manage whether users can start the **eport Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu.<p>If you enable this policy setting, users won’t be able to start the **Report Site Problems** dialog box from the Internet Explorer settings or the Tools menu.<p>If you disable or don’t configure this policy setting, users will be able to start the **Report Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu. |
+|Allow only approved domains to use the TDC ActiveX control |<ul><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone</li><li>Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone</li></ul> |IE11 in Windows 10 |This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the **Internet** and **Restricted Sites** security zones.<p>If you enable this policy setting, users won’t be able to run the TDC ActiveX control from all sites in the specified zone.<p>If you disable this policy setting, users can run the TDC Active X control from all sites in the specified zone. |
+|Turn on Site Discovery XML output |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to manage the XML output functionality of the Internet Explorer Site Discovery Toolkit.<p>If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an XML file, stored in your specified location.<p>If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an XML file.<p>**Note:**<br>Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. |
+|Turn on Site Discovery WMI output |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to manage the WMI output functionality of the Internet Explorer Site Discovery Toolkit.<p>If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an WMI class, which can be aggregated by using a client-management solution, such as System Center Configuration Manager.<p>If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an WMI class.<p>**Note:**<br>Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. |
+|Limit Site Discovery output by Domain |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.<p>If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.<p>If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.<p>**Note:**<br>You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. |
+|Limit Site Discovery output by Zone |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which zones are included in the discovery function of the Internet Explorer Site Discovery Toolkit.<p>If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all specified security zones.<p>If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all security zones.<p>To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:<ul><li>0 – Restricted Sites zone</li><li>0 – Internet zone</li><li>0 – Trusted Sites zone</li><li>0 – Local Intranet zone</li><li>0 – Local Machine zone</li></ul><br>**Example 1:** Include only the Local Intranet zone (binary representation: 00010), based on:<br><ul><li>0 – Restricted Sites zone</li><li>0 – Internet zone</li><li>0 – Trusted Sites zone</li><li>1 – Local Intranet zone</li><li>0 – Local Machine zone</li></ul><br>**Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones (binary representation: 10110), based on:<br><ul><li>1 – Restricted Sites zone</li><li>0 – Internet zone</li><li>1 – Trusted Sites zone</li><li>1 – Local Intranet zone</li><li>1 – Local Machine zone</li></ul><p>**Note:**<br>You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. |
+|Allow SSL3 Fallback |Administrative Templates\Windows Components\Internet Explorer\Security Features |Internet Explorer 11 on Windows 10 |This policy setting allows you to stop websites from falling back to using Secure Socket Layer (SSL) 3.0 or lower, if Transport Layer Security (TLS) 1.0 or higher, fails. This setting doesn’t affect which security protocols are enabled.<p>If you enable this policy setting and a website fails while using the TLS 1.0 or higher security protocols, Internet Explorer will try to fallback and use SSL 3.0 or lower security protocols.<p>If you disable or don’t configure this setting, Internet Explorer uses the default system protocols.**Important:**<br>By default, SSL 3.0 is disabled. If you choose to enable SSL 3.0, we recommend that you disable or don't configure this setting to help mitigate potential man-in-the-middle attacks. |
+|Turn off automatic download of the ActiveX VersionList |Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management |At least Windows Internet Explorer 8 |This policy setting allows you to decide whether Internet Explorer automatically downloads updated versions of Microsoft's VersionList.XML file. This file tells Internet Explorer whether to stop specific ActiveX controls from loading.<p>If you enable this policy setting, Internet Explorer stops automatically downloading updated versions of the VersionList.XML file.<p>If you disable or don’t configure this setting, Internet Explorer continues to download updated versions of the VersionList.XML file.<p>**Important:**<br>Stopping this file from updating breaks the out-of-date ActiveX control blocking feature, potentially compromising the security of the device. For more info, see the Out-of-Date ActiveX Control Blocking (https://technet.microsoft.com/en-us/itpro/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking) topic. |
+|Let users turn on and use Enterprise Mode from the **Tools** menu |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10 |This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.<p>If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.<p>If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. |
+|Use the Enterprise Mode IE website list |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10, version 1511 |This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode, instead of Standard mode, because of compatibility issues. Users can’t edit this list.<p>If you enable this policy setting, Internet Explorer downloads the Enterprise Mode website list from the `HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE`\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode hive, opening all included websites using Enterprise Mode. We recommend storing and downloading your list from a secure web server `(https://)`, to help protect against data tampering.<p>If you disable or don’t configure this policy setting, Internet Explorer opens all websites using **Standard** mode. |
+|Send all sites not included in the Enterprise Mode Site List to Microsoft Edge |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10, version 1607 |This policy setting lets you decide whether to open all sites that aren’t specified to open in IE11 by the Enterprise Mode site list, to open in Microsoft Edge.<p>If you enable this policy setting, you must also enable the Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list policy setting and you must include at least one site in the Enterprise Mode site list.<p>If you disable or don't configure this policy setting, all sites will open based on the currently active browser.<p>**Note:**<br>If you’ve also enabled the Administrative Templates\Windows Components\Microsoft Edge\Send all intranet sites to Internet Explorer 11 policy setting, then all intranet sites will continue to open in Internet Explorer 11. |
+|Show message when opening sites in Microsoft Edge using Enterprise Mode |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10, version 1607 |This policy setting lets you decide whether employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.<p>If you enable this policy setting, employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.<p>If you disable or don't configure this policy setting, the default app behavior occurs and no additional page appears. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 ## Removed Group Policy settings
 IE11 no longer supports these Group Policy settings:
@@ -45,16 +88,9 @@ IE11 no longer supports these Group Policy settings:
 ## Viewing your policy settings
 After you've finished updating and deploying your Group Policy, you can use the Resultant Set of Policy (RSoP) snap-in to view your settings.
 
- ![](images/wedge.gif) **To use the RSoP snap-in**
+**To use the RSoP snap-in**
 
 1.  Open and run the Resultant Set of Policy (RSoP) wizard, specifying the information you want to see.
 
 2.  Open your wizard results in the Group Policy Management Console (GPMC).<p>
 For complete instructions about how to add, open, and use RSoP, see [Use the RSoP Snap-in](http://go.microsoft.com/fwlink/p/?LinkId=395201)
-
- 
-
- 
-
-
-

devices/surface-hub/TOC.md

@@ -19,7 +19,7 @@
 ### [Manage Microsoft Surface Hub](manage-surface-hub.md)
 #### [Accessibility](accessibility-surface-hub.md)
 #### [Change the Surface Hub device account](change-surface-hub-device-account.md)
-#### [Device reset](device-reset-suface-hub.md)
+#### [Device reset](device-reset-surface-hub.md)
 #### [End a Surface Hub meeting with I'm Done](i-am-done-finishing-your-surface-hub-meeting.md)
 #### [Install apps on your Surface Hub](install-apps-on-surface-hub.md)
 #### [Manage settings with a local admin account](manage-settings-with-local-admin-account-surface-hub.md)

devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Appendix: PowerShell (Surface Hub)

devices/surface-hub/change-surface-hub-device-account.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Change the Microsoft Surface Hub device account

devices/surface-hub/connect-and-display-with-surface-hub.md

@@ -130,7 +130,7 @@ When a Surface hub is connected to guest computer with the wired connect USB por
 
 -   HID-compliant mouse
 
-**Universal serial bus conntrollers**
+**Universal serial bus controllers**
 
 -   Generic USB hub
 
@@ -224,7 +224,7 @@ In replacement PC mode, the embedded computer of the Surface Hub is turned off a
 
 ### Software requirements
 
-You can run Surface Hub in replacement PC mode with 64-bit versions of Windows 10 Home, Windows 10 Pro and Windows 10 Enterprise. You can download the  [Surface Hub Replacement PC driver package](https://www.microsoft.com/en-us/download/details.aspx?id=52210) from the Microsoft download center. We recommend that you install these drivers on any computer you plan to use as a replacement PC.
+You can run Surface Hub in replacement PC mode with 64-bit versions of Windows 10 Home, Windows 10 Pro and Windows 10 Enterprise. You can download the  [Surface Hub Replacement PC driver package](https://www.microsoft.com/download/details.aspx?id=52210) from the Microsoft download center. We recommend that you install these drivers on any computer you plan to use as a replacement PC.
 
 ### Hardware requirements
 
@@ -389,7 +389,7 @@ Replacement PC ports on 84" Surface Hub.
 
 **To use replacement PC mode**
 
-1.  Download and install the [Surface Hub Replacement PC driver package](https://www.microsoft.com/en-us/download/details.aspx?id=52210) on the replacement PC.
+1.  Download and install the [Surface Hub Replacement PC driver package](https://www.microsoft.com/download/details.aspx?id=52210) on the replacement PC.
 
     **Note**  We recommend that you set sleep or hibernation on the replacement PC so the Surface Hub will turn off the display when it isn't being used.
 

devices/surface-hub/create-a-device-account-using-office-365.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Create a device account using UI (Surface Hub)
@@ -29,7 +30,7 @@ If you prefer to use a graphical user interface, you can create a device account
 1.  Sign in to Office 365 by visiting http://portal.office.com/admin/
 2.  Provide the admin credentials for your Office 365 tenant. This will take you to your Office 365 Admin Center.
 
-    ![office 365 admin center. ](images/setupdeviceaccto365-02.png)
+    ![Office 365 admin center.](images/setupdeviceaccto365-02.png)
 
 3.  Once you are at the Office 365 Admin Center, navigate to **Users** in the left panel, and then click **Active Users**.
 
@@ -43,7 +44,7 @@ If you prefer to use a graphical user interface, you can create a device account
 
 5.  Once the account has been successfully created, click **Close** on the resulting dialog box, and you will see the admin center Active Users list again.
 
-    ![confirmation screen for creating a new account. ](images/setupdeviceaccto365-05.png)
+    ![Confirmation screen for creating a new account.](images/setupdeviceaccto365-05.png)
 
 6.  Select the user you just created from the **Active Users** list. You need to disable the Skype for Business license, because you can’t create a Skype Meeting Room with this option.
 
@@ -51,7 +52,7 @@ If you prefer to use a graphical user interface, you can create a device account
 
     In the right panel you can see the account properties and several optional actions. The process so far has created a regular Skype account for this user, which you need to disable. Click **Edit** for the **Assigned license** section, then click the dropdown arrow next to the license to expand the details.
 
-    ![assign license for skype for business online.](images/setupdeviceaccto365-07.png)
+    ![assign license for Skype for Business online.](images/setupdeviceaccto365-07.png)
 
     From the list, uncheck **Skype for Business Online (plan 2)** (this license may vary depending on your organization), and click **SAVE**.
 
@@ -59,39 +60,39 @@ If you prefer to use a graphical user interface, you can create a device account
 
 1.  In the Office 365 Admin Center’s left panel, click **ADMIN**, and then click **Exchange**.
 
-    ![office 365 admin center, showing exchange active users. ](images/setupdeviceaccto365-08.png)
+    ![Office 365 admin center, showing exchange active users.](images/setupdeviceaccto365-08.png)
 
 2.  This will open another tab on your browser to take you to the Exchange Admin Center, where you can create and set the Mailbox Setting for Surface Hub.
 
-    ![exchange admin center. ](images/setupdeviceaccto365-09.png)
+    ![Exchange admin center.](images/setupdeviceaccto365-09.png)
 
 3.  To create a Mobile Device Mailbox Policy, click **Mobile** from the left panel and then click **Mobile device mailbox policies**. Surface Hubs require an account with a mobile device mailbox policy that does not require a password, so if you already have an existing policy that matches this requirement, you can apply that policy to the account. Otherwise use the following steps to create a new one to be used only for Surface Hub device accounts.
 
-    ![excahnge admin center - creating a mobile device mailbox policy. ](images/setupdeviceaccto365-10.png)
+    ![Excahnge admin center - creating a mobile device mailbox policy.](images/setupdeviceaccto365-10.png)
 
 4.  To create a New Surface Hub mobile device mailbox policy, click the **+** button from the controls above the list of policies to add a new policy. For the name, provide a name that will help you distinguish this policy from other device accounts (for example, *SurfaceHubDeviceMobilePolicy*). Make sure the policy does not require a password for the devices assigned to, so make sure **Require a Password** remains unchecked, then click **Save**.
 
-    ![image showing new mobile device policy](images/setupdeviceaccto365-11.png)
+    ![Image showing new mobile device policy.](images/setupdeviceaccto365-11.png)
 
 5.  After you have created the new mobile device mailbox policy, go back to the **Exchange Admin Center** and you will see the new policy listed.
 
-    ![image with new mobile device mailbox policy in exchange admin center. ](images/setupdeviceaccto365-12.png)
+    ![Image with new mobile device mailbox policy in Exchange admin center.](images/setupdeviceaccto365-12.png)
 
 6.  Now, to apply the ActiveSync policy without using PowerShell, you can do the following: In the EAC, click **Recipients** > **Mailboxes** and then select a mailbox.
 
-    ![image showing mailbox in exchange admin center. ](images/setupdeviceaccto365-13.png)
+    ![Image showing mailbox in Exchange admin center.](images/setupdeviceaccto365-13.png)
 
 7.  In the Details pane, scroll to **Phone and Voice Features** and click **View details** to display the **Mobile Device Details** screen.
 
-    ![image showing mobile device details for the mailbox. ](images/setupdeviceaccto365-14.png)
+    ![Image showing mobile device details for the mailbox.](images/setupdeviceaccto365-14.png)
 
 8.  The mobile device mailbox policy that’s currently assigned is displayed. To change the mobile device mailbox policy, click **Browse**.
 
-    ![image with details for the mobile device policy. ](images/setupdeviceaccto365-15.png)
+    ![Image with details for the mobile device policy.](images/setupdeviceaccto365-15.png)
 
 9.  Choose the appropriate mobile device mailbox policy from the list, click **OK** and then click **Save**.
 
-    ![image showing multiple mobile device mailbox policies. ](images/setupdeviceaccto365-16.png)
+    ![Image showing multiple mobile device mailbox policies.](images/setupdeviceaccto365-16.png)
 
 ### <a href="" id="create-device-acct-o365-complete-acct"></a>Use PowerShell to complete device account creation
 
@@ -107,11 +108,11 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
 
 1.  Run Windows PowerShell as Administrator.
 
-    ![image showing how to start windows powershell and run as administrator. ](images/setupdeviceaccto365-17.png)
+    ![Image showing how to start Windows PowerShell and run as administrator.](images/setupdeviceaccto365-17.png)
 
 2.  Create a Credentials object, then create a new session that connects to Skype for Business Online, and provide the global tenant administrator account, then click **OK**.
 
-    ![image for windows powershell credential request. ](images/setupdeviceaccto365-18.png)
+    ![Image for Windows PowerShell credential request. ](images/setupdeviceaccto365-18.png)
 
 3.  To connect to Microsoft Online Services, run:
 
@@ -119,7 +120,7 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
     Connect-MsolService -Credential $Cred
     ```
 
-    ![image showing powershell cmdlet.](images/setupdeviceaccto365-19.png)
+    ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-19.png)
 
 4.  Now to connect to Skype for Business Online Services, run:
 
@@ -127,7 +128,7 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
     $sfbsession = New-CsOnlineSession -Credential $cred
     ```
 
-    ![image showing powershell cmdlet.](images/setupdeviceaccto365-20.png)
+    ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-20.png)
 
 5.  Finally, to connect to Exchange Online Services, run:
 
@@ -136,7 +137,7 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
     "https://outlook.office365.com/powershell-liveid/" -Credential $cred -Authentication "Basic" –AllowRedirection
     ```
 
-    ![image showing powershell cmdlet.](images/setupdeviceaccto365-21.png)
+    ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-21.png)
 
 6.  Now you have to import the Skype for Business Online Session and the Exchange Online session you have just created, which will import the Exchange and Skype Commands so you can use them locally.
 
@@ -147,7 +148,7 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
 
     Note that this could take a while to complete.
 
-    ![image showing powershell cmdlet.](images/setupdeviceaccto365-22.png)
+    ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-22.png)
 
 7.  Once you’re connected to the online services you need to run a few more cmdlets to configure this account as a Surface Hub device account.
 
@@ -180,11 +181,11 @@ Now that you're connected to the online services, you can finish setting up the
 
     You will see the correct email address.
 
-    ![image showing powershell cmdlet.](images/setupdeviceaccto365-23.png)
+    ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-23.png)
 
 2.  You need to convert the account into to a room mailbox, so run:
 
-    ![image showing powershell cmdlet.](images/setupdeviceaccto365-24.png)
+    ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-24.png)
 
     ``` syntax
     Set-Mailbox $strEmail -Type Room
@@ -196,7 +197,7 @@ Now that you're connected to the online services, you can finish setting up the
     Set-Mailbox $strEmail -RoomMailboxPassword (ConvertTo-SecureString  -String "<your password>" -AsPlainText -Force) -EnableRoomMailboxAccount $true
     ```
 
-    ![image showing powershell cmdlet.](images/setupdeviceaccto365-25.png)
+    ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-25.png)
 
 4.  Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
 
@@ -205,7 +206,7 @@ Now that you're connected to the online services, you can finish setting up the
     Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a <tla rid="surface_hub"/> room!"
     ```
 
-    ![image showing powershell cmdlet.](images/setupdeviceaccto365-26.png)
+    ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-26.png)
 
 5.  If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information.
 
@@ -260,11 +261,11 @@ You can use the Exchange Admin Center to create a device account:
 1.  Sign in to your Exchange Admin Center using Exchange admin credentials.
 2.  Once you are at the Exchange Admin Center (EAC), navigate to **Recipients** in the left panel.
 
-    ![image showing mailboxes in exchange admin center. ](images/setupdeviceacctexch-01.png)
+    ![Image showing mailboxes in Exchange admin center.](images/setupdeviceacctexch-01.png)
 
 3.  On the controls above the list of mailboxess, choose **+** to create a new one, and provide a **Display name**, **Name**, and **User logon name**, and then click **Save**.
 
-    ![image showing creating a new mailbox. ](images/setupdeviceacctexch-02.png)
+    ![Image showing creating a new mailbox.](images/setupdeviceacctexch-02.png)
 
 ### <a href="" id="create-device-acct-exch-mbx-policy"></a>Create a mobile device mailbox policy from the Exchange Admin Center
 
@@ -274,19 +275,19 @@ You can use the Exchange Admin Center to create a device account:
 
 1.  Go to the Exchange Admin Center.
 
-    ![image showing exchange admin center. ](images/setupdeviceacctexch-03.png)
+    ![Image showing Exchange admin center.](images/setupdeviceacctexch-03.png)
 
 2.  To create a mobile device mailbox policy, click **Mobile** from the left panel, then **Mobile device mailbox policies**. Surface Hubs require an account with a mobile device mailbox policy that does not require a password, so if you already have an existing policy that matches this requirement, you can apply that policy to the account. Otherwise use the following steps to create a new one to be used only for Surface Hub device accounts.
 
-    ![image showing using exchange admin center to create a mobile device mailbox policy. ](images/setupdeviceacctexch-05.png)
+    ![Image showing using Exchange admin center to create a mobile device mailbox policy.](images/setupdeviceacctexch-05.png)
 
 3.  To create a new mobile device account mailbox policy, click the **+** button from the controls above the list of policies to add a new policy. For the name provide a name that will help you distinguish this policy from other device accounts (for example, *SurfaceHubDeviceMobilePolicy*). The policy must not be password-protected, so make sure **Require a Password** remains unchecked, then click **Save**.
 
-    ![image showing new mobile device mailbox policy. ](images/setupdeviceacctexch-06.png)
+    ![Image showing new mobile device mailbox policy.](images/setupdeviceacctexch-06.png)
 
 4.  After you have created the new mobile device mailbox policy, go back to the Exchange Admin Center and you will see the new policy listed.
 
-    ![image showing new mobile device mailbox policy in exchange admin center. ](images/setupdeviceacctexch-07.png)
+    ![Image showing new mobile device mailbox policy in Exchange admin center.](images/setupdeviceacctexch-07.png)
 
 5.  To apply the ActiveSync policy without using PowerShell, you can do the following:
 

devices/surface-hub/create-and-test-a-device-account-surface-hub.md

@@ -116,7 +116,7 @@ You can check online for updated versions at [Surface Hub device account scripts
 
 Your infrastructure will likely fall into one of three configurations. Which configuration you have will affect how you prepare for device setup.
 
-![](images/deploymentoptions-01.png)
+![Image showing deployment options: online, on-premises, or hybrid.](images/deploymentoptions-01.png)
 
 -   [Online deployment (Office 365)](online-deployment-surface-hub-device-accounts.md): Your organization’s environment is deployed entirely on Office 365.
 -   [On-premises deployment](on-premises-deployment-surface-hub-device-accounts.md): Your organization has servers that it controls, where Active Directory, Exchange, and Skype for Business (or Lync) are hosted.

devices/surface-hub/device-reset-suface-hub.md

@@ -2,6 +2,7 @@
 title: Device reset (Surface Hub)
 description: You may wish to reset your Microsoft Surface Hub.
 ms.assetid: 44E82EEE-1905-464B-A758-C2A1463909FF
+redirect_url: https://technet.microsoft.com/itpro/surface-hub/device-reset-surface-hub
 keywords: reset Surface Hub
 ms.prod: w10
 ms.mktglfcycl: manage
@@ -10,33 +11,6 @@ ms.pagetype: surfacehub
 author: TrudyHa
 ---
 
-# Device reset (Surface Hub)
-
-
-You may wish to reset your Microsoft Surface Hub.
-
-Typical reasons for a reset include:
-
--   The device isn’t running well after installing an update.
--   You’re repurposing the device for a new meeting space and want to reconfigure it.
--   You want to change how you locally manage the device.
-
-Initiating a reset will return the device to the last cumulative Windows update, and remove all local user files and configuration, including:
-
--   The device account
--   MDM enrollment
--   Domain join or Azure AD join information
--   Local admins on the device
--   Configurations from MDM or the Settings app.
-
-After the reset, you'll be taken through the [first run program](first-run-program-surface-hub.md) again.
-
-## Related topics
-
-
-[Manage Microsoft Surface Hub](manage-surface-hub.md)
-
-[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
 
  
 

devices/surface-hub/device-reset-surface-hub.md

@@ -0,0 +1,55 @@
+---
+title: Device reset (Surface Hub)
+description: You may wish to reset your Microsoft Surface Hub.
+ms.assetid: 44E82EEE-1905-464B-A758-C2A1463909FF
+keywords: reset Surface Hub
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: surfacehub
+author: TrudyHa
+---
+
+# Device reset (Surface Hub)
+
+
+You may wish to reset your Microsoft Surface Hub.
+
+Typical reasons for a reset include:
+
+-   The device isn’t running well after installing an update.
+-   You’re repurposing the device for a new meeting space and want to reconfigure it.
+-   You want to change how you locally manage the device.
+
+Initiating a reset will return the device to the last cumulative Windows update, and remove all local user files and configuration, including:
+
+-   The device account
+-   MDM enrollment
+-   Domain join or Azure AD join information
+-   Local admins on the device
+-   Configurations from MDM or the Settings app
+
+**To reset a Surface Hub**
+1.	On your Surface Hub, open **Settings**. 
+
+    ![Image showing Settings app for Surface Hub.](images/sh-settings.png)
+ 
+2.	Click **Update & Security**.
+
+    ![Image showing Update & Security group in Settings app for Surface Hub.](images/sh-settings-update-security.png)
+ 
+3.	Click **Recovery**, and then click **Get started**.
+
+    ![Image showing Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png) 
+
+**Important Note**</br>
+Performing a device reset may take up to 6 hours. Do not interrupt the reset process. Interrupting the process will render the device inoperable, requiring warranty service to return to normal functionality.
+
+After the reset, Surface Hub restarts the [first run program](first-run-program-surface-hub.md) again. 
+
+## Related topics
+
+
+[Manage Microsoft Surface Hub](manage-surface-hub.md)
+
+[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)

devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Microsoft Exchange properties (Surface Hub)

devices/surface-hub/first-run-program-surface-hub.md

@@ -46,7 +46,7 @@ This is the first screen you'll see when you power up the Surface Hub for the fi
 
  
 
-![icd options checklist](images/setuplocale.png)
+![Image showing ICD options checklist.](images/setuplocale.png)
 
 ### Details
 
@@ -72,7 +72,7 @@ If no wired connection can be found, then the device will attempt to set up a wi
 
 If your device does not detect a wired connection that it can use to connect to a network or the Internet, you will see this page. Here you can either connect to a wireless network, or skip making the network connection.
 
-![](images/setupnetworksetup-1.png)
+![Image shoring Network setup page.](images/setupnetworksetup-1.png)
 
 ### Details
 
@@ -97,7 +97,7 @@ If you want to connect to a secured wireless network from this page, click on th
 
 This page will be shown when you've selected a secured wireless network.
 
-![](images/setupnetworksetup-3.png)
+![Image showing wireless network setup page.](images/setupnetworksetup-3.png)
 
 ### Details
 
@@ -121,11 +121,11 @@ This page will be shown when the device detects a wired connection with limited
 
 -   You can select **Enter proxy settings** which will allow you to specify how to use the network proxy. You'll be taken to the next screen.
 
-![](images/setupnetworksetup-2.png)
+![Image showing network proxy page.](images/setupnetworksetup-2.png)
 
 This is the screen you'll see if you clicked **Enter proxy settings** on the previous screen.
 
-![](images/setupnetworksetup-4.png)
+![Image showing proxy server setting details.](images/setupnetworksetup-4.png)
 
 ### Details
 
@@ -149,7 +149,7 @@ You can skip connecting to a network by selecting **Skip this step**. You'll be
 
 This screen is purely informational, and shows which recommended settings have been enabled by default.
 
-![](images/setupsetupforyou.png)
+![Image showing set up for you page.](images/setupsetupforyou.png)
 
 ### Details
 
@@ -170,7 +170,7 @@ On this page, the Surface Hub will ask for credentials for the device account th
 
  
 
-![icd options checklist](images/setupdeviceacct.png)
+![Image showing Enter device account info page.](images/setupdeviceacct.png)
 
 ### Details
 
@@ -192,7 +192,7 @@ If you skip setting it up now, you can add a device account later by using the S
 
 If you click **Skip setting up a device account**, the device will display a dialog box showing what will happen if the device doesn't have a device account. If you choose **Yes, skip this**, you will be sent to the [Name this device page](#name-this-device).
 
-![icd options checklist](images/setupskipdeviceacct.png)
+![Image showing message the is displaed to confirm you want to skip creating a device account.](images/setupskipdeviceacct.png)
 
 ### What happens?
 
@@ -211,7 +211,7 @@ The device will use the UPN or DOMAIN\\User name and password for the device acc
 
 This page will only be shown if there's a problem. Typically, it means that the device account that you provided was found in Active Directory (AD) or Azure Active Directory (Azure AD), but the Exchange server for the account was not discovered.
 
-![icd options checklist](images/setupexchangeserver-01.png)
+![Image showing Exchange server page.](images/setupexchangeserver-01.png)
 
 ### Details
 
@@ -230,7 +230,7 @@ You can enable Exchange services for a device account later by using the Setting
 
 If you click **Skip setting up Exchange services**, the device will display a dialog showing what will happen. If you choose **Yes, skip this**, then Exchange services will not be set up.
 
-![icd options checklist](images/setupexchangeserver-02.png)
+![Image showing confirmation message that is displayed when you skip setting up Exchange services.](images/setupexchangeserver-02.png)
 
 ### What happens?
 
@@ -249,7 +249,7 @@ This page will be shown when:
 -   Exchange supported protocols are not supported by the Surface Hub.
 -   Exchange returns incorrect XML.
 
-![icd options checklist](images/setupexchangepolicies.png)
+![Image showing Exchange policis page.](images/setupexchangepolicies.png)
 
 ### Details
 
@@ -273,7 +273,7 @@ If you choose to skip this check, the Surface Hub will stop looking for the Exch
 
 This page asks you to provide two names that will be used for identifying the Surface Hub.
 
-![icd options checklist](images/setupnamedevice.png)
+![Image showing Name this device page.](images/setupnamedevice.png)
 
 ### Details
 
@@ -307,7 +307,7 @@ Because every Surface Hub can be used by any number of authenticated employees,
 
  
 
-![icd options checklist](images/setupsetupadmins.png)
+![Image showing Set up admins for this device page.](images/setupsetupadmins.png)
 
 ### Details
 
@@ -348,7 +348,7 @@ Joining Azure AD has two primary benefits:
 1.  Some employees from your organization will be able to access the device as admins, and will be able to start the Settings app and configure the device. People that have admin permissions will be defined in your Azure AD subscription.
 2.  If your Azure AD is connected to a mobile device management (MDM) solution, the device will enroll with that MDM solution so you can apply policies and configuration.
 
-![](images/setupjoiningazuread-1.png)
+![Image showing message when you join your Surface Hub to Azure Active Directory.](images/setupjoiningazuread-1.png)
 
 ### Details
 
@@ -357,11 +357,11 @@ The following input is required:
 -   **User's UPN:** The user principal name (UPN) of an account that can join Azure AD.
 -   **Password:** The password of the account you’re using to join Azure AD.
 
-![](images/setupjoiningazuread-2.png)
+![Image showing account log in info.](images/setupjoiningazuread-2.png)
 
 If you get to this point and don't have valid credentials for an Azure AD account, the device will allow you to continue by creating a local admin account. Click **Set up Windows with a local account instead**.
 
-![](images/setupjoiningazuread-3.png)
+![Image showing Set up an admin account page.](images/setupjoiningazuread-3.png)
 
 ### What happens?
 
@@ -373,7 +373,7 @@ This page will ask for credentials to join a domain so that the Surface Hub can
 
 Once the device has been domain joined, you must specify a security group from the domain you joined. This security group will be provisioned as administrators on the Surface Hub, and anyone from the security group can enter their domain credentials to access Settings.
 
-![icd options checklist](images/setupdomainjoin.png)
+![Image showing Set up admins using domain join page.](images/setupdomainjoin.png)
 
 ### Details
 
@@ -385,7 +385,7 @@ The following input is required:
 
 After the credentials are verified, you will be asked to type a security group name. This input is required.
 
-![icd options checklist](images/setupsecuritygroup-1.png)
+![Image showing Enter a security group page.](images/setupsecuritygroup-1.png)
 
 ### What happens?
 
@@ -401,7 +401,7 @@ If the join is successful, you'll see the **Enter a security group** page. When
 
 If you decide not to use Azure Active Directory (Azure AD) or Active Directory (AD) to manage the Surface Hub, you'll need to create a local admin account.
 
-![](images/setuplocaladmin.png)
+![Image showing Set up an admin account for local admin.](images/setuplocaladmin.png)
 
 ### Details
 

devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Hybrid deployment (Surface Hub)
@@ -21,17 +22,17 @@ Use this procedure if you use Exchange on-prem.
     - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
     - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.<p>
     
-        ![new object box for creating a new user in active directory](images/hybriddeployment-01a.png)
+        ![New object box for creating a new user in active directory.](images/hybriddeployment-01a.png)
 
     - Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
 
         >**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
 
-        ![image showing password dialog box](images/hybriddeployment-02a.png)
+        ![Image showing password dialog box.](images/hybriddeployment-02a.png)
         
     -   Click **Finish** to create the account.
 
-        ![image with account name, logon name, and password options for new user](images/hybriddeployment-03a.png)
+        ![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png)
 
 2.  After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Office 365 admin center and verify that the account created in the previous steps has merged to online.
 
@@ -223,17 +224,17 @@ Use this procedure if you use Exchange online.
     - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
     - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.
 
-        ![new object box for creating a new user in active directory](images/hybriddeployment-01a.png)
+        ![New object box for creating a new user in Active Directory.](images/hybriddeployment-01a.png)
 
     - Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
     
         >**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
     
-        ![image showing password dialog box](images/hybriddeployment-02a.png)
+        ![Image showing password dialog box.](images/hybriddeployment-02a.png)
     
     - Click **Finish** to create the account.
 
-        ![image with account name, logon name, and password options for new user](images/hybriddeployment-03a.png)
+        ![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png)
 
 6.  Directory synchronization.
 

devices/surface-hub/index.md

@@ -7,6 +7,7 @@ ms.mktglfcycl: explore
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Microsoft Surface Hub

devices/surface-hub/install-apps-on-surface-hub.md

@@ -2,7 +2,7 @@
 title: Install apps on your Microsoft Surface Hub
 description: Admins can install apps can from either the Windows Store or the Windows Store for Business.
 ms.assetid: 3885CB45-D496-4424-8533-C9E3D0EDFD94
-keywords: [install apps, Windows Store, Windows Store for Business
+keywords: install apps, Windows Store, Windows Store for Business
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.sitesec: library

devices/surface-hub/intro-to-surface-hub.md

@@ -37,7 +37,7 @@ The capabilities of your Surface Hub will depend on what other Microsoft product
 </tr>
 <tr class="even">
 <td align="left"><p>Meetings using Skype for Business</p></td>
-<td align="left"><p>Device account with Skype for Business (Lync 2010 or later) or Skype for Business Online, and a network connection so the account can be accessed.</p></td>
+<td align="left"><p>Device account with Skype for Business (Lync Server 2013 or later) or Skype for Business Online, and a network connection so the account can be accessed.</p></td>
 </tr>
 <tr class="odd">
 <td align="left"><p>Web browsing through Microsoft Edge</p></td>

devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub, mobility
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Manage settings with an MDM provider (Surface Hub)
@@ -30,11 +31,11 @@ If you joined your Surface Hub to an Azure Active Directory (Azure AD) subscript
 
 Alternatively, the device can be enrolled like any other Windows device by going to **Settings** > **Accounts** > **Work access**.
 
-![image showing enroll in device maagement page. ](images/managesettingsmdm-enroll.png)
+![Image showing enroll in device maagement page.](images/managesettingsmdm-enroll.png)
 
 ### Manage a device through MDM
 
-The following table lists the device settings that can be managed remotely using MDM, including the OMA URI paths that 3rd party MDM providers need to create policies. Intune and SCCM have special templates to help create policies to manage these settings.
+The following table lists the device settings that can be managed remotely using MDM, including the OMA URI paths that 3rd party MDM providers need to create policies. Intune and System Center Configuration Manager have special templates to help create policies to manage these settings.
 
 <table>
 <colgroup>

devices/surface-hub/monitor-surface-hub.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Monitor your Microsoft Surface Hub

devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # On-premises deployment (Surface Hub)

devices/surface-hub/online-deployment-surface-hub-device-accounts.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Online deployment with Office 365 (Surface Hub)

devices/surface-hub/physically-install-your-surface-hub-device.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub, readiness
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Physically install Microsoft Surface Hub

devices/surface-hub/prepare-your-environment-for-surface-hub.md

@@ -29,7 +29,7 @@ In order to function properly, the Surface Hub must have access to a wired or wi
 -   Can receive an IP address using DHCP
 -   Open ports:
     -   HTTPS: 443
-    -   HTTP: 8080
+    -   HTTP: 80
 
 A wired connection is preferred.
 
@@ -79,7 +79,7 @@ In order to ensure that your environment is ready for the Surface Hub, verify th
     -   It must have these ports open:
 
         -   HTTPS: 443
-        -   HTTP: 8080
+        -   HTTP: 80
 
         If your network runs through a proxy, you'll need the proxy address or script information as well.
 

devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md

@@ -34,7 +34,7 @@ Provisioning packages are created using Windows Imaging and Configuration Design
 
 ### <a href="" id="what-can-prov-pkg"></a>What can provisioning packages configure for Surface Hubs?
 
-Currently, you can use provisioning packages to install certificates and to install Universal App Platform (UAP) apps on your Surface Hub. These are the only two supported scenarios.
+Currently, you can use provisioning packages to install certificates and to install Universal Windows Platform (UWP) apps on your Surface Hub. These are the only two supported scenarios.
 
 You may use provisioning packages to install certificates that will allow the device to authenticate to Microsoft Exchange or Skype for Business, or to sideload apps that don't come from the Windows Store (for example, your own in-house apps).
 
@@ -58,9 +58,7 @@ In order to create and deploy provisioning packages, all of the following are re
 ### <a href="" id="installing-wicd-prov-pkg"></a>Install the Windows Imaging and Configuration Designer
 
 1.  The Windows Imaging and Configuration Designer (ICD) is installed as part of the Windows 10 ADK. The installer for the ADK can be downloaded from the [Microsoft Download Center](http://go.microsoft.com/fwlink/?LinkId=718147).
-    >**Note**  The ADK must be installed on a separate PC, not on the Surface Hub.
+    >**Note**  The ADK must be installed on a separate PC, not on the Surface Hub.  
-
-     
 
 2.  Run the installer, and set your preferences for installation. When asked what features you want to install, you will see a checklist like the one in the following figure. Note that **Windows Performance Toolkit** and **Windows Assessment Toolkit** should be unchecked, as they are not needed to run the ICD.
 
@@ -73,7 +71,7 @@ In order to create and deploy provisioning packages, all of the following are re
 
     All four of these features are required to run the ICD and create a package for the Surfact Hub.
 
-    ![icd options checklist](images/idcfeatureschecklist.png)
+    ![Image showing Windows ADK install page - select features to install.](images/idcfeatureschecklist.png)
 
 3.  Continue with the installer until the ADK is installed. This may take a while, because the installer downloads remote content.
 
@@ -83,29 +81,29 @@ This example will demonstrate how to create a provisioning package to install a
 
 1.  On the PC that had the Windows 10 ADK installed, open ICD and choose the **New provisioning package** tile from the main menu.
 
-    ![icd tiles](images/wicd-screen01a.png)
+    ![Image showing Start page in Windows Imaging and Configuration Designer.](images/wicd-screen01a.png)
 
 2.  When the **New project** dialog box opens, type whatever name you like in the **Name** box. The **Location** and **Description** boxes can also be filled at your discretion, though we recommend using the **Description** box to help you distinguish among multiple packages. Click **Next**.
 
-    ![icd tiles](images/wicd-screen02a.png)
+    ![Image showing New project screen for Windows Imaging and Configuration Designer.](images/wicd-screen02a.png)
 
     Select the settings that are **Common to all Windows editions**, and click **Next**.
 
-    ![icd tiles](images/wicd-screen02b.png)
+    ![Image showing project settings in Windows Imaging and Configuration Designer.](images/wicd-screen02b.png)
 
     When asked to import a provisioning package, just click **Finish.**
 
-    ![icd tiles](images/wicd-screen02c.png)
+    ![Image showing option for importing a provisioning package.](images/wicd-screen02c.png)
 
 3.  ICD's main screen will be displayed. This is where you create the provisioning package. In the **Available customizations** pane, expand **Runtime settings** and then expand **Certificates**. Click **Root certificates**.
 
-    ![icd tiles](images/wicd-screen03a.png)
+    ![Image showing Windows Imaging and Configuration Designer's man page.](images/wicd-screen03a.png)
 
     In the center pane, you’ll be asked to specify a **CertificateName** for the Root certificate. You can set this to whatever you want. For the example, we've used the same name as the project. Click **Add**, and an entry will be added in the left pane.
 
 4.  In the **Available customizations** pane on the left, a new category has appeared for **CertificatePath** underneath the **CertificateName** you provided. There’s also a red exclamation icon indicating that there is a required field that needs to be set. Click **CeritficatePath**.
 
-    ![icd tiles](images/wicd-screen04a.png)
+    ![Image showing available customizations in Windows Imaging and Configuration Designer.](images/wicd-screen04a.png)
 
 5.  In the center pane, you’ll be asked to specify the path for the certificate. Enter the name of the .cer file that you want to deploy, either by typing or clicking **Browse**. It must be a root certificate. The provisioning package created will copy the .cer file into the package it creates.
 
@@ -238,15 +236,15 @@ The following two methods for deploying provisioning packages apply to any kind
 3.  Navigate to **System &gt; Work Access**. Under the header **Related settings**, click on **Add or remove a management package**.
 4.  Here, click the button for **Add a package**.
 
-    ![](images/provisioningpackagesettings-01.png)
+    ![Image showing provisioining packages page in Settings.](images/provisioningpackagesettings-01.png)
 
 5.  Click **Removable media** from the dropdown list. You will see a list of available provisioning packages on the **Settings** page.
 
-    ![](images/provisioningpackagesettings-02.png)
+    ![Image showing add a package page in Settings.](images/provisioningpackagesettings-02.png)
 
 6.  Choose your package and click **Add**.
 
-    ![](images/provisioningpackagesettings-03.png)
+    ![Image showing select a package box.](images/provisioningpackagesettings-03.png)
 
 7.  You may have to re-enter the admin credentials if User Access Control (UAC) asks for them.
 8.  You’ll see a confirmation dialog box. Click **Yes, add it**. The certificate will be installed.

devices/surface-hub/save-bitlocker-key-surface-hub.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub, security
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Save your BitLocker key (Surface Hub)

devices/surface-hub/set-up-your-surface-hub.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Set up Microsoft Surface Hub

devices/surface-hub/setup-worksheet-surface-hub.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Setup worksheet (Surface Hub)

devices/surface-hub/surface-hub-administrators-guide.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Microsoft Surface Hub administrator's guide

devices/surface-hub/troubleshoot-surface-hub.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: support
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Troubleshoot Microsoft Surface Hub
@@ -43,7 +44,7 @@ Possible fixes for issues on the Surface Hub after you've completed the first-ru
 <p>The device account isn't configured to automatically accept/decline messages.</p>
 </td>
 <td>
-<p>Use PowerShell<code>cmdlet Set-CalendarProcessing $upn -AutomateProcessing AutoAccept</code>.</p>
+<p>Use PowerShell cmdlet <code>Set-CalendarProcessing $upn -AutomateProcessing AutoAccept</code>.</p>
 </td>
 </tr>
 <tr>
@@ -291,7 +292,7 @@ Possible fixes for issues with Surface Hub first-run program.
 </tr>
 <tr>
 <td rowspan="3">
-<div class="alert"><b>Note</b>  <p class="note">People land on the page titled "There's a problem with this account" regarding ActiveSync.</p>
+<div><p>People land on the page titled "There's a problem with this account" regarding ActiveSync.</p>
 </div>
 <div> </div>
 </td>
@@ -456,7 +457,7 @@ This section lists status codes, mapping, user messages, and actions an admin ca
 </colgroup>
 <thead>
 <tr class="header">
-<th align="left">Status Code</th>
+<th align="left">Hex Code</th>
 <th align="left">Mapping</th>
 <th align="left">User-Friendly Message</th>
 <th align="left">Action admin should take</th>
@@ -464,149 +465,148 @@ This section lists status codes, mapping, user messages, and actions an admin ca
 </thead>
 <tbody>
 <tr class="odd">
-<td align="left"><p>-2063532030</p></td>
+<td align="left"><p>0x85010002</p></td>
 <td align="left"><p>E_HTTP_DENIED</p></td>
 <td align="left"><p>The password must be updated.</p></td>
 <td align="left"><p>Update the password.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2147012867</p></td>
+<td align="left"><p>0x80072EFD</p></td>
 <td align="left"><p>WININET_E_CANNOT_CONNECT</p></td>
 <td align="left"><p>Can’t connect to the server right now. Wait a while and try again, or check the account settings.</p></td>
 <td align="left"><p>Verify that the server name is correct and reachable. Verify that the device is connected to the network.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>-2046817239</p></td>
+<td align="left"><p>0x86000C29</p></td>
 <td align="left"><p>E_NEXUS_STATUS_DEVICE_NOTPROVISIONED (policies don’t match)</p></td>
-<td align="left"><p>The account is configured with policies not compatible with Surface Hub</p>
+<td align="left"><p>The account is configured with policies not compatible with Surface Hub.</p></td>
-.</td>
 <td align="left"><p>Disable the <strong>PasswordEnabled</strong> policy for this account.</p>
 <p>We have a bug were we may surface policy errors if the account doesn’t receive any server notifications within the policy refresh interval.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2046817204</p></td>
+<td align="left"><p>0x86000C4C</p></td>
 <td align="left"><p>E_NEXUS_STATUS_MAXIMUMDEVICESREACHED</p></td>
 <td align="left"><p>The account has too many device partnerships.</p></td>
 <td align="left"><p>Delete one or more partnerships on the server.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>-2046817270</p></td>
+<td align="left"><p>0x86000C0A</p></td>
 <td align="left"><p>E_NEXUS_STATUS_SERVERERROR_RETRYLATER</p></td>
 <td align="left"><p>Can’t connect to the server right now.</p></td>
 <td align="left"><p>Wait until the server comes back online. If the issue persists, re-provision the account.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2063269885</p></td>
+<td align="left"><p>0x85050003</p></td>
 <td align="left"><p>E_CREDENTIALS_EXPIRED (Credentials have expired and need to be updated)</p></td>
 <td align="left"><p>The password must be updated.</p></td>
 <td align="left"><p>Update the password.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>-2063269875</p></td>
+<td align="left"><p>0x8505000D</p></td>
 <td align="left"><p>E_AIRSYNC_RESET_RETRY</p></td>
 <td align="left"><p>Can’t connect to the server right now. Wait a while or check the account’s settings.</p></td>
 <td align="left"><p>This is normally a transient error but if the issue persists check the number of devices associated with the account and delete some of them if the number is large.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2046817258</p></td>
+<td align="left"><p>0x86000C16</p></td>
 <td align="left"><p>E_NEXUS_STATUS_USER_HASNOMAILBOX</p></td>
 <td align="left"><p>The mailbox was migrated to a different server.</p></td>
 <td align="left"><p>You should never see this error. If the issue persists, re-provision the account.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>-2063532028</p></td>
+<td align="left"><p>0x85010004</p></td>
 <td align="left"><p>E_HTTP_FORBIDDEN</p></td>
 <td align="left"><p>Can’t connect to the server right now. Wait a while and try again, or check the account’s settings.</p></td>
 <td align="left"><p>Verify the server name to make sure it is correct. If the account is using cert based authentication make sure the certificate is still valid and update it if not.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2063400920</p></td>
+<td align="left"><p>0x85030028</p></td>
 <td align="left"><p>E_ACTIVESYNC_PASSWORD_OR_GETCERT</p></td>
 <td align="left"><p>The account’s password or client certificate are missing or invalid.</p></td>
 <td align="left"><p>Update the password and/or deploy the client certificate.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>-2046817238</p></td>
+<td align="left"><p>0x86000C2A</p></td>
 <td align="left"><p>E_NEXUS_STATUS_DEVICE_POLICYREFRESH</p></td>
 <td align="left"><p>The account is configured with policies not compatible with Surface Hub.</p></td>
 <td align="left"><p>Disable the PasswordEnabled policy for this account.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2063269886</p></td>
+<td align="left"><p>0x85050002</p></td>
 <td align="left"><p>E_CREDENTIALS_UNAVAILABLE</p></td>
 <td align="left"><p>The password must be updated.</p></td>
 <td align="left"><p>Update the password.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>-2147012894</p></td>
+<td align="left"><p>0x80072EE2</p></td>
 <td align="left"><p>WININET_E_TIMEOUT</p></td>
 <td align="left"><p>The network doesn’t support the minimum idle timeout required to receive server notification, or the server is offline.</p></td>
 <td align="left"><p>Verify that the server is running. Verify the NAT settings.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2063589372</p></td>
+<td align="left"><p>0x85002004</p></td>
 <td align="left"><p>E_FAIL_ABORT</p></td>
 <td align="left"><p>This error is used to interrupt the hanging sync, and will not be exposed to users. It will be shown in the telemetry if you force an interactive sync, delete the account, or update its settings.</p></td>
 <td align="left"><p>Nothing.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>-2063532009</p></td>
+<td align="left"><p>0x85010017</p></td>
 <td align="left"><p>E_HTTP_SERVICE_UNAVAIL</p></td>
 <td align="left"><p>Can’t connect to the server right now. Wait a while or check the account’s settings.</p></td>
 <td align="left"><p>Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2046817267</p></td>
+<td align="left"><p>0x86000C0D</p></td>
 <td align="left"><p>E_NEXUS_STATUS_MAILBOX_SERVEROFFLINE</p></td>
 <td align="left"><p>Can’t connect to the server right now. Wait a while or check the account’s settings.</p></td>
 <td align="left"><p>Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>-2063400921</p></td>
+<td align="left"><p>0x85030027</p></td>
 <td align="left"><p>E_ACTIVESYNC_GETCERT</p></td>
 <td align="left"><p>The Exchange server requires a certificate.</p></td>
 <td align="left"><p>Import the appropriate EAS certificate on the Surface Hub.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2046817237</p></td>
+<td align="left"><p>0x86000C2B</p></td>
 <td align="left"><p>E_NEXUS_STATUS_INVALID_POLICYKEY</p></td>
 <td align="left"><p>The account is configured with policies not compatible with Surface Hub.</p></td>
 <td align="left"><p>Disable the PasswordEnabled policy for this account.</p>
 <p>We have a bug were we may surface policy errors if the account doesn’t receive any server notifications within the policy refresh interval.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>-2063532027</p></td>
+<td align="left"><p>0x85010005</p></td>
 <td align="left"><p>E_HTTP_NOT_FOUND</p></td>
 <td align="left"><p>The server name is invalid.</p></td>
 <td align="left"><p>Verify the server name to make sure it is correct. If the issue persists, re-provision the account.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>-2063532012</p></td>
+<td align="left"><p>0x85010014</p></td>
 <td align="left"><p>E_HTTP_SERVER_ERROR</p></td>
 <td align="left"><p>Can’t connect to the server.</p></td>
 <td align="left"><p>Verify the server name to make sure it is correct. Trigger a sync and, if the issue persists, re-provision the account.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>0x80072ee7</p></td>
+<td align="left"><p>0x80072EE7</p></td>
-<td align="left"></td>
+<td align="left"><p>WININET_E_NAME_NOT_RESOLVED</p></td>
 <td align="left"><p>The server name or address could not be resolved.</p></td>
 <td align="left"><p>Make sure the server name is entered correctly.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>0x8007052f</p></td>
+<td align="left"><p>0x8007052F</p></td>
-<td align="left"></td>
+<td align="left"><p>ERROR_ACCOUNT_RESTRICTION</p></td>
 <td align="left"><p>While auto-discovering the Exchange server, a policy is applied that prevents the logged-in user from logging in to the server.</p></td>
 <td align="left"><p>This is a timing issue. Re-verify the account's credentials. Try to re-provision when they're correct.</p></td>
 </tr>
 <tr class="odd">
-<td align="left"><p>0x800c0019</p></td>
+<td align="left"><p>0x800C0019</p></td>
-<td align="left"></td>
+<td align="left"><p>INET_E_INVALID_CERTIFICATE</p></td>
 <td align="left"><p>Security certificate required to access this resource is invalid.</p></td>
 <td align="left"><p>Install the correct ActiveSync certificate needed for the provided device account.</p></td>
 </tr>
 <tr class="even">
-<td align="left"><p>0x80072f0d</p></td>
+<td align="left"><p>0x80072F0D</p></td>
-<td align="left"></td>
+<td align="left"><p>WININET_E_INVALID_CA</p></td>
 <td align="left"><p>The certificate authority is invalid or is incorrect. Could not auto-discover the Exchange server because a certificate is missing.</p></td>
 <td align="left"><p>Install the correct ActiveSync certificate needed for the provided device account.</p></td>
 </tr>
@@ -616,12 +616,6 @@ This section lists status codes, mapping, user messages, and actions an admin ca
 <td align="left"><p>The domain provided couldn't be found. The Exchange server could not be auto-discovered and was not provided in the settings.</p></td>
 <td align="left"><p>Make sure that the domain entered is the FQDN, and that there is an Exchange server entered in the Exchange server text box.</p></td>
 </tr>
-<tr class="even">
-<td align="left"><p>0x80072efd</p></td>
-<td align="left"></td>
-<td align="left"><p>Fail to connect to Exchange server as a result of a networking issue. It's possible the server was misspelled or it just couldn't be found.</p></td>
-<td align="left"><p>Make sure that the Exchange server ID is entered correctly, and that the device is connected to the right network.</p></td>
-</tr>
 </tbody>
 </table>
 

devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md

@@ -4,6 +4,7 @@ description: Troubleshoot common problems, including setup issues, Exchange Acti
 ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A
 keywords: ["Troubleshoot common problems", "setup issues", "Exchange ActiveSync errors"]
 author: TrudyHa
+localizationpriority: high
 ---
 
 # When to use a fully qualified domain name with Surface Hub

devices/surface-hub/use-room-control-system-with-surface-hub.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Using a room control system (Surface Hub)
@@ -68,7 +69,7 @@ You can use a standard RJ-11 (6P6C) connector to connect the Surface Hub serial
 
 This diagram shows the correct pinout used for an RJ-11 (6P6C) to DB9 cable.
 
-![image showing the wiring diagram.](images/room-control-wiring-diagram.png)
+![Image showing the wiring diagram.](images/room-control-wiring-diagram.png)
 
 ## Command sets
 

devices/surface-hub/wireless-network-management-for-surface-hub.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: surfacehub, networking
 author: TrudyHa
+localizationpriority: high
 ---
 
 # Wireless network management (Surface Hub)
@@ -25,33 +26,33 @@ If a wired network connection is not available, the Surface Hub can use a wirele
 1.  On the Surface Hub, open **Settings** and enter your admin credentials.
 2.  Click **System**, and then click **Network & Internet**. Under **Wi-Fi**, choose an access point. If you want Surface Hub to automatically connect to this access point, click **Connect automatically**. Click **Connect**.
 
-    ![](images/networkmgtwireless-01.png)
+    ![Image showing Wi-Fi settings, Network & Internet page.](images/networkmgtwireless-01.png)
 
 3.  If the network is secured, you'll be asked to enter the security key. Click **Next** to connect.
 
-    ![](images/networkmgtwireless-02.png)
+    ![Image showing security key and password prompts for connecting to secured Wi-Fi.](images/networkmgtwireless-02.png)
 
 ### Review wireless settings
 
 1.  On the Surface Hub, open **Settings** and enter your admin credentials.
 2.  Click **System**, click **Network & Internet**, then **Wi-Fi**, and then click **Advanced options**.
 
-    ![](images/networkmgtwireless-03.png)
+    ![Image showing where to find Advanced options for Network & Internect, Wi-Fi settings.](images/networkmgtwireless-03.png)
 
 3.  The system will show you the properties for the wireless network connection.
 
-    ![](images/networkmgtwireless-04.png)
+    ![Image showing properties for connected Wi-Fi.](images/networkmgtwireless-04.png)
 
 ### Review wired settings
 
 1.  On the Surface Hub, open **Settings** and enter your admin credentials.
 2.  Click **System**, click **Network & Internet**, then click on the network under Ethernet.
 
-    ![](images/networkmgtwired-01.png)
+    ![Image showing Network & Internet, Ethernet settings page.](images/networkmgtwired-01.png)
 
 3.  The system will show you the properties for the wired network connection.
 
-    ![](images/networkmgtwired-02.png)
+    ![Image showing properties for ethernet connection.](images/networkmgtwired-02.png)
 
 ## Related topics
 

devices/surface/TOC.md

@@ -1,6 +1,8 @@
 # [Surface](index.md)
 ## [Advanced UEFI security features for Surface Pro 3](advanced-uefi-security-features-for-surface-pro-3.md)
 ## [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)
+## [Deploy Surface app with Windows Store for Business](deploy-surface-app-with-windows-store-for-business.md)
+## [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md)
 ## [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)
 ## [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md)
 ## [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md)
@@ -12,4 +14,8 @@
 ### [Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md)
 ## [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md)
 ## [Surface Dock Updater](surface-dock-updater.md)
+## [Surface Enterprise Management Mode](surface-enterprise-management-mode.md)
+### [Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md)
+### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md)
+## [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)
 

devices/surface/advanced-uefi-security-features-for-surface-pro-3.md

@@ -3,6 +3,7 @@ title: Advanced UEFI security features for Surface Pro 3 (Surface)
 description: This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices.
 ms.assetid: 90F790C0-E5FC-4482-AD71-60589E3C9C93
 keywords: security, features, configure, hardware, device, custom, script, update
+localizationpriority: high
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices, security

devices/surface/customize-the-oobe-for-surface-deployments.md

@@ -3,6 +3,7 @@ title: Customize the OOBE for Surface deployments (Surface)
 description: This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization.
 ms.assetid: F6910315-9FA9-4297-8FA8-2C284A4B1D87
 keywords: deploy, customize, automate, network, Pen, pair, boot
+localizationpriority: high
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices

devices/surface/deploy-surface-app-with-windows-store-for-business.md

@@ -0,0 +1,147 @@
+---
+title: Deploy Surface app with Windows Store for Business (Surface)
+description: Find out how to add and download Surface app with Windows Store for Business, as well as install Surface app with PowerShell and MDT.
+keywords: surface app, app, deployment, customize
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: surface, store
+ms.sitesec: library
+author: miladCA
+---
+
+#Deploy Surface app with Windows Store for Business
+
+The Surface app is a lightweight Windows Store app that provides control of many Surface-specific settings and options, including: 
+
+* Enable or disable the Windows button on the Surface device 
+
+* Adjust the sensitivity of a Surface Pen 
+
+* Customize Surface Pen button actions 
+
+* Enable or disable Surface audio enhancements 
+
+* Quick access to support documentation and information for your device 
+
+If your organization is preparing images that will be deployed to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Windows Store or your Windows Store for Business. 
+
+####Surface app overview
+
+The Surface app is available as a free download from the [Windows Store](https://www.microsoft.com/en-us/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Windows Store, but if your organization uses Windows Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Windows Store for Business, see [Windows Store for Business](https://technet.microsoft.com/en-us/windows/store-for-business) in the Windows TechCenter. 
+
+##Add Surface app to a Windows Store for Business account 
+
+Before users can install or deploy an app from a company’s Windows Store for Business account, the desired app(s) must first be made available and licensed to the users of a business. 
+
+1. If you have not already done so, create a [Windows Store for Business account](https://www.microsoft.com/en-us/business-store). 
+
+2. Log on to the portal. 
+
+3. Enable offline licensing: click **Settings->Account Information**, and then select the **Show offline licensed apps to people shopping in the store** checkbox, as shown in Figure 1. For more information about Windows Store for Business app licensing models, see [Apps in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing_model).<br/> <br/>
+   ![Show offline licenses apps checkbox](images/deploysurfapp-figure1-enablingapps.png "Show offline licenses apps checkbox")<br/>
+   *Figure 1. Enable apps for offline use*
+
+4.	Add Surface app to your Windows Store for Business account by following this procedure:
+    * Click the **Shop** menu.
+    * In the search box, type **Surface app**, and then click the search icon.
+    * After the Surface app is presented in the search results, click the app’s icon.
+    * You are presented with a choice (select **Online** or **Offline**), as shown in Figure 2.<br/><br/>
+    
+    ![Select the Offline licensing mode and add the app to your inventory](images/deploysurfapp-fig2-selectingofflinelicense.png "Select the Offline licensing mode and add the app to your inventory")
+    
+    *Figure 2. Select the Offline licensing mode and add the app to your inventory*
+    
+    * Click **Offline** to select the Offline licensing mode.
+    * Click **Get the app** to add the app to your Windows Store for Business inventory. As shown in Figure 3, you’ll see a dialog box that prompts you to acknowledge that offline apps can be deployed using a management tool or downloaded from the company’s inventory page in their private store.
+    
+    ![Offline-licensed app acknowledgement window](images/deploysurfapp-fig3-acknowledge.png "Offline-licensed app acknowledgement window")
+    
+    *Figure 3. Offline-licensed app acknowledgement*
+    * Click **OK**.
+
+##Download Surface app from a Windows Store for Business account
+After you add an app to the Windows Store for Business account in Offline mode, you can download and add the app as an AppxBundle to a deployment share.
+1. Log on to the Windows Store for Business account at https://businessstore.microsoft.com.
+2. Click the **Manage->Inventory** menu. A list of all apps in your company’s private store is displayed, including the Surface app you added in the [Add Surface app to a Windows Store for Business account](#add-surface-app-to-a-windows-store-for-business-account) section of this article.
+3. Under **Actions**, click the ellipsis (**…**), and then click **Download for offline use** for the Surface app.
+4. Select the desired **Platform** and **Architecture** options from the available selections for the selected app, as shown in Figure 4.
+
+    ![Example of the AppxBundle package](images\deploysurfapp-fig4-downloadappxbundle.png "Example of the AppxBundle package")
+
+    *Figure 4. Download the AppxBundle package for an app*
+5. Click **Download**. The AppxBundle package will be downloaded. Make sure you note the path of the downloaded file because you’ll need that later in this article.
+6. Click either the **Encoded license** or **Unencoded license** option. Use the Encoded license option with management tools like System Center Configuration Manager or when you use Windows Imaging and Configuration Designer (Windows ICD). Select the Unencoded license option when you use Deployment Image Servicing and Management (DISM) or deployment solutions based on imaging, including the Microsoft Deployment Toolkit (MDT).
+7. Click **Generate** to generate and download the license for the app. Make sure you note the path of the license file because you’ll need that later in this article.
+
+>**Note:**&nbsp;&nbsp;When you download an app for offline use, such as the Surface app, you may notice a section at the bottom of the page labeled **Required frameworks**. Your target computers must have the frameworks installed for the app to run, so you may need to repeat the download process for each of the required frameworks for your architecture (either x86 or x64) and also include them as part of your Windows deployment discussed later in this article.
+
+Figure 5 shows the required frameworks for the Surface app.
+
+![Required frameworks for the Surface app](images\deploysurfapp-fig5-requiredframework.png "Required frameworks for the Surface app")
+
+*Figure 5. Required frameworks for the Surface app*
+
+>**Note:**&nbsp;&nbsp;The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Windows Store for Business. Always use the Surface app and recommended framework versions as provided by Windows Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes.
+
+To download the required frameworks for the Surface app, follow these steps:
+1.	Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
+2.	Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
+
+>**Note:**&nbsp;&nbsp;Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks. 
+
+##Install Surface app on your computer with PowerShell
+The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards.
+1.	Using the procedure described in the [How to download Surface app from a Windows Store for Business account](#how-to-download-surface-app-from-a-windows-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. 
+2.	Begin an elevated PowerShell session.
+>**Note:**&nbsp;&nbsp;If you don’t run PowerShell as an Administrator, the session won’t have the required permissions to install the app.
+3.	In the elevated PowerShell session, copy and paste the following command:
+    ```
+    Add-AppxProvisionedPackage –Online –PackagePath <DownloadPath>\ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath <DownloadPath>\ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml
+    ```
+
+    Where `<DownloadPath>` is the folder where you downloaded the AppxBundle and license file from the Windows Store for Business account.
+
+    For example, if you downloaded the files to c:\Temp, the command you run is:
+    ````
+    Add-AppxProvisionedPackage –Online –PackagePath c:\Temp\ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath c:\Temp\ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml
+    ```
+
+4.	The Surface app will now be available on your current Windows computer. 
+Before the Surface app is functional on the computer where it has been provisioned, you must also provision the frameworks described earlier in this article. To provision these frameworks, use the following procedure in the elevated PowerShell session you used to provision the Surface app.
+5.	In the elevated PowerShell session, copy and paste the following command:
+```
+    Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath <DownloadPath>\Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx
+```
+6.	In the elevated PowerShell session, copy and paste the following command:
+    ```
+    Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath <DownloadPath>\Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx
+    ```
+
+##Install Surface app with MDT
+The following procedure uses MDT to automate installation of the Surface app at the time of deployment. The application is provisioned automatically by MDT during deployment and thus you can use this process with existing images. This is the recommended process to deploy the Surface app as part of a Windows deployment to Surface devices because it does not reduce the cross platform compatibility of the Windows image.
+1.	Using the procedure described [earlier in this article](#how-to-download-surface-app-from-a-windows-store-for-business-account), download the Surface app AppxBundle and license file. 
+2.	Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**.
+3.	On the **Command Details** page of the New Application Wizard, specify the default **Working Directory** and for the **Command** specify the file name of the AppxBundle, as follows:
+
+    * Command:
+    ```
+    Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle
+    ```
+    * Working Directory: %DEPLOYROOT%\Applications\SurfaceApp
+
+For the Surface app to function on the target computer, it will also require the frameworks described earlier in this article. Use the following procedure to import the frameworks required for the Surface app into MDT and to configure them as dependencies.
+1.	Using the procedure described earlier in this article, download the framework files. Store each framework in a separate folder.
+2.	Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**.
+3.	On the **Command Details** page, type the file name of each application you downloaded in the **Command** field and the default Working Directory.
+
+To configure the frameworks as dependencies of the Surface app, use this process:
+1.	Open the properties of the Surface app in the MDT Deployment Workbench.
+2.	Click the **Dependencies** tab, and then click **Add**.
+3.	Select the check box for each framework using the name you provided in the New Application Wizard.
+
+After import, the Surface app will be available for selection in the **Applications** step of the Windows Deployment Wizard. You can also install the application automatically by specifying the application in the deployment task sequence by following this process:
+1.	Open your deployment task sequence in the MDT Deployment Workbench.
+2.	Add a new **Install Application** task in the **State Restore** section of deployment.
+3.	Select **Install a single application** and specify the **Surface App** as the **Application to be installed**.
+
+For more information about including apps into your Windows deployments, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit).

devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md

@@ -3,6 +3,7 @@ title: Download the latest firmware and drivers for Surface devices (Surface)
 description: This article provides a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.
 ms.assetid: 7662BF68-8BF7-43F7-81F5-3580A770294A
 keywords: update Surface, newest, latest, download, firmware, driver, tablet, hardware, device
+localizationpriority: high
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices

devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md

@@ -0,0 +1,759 @@
+---
+title: Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit (Surface)
+description: Walk through the recommended process of how to deploy Windows 10 to your Surface devices with the Microsoft Deployment Toolkit.
+keywords: windows 10 surface, automate, customize, mdt
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: surface
+ms.sitesec: library
+author: Scottmca
+---
+
+# Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit
+
+#### Applies to
+* Surface Pro 4
+* Surface Book
+* Surface 3
+* Windows 10
+
+This article walks you through the recommended process to deploy Windows 10 to Surface devices with Microsoft deployment technologies. The process described in this article yields a complete Windows 10 environment including updated firmware and drivers for your Surface device along with applications like Microsoft Office 365 and the Surface app. When the process is complete, the Surface device will be ready for use by the end user. You can customize this process to include your own applications and configuration to meet the needs of your organization. You can also follow the guidance provided in this article to integrate deployment to Surface devices into existing deployment strategies.
+
+By following the procedures in this article, you can create an up-to-date reference image and deploy this image to your Surface devices, a process known as *reimaging*. Reimaging will erase and overwrite the existing environment on your Surface devices. This process allows you to rapidly configure your Surface devices with identical environments that can be configured to precisely fit your organization’s requirements. 
+
+An alternative to the reimaging process is an upgrade process. The upgrade process is non-destructive and instead of erasing the existing environment on your Surface device, it allows you to install Windows 10 while retaining your user data, applications, and settings. You can read about how to manage and automate the upgrade process of Surface devices to Windows 10 at [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md). 
+
+The goal of the deployment process presented in this article is automation. By leveraging the many technologies and tools available from Microsoft, you can create a process that requires only a single touch on the devices being deployed. The automation can load the deployment environment; format the device; prepare an updated Windows image with the drivers required for the device; apply that image to the device; configure the Windows environment with licensing, membership in a domain, and user accounts; install applications; apply any Windows updates that were not included in the reference image; and log out.
+
+By automating each aspect of the deployment process, you not only greatly decrease the effort involved, but you create a process that can be easily repeated and where human error becomes less of a factor. Take for example a scenario where you create a reference image for the device manually, but you accidentally install conflicting applications and cause the image to become unstable. In this scenario you have no choice but to begin again the manual process of creating your image. If in this same scenario you had automated the reference image creation process, you could repair the conflict by simply editing a step in the task sequence and then re-running the task sequence.
+
+## Deployment tools
+
+The deployment process described in this article leverages a number of Microsoft deployment tools and technologies. Some of these tools and technologies are included in Windows client and Windows Server, such as Hyper-V and Windows Deployment Services (WDS), while others are available as free downloads from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/windows.aspx).
+
+#### Microsoft Deployment Toolkit
+
+The Microsoft Deployment Toolkit (MDT) is the primary component of a Windows deployment. It serves as a unified interface for most of the Microsoft deployment tools and technologies, such as the Windows Assessment and Deployment Kit (Windows ADK), Windows System Image Manager (Windows SIM), Deployment Image Servicing and Management (DISM), User State Migration Tool (USMT), and many other tools and technologies. Each of these is discussed throughout this article. The unified interface, called the *Deployment Workbench*, facilitates automation of the deployment process through a series of stored deployment procedures, known as a *task sequence*. Along with these task sequences and the many scripts and tools that MDT provides, the resources for a Windows deployment (driver files, application installation files, and image files) are stored in a network share known as the *deployment share*. 
+
+You can download and find out more about MDT at [Microsoft Deployment Toolkit](https://technet.microsoft.com/en-us/windows/dn475741).
+
+#### Windows Assessment and Deployment Kit
+
+Although MDT is the tool you will interact with most during the deployment process, the deployment tools found in the Windows ADK perform most of the deployment tasks during the deployment process. The resources for deployment are held within the MDT deployment share, but it is the collection of tools included in Windows ADK that access the image files, stage drivers and Windows updates, run the deployment experience, provide instructions to Windows Setup, and back up and restore user data.
+
+You can download and find out more about the Windows ADK at [Download the Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit#windowsadk).
+
+#### Windows 10 installation media
+
+Before you can perform a deployment with MDT, you must first supply a set of operating system installation files and an operating system image. These files and image can be found on the physical installation media (DVD) for Windows 10. You can also find these files in the disk image (ISO file) for Windows 10, which you can download from the [Volume Licensing Service Center (VLSC)](https://www.microsoft.com/Licensing/servicecenter/default.aspx).
+
+>**Note:**  The installation media generated from the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT.
+
+#### Windows Server
+
+Although MDT can be installed on a Windows client, to take full advantage of Windows Deployment Services’ ability to network boot, a full Windows Server environment is recommended. To provide network boot for UEFI devices like Surface with WDS, you will need Windows Server 2008 R2 or later.
+
+>**Note:**  To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter).
+
+#### Windows Deployment Services
+
+Windows Deployment Services (WDS) is leveraged to facilitate network boot capabilities provided by the Preboot Execution Environment (PXE) server. The boot media generated by MDT is loaded onto the Surface device simply by pressing Enter at the prompt when the device attempts to boot from the attached network adapter or Surface Dock.
+
+#### Hyper-V virtualization platform
+
+The process of creating a reference image should always be performed in a virtual environment. When you use a virtual machine as the platform to build your reference image, you eliminate the need for installation of additional drivers. The drivers for a Hyper-V virtual machine are included by default in the factory Windows 10 image. When you avoid the installation of additional drivers – especially complex drivers that include application components like control panel applications – you ensure that the image created by your reference image process will be as universally compatible as possible.
+
+>**Note:**  A Generation 1 virtual machine is recommended for the preparation of a reference image in a Hyper-V virtual environment.
+
+Because customizations are performed by MDT at the time of deployment, the goal of reference image creation is not to perform customization but to increase performance during deployment by reducing the number of actions that need to occur on each deployed device. The biggest action that can slow down an MDT deployment is the installation of Windows updates. When MDT performs this step during the deployment process, it downloads the updates on each deployed device and installs them. By installing Windows updates in your reference image, the updates are already installed when the image is deployed to the device and the MDT update process only needs to install updates that are new since the image was created or are applicable to products other than Windows (for example, Microsoft Office updates).
+
+>**Note:**  Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library.  Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center.
+
+#### Surface firmware and drivers
+
+For your deployed Windows environment to function correctly on your Surface devices, you will need to install the drivers used by Windows to communicate with the components of your device. These drivers are available for download in the Microsoft Download Center for each Surface device. You can find the correct Microsoft Download Center page for your device at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices).
+
+When you browse to the specific Microsoft Download Center page for your device, you will notice that there are two files available for download. One file is a Windows Installer (.msi) file. This file is used to update drivers on devices that are already running Windows or that have device management solutions. The other file is an archive (.zip) file. This file contains the individual driver files that are used during deployment, or for manual installation with Device Manager. The file that you will need to download is the .zip archive file. You can read more about the difference between the firmware and driver pack file types at [Manage Surface driver and firmware updates](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-pro-3-firmware-updates).
+
+
+In addition to the driver files that help Windows communicate with the hardware components of the Surface device, the .zip file you download will also contain firmware updates. These firmware updates will update the instructions used by the device hardware to communicate between components and Windows. The firmware of Surface device components is updated by installation of specific driver files and thus is installed along with the other drivers during deployment. The firmware of an out-of-date Surface device is thus updated when the device reboots during and after the Windows deployment process.
+
+>**Note:**  Beginning in Windows 10, the drivers for Surface devices are included in the Windows Preinstallation Environment (WinPE). In earlier versions of Windows, specific drivers (like network drivers) had to be imported and configured in MDT for use in WinPE to successfully deploy to Surface devices.
+
+#### Application installation files
+
+In addition to the drivers that are used by Windows to communicate with the Surface device’s hardware and components, you will also need to provide the installation files for any applications that you want to install on your deployed Surface devices. To automate the deployment of an application, you will also need to determine the command-line instructions for that application to perform a silent installation. In this article, the Surface app and Microsoft Office 365 will be installed as examples of application installation. The application installation process can be used with any application with installation files that can be launched from command line.
+
+>**Note:**  If the application files for your application are stored on your organization’s network and will be accessible from your Surface devices during the deployment process, you can deploy that application directly from that network location. To use installation files from a network location, use the **Install Application Without Source Files or Elsewhere on the Network** option in the MDT New Application Wizard, which is described in the [Import applications](#import-applications) section later in this article.
+
+#### Microsoft Surface Deployment Accelerator
+
+If you want to deploy only to Surface devices or you want an accelerated method to perform deployment to Surface devices, you can use the Microsoft Surface Deployment Accelerator to generate an MDT deployment share complete with Surface device drivers, Surface apps, and pre-configured task sequences to create a reference image and perform deployment to Surface devices. Microsoft Surface Deployment Accelerator can automatically import boot images into WDS and prepare WDS for network boot (PXE). You can download the Microsoft Surface Deployment Accelerator from the [Surface Tools for IT](https://www.microsoft.com/en-us/download/details.aspx?id=46703) page in the Microsoft Download Center.
+
+### Install the deployment tools
+
+Before you can configure the deployment environment with Windows images, drivers, and applications, you must first install the deployment tools that will be used throughout the deployment process. The three main tools to be installed are WDS, Windows ADK, and MDT. WDS provides the capacity for network boot, Windows ADK provides several deployment tools that perform specific deployment tasks, and MDT provides automation and a central interface from which to manage and control the deployment process.
+
+To boot from the network with either your reference virtual machines or your Surface devices, your deployment environment must include a Windows Server environment. The Windows Server environment is required to install WDS and the WDS PXE server. Without PXE support, you will be required to create physical boot media, such as a USB stick to perform your deployment – MDT and Windows ADK will still be required, but Windows Server is not required. Both MDT and Windows ADK can be installed on a Windows client and perform a Windows deployment.
+
+>**Note:**  To download deployment tools directly to Windows Server, you must disable [Internet Explorer Enhanced Security Configuration](https://technet.microsoft.com/library/dd883248). On Windows Server 2012 R2, this can be performed directly through the **Server Manager** option on the **Local Server** tab. In the **Properties** section, **IE Enhanced Security Configuration** can be found on the right side. You may also need to enable the **File Download** option for the **Internet** zone through the **Security** tab of **Internet Options**.
+
+#### Install Windows Deployment Services
+
+Windows Deployment Services (WDS) is a Windows Server role. To add the WDS role to a Windows Server 2012 R2 environment, use the Add Roles and Features Wizard, as shown in Figure 1. Start the Add Roles and Features Wizard from the **Manage** button of **Server Manager**. Install both the Deployment Server and Transport Server role services.
+
+![Install the Windows Deployment Services role](images\surface-deploymdt-fig1.png "Install the Windows Deployment Services role")
+
+*Figure 1. Install the Windows Deployment Services server role*
+
+After the WDS role is installed, you need to configure WDS. You can begin the configuration process from the WDS node of Server Manager by right-clicking your server’s name and then clicking **Windows Deployment Services Management Console**. In the **Windows Deployment Services** window, expand the **Servers** node to find your server, right-click your server, and then click **Configure** in the menu to start the Windows Deployment Services Configuration Wizard, as shown in Figure 2.
+
+![Configure PXE response for Windows Deployment Services](images\surface-deploymdt-fig2.png "Configure PXE response for Windows Deployment Services")
+
+*Figure 2. Configure PXE response for Windows Deployment Services*
+
+>**Note:**  Before you configure WDS make sure you have a local NTFS volume that is not your system drive (C:) available for use with WDS. This volume is used to store WDS boot images, deployment images, and configuration.
+
+Using the Windows Deployment Services Configuration Wizard, configure WDS to fit the needs of your organization. You can find detailed instructions for the installation and configuration of WDS at [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426). On the **PXE Server Initial Settings** page, be sure to configure WDS so that it will respond to your Surface devices when they attempt to boot from the network. If you have already installed WDS or need to change your PXE server response settings, you can do so on the **PXE Response** tab of the **Properties** of your server in the Windows Deployment Services Management Console.
+
+>**Note:**  You will add boot images to WDS when you update your boot images in MDT. You do not need to add boot images or Windows images to WDS when you configure the role.
+
+#### Install Windows Assessment and Deployment Kit
+
+To install Windows ADK, run the Adksetup.exe file that you downloaded from [Download the Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit#adkwin10). Windows ADK must be installed before MDT. You should always download and use the most recent version of Windows ADK. A new version is usually released corresponding with each new version of Windows.
+
+>**Note:**  You can also use the Adksetup.exe file to download the Windows ADK installation files locally for use on other devices.
+
+When you get to the **Select the features you want to install** page, you only need to select the **Deployment Tools** and **Windows Preinstallation Environment (Windows PE)** check boxes to deploy Windows 10 using MDT, as shown in Figure 3. 
+
+![Required options for deployment with MDT](images\surface-deploymdt-fig3.png "Required options for deployment with MDT")
+
+*Figure 3. Only Deployment Tools and Windows PE options are required for deployment with MDT*
+
+#### Install Microsoft Deployment Toolkit
+
+After the Windows ADK installation completes successfully, you can install MDT. When you download MDT, ensure that you download the version that matches the architecture of your deployment server environment. For Windows Server the architecture is 64-bit. Download the MDT installation file that ends in **x64**. When MDT is installed you can use the default options during the installation wizard, as shown in Figure 4.
+
+![MDT installation with default options](images/surface-deploymdt-fig4.png "MDT installation with default options")
+
+*Figure 4. Install the Microsoft Deployment Toolkit with default options*
+
+Before you can open the MDT Deployment Workbench, you must enable execution of scripts in PowerShell. If you do not do this, the following error message may be displayed: *"Initialization Error PowerShell is required to use the Deployment Workbench.  Please install PowerShell then relaunch Deployment Workbench."*
+
+To enable the execution of scripts, run the following cmdlet in PowerShell as an Administrator:
+
+   `Set-ExecutionPolicy RemoteSigned -Scope CurrentUser`
+
+## Create a reference image
+
+Now that you have installed the required tools, you can begin the first step of customizing your deployment environment to your needs – create a reference image. Because the reference image should be created in a virtual machine where there is no need for drivers to be installed, and because the reference image will not include applications, you can use the MDT deployment environment almost entirely with default settings.
+
+### Create a deployment share
+
+Now that you have the tools installed, the next step is to configure MDT for the creation of a reference image. Before you can perform the process of creating a reference image, MDT needs to be set up with a repository for scripts, images, and other deployment resources. This repository is known as the *deployment share*. After the deployment share is created, you must supply MDT with a complete set of Windows 10 installation files, the last set of tools required before MDT can perform reference image creation.
+
+To create the deployment share, follow these steps:
+
+1. Open the Deployment Workbench from your Start menu or Start screen, as shown in Figure 5.
+
+   ![The MDT Deployment Workbench](images\surface-deploymdt-fig5.png "The MDT Deployment Workbench")
+
+   *Figure 5. The MDT Deployment Workbench*
+
+2. Right-click the **Deployment Shares** folder, and then click **New Deployment Share** to start the New Deployment Share Wizard, as shown in Figure 6.
+
+   ![Summary page of the New Deployment Share Wizard](images\surface-deploymdt-fig6.png "Summary page of the New Deployment Share Wizard")
+
+   *Figure 6. The Summary page of the New Deployment Share Wizard*
+
+3. Create a new deployment share with New Deployment Share Wizard with the following steps:
+
+  * **Path** – Specify a local folder where the deployment share will reside, and then click **Next**.
+
+      >**Note:**  Like the WDS remote installation folder, it is recommended that you put this folder on an NTFS volume that is not your system volume.
+
+  * **Share** – Specify a name for the network share under which the local folder specified on the **Path** page will be shared, and then click **Next**.
+
+      >**Note:**  The share name cannot contain spaces.
+
+      >**Note:**  You can use a Dollar Sign (**$**) to hide your network share so that it will not be displayed when users browse the available network shares on the server in File Explorer.
+
+  * **Descriptive Name** – Enter a descriptive name for the network share (this descriptive name can contain spaces), and then click **Next**. The descriptive name will be the name of the folder as it appears in the Deployment Workbench.
+  * **Options** – You can accept the default options on this page. Click **Next**.
+  * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the deployment share.
+  * **Progress** – While the deployment share is being created, a progress bar is displayed on this page to indicate the status of the deployment share creation process.
+  * **Confirmation** – When the deployment share creation process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Deployment Share Wizard.
+
+4. When the New Deployment Share Wizard is complete, you can expand the Deployment Shares folder to find your newly created deployment share.
+5. You can expand your deployment share, where you will find several folders for the resources, scripts, and components of your MDT deployment environment are stored.
+
+To secure the deployment share and prevent unauthorized access to the deployment resources, you can create a local user on the deployment share host and configure permissions for that user to have read-only access to the deployment share only. It is especially important to secure access to the deployment share if you intend to automate the logon to the deployment share during the deployment boot process. By automating the logon to the deployment share during the boot of deployment media, the credentials for that logon are stored in plaintext in the bootstrap.ini file on the boot media.
+
+>**Note:**  If you intend to capture images (such as the reference image) with this user, the user must also have write permission on the Captures folder in the MDT deployment share.
+
+You now have an empty deployment share that is ready for you to add the resources that will be required for reference image creation and deployment to Surface devices.
+
+### Import Windows installation files
+
+The first resources that are required to perform a deployment of Windows are the installation files from Windows 10 installation media. Even if you have an already prepared reference image, you still need to supply the unaltered installation files from your installation media. The source of these files can be a physical disk, or it can be an ISO file like the download from the Volume Licensing Service Center (VLSC).
+
+>**Note:**  A 64-bit operating system is required for compatibility with Surface Pro 4, Surface Book, Surface Pro 3, and Surface 3.
+
+To import Windows 10 installation files, follow these steps:
+
+1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench, and then click **New Folder** to open the **New Folder** page, as shown in Figure 7.
+
+   ![Create a new folder on the New Folder page](images\surface-deploymdt-fig7.png "Create a new folder on the New Folder page")
+   
+   *Figure 7. Create a new folder on the New Folder page*
+
+2. On the **New Folder** page a series of steps is displayed, as follows:
+  * **General Settings** – Enter a name for the folder in the **Folder Name** field (for example, Windows 10 Enterprise), add any comments you want in the **Comments** field, and then click **Next**.
+  * **Summary** – Review the specified configuration of the new folder on this page, and then click **Next**.
+  * **Progress** – A progress bar will be displayed on this page while the folder is created. This page will likely pass very quickly.
+  * **Confirmation** – When the new folder has been created, a **Confirmation** page displays the success of the operation. Click **Finish** to close the **New Folder** page.
+3. Expand the Operating Systems folder to see the newly created folder.
+4. Right-click the newly created folder, and then click **Import Operating System** to launch the Import Operating System Wizard, as shown in Figure 8.
+
+   ![Import source files with the Import Operating System Wizard](images\surface-deploymdt-fig8.png "Import source files with the Import Operating System Wizard")
+
+   *Figure 8. Import source files with the Import Operating System Wizard*
+
+5. The Import Operating System Wizard walks you through the import of your operating system files, as follows:
+  * **OS Type** – Click **Full Set of Source Files** to specify that you are importing the Windows source files from installation media, and then click **Next**.
+  * **Source** – Click **Browse**, move to and select the folder or drive where your installation files are found, and then click **Next**.
+  * **Destination** – Enter a name for the new folder that will be created to hold the installation files, and then click **Next**.
+  * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+  * **Progress** – While the installation files are imported, a progress bar is displayed on this page.
+  * **Confirmation** – When the operating system import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Operating System Wizard.
+6.	Expand the folder you created in Step 1 to see the entry for your newly imported installation files for Windows 10.
+
+Now that you’ve imported the installation files from the installation media, you have the files that MDT needs to create the reference image and you are ready to instruct MDT how to create the reference image to your specifications.
+
+### Create reference image task sequence
+
+As described in the [Deployment tools](#deployment-tools) section of this article, the goal of creating a reference image is to keep the Windows environment as simple as possible while performing tasks that would be common to all devices being deployed. You should now have a basic MDT deployment share configured with default options and a set of unaltered, factory installation files for Windows 10. This simple configuration is perfect for reference image creation because the deployment share contains no applications or drivers to interfere with the process.
+
+>**Note:**  For some organizations keeping a simple deployment share without applications or drivers is the simplest solution for creation of reference images. You can easily connect to more than one deployment share from a single Deployment Workbench and copy images from a simple, reference-image-only deployment share to a production deployment share complete with drivers and applications.
+
+To create the reference image task sequence, follow these steps:
+
+1. Right-click the **Task Sequences** folder under your deployment share in the Deployment Workbench, and then click **New Task Sequence** to start the New Task Sequence Wizard, as shown in Figure 9.
+
+   ![Create new task sequence to deploy and update a Windows 10 reference environment](images\surface-deploymdt-fig9.png "Create new task sequence to deploy and update a Windows 10 reference environment")
+
+   *Figure 9. Create a new task sequence to deploy and update a Windows 10 reference environment*
+
+2. The New Task Sequence Wizard presents a series of steps, as follows:
+  * **General Settings** – Enter an identifier for the reference image task sequence in the **Task Sequence ID** field, a name for the reference image task sequence in the **Task Sequence Name** field, and any comments for the reference image task sequence in the **Task Sequence Comments** field, and then click **Next**.
+  >**Note:**  The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
+  * **Select Template** – Select **Standard Client Task Sequence** from the drop-down menu, and then click **Next**.
+  * **Select OS** – Navigate to and select the Windows 10 image you imported with the Windows 10 installation files, and then click **Next**.
+  * **Specify Product Key** – Click **Do Not Specify a Product Key at This Time**, and then click **Next**.
+  * **OS Settings** – Enter a name, organization, and home page URL in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**.
+  * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**.
+  >**Note:**  During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments.
+  * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence.
+  * **Progress** – While the task sequence is created, a progress bar is displayed on this page.
+  * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard.
+2. Select the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**.
+3. Select the **Task Sequence** tab to view the steps that are included in the Standard Client Task Sequence template, as shown in Figure 10.
+
+   ![Enable Windows Update in the reference image task sequence](images\surface-deploymdt-fig10.png "Enable Windows Update in the reference image task sequence")
+
+   *Figure 10. Enable Windows Update in the reference image task sequence*
+
+4. Select the **Windows Update (Pre-Application Installation)** option, located under the **State Restore** folder.
+5. Click the **Options** tab, and then clear the **Disable This Step** check box.
+6. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option.
+7. Click **OK** to apply changes to the task sequence, and then close the task sequence properties window.
+
+### Generate and import MDT boot media
+
+To boot the reference virtual machine from the network, the MDT deployment share first must be updated to generate boot media with the resources that have been added in the previous sections.
+
+To update the MDT boot media, follow these steps:
+
+1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard, as shown in Figure 11.
+
+   ![Generate boot images with the Update Deployment Share Wizard](images\surface-deploymdt-fig11.png "Generate boot images with the Update Deployment Share Wizard")
+
+   *Figure 11. Generate boot images with the Update Deployment Share Wizard*
+
+2. Use the Update Deployment Share Wizard to create boot images with the following process:
+  * **Options** – Click **Completely Regenerate the Boot Images**, and then click **Next**.
+  >**Note:**  Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page.
+  * **Summary** – Review the specified options on this page before you click **Next** to begin generation of boot images.
+  * **Progress** – While the boot images are being generated, a progress bar is displayed on this page.
+  * **Confirmation** – When the boot images have been generated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard.
+3. Confirm that boot images have been generated by navigating to the deployment share in File Explorer and opening the Boot folder. The following files should be displayed, as shown in Figure 12:
+  * **LiteTouchPE_x86.iso**
+  * **LiteTouchPE_x86.wim**
+  * **LiteTouchPE_x64.iso**
+  * **LiteTouchPE_x64.wim**
+
+
+   ![Boot images in the Boot folder after Update Deployment Share Wizard completes](images\surface-deploymdt-fig12.png "Boot images in the Boot folder after Update Deployment Share Wizard completes")
+
+   *Figure 12. Boot images displayed in the Boot folder after completion of the Update Deployment Share Wizard*
+
+To import the MDT boot media into WDS for PXE boot, follow these steps:
+
+1. Open Windows Deployment Services from the Start menu or Start screen.
+2. Expand **Servers** and your deployment server.
+3. Click the **Boot Images** folder, as shown in Figure 13.
+
+   ![Start the Add Image Wizard from the Boot Images folder](images\surface-deploymdt-fig13.png "Start the Add Image Wizard from the Boot Images folder")
+
+   *Figure 13. Start the Add Image Wizard from the Boot Images folder*
+
+4. Right-click the **Boot Images** folder, and then click **Add Boot Image** to open the Add Image Wizard, as shown in Figure 14.
+
+   ![Import the LiteTouchPE_x86.wim MDT boot image](images\surface-deploymdt-fig14.png "Import the LiteTouchPE_x86.wim MDT boot image")
+
+   *Figure 14. Import the LiteTouchPE_x86.wim MDT boot image*
+
+5. The Add Image Wizard displays a series of steps, as follows:
+  * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, click **Open**, and then click **Next**.
+  * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options.
+  * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**.
+  * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard.
+
+>**Note:**  Only the 32-bit boot image, LiteTouchPE_x86.wim, is required to boot from BIOS devices, including Generation 1 Hyper-V virtual machines like the reference virtual machine.
+
+If your WDS configuration is properly set up to respond to PXE clients, you should now be able to boot from the network with any device with a network adapter properly configured for network boot (PXE).
+
+>**Note:**  If your WDS server resides on the same server as DHCP or in a different subnet than the devices you are attempting to boot, additional configuration may be required. For more information, see [Managing Network Boot Programs](https://technet.microsoft.com/library/cc732351).
+
+### Deploy and capture a reference image
+
+Your deployment environment is now set up to create a reference image for Windows 10 complete with Windows Updates.
+
+>**Note:**&nbsp;&nbsp;You cannot install version updates (such as Windows 10, Version 1511) in a reference image. To create a reference image with a new version of Windows, you must use installation files from that version of Windows. When  you install a version update in Windows, it effectively performs an upgrade to a new version of Windows, and upgraded installations of Windows cannot be prepared for deployment with Sysprep.<br/><br/>
+By using a fully automated task sequence in an MDT deployment share dedicated to reference image creation, you can greatly reduce the time and effort required to create new reference images and it is the best way to ensure that your organization is ready for feature updates and new versions of Windows 10.
+
+You can now boot from the network with a virtual machine to run the prepared task sequence and generate a reference image. When you prepare your virtual machine in Hyper-V for reference image creation, consider the following:
+
+* Use a Generation 1 virtual machine for the simplicity of drivers and to ensure maximum compatibility with both BIOS and UEFI devices.
+* Ensure your virtual machine has at least 1 GB of system memory at boot. You can ensure that the virtual machine has at least 1 GB of memory at boot but allow the memory to adjust after boot by using Dynamic Memory. You can read more about Dynamic Memory in the [Hyper-V Dynamic Memory Overview](https://technet.microsoft.com/library/hh831766).
+* Ensure your virtual machine uses a legacy network adapter to support network boot (PXE); that network adapter should be connected to the same network as your deployment server, and that network adapter should receive an IP address automatically via DHCP.
+* Configure your boot order such that PXE Boot is the first option.
+
+When your virtual machine (VM) is properly configured and ready, start or boot the VM and be prepared to press the F12 key when prompted to boot via PXE from the WDS server.
+
+Perform the reference image deployment and capture using the following steps:
+
+1. Start your virtual machine and press the F12 key when prompted to boot to the WDS server via PXE, as shown in Figure 15.
+
+   ![Start network boot by pressing the F12 key](images\surface-deploymdt-fig15.png "Start network boot by pressing the F12 key")
+
+   *Figure 15. Start network boot by pressing the F12 key*
+
+2. Click **Run the Deployment Wizard to Install a New Operating System** to begin the MDT deployment process.
+3. Enter your MDT username and password, a user with rights to access the MDT deployment share over the network and with rights to write to the Captures folder in the deployment share.
+4. After your credentials are validated, the Windows Deployment Wizard will start and process the boot and deployment share rules.
+5. The Windows Deployment Wizard displays a series of steps, as follows:
+  * **Task Sequence** – Select the task sequence you created for reference image creation (it should be the only task sequence available), and then click **Next**.
+  * **Computer Details** – Leave the default computer name, workgroup name, and the **Join a Workgroup** option selected, and then click **Next**. The computer name and workgroup will be reset when the image is prepared by Sysprep and captured.
+  * **Move Data and Settings** – Leave the default option of **Do Not Move User Data and Settings** selected, and then click **Next**.
+  * **User Data (Restore)** – Leave the default option of **Do Not Restore User Data and Settings** selected, and then click **Next**.
+  * **Locale and Time** – Leave the default options for language and time settings selected. The locale and time settings will be specified during deployment of the image to other devices. Click **Next**.
+  * **Capture Image** – Click the **Capture an Image of this Reference Computer** option, as shown in Figure 16. In the **Location** field, keep the default location of the Captures folder. You can keep or change the name of the image file in the **File Name** field. When you are finished, click **Next**.
+  
+  ![Capture an image of the reference machine](images\surface-deploymdt-fig16.png "Capture an image of the reference machine")
+    
+  *Figure 16. Use the Capture Image page to capture an image of the reference machine after deployment*
+
+  * **Ready** – You can review your selections by expanding **Details** on the **Ready** page. Click **Begin** when you are ready to perform the deployment and capture of your reference image.
+
+6. Your reference task sequence will run with the specified options.
+
+As the task sequence processes the deployment, it will automatically perform the following tasks:
+* Install the Windows 10 image from the installation files you supplied
+* Reboot into Windows 10
+* Run Windows updates until all Windows updates have been installed and the Windows environment is fully up to date
+* Run Sysprep and prepare the Windows 10 environment for deployment
+* Reboot into WinPE
+* Capture an image of the Windows 10 environment and store it in the Captures folder in the MDT deployment share
+
+>**Note:**&nbsp;&nbsp;The Windows Update process can take some time to complete as it searches the Internet for updates, downloads those updates, and then installs them. By performing this process now, in the reference environment, you eliminate the need to perform these tasks on each deployed device and significantly reduce the amount of time and bandwidth required to perform your deployment. 
+
+When the task sequence completes, your virtual machine will be off and a new reference image complete with updates will be ready in your MDT deployment share for you to import it and prepare your deployment environment for deployment to Surface devices.
+
+## Deploy Windows 10 to Surface devices
+
+With a freshly prepared reference image, you are now ready to configure the deployment process for deployment to the Surface devices. Use the steps detailed in this section to produce a deployment process that requires minimal effort on each Surface device to produce a complete and ready-to-use Windows 10 environment.
+
+### Import reference image
+
+After the reference image has been created and stored in the Captures folder, you need to add it to your MDT deployment share as an image for deployment. You perform this task by using the same process that you used to import the installation files for Windows 10.
+
+To import the reference image for deployment, use the following steps:
+
+1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench or the folder you created in when you imported Windows 10 installation files, and then click **Import Operating System** to start the Import Operating System Wizard. 
+2. Import the custom image with the Import Operating System Wizard by using the following steps:
+  * **OS Type** – Select Custom Image File to specify that you are importing the Windows source files from installation media, and then click **Next**.
+  * **Image** – Click **Browse**, and then navigate to and select the image file in the **Captures** folder in your deployment share. Select the **Move the Files to the Deployment Share Instead of Copying Them** checkbox if desired. Click **Next**. 
+  * **Setup** – Click **Setup Files are not Neededf**, and then click **Next**.
+  * **Destination** – Enter a name for the new folder that will be created to hold the image file, and then click **Next**.
+  * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+  * **Progress** – While the image is imported, a progress bar is displayed on this page.
+  * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Operating System Wizard.
+3.	Expand the folder in which you imported the image to verify that the import completed successfully.
+
+>**Note:**&nbsp;&nbsp;You can import the reference image into the same deployment share that you used to create your reference image, or you could import the reference image into a new deployment share for deployment to your Surface devices. If you chose to create a new deployment share for deployment of your reference image, remember that you still need to import a full set of installation files from installation media.
+
+Now that your updated reference image is imported, it is time to prepare your deployment environment for deployment to Surface devices complete with drivers, applications, and automation.
+
+### Import Surface drivers
+
+Before you can deploy your updated reference image to Surface devices, or any physical environment, you need to supply MDT with the drivers that Windows will use to communicate with that physical environment. For Surface devices you can download all of the drivers required by Windows in a single archive (.zip) file in a format that is ready for deployment. In addition to the drivers that are used by Windows to communicate with the hardware and components, Surface firmware and driver packs also include updates for the firmware of those components. By installing the Surface firmware and driver pack, you will also bring your device’s firmware up to date. If you have not done so already, download the drivers for your Surface device listed at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices).
+
+Many devices require that you import drivers specifically for WinPE in order for the MDT boot media to communicate with the deployment share and to boot properly on that device. Even Surface Pro 3 required that network drivers be imported specifically for WinPE for deployment of Windows 8.1. Fortunately, for Windows 10 deployments to Surface devices, all of the required drivers for operation of WinPE are contained within the out-of-box drivers that are built into Windows 10. It is still a good idea to prepare your environment with folder structure and selection profiles that allow you to specify drivers for use in WinPE. You can read more about that folder structure in **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec05).
+
+To import the Surface drivers (in this example, Surface Pro 4) into MDT, follow these steps:
+
+1. Extract the downloaded archive (.zip) file to a folder that you can easily locate. Keep the driver files separate from other drivers or files.
+2. Open the Deployment Workbench and expand the Deployment Shares node and your deployment share. 
+3. If you have not already created a folder structure by operating system version, you should do so now and create under the Windows 10 x64 folder a new folder for Surface Pro 4 drivers named Surface Pro 4. Your Out-of-Box Drivers folder should resemble the following structure, as shown in Figure 17:
+   * WinPE x86
+   * WinPE x64
+   * Windows 10 x64
+     * Microsoft Corporation
+       * Surface Pro 4
+
+   ![Recommended folder structure for drivers](images\surface-deploymdt-fig17.png "Recommended folder structure for drivers")
+
+   *Figure 17. The recommended folder structure for drivers*
+
+4. Right-click the **Surface Pro 4** folder, and then click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 18.
+
+   ![Progress page during drivers import](images\surface-deploymdt-fig18.png "Progress page during drivers import")
+
+   *Figure 18. The Progress page during drivers import*
+
+5. The Import Driver Wizard displays a series of steps, as follows:
+  * **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 4 firmware and drivers in Step 1.
+  * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+  * **Progress** – While the drivers are imported, a progress bar is displayed on this page.
+  * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard.
+6.	Click the **Surface Pro 4** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 19.
+
+   ![Drivers for Surface Pro 4 imported and organized in the MDT deployment share](images\surface-deploymdt-fig19.png "Drivers for Surface Pro 4 imported and organized in the MDT deployment share")
+
+   *Figure 19. Drivers for Surface Pro 4 imported and organized in the MDT deployment share*
+
+### Import applications
+
+You can import any number of applications into MDT for installation on your devices during the deployment process. You can configure your applications and task sequences to prompt you during deployment to pick and choose which applications are installed, or you can use your task sequence to explicitly define which applications are installed. For more information, see **Step 4: Add an application** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec04).
+
+#### Import Microsoft Office 365 Installer
+
+The Office Deployment Tool is a free download available in the Microsoft Download Center that allows IT professionals and system administrators to download and prepare Office installation packages for Office Click-to-Run. You can find the Office Deployment Tool and instructions to download Click-to-Run for Office 365 installation source files at [Download Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/library/jj219424).
+
+Download and install the version of Office Deployment Tool (ODT), for Office 2013 or Office 2016, that fits your organization’s needs and use the steps provided by that page to download the Office installation files for use with MDT.
+
+After you have downloaded the source files for your version of Office Click-to-Run, you need to edit the Configuration.xml file with instructions to install Office Click-to-Run silently. To configure the Office Deployment Tool for silent installation, follow these steps:
+
+1. Right-click the existing **Configuration.xml** file, and then click **Edit**.
+2. This action opens the file in Notepad. Replace the existing text with the following:
+  ```
+   <Configuration> 
+   <Add OfficeClientEdition="32">  
+    <Product ID="O365ProPlusRetail" >  
+     <Language ID="en-us" />        
+    </Product>  
+   </Add> 
+   <Display Level="None" AcceptEULA="TRUE" /> </Configuration>
+```
+
+3. Save the file.
+
+The default behavior of Setup.exe is to look for the source files in the path that contains **Setup.exe**. If the installation files are not found in this folder, the Office Deployment Tool will default to online source files from an Internet connection.
+
+For MDT to perform an automated installation of office, it is important to configure the **Display Level** option to a value of **None**. This setting is used to suppress the installation dialog box for silent installation. It is required that the **AcceptEULA** option is set to **True** to accept the license agreement when the **Display Level** option is set to **None**. With both of these options configured, the installation of Office will occur without the display of dialog boxes which could potentially cause the installation to pause until a user can address an open dialog box.
+
+Now that the installation and configuration files are prepared, the application can be imported into the deployment share by following these steps:
+
+1. Open the Deployment Workbench. 
+2. Expand the deployment share, right-click the **Applications** folder, and then click **New Application** to start the New Application Wizard, as shown in Figure 20.
+
+   ![Enter the command and directory for Office 2016 Click-to-Run](images\surface-deploymdt-fig20.png "Enter the command and directory for Office 2016 Click-to-Run")
+
+   *Figure 20. Enter the command and directory for Office 2016 Click-to-Run*
+
+3. The New Application Wizard walks you through importing the Office 2016 Click-to-Run files, as follows:
+  * **Application Type** – Click **Application with Source Files**, and then click **Next**.
+  * **Details** – Enter a name for the application (for example, Office 2016 Click-to-Run) in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**.
+  * **Source** – Click **Browse** to navigate to and select the folder where you downloaded the Office installation files with the Office Deployment Tool, and then click **Next**.
+  * **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name.
+  * **Command Details** – Enter the Office Deployment Tool installation command line:
+
+     `Setup.exe /configure configuration.xml`
+
+  * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+  * **Progress** – While the installation files are imported, a progress bar is displayed on this page.
+  * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard.
+
+4. You should now see the **Office 2016 Click-to-Run** item under the **Applications** folder in the Deployment Workbench.
+
+#### Import Surface app installer
+
+The Surface app is a Windows Store app that provides the user with greater control over specific Surface device functions and capabilities (for example, control over the sensitivity of the Surface Pen). It is a highly recommended app for Surface devices to provide end users with the best experience and greatest control over their device. Find out more about the Surface app at [Install and use the Surface app](https://www.microsoft.com/surface/en-us/support/apps-and-windows-store/surface-app?os=windows-10).
+
+To perform a deployment of the Surface app, you will need to download the app files through Windows Store for Business. You can find detailed instructions on how to download the Surface app through Windows Store for Business at [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/en-us/itpro/surface/deploy-surface-app-with-windows-store-for-business).
+
+After you have downloaded the installation files for Surface app, including the AppxBundle and license files, you can import these files into the deployment share through the same process as a desktop application like Microsoft Office. Both the AppxBundle and license files must be together in the same folder for the import process to complete successfully. Use the following command on the **Command Details** page to install the Surface app:
+   ```
+DISM.exe /Online /Add-ProvisionedAppxPackage /PackagePath: Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle /LicensePath: Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml
+   ```
+
+### Create deployment task sequence
+
+The next step in the process is to create the deployment task sequence. This task sequence will be configured to completely automate the deployment process and will work along with customized deployment share rules to reduce the need for user interaction down to a single touch. Before you can make  customizations to include all of this automation, the new task sequence has to be created from a template.
+
+To create the deployment task sequence, follow these steps:
+1. In the Deployment Workbench, under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard.
+2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard:
+  * **General Settings** – Enter an identifier for the deployment task sequence in the **Task Sequence ID** field, a name for the deployment task sequence in the **Task Sequence Name** field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, then click **Next**.
+  >**Note:**&nbsp;&nbsp;The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
+  * **Select Template** – Click **Standard Client Task Sequence** from the drop-down menu, and then click **Next**.
+  * **Select OS** – Navigate to and select the reference image that you imported, and then click **Next**.
+  * **Specify Product Key** – Select the product key entry that fits your organization's licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**.
+  * **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**.
+  * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**.
+  * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence.
+  * **Progress** – While the task sequence is being created, a progress bar is displayed on this page.
+  * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard.
+
+After the task sequence is created it can be modified for increased automation, such as the installation of applications without user interaction, the selection of drivers, and the installation of Windows updates.
+
+1. Click the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**.
+2. Click the **Task Sequence** tab to view the steps that are included in the new task sequence.
+3. Click the **Windows Update (Pre-Application Installation)** step, located under the **State Restore** folder.
+4. Click the **Options** tab, and then clear the **Disable This Step** check box.
+5. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option.
+6. Between the two **Windows Update** steps is the **Install Applications** step. Click the **Install Applications** step, and then click **Add**.
+7. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 21.
+
+   ![A new Install Application step in the deployment task sequence](images\surface-deploymdt-fig21.png "A new Install Application step in the deployment task sequence")
+
+   *Figure 21. A new Install Application step in the deployment task sequence*
+
+8. On the **Properties** tab of the new **Install Application** step, enter **Install Microsoft Office 2016 Click-to-Run** in the **Name** field.
+9. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share.
+10.	Select Office 2016 Click-to-Run from the list of applications, and then click **OK**.
+11.	Repeat Steps 6 through 10 for the Surface app.
+12.	Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step.
+13.	Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu.
+14. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 22), configure the following options:
+  * **Name** – Set DriverGroup001
+  * **Task Sequence Variable** – DriverGroup001
+  * **Value** – Windows 10 x64\%Make%\%Model%
+
+   ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images\surface-deploymdt-fig22.png "Configure a new Set Task Sequence Variable step in the deployment task sequence")
+
+   Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence
+
+15.	Select the **Inject Drivers** step, the next step in the task sequence.
+16.	On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options:
+  * In the **Choose a selection profile** drop-down menu, select **Nothing**.
+  * Click the **Install all drivers from the selection profile** button.
+
+   ![Configure deployment task sequence not to choose the drivers to inject into Windows](images\surface-deploymdt-fig23.png "Configure deployment task sequence not to choose the drivers to inject into Windows")
+
+   *Figure 23. Configure the deployment task sequence not to choose the drivers to inject into Windows*
+
+17.	Click **OK** to apply changes to the task sequence and close the task sequence properties window.
+
+### Configure deployment share rules
+
+The experience of users during a Windows deployment is largely governed by a set of rules that control how the MDT and Windows Deployment Wizard experience should proceed. These rules are stored in two configuration files. Boot media rules are stored in the Bootstrap.ini file that is processed when the MDT boot media is first run. Deployment share rules are stored in the Customsettings.ini file and tell the Windows Deployment Wizard how to operate (for example, what screens to show and what questions to ask). By using these the rules stored in these two files, you can completely automate the process of deployment to where you will not be asked to supply the answer to any questions during deployment and the deployment will perform all tasks completely on its own.
+
+#### Configure Bootstrap.ini
+
+Bootstrap.ini is the simpler of the two rule files. The purpose it serves is to provide instructions from when the MDT boot media starts on a device until the Windows Deployment Wizard is started. The primary use of this file is to provide the credentials that will be used to log on to the deployment share and start the Windows Deployment Wizard.
+
+To automate the boot media rules, follow these steps:
+
+1. Right-click your deployment share in the Deployment Workbench, and then click **Properties**.
+2. Click the **Rules** tab, and then click **Edit Bootstrap.ini** to open Bootstrap.ini in Notepad.
+3. Replace the text of the Bootstrap.ini file with the following text:
+
+  ```
+  [Settings]
+  Priority=Model,Default
+
+  [Surface Pro 4]
+  DeployRoot=\\STNDeployServer\DeploymentShare$
+  UserDomain=STNDeployServer
+  UserID=MDTUser
+  UserPassword=P@ssw0rd
+  SkipBDDWelcome=YES
+
+  [Surface Pro 4]
+  DeployRoot=\\STNDeployServer\DeploymentShare$
+  ```
+
+4. Press Ctrl+S to save Bootstrap.ini, and then close Notepad.
+
+You can use a number of variables in both boot media and deployment share rules to apply rules only when certain conditions are met. For example, you can use MAC addresses to identify specific machines where MDT will run fully automated, but will run with required user interaction on all other devices. You can also use the model of the device to instruct the MDT boot media to perform different actions based on computer model, much as the way **[Surface Pro 4]** is listed in Step 3. You can use the following cmdlet in a PowerShell session to see what the Model variable would be on a device:
+   
+```wmic csproduct get name```
+
+Rules used in the text shown in Step 3 include:
+
+* **DeployRoot** – Used to specify the deployment share that the MDT boot media will connect to.
+* **UserDomain** – Used to specify the domain or computer where the MDT user account is located.
+* **UserID** – Used to specify the MDT user account for automatic logon to the deployment share.
+* **UserPassword** – Used to specify the MDT user password for automatic logon to the deployment share.
+* **SkipBDDWelcome** – Used to skip the Welcome page and to start the Windows Deployment Wizard immediately using the specified credentials and deployment share.
+
+#### Configure CustomSettings.ini
+
+The bulk of the rules used to automate the MDT deployment process are stored in the deployment share rules, or the Customsettings.ini file. In this file you can answer and hide all of the prompts from the Windows Deployment Wizard, which yields a deployment experience that mostly consists of a progress bar that displays the automated actions occurring on the device. The deployment share rules are shown directly in the **Rules** tab of the deployment share properties, as shown in Figure 24.
+
+![Deployment share rules configured for automation of the Windows Deployment Wizard](images\surface-deploymdt-fig24.png "Deployment share rules configured for automation of the Windows Deployment Wizard")
+
+*Figure 24. Deployment share rules configured for automation of the Windows Deployment Wizard*
+
+To configure automation for the production deployment, copy and paste the following text into the text box on the **Rules** tab of your deployment share properties:
+
+   ```
+[Settings]
+Priority=Model,Default
+Properties=MyCustomProperty
+
+[Surface Pro 4]
+SkipTaskSequence=YES
+TaskSequenceID=Win10SP4
+
+[Default]
+OSInstall=Y
+SkipCapture=YES
+SkipAdminPassword=YES
+SkipProductKey=YES
+SkipComputerBackup=YES
+SkipBitLocker=YES
+SkipBDDWelcome=YES
+SkipUserData=YES
+UserDataLocation=AUTO
+SkipApplications=YES
+SkipPackageDisplay=YES
+SkipComputerName=YES
+SkipDomainMembership=YES
+JoinDomain=contoso.com
+DomainAdmin=MDT
+DomainAdminDomain=contoso
+DomainAdminPassword=P@ssw0rd
+SkipLocaleSelection=YES
+KeyboardLocale=en-US
+UserLocale=en-US
+UILanguage=en-US
+SkipTimeZone=YES
+TimeZoneName=Pacific Standard Time
+UserID=MDTUser
+UserDomain=STNDeployServer
+UserPassword=P@ssw0rd
+SkipSummary=YES
+SkipFinalSummary=YES
+FinishAction=LOGOFF
+   ```
+Rules used in this example include:
+
+* **SkipTaskSequence** – This rule is used to skip the **Task Sequence** page where the user would have to select between available task sequences.
+* **TaskSequenceID** – This rule is used to instruct the Windows Deployment Wizard to run a specific task sequence. In this scenario the task sequence ID should match the deployment task sequence you created in the previous section.
+* **OSInstall** – This rule indicates that the Windows Deployment Wizard will be performing an operating system deployment.
+* **SkipCapture** – This rule prevents the **Capture Image** page from being displayed, prompting the user to create an image of this device after deployment.
+* **SkipAdminPassword** – This rule prevents the **Admin Password** page from being displayed. The Administrator password specified in the task sequence will still be applied.
+* **SkipProductKey** – This rule prevents the **Specify Product Key** page from being displayed. The product key specified in the task sequence will still be applied.
+* **SkipComputerBackup** – This rule prevents the **Move Data and Settings** page from being displayed, where the user is asked if they would like to make a backup of the computer before performing deployment.
+* **SkipBitLocker** – This rule prevents the **BitLocker** page from being displayed, where the user is asked if BitLocker Drive Encryption should be used to encrypt the device.
+* **SkipBDDWelcome** – This rule prevents the **Welcome** page from being displayed, where the user is prompted to begin Windows deployment.
+* **SkipUserData** – This rule prevents the **User Data (Restore)** page from being displayed, where the user is asked to restore previously backed up user data in the new environment.
+* **UserDataLocation** – This rule prevents the user from being prompted to supply a location on the User Data (Restore) page.
+* **SkipApplications** – This rule prevents the **Applications** page from being displayed, where the user is prompted to select from available applications to be installed in the new environment.
+* **SkipPackageDisplay** – This rule prevents the **Packages** page from being displayed, where the user is prompted to select from available packages to be installed in the new environment.
+* **SkipComputerName** – This rule, when combined with the **SkipDomainMembership** rule, prevents the **Computer Details** page from being displayed, where the user is asked to supply computer name and join a domain or workgroup.
+* **SkipDomainMembership** – This rule, when combined with the **SkipComputerName** rule, prevents the **Computer Details** page from being displayed, where the user is asked to supply computer name and join a domain or workgroup.
+* **JoinDomain** – This rule instructs the Windows Deployment Wizard to have the computer join the specified domain using the specified credentials. 
+* **DomainAdmin** – This rule specifies the username for the domain join operation.
+* **DomainAdminDomain** – This rule specifies the domain for the username for the domain join operation.
+* **DomainAdminPassword** – This rule specifies the password for the username for the domain join operation.
+* **SkipLocaleSelection** –  This rule, along with the **SkipTimeZone** rule, prevents the **Locale and Time** page from being displayed.
+* **KeyboardLocale** – This rule is used to specify the keyboard layout for the deployed Windows environment.
+* **UserLocale** – This rule is used to specify the geographical locale for the deployed Windows environment.
+* **UILanguage** – This rule is used to specify the language to be used in the deployed Windows environment.
+* **SkipTimeZone** –  This rule, along with the **SkipLocaleSelection** rule, prevents the **Locale and Time** page from being displayed.
+* **TimeZoneName** – This rule is used to specify the time zone for the deployed Windows environment.
+* **UserID** – This rule is used to supply the username under which the MDT actions and task sequence steps are performed.
+* **UserDomain** – This rule is used to supply the domain for the username under which the MDT actions and task sequence steps are performed.
+* **UserPassword** – This rule is used to supply the password for the username under which the MDT actions and task sequence steps are performed.
+* **SkipSummary** – This rule prevents the **Summary** page from being displayed before the task sequence is run, where the user is prompted to confirm the selections before beginning the task sequence.
+* **SkipFinalSummary** – This rule prevents the **Summary** page from being displayed when the task sequence has completed.
+* **FinishAction** – This rule specifies whether to log out, reboot, or shut down the device after the task sequence has completed.
+
+You can read about all of the possible deployment share and boot media rules in the [Microsoft Deployment Toolkit Reference](https://technet.microsoft.com/library/dn781091).
+
+### Update and import updated MDT boot media
+
+The process to update MDT boot media with these new rules and changes to the deployment share is very similar to the process to generate boot media from scratch.
+
+To update the MDT boot media, follow these steps:
+
+1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard.
+2. The Update Deployment Share Wizard displays a series of steps, as follows:
+  * **Options** – Choose between the **Completely Regenerate the Boot Images** or **Optimize the Boot Image Updating Process** options. Completely regenerating the boot images will take more time, but produces boot media that is not fragmented and does not contain out of date components. Optimizing the boot image updating process will proceed more quickly, but may result in longer load times when booting via PXE. Click **Next**.
+  * **Summary** – Review the specified options on this page before you click **Next** to begin the update of boot images.
+  * **Progress** – While the boot images are being updated a progress bar is displayed on this page.
+  * **Confirmation** – When the boot images have been updated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard.
+
+To import the updated MDT boot media into WDS for PXE boot, follow these steps:
+
+1. Open Windows Deployment Services from the Start menu or Start screen.
+2. Expand **Servers** and your deployment server.
+3. Click the **Boot Images** folder.
+4. Right-click the existing MDT boot image, and then click **Replace Image** to open the Replace Boot Image Wizard.
+5. Replace the previously imported MDT boot image with the updated version by using these steps in the Replace Boot Image Wizard:
+  * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, and then click **Open**. Click **Next**.
+  * **Available Images** – Only one image should be listed and selected **LiteTouch Windows PE (x86)**, click **Next**.
+  * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options.
+  * **Summary** – Review your selections for importing a boot image into WDS, and then click **Next**.
+  * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Replace Boot Image Wizard.
+6. Right-click the **Boot Images** folder, and then click **Add Image** to open the Add Image Wizard.
+7. Add the new 64-bit boot image for 64-bit UEFI device compatibility with the Add Image Wizard , as follows:
+  * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, select **LiteTouchPE_x64.wim**, and then click **Open**. Click **Next**.
+  * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options.
+  * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**.
+  * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard.
+
+>**Note:**&nbsp;&nbsp;Although it is a best practice to replace and update the boot images in WDS whenever the MDT deployment share is updated, for deployment to Surface devices the 32-bit boot image, LiteTouchPE_x86.wim, is not required. Only the 64-bit boot image is required for 64-bit UEFI devices.
+
+### Deploy Windows to Surface
+
+With all of the automation provided by the deployment share rules and task sequence, performing the deployment on each Surface device becomes as easy as a single touch.
+
+>**Note:**&nbsp;&nbsp;For the deployment to require only a single touch, the Surface devices must be connected to a keyboard, connected to the network with a Microsoft Surface USB Ethernet Adapter or Surface Dock, and configured with PXE boot as the first boot option, as shown in Figure 25.
+
+![Set boot priority for PXE boot](images\surface-deploymdt-fig25.png "Set boot priority for PXE boot")
+
+*Figure 25. Setting boot priority for PXE boot*
+
+On a properly configured Surface device, simply turn on the device and press Enter when you are prompted to boot from the network. The fully automated MDT deployment process will then take over and perform the following tasks:
+
+* The MDT boot media will be loaded to your Surface device via the network
+* The MDT boot media will use the provided credentials and rules to connect to the MDT deployment share
+* The task sequence and drivers will be automatically selected for your device via make and model information
+* The task sequence will deploy your updated Windows 10 image to the device complete with the selected drivers
+* The task sequence will join your device to the domain
+* The task sequence will install the applications you specified, Microsoft Office and Surface app
+* Windows Update will run, installing any new Windows Updates or updates for installed applications, like Microsoft Office
+* The task sequence will complete silently and log out of the device
+
+>**Note:**&nbsp;&nbsp;For Surface devices not configured to boot to the network as the first boot option, you can hold Volume Down and press Power to boot the system immediately to a USB or network device.
+
+The resulting configuration is a Surface device that is logged out and ready for an end user to enter their credentials, log on, and get right to work. The applications and drivers they need are already installed and up to date.
+
+
+
+

devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md

@@ -3,6 +3,7 @@ title: Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices (Surface)
 description: Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device.
 ms.assetid: A281EFA3-1552-467D-8A21-EB151E58856D
 keywords: network, wireless, device, deploy, authentication, protocol
+localizationpriority: high
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices

devices/surface/enroll-and-configure-surface-devices-with-semm.md

@@ -0,0 +1,135 @@
+---
+title: Enroll and configure Surface devices with SEMM (Surface)
+description: Learn how to create a Surface UEFI configuration package to control the settings of Surface UEFI, as well as enroll a Surface device in SEMM.
+keywords: surface enterprise management
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: surface, devices, security
+ms.sitesec: library
+author: jobotto
+---
+
+# Enroll and configure Surface devices with SEMM
+
+With Microsoft Surface Enterprise Management Mode (SEMM), you can securely configure the settings of Surface UEFI on a Surface device and manage those settings on Surface devices in your organization. When a Surface device is managed by SEMM, that device is considered to be *enrolled* (sometimes referred to as activated). This article shows you how to create a Surface UEFI configuration package that will not only control the settings of Surface UEFI, but will also enroll a Surface device in SEMM.
+
+For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode).
+
+#### Download and install Microsoft Surface UEFI Configurator
+The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/en-us/download/details.aspx?id=46703) page in the Microsoft Download Center.
+Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu.
+
+>**Note**:  Microsoft Surface UEFI Configurator is supported only on Windows 10.
+
+## Create a Surface UEFI configuration package
+
+The Surface UEFI configuration package performs both the role of applying a new configuration of Surface UEFI settings to a Surface device managed with SEMM and the role of enrolling Surface devices in SEMM. The creation of a configuration package requires you to have a signing certificate to be used with SEMM to secure the configuration of UEFI settings on each Surface device. For more information about the requirements for the SEMM certificate, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode).
+
+To create a Surface UEFI configuration package, follow these steps:
+
+1. Open Microsoft Surface UEFI Configurator from the Start menu.
+2. Click **Start**.
+3. Click **Configuration Package**, as shown in Figure 1.
+
+   ![Create a package for SEMM enrollment](images\surface-semm-enroll-fig1.png "Create a package for SEMM enrollment")
+
+   *Figure 1. Select Configuration Package to create a package for SEMM enrollment and configuration*
+
+4. Click **Certificate Protection** to add your exported certificate file with private key (.pfx), as shown in Figure 2. Browse to the location of your certificate file, select the file, and then click **OK**.
+
+   ![Add the SEM certificate and Surface UEFI password to configuration package](images\surface-semm-enrollment-fig2.png "Add the SEM certificate and Surface UEFI password to configuration package")
+
+   *Figure 2. Add the SEMM certificate and Surface UEFI password to a Surface UEFI configuration package*
+
+5. When you are prompted to confirm the certificate password, enter and confirm the password for your certificate file, and then click **OK**.
+6. Click **Password Protection** to add a password to Surface UEFI. This password will be required whenever you boot to UEFI. If this password is not entered, only the **PC information**, **About**, **Enterprise management**, and **Exit** pages will be displayed. This step is optional.
+7. When you are prompted, enter and confirm your chosen password for Surface UEFI, and then click **OK**. If you want to clear an existing Surface UEFI password, leave the password field blank.
+8. If you do not want the Surface UEFI package to apply to a particular device, on the **Choose which Surface type you want to target** page, click the slider beneath the corresponding Surface Book or Surface Pro 4 image so that it is in the **Off** position. (As shown in Figure 3.)
+
+   ![Choose devices for package compatibility](images\surface-semm-enroll-fig3.png "Choose devices for package compatibility")
+
+   *Figure 3. Choose the devices for package compatibility*
+
+9. Click **Next**.
+10. If you want to deactivate a component on managed Surface devices, on the **Choose which components you want to activate or deactivate** page, click the slider next to any device or group of devices you want to deactivate so that the slider is in the **Off** position. (Shown in Figure 4.) The default configuration for each device is **On**. Click the **Reset** button if you want to return all sliders to the default position.
+
+   ![Disable or enable Surface components](images\surface-semm-enroll-fig4.png "Disable or enable Surface components")
+
+   *Figure 4. Disable or enable individual Surface components*
+
+11.	Click **Next**.
+12.	To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package.
+
+   ![Control advanced Surface UEFI settings and Surface UEFI pages](images\surface-semm-enroll-fig5.png "Control advanced Surface UEFI settings and Surface UEFI pages")
+
+   *Figure 5. Control advanced Surface UEFI settings and Surface UEFI pages with SEMM*
+
+13.	In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**.
+14.	When the package is created and saved, the **Successful** page is displayed.
+
+>**Note**:  Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator.
+
+![Display of certificate thumbprint characters](images\surface-semm-enroll-fig6.png "Display of certificate thumbprint characters")
+
+*Figure 6. The last two characters of the certificate thumbprint are displayed on the Successful page*
+
+Now that you have created your Surface UEFI configuration package, you can enroll or configure Surface devices.
+
+>**Note**:  When a Surface UEFI configuration package is created, a log file is created on the desktop with details of the configuration package settings and options.
+
+## Enroll a Surface device in SEMM
+When the Surface UEFI configuration package is executed, the SEMM certificate and Surface UEFI configuration files are staged in the firmware storage of the Surface device. When the Surface device reboots, Surface UEFI processes these files and begins the process of applying the Surface UEFI configuration or enrolling the Surface device in SEMM, as shown in Figure 7.
+
+![SEMM process for configuration of Surface UEFI or enrollment](images\surface-semm-enroll-fig7.png "SEMM process for configuration of Surface UEFI or enrollment")
+
+*Figure 7. The SEMM process for configuration of Surface UEFI or enrollment of a Surface device*
+
+Before you begin the process to enroll a Surface device in SEMM, ensure that you have the last two characters of the certificate thumbprint on hand. You will need these characters to confirm the device’s enrollment (see Figure 6).
+
+To enroll a Surface device in SEMM with a Surface UEFI configuration package, follow these steps:
+
+1. Run the Surface UEFI configuration package .msi file on the Surface device you want to enroll in SEMM. This will provision the Surface UEFI configuration file in the device’s firmware.
+2. Select the **I accept the terms in the License Agreement** check box to accept the End User License Agreement (EULA), and then click **Install** to begin the installation process.
+3. Click **Finish** to complete the Surface UEFI configuration package installation and restart the Surface device when you are prompted to do so.
+4. Surface UEFI will load the configuration file and determine that SEMM is not enabled on the device. Surface UEFI will then begin the SEMM enrollment process, as follows:
+  * Surface UEFI will verify that the SEMM configuration file contains a SEMM certificate.
+  * Surface UEFI will prompt you to enter to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8.
+
+  ![SEMM enrollment requires last two characters of certificate thumbprint](images\surface-semm-enroll-fig8.png "SEMM enrollment requires last two characters of certificate thumbprint")
+  
+  *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint*
+
+   * Surface UEFI will store the SEMM certificate in firmware and apply the configuration settings that are specified in the Surface UEFI configuration file.
+   
+5. The Surface device is now enrolled in SEMM and will boot to Windows.
+
+You can verify that a Surface device has been successfully enrolled in SEMM by looking for **Microsoft Surface Configuration Package** in **Programs and Features** (as shown in Figure 9), or in the events stored in the **Microsoft Surface UEFI Configurator** log, found under **Applications and Services Logs** in Event Viewer (as shown in Figure 10).
+
+![Verify enrollment of Surface device in SEMM in Programs and Features](images\surface-semm-enroll-fig9.png "Verify enrollment of Surface device in SEMM in Programs and Features")
+
+*Figure 9. Verify the enrollment of a Surface device in SEMM in Programs and Features*
+
+![Verify enrollment of Surface device in SEMM in Event Viewer](images\surface-semm-enroll-fig10.png "Verify enrollment of Surface device in SEMM in Event Viewer")
+
+*Figure 10. Verify the enrollment of a Surface device in SEMM in Event Viewer*
+
+You can also verify that the device is enrolled in SEMM in Surface UEFI – while the device is enrolled, Surface UEFI will contain the **Enterprise management** page (as shown in Figure 11).
+
+![Surface UEFI Enterprise management page](images\surface-semm-enroll-fig11.png "Surface UEFI Enterprise management page")
+
+*Figure 11. The Surface UEFI Enterprise management page*
+
+
+## Configure Surface UEFI settings with SEMM
+
+After a device is enrolled in SEMM, you can run Surface UEFI configuration packages signed with the same SEMM certificate to apply new Surface UEFI settings. These settings are applied automatically the next time the device boots, without any interaction from the user. You can use application deployment solutions like System Center Configuration Manager to deploy Surface UEFI configuration packages to Surface devices to change or manage the settings in Surface UEFI.
+
+For more information about how to deploy Windows Installer (.msi) files with Configuration Manager, see [Deploy and manage applications with System Center Configuration Manager](https://technet.microsoft.com/library/mt627959).
+
+If you have secured Surface UEFI with a password, users without the password who attempt to boot to Surface UEFI will only have the **PC information**, **About**, **Enterprise management**, and **Exit** pages displayed to them.
+
+If you have not secured Surface UEFI with a password or a user enters the password correctly, settings that are configured with SEMM will be dimmed (unavailable) and the text Some settings are managed by your organization will be displayed at the top of the page, as shown in Figure 12.
+
+![Settings managed by SEMM disabled in Surface UEFI](images\surface-semm-enroll-fig12.png "Settings managed by SEMM disabled in Surface UEFI")
+
+*Figure 12. Settings managed by SEMM will be disabled in Surface UEFI*

devices/surface/ethernet-adapters-and-surface-device-deployment.md

@@ -3,6 +3,7 @@ title: Ethernet adapters and Surface deployment (Surface)
 description: This article provides guidance and answers to help you perform a network deployment to Surface devices.
 ms.assetid: 5273C59E-6039-4E50-96B3-426BB38A64C0
 keywords: ethernet, deploy, removable, network, connectivity, boot, firmware, device, adapter, PXE boot, USB
+localizationpriority: high
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices