mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 22:37:22 +00:00
Merge branch 'master' into whfb-cloudtrust
This commit is contained in:
Matthew Palko
commit
41473fccbd
@ -6438,6 +6438,14 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### EAP policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-eap.md#eap-allowtls1_3" id="eap-allowtls1_3">EAP/AllowTLS1_3</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### Education policies
|
||||
|
||||
<dl>
|
||||
@ -6628,6 +6636,20 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### HumanPresence policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-humanpresence.md#humanpresence-forceinstantlock" id="humanpresence-forceinstantlock">HumanPresence/ForceInstantLock</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-humanpresence.md#humanpresence-forceinstantwake" id="humanpresence-forceinstantwake">HumanPresence/ForceInstantWake</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-humanpresence.md#humanpresence-forcelocktimeout" id="humanpresence-forcelocktimeout">HumanPresence/ForceLockTimeout</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### InternetExplorer policies
|
||||
|
||||
<dl>
|
||||
@ -8551,6 +8573,18 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
<dd>
|
||||
<a href="./policy-csp-storage.md#storage-removablediskdenywriteaccess" id="storage-removablediskdenywriteaccess">Storage/RemovableDiskDenyWriteAccess</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-storage.md#storage-wpddevicesdenyreadaccessperdevice" id="storage-wpddevicesdenyreadaccessperdevice">Storage/WPDDevicesDenyReadAccessPerDevice</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-storage.md#storage-wpddevicesdenyreadaccessperuser" id="storage-wpddevicesdenyreadaccessperuser">Storage/WPDDevicesDenyReadAccessPerUser</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-storage.md#storage-wpddevicesdenywriteaccessperdevice" id="storage-wpddevicesdenywriteaccessperdevice">Storage/WPDDevicesDenyWriteAccessPerDevice</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-storage.md#storage-wpddevicesdenywriteaccessperuser" id="storage-wpddevicesdenywriteaccessperuser">Storage/WPDDevicesDenyWriteAccessPerUser</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### System policies
|
||||
|
||||
@ -20,6 +20,9 @@ manager: dansimp
|
||||
## ApplicationManagement policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#applicationmanagement-allowautomaticapparchiving">ApplicationManagement/AllowAutomaticAppArchiving</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#applicationmanagement-allowalltrustedapps">ApplicationManagement/AllowAllTrustedApps</a>
|
||||
</dd>
|
||||
@ -65,6 +68,62 @@ manager: dansimp
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="applicationmanagement-allowautomaticapparchiving"></a>**ApplicationManagement/AllowAutomaticAppArchiving**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|Yes|Yes|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether the system can archive infrequently used apps.
|
||||
|
||||
- If you enable this policy setting, then the system will periodically check for and archive infrequently used apps.
|
||||
|
||||
- If you disable this policy setting, then the system will not archive any apps.
|
||||
|
||||
If you do not configure this policy setting (default), then the system will follow default behavior, which is to periodically check for and archive infrequently used apps, and the user will be able to configure this setting themselves.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Allow all trusted apps to install*
|
||||
- GP name: *AllowAutomaticAppArchiving*
|
||||
- GP path: *Windows Components/App Package Deployment*
|
||||
- GP ADMX file name: *AppxPackageManager.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 - Explicit disable.
|
||||
- 1 - Explicit enable.
|
||||
- 65535 (default) - Not configured.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
|
||||
@ -39,6 +39,9 @@ manager: dansimp
|
||||
<dd>
|
||||
<a href="#authentication-configurewebsigninallowedurls">Authentication/ConfigureWebSignInAllowedUrls</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#authentication-configurewebcamaccessdomainnames">Authentication/ConfigureWebcamAccessDomainNames</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#authentication-enablefastfirstsignin">Authentication/EnableFastFirstSignIn</a>
|
||||
</dd>
|
||||
@ -307,6 +310,55 @@ Specifies the list of domains that are allowed to be navigated to in AAD PIN res
|
||||
|
||||
**Example**: If your organization's PIN reset or Web Sign-in authentication flow is expected to navigate to two domains, accounts.contoso.com and signin.contoso.com, the policy value should be "accounts.contoso.com;signin.contoso.com".
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="authentication-configurewebcamaccessdomainnames"></a>**Authentication/ConfigureWebcamAccessDomainNames**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
Specifies the list of domain names that are allowed to access the webcam in Web Sign-in Windows device sign-in scenarios.
|
||||
|
||||
Web Sign-in is only supported on Azure AD Joined PCs.
|
||||
|
||||
**Example**: If your organization federates to "Contoso IDP" and your Web Sign-in portal at "signinportal.contoso.com" requires webcam access, the policy value should be "contoso.com".
|
||||
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
|
||||
@ -28,6 +28,9 @@ manager: dansimp
|
||||
<dd>
|
||||
<a href="#devicelock-allowsimpledevicepassword">DeviceLock/AllowSimpleDevicePassword</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#devicelock-allowscreentimeoutwhilelockeduserconfig">DeviceLock/AllowScreenTimeoutWhileLockedUserConfig</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#devicelock-alphanumericdevicepasswordrequired">DeviceLock/AlphanumericDevicePasswordRequired</a>
|
||||
</dd>
|
||||
@ -149,9 +152,49 @@ Specifies whether PINs or passwords such as "1111" or "1234" are allowed. For th
|
||||
> This policy must be wrapped in an Atomic command.
|
||||
|
||||
|
||||
|
||||
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)).
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) – Blocked
|
||||
- 1 – Allowed
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="devicelock-allowscreentimeoutwhilelockeduserconfig"></a>**DeviceLock/AllowScreenTimeoutWhileLockedUserConfig**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|Yes|Yes|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
83
windows/client-management/mdm/policy-csp-eap.md
Normal file
83
windows/client-management/mdm/policy-csp-eap.md
Normal file
@ -0,0 +1,83 @@
|
||||
---
|
||||
title: Policy CSP - EAP
|
||||
description: Learn how to use the Policy CSP - Education setting to control graphing functionality in the Windows Calculator app.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/27/2019
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - EAP
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## EAP policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#eap-allowtls1_3">EAP/AllowTLS1_3</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="eap-allowtls1_3"></a>**EAP/AllowTLS1_3**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|Yes|Yes|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting is added in Windows 10, version 21H1. Allow or disallow use of TLS 1.3 during EAP client authentication.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *AllowTLS1_3*
|
||||
- GP name: *AllowTLS1_3*
|
||||
- GP path: *Windows Components/EAP*
|
||||
- GP ADMX file name: *EAP.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
- 0 – Use of TLS version 1.3 is not allowed for authentication.
|
||||
|
||||
- 1 (default) – Use of TLS version 1.3 is allowed for authentication.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
190
windows/client-management/mdm/policy-csp-humanpresence.md
Normal file
190
windows/client-management/mdm/policy-csp-humanpresence.md
Normal file
@ -0,0 +1,190 @@
|
||||
---
|
||||
title: Policy CSP - HumanPresence
|
||||
description: Use the Policy CSP - HumanPresence setting allows wake on approach and lock on leave that can be managed from MDM.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/27/2019
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - HumanPresence
|
||||
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## HumanPresence policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#humanpresence-forceinstantlock">HumanPresence/ForceInstantLock</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#humanpresence-forceinstantwake">HumanPresence/ForceInstantWake</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#humanpresence-forcelocktimeout">HumanPresence/ForceLockTimeout</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="humanpresence-forceinstantlock"></a>**HumanPresence/ForceInstantLock**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|No|No|
|
||||
|Business|No|No|
|
||||
|Enterprise|No|Yes|
|
||||
|Education|No|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy specifies whether the device can lock when a human presence sensor detects a human.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Implements wake on approach and lock on leave that can be managed from MDM*
|
||||
- GP name: *ForceInstantLock*
|
||||
- GP path: *Windows Components/HumanPresence*
|
||||
- GP ADMX file name: *HumanPresence.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 2 = ForcedOff
|
||||
- 1 = ForcedOn
|
||||
- 0 = DefaultToUserChoice
|
||||
- Defaults to 0.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="humanpresence-forceinstantwake"></a>**HumanPresence/ForceInstantWake**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|No|No|
|
||||
|Business|No|No|
|
||||
|Enterprise|No|Yes|
|
||||
|Education|No|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy specifies whether the device can lock when a human presence sensor detects a human.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Implements wake on approach and lock on leave that can be managed from MDM*
|
||||
- GP name: *ForceInstantWake*
|
||||
- GP path: *Windows Components/HumanPresence*
|
||||
- GP ADMX file name: *HumanPresence.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 2 = ForcedOff
|
||||
- 1 = ForcedOn
|
||||
- 0 = DefaultToUserChoice
|
||||
- Defaults to 0.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="humanpresence-forcelocktimeout"></a>**HumanPresence/ForceLockTimeout**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|No|No|
|
||||
|Business|No|No|
|
||||
|Enterprise|No|Yes|
|
||||
|Education|No|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy specifies at what distance the sensor wakes up when it sees a human in seconds.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Implements wake on approach and lock on leave that can be managed from MDM*
|
||||
- GP name: *ForceLockTimeout*
|
||||
- GP path: *Windows Components/HumanPresence*
|
||||
- GP ADMX file name: *HumanPresence.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
Integer value that specifies whether the device can lock when a human presence sensor detects a human.
|
||||
|
||||
The following list shows the supported values:
|
||||
|
||||
- 120 = 120 seconds
|
||||
- 30 = 30 seconds
|
||||
- 10 = 10 seconds
|
||||
- 0 = DefaultToUserChoice
|
||||
- Defaults to 0
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -14,14 +14,16 @@ manager: dansimp
|
||||
|
||||
# Policy CSP - Power
|
||||
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
|
||||
## Power policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#power-allowhibernate">Power/AllowHibernate</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#power-allowstandbystateswhensleepingonbattery">Power/AllowStandbyStatesWhenSleepingOnBattery</a>
|
||||
</dd>
|
||||
@ -98,6 +100,71 @@ manager: dansimp
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="power-allowhibernate"></a>**Power/AllowHibernate**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td>No</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td>No</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td>No</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td>No</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
<!--/Description-->
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Decides if hibernate on the machine is allowed or not*
|
||||
- GP name: *AllowHibernate*
|
||||
- GP path: *System/Power Management/Sleep Settings*
|
||||
- GP ADMX file name: *power.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
|
||||
264
windows/client-management/mdm/policy-csp-remotedesktop.md
Normal file
264
windows/client-management/mdm/policy-csp-remotedesktop.md
Normal file
@ -0,0 +1,264 @@
|
||||
---
|
||||
title: Policy CSP - RemoteDesktop
|
||||
description: Learn how the Policy CSP - RemoteDesktop setting allows you to specify a custom message to display.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/27/2019
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - RemoteDesktop
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## RemoteDesktop policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#remotedesktop-autosubscription">RemoteDesktop/AutoSubscription</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#remotedesktop-loadaadcredkeyfromprofile">RemoteDesktop/LoadAadCredKeyFromProfile</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
> [!TIP]
|
||||
> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="remotedesktop-autosubscription"></a>**RemoteDesktop/AutoSubscription<**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
<!--/Description-->
|
||||
|
||||
<!--ADMXBacked-->
|
||||
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Customize warning messages*
|
||||
- GP name: *AutoSubscription*
|
||||
- GP path: *System/Remote Desktop*
|
||||
- GP ADMX file name: *remotedesktop.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="remotedesktop-loadaadcredkeyfromprofile"></a>**RemoteDesktop/LoadAadCredKeyFromProfile**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance.
|
||||
|
||||
If you enable this policy setting, log files are generated.
|
||||
|
||||
If you disable this policy setting, log files are not generated.
|
||||
|
||||
If you do not configure this setting, application-based settings are used.
|
||||
|
||||
<!--/Description-->
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Turn on session logging*
|
||||
- GP name: *RA_Logging*
|
||||
- GP path: *System/Remote Assistance*
|
||||
- GP ADMX file name: *remoteassistance.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="remoteassistance-solicitedremoteassistance"></a>**RemoteAssistance/SolicitedRemoteAssistance**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer.
|
||||
|
||||
If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings.
|
||||
|
||||
If you disable this policy setting, users on this computer cannot use email or file transfer to ask someone for help. Also, users cannot use instant messaging programs to allow connections to this computer.
|
||||
|
||||
If you do not configure this policy setting, users can turn on or turn off Solicited (Ask for) Remote Assistance themselves in System Properties in Control Panel. Users can also configure Remote Assistance settings.
|
||||
|
||||
If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer."
|
||||
|
||||
The "Maximum ticket time" policy setting sets a limit on the amount of time that a Remote Assistance invitation created by using email or file transfer can remain open.
|
||||
|
||||
The "Select the method for sending email invitations" setting specifies which email standard to use to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting is not available in Windows Vista since SMAPI is the only method supported.
|
||||
|
||||
If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications.
|
||||
|
||||
<!--/Description-->
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Configure Solicited Remote Assistance*
|
||||
- GP name: *RA_Solicit*
|
||||
- GP path: *System/Remote Assistance*
|
||||
- GP ADMX file name: *remoteassistance.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="remoteassistance-unsolicitedremoteassistance"></a>**RemoteAssistance/UnsolicitedRemoteAssistance**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer.
|
||||
|
||||
If you enable this policy setting, users on this computer can get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.
|
||||
|
||||
If you disable this policy setting, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.
|
||||
|
||||
If you do not configure this policy setting, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.
|
||||
|
||||
If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer." When you configure this policy setting, you also specify the list of users or user groups that are allowed to offer remote assistance.
|
||||
|
||||
To configure the list of helpers, click "Show." In the window that opens, you can enter the names of the helpers. Add each user or group one by one. When you enter the name of the helper user or user groups, use the following format:
|
||||
|
||||
`<Domain Name>\<User Name>` or
|
||||
|
||||
`<Domain Name>\<Group Name>`
|
||||
|
||||
If you enable this policy setting, you should also enable firewall exceptions to allow Remote Assistance communications. The firewall exceptions required for Offer (Unsolicited) Remote Assistance depend on the version of Windows you are running.
|
||||
|
||||
Windows Vista and later
|
||||
|
||||
Enable the Remote Assistance exception for the domain profile. The exception must contain:
|
||||
Port 135:TCP
|
||||
%WINDIR%\System32\msra.exe
|
||||
%WINDIR%\System32\raserver.exe
|
||||
|
||||
Windows XP with Service Pack 2 (SP2) and Windows XP Professional x64 Edition with Service Pack 1 (SP1)
|
||||
|
||||
Port 135:TCP
|
||||
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe
|
||||
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe
|
||||
%WINDIR%\System32\Sessmgr.exe
|
||||
|
||||
For computers running Windows Server 2003 with Service Pack 1 (SP1)
|
||||
|
||||
Port 135:TCP
|
||||
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe
|
||||
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe
|
||||
Allow Remote Desktop Exception
|
||||
|
||||
<!--/Description-->
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Configure Offer Remote Assistance*
|
||||
- GP name: *RA_Unsolicit*
|
||||
- GP path: *System/Remote Assistance*
|
||||
- GP ADMX file name: *remoteassistance.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--/Policies-->
|
||||
@ -24,6 +24,9 @@ manager: dansimp
|
||||
<dd>
|
||||
<a href="#search-allowcloudsearch">Search/AllowCloudSearch</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#search-allowcortanainaad">Search/AllowCortanaInAAD</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#search-allowfindmyfiles">Search/AllowFindMyFiles</a>
|
||||
</dd>
|
||||
@ -115,6 +118,7 @@ The following list shows the supported values:
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="search-allowcortanainaad"></a>**Search/AllowCortanaInAAD**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
@ -137,6 +141,30 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy allows the cortana opt-in page during windows setup out of the box experience.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English name: *Allow Cloud Search*
|
||||
- GP name: *AllowCortanaInAAD*
|
||||
- GP element: *AllowCloudSearch_Dropdown*
|
||||
- GP path: *Windows Components/Search*
|
||||
- GP ADMX file name: *Search.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
This is a simple boolean value, default false, that can be set by MDM policy to allow the Cortana Page in OOBE when logged in with an AAD account.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="search-allowfindmyfiles"></a>**Search/AllowFindMyFiles**
|
||||
|
||||
|
||||
@ -48,6 +48,18 @@ manager: dansimp
|
||||
<dd>
|
||||
<a href="#storage-removablediskdenywriteaccess">Storage/RemovableDiskDenyWriteAccess</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#storage-wpddevicesdenyreadaccessperdevice">Storage/WPDDevicesDenyReadAccessPerDevice</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#storage-wpddevicesdenyreadaccessperuser">Storage/WPDDevicesDenyReadAccessPerUser</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#storage-wpddevicesdenywriteaccessperdevice">Storage/WPDDevicesDenyWriteAccessPerDevice</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#storage-wpddevicesdenywriteaccessperuser">Storage/WPDDevicesDenyWriteAccessPerUser</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
@ -566,5 +578,252 @@ See [Use custom settings for Windows 10 devices in Intune](/intune/custom-settin
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="storage-wpddevicesdenyreadaccessperdevice"></a>**Storage/WPDDevicesDenyReadAccessPerDevice**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy will do the enforcement over the following protocols which are used by most portable devices, e.g. mobile/IOS/Android:
|
||||
|
||||
- Picture Transfer Protocol (PTP) over USB, IP, and Bluetooth
|
||||
- Media Transfer Protocol (MTP) over USB, IP, and Bluetooth
|
||||
- Mass Storage Class (MSC) over USB
|
||||
|
||||
To enable this policy, the minimum OS requirement is Windows 10, version 1809 and [KB5003217 (OS Build 17763.1971)](https://support.microsoft.com/en-us/topic/may-20-2021-kb5003217-os-build-17763-1971-preview-08687c95-0740-421b-a205-54aa2c716b46).
|
||||
|
||||
If enabled, this policy will block end-user from Read access on any Windows Portal devices, e.g. mobile/iOS/Android.
|
||||
|
||||
>[!NOTE]
|
||||
> WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer.
|
||||
|
||||
Supported values for this policy are:
|
||||
- Not configured
|
||||
- Enabled
|
||||
- Disabled
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *WPD Devices: Deny read access*
|
||||
- GP name: *WPDDevices_DenyRead_Access_2*
|
||||
- GP path: *System/Removable Storage Access*
|
||||
- GP ADMX file name: *RemovableStorage.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="storage-wpddevicesdenyreadaccessperuser"></a>**Storage/WPDDevicesDenyReadAccessPerUser**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy will do the enforcement over the following protocols which are used by most portable devices, e.g. mobile/IOS/Android:
|
||||
|
||||
- Picture Transfer Protocol (PTP) over USB, IP, and Bluetooth
|
||||
- Media Transfer Protocol (MTP) over USB, IP, and Bluetooth
|
||||
- Mass Storage Class (MSC) over USB
|
||||
|
||||
To enable this policy, the minimum OS requirement is Windows 10, version 1809 and [KB5003217 (OS Build 17763.1971)](https://support.microsoft.com/en-us/topic/may-20-2021-kb5003217-os-build-17763-1971-preview-08687c95-0740-421b-a205-54aa2c716b46).
|
||||
|
||||
If enabled, this policy will block end-user from Read access on any Windows Portal devices, e.g. mobile/iOS/Android.
|
||||
|
||||
>[!NOTE]
|
||||
> WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer.
|
||||
|
||||
Supported values for this policy are:
|
||||
- Not configured
|
||||
- Enabled
|
||||
- Disabled
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *WPD Devices: Deny read access*
|
||||
- GP name: *WPDDevices_DenyRead_Access_1*
|
||||
- GP path: *System/Removable Storage Access*
|
||||
- GP ADMX file name: *RemovableStorage.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="storage-wpddevicesdenywriteaccessperdevice"></a>**Storage/WPDDevicesDenyWriteAccessPerDevice**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy will do the enforcement over the following protocols which are used by most portable devices, e.g. mobile/IOS/Android:
|
||||
|
||||
- Picture Transfer Protocol (PTP) over USB, IP, and Bluetooth
|
||||
- Media Transfer Protocol (MTP) over USB, IP, and Bluetooth
|
||||
- Mass Storage Class (MSC) over USB
|
||||
|
||||
To enable this policy, the minimum OS requirement is Windows 10, version 1809 and [KB5003217 (OS Build 17763.1971)](https://support.microsoft.com/en-us/topic/may-20-2021-kb5003217-os-build-17763-1971-preview-08687c95-0740-421b-a205-54aa2c716b46).
|
||||
|
||||
If enabled, this will block end-user from Write access on any Windows Portal devices, e.g. mobile/iOS/Android.
|
||||
|
||||
>[!NOTE]
|
||||
> WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer.
|
||||
|
||||
Supported values for this policy are:
|
||||
- Not configured
|
||||
- Enabled
|
||||
- Disabled
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *WPD Devices: Deny write access*
|
||||
- GP name: *WPDDevices_DenyWrite_Access_2*
|
||||
- GP path: *System/Removable Storage Access*
|
||||
- GP ADMX file name: *RemovableStorage.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="storage-wpddevicesdenywriteaccessperuser"></a>**Storage/WPDDevicesDenyWriteAccessPerUser**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
|--- |--- |--- |
|
||||
|Home|No|No|
|
||||
|Pro|Yes|Yes|
|
||||
|Business|Yes|Yes|
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy will do the enforcement over the following protocols which are used by most portable devices, e.g. mobile/IOS/Android:
|
||||
|
||||
- Picture Transfer Protocol (PTP) over USB, IP, and Bluetooth
|
||||
- Media Transfer Protocol (MTP) over USB, IP, and Bluetooth
|
||||
- Mass Storage Class (MSC) over USB
|
||||
|
||||
To enable this policy, the minimum OS requirement is Windows 10, version 1809 and [KB5003217 (OS Build 17763.1971)](https://support.microsoft.com/en-us/topic/may-20-2021-kb5003217-os-build-17763-1971-preview-08687c95-0740-421b-a205-54aa2c716b46).
|
||||
|
||||
If enabled, this will block end-user from Write access on any Windows Portal devices, e.g. mobile/iOS/Android.
|
||||
|
||||
>[!NOTE]
|
||||
> WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer.
|
||||
|
||||
Supported values for this policy are:
|
||||
- Not configured
|
||||
- Enabled
|
||||
- Disabled
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *WPD Devices: Deny write access*
|
||||
- GP name: *WPDDevices_DenyWrite_Access_1*
|
||||
- GP path: *System/Removable Storage Access*
|
||||
- GP ADMX file name: *RemovableStorage.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -701,6 +701,8 @@ items:
|
||||
href: policy-csp-display.md
|
||||
- name: DmaGuard
|
||||
href: policy-csp-dmaguard.md
|
||||
- name: EAP
|
||||
href: policy-csp-eap.md
|
||||
- name: Education
|
||||
href: policy-csp-education.md
|
||||
- name: EnterpriseCloudPrint
|
||||
@ -721,6 +723,8 @@ items:
|
||||
href: policy-csp-games.md
|
||||
- name: Handwriting
|
||||
href: policy-csp-handwriting.md
|
||||
- name: HumanPresence
|
||||
href: policy-csp-humanpresence.md
|
||||
- name: InternetExplorer
|
||||
href: policy-csp-internetexplorer.md
|
||||
- name: Kerberos
|
||||
|
||||
@ -11,7 +11,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 12/16/2021
|
||||
ms.date: 01/05/2021
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
|
||||
@ -49,5 +49,5 @@ If success auditing is enabled, an audit entry is generated each time any accoun
|
||||
|
||||
> [!NOTE]
|
||||
> On creating a subkey for a parent (RegCreateKey), the expectation is to see an event for opening a handle for the newly created object (event 4656) issued by the object manager. You will see this event only when "Audit Object Access" is enabled under **Local Policies** > **Audit Policy** in Local Security Policy. This event is not generated while using precisely defined settings for seeing only registry-related events under **Advanced Audit Policy Configurations** > **Object Access** > **Audit Registry** in Local Security Policy. For example, you will not see this event with the setting to just see the registry-related auditing events using "auditpol.exe /set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030} /success:enable".
|
||||
|
||||
Calls to Registry APIs to access an open key object to perform an operation such as RegSetValue, RegEnumValue, and RegRenameKey would trigger an event to access the object (event 4663). For example, creating a subkey using regedit.exe would not trigger a 4663 event, but renaming it would.
|
||||
>
|
||||
> Calls to Registry APIs to access an open key object to perform an operation such as RegSetValue, RegEnumValue, and RegRenameKey would trigger an event to access the object (event 4663). For example, creating a subkey using regedit.exe would not trigger a 4663 event, but renaming it would.
|
||||
|
||||
@ -17,12 +17,12 @@ ms.topic: article
|
||||
# What's new in Windows 10 Enterprise LTSC 2015
|
||||
|
||||
**Applies to**
|
||||
- Windows 10 Enterprise LTSC 2015
|
||||
- Windows 10 Enterprise LTSC 2015
|
||||
|
||||
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md).
|
||||
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md).
|
||||
|
||||
>[!NOTE]
|
||||
>Features in Windows 10 Enterprise LTSC 2015 are equivalent to [Windows 10, version 1507](../whats-new-windows-10-version-1507-and-1511.md).
|
||||
> [!NOTE]
|
||||
> Features in Windows 10 Enterprise LTSC 2015 are equivalent to [Windows 10, version 1507](../whats-new-windows-10-version-1507-and-1511.md).
|
||||
|
||||
## Deployment
|
||||
|
||||
@ -42,7 +42,6 @@ Enhancements to AppLocker in Windows 10 include:
|
||||
|
||||
- A new parameter was added to the [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**.
|
||||
- A new [AppLocker](/windows/client-management/mdm/applocker-csp) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server.
|
||||
- You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](/windows/client-management/mdm/applocker-csp).
|
||||
|
||||
[Learn how to manage AppLocker within your organization](/windows/device-security/applocker/applocker-overview).
|
||||
|
||||
@ -58,7 +57,7 @@ Enhancements to AppLocker in Windows 10 include:
|
||||
|
||||
### Certificate management
|
||||
|
||||
For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](https://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile)
|
||||
For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates.
|
||||
|
||||
### Microsoft Passport
|
||||
|
||||
@ -68,13 +67,13 @@ Microsoft Passport lets users authenticate to a Microsoft account, an Active Dir
|
||||
|
||||
### Security auditing
|
||||
|
||||
In Windows 10, security auditing has added some improvements:
|
||||
In Windows 10, security auditing has added some improvements:
|
||||
- [New audit subcategories](#bkmk-auditsubcat)
|
||||
- [More info added to existing audit events](#bkmk-moreinfo)
|
||||
|
||||
#### <a href="" id="bkmk-auditsubcat"></a>New audit subcategories
|
||||
|
||||
In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events:
|
||||
In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events:
|
||||
- [Audit Group Membership](/windows/device-security/auditing/audit-group-membership) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the logon session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource.
|
||||
When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. Multiple events are generated if the group membership information cannot fit in a single security audit event.
|
||||
- [Audit PNP Activity](/windows/device-security/auditing/audit-pnp-activity) Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device.
|
||||
@ -83,7 +82,7 @@ In Windows 10, two new audit subcategories were added to the Advanced Audit Pol
|
||||
|
||||
#### <a href="" id="bkmk-moreinfo"></a>More info added to existing audit events
|
||||
|
||||
With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events:
|
||||
With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events:
|
||||
- [Changed the kernel default audit policy](#bkmk-kdal)
|
||||
- [Added a default process SACL to LSASS.exe](#bkmk-lsass)
|
||||
- [Added new fields in the logon event](#bkmk-logon)
|
||||
@ -94,11 +93,11 @@ With Windows 10, version 1507, we've added more info to existing audit events t
|
||||
|
||||
#### <a href="" id="bkmk-kdal"></a>Changed the kernel default audit policy
|
||||
|
||||
In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts.
|
||||
In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts.
|
||||
|
||||
#### <a href="" id="bkmk-lsass"></a>Added a default process SACL to LSASS.exe
|
||||
|
||||
In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**.
|
||||
In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**.
|
||||
This can help identify attacks that steal credentials from the memory of a process.
|
||||
|
||||
#### <a href="" id="bkmk-logon"></a>New fields in the logon event
|
||||
@ -137,7 +136,7 @@ The logon event ID 4688 has been updated to include more verbose information to
|
||||
|
||||
#### <a href="" id="bkmk-sam"></a>New Security Account Manager events
|
||||
|
||||
In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited:
|
||||
In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited:
|
||||
- SamrEnumerateGroupsInDomain
|
||||
- SamrEnumerateUsersInDomain
|
||||
- SamrEnumerateAliasesInDomain
|
||||
@ -170,9 +169,9 @@ Event ID 6416 has been added to track when an external device is detected throug
|
||||
|
||||
### Trusted Platform Module
|
||||
|
||||
#### New TPM features in Windows 10
|
||||
#### New TPM features in Windows 10
|
||||
|
||||
The following sections describe the new and changed functionality in the TPM for Windows 10:
|
||||
The following sections describe the new and changed functionality in the TPM for Windows 10:
|
||||
- [Device health attestation](#bkmk-dha)
|
||||
- [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) support
|
||||
- [Device Guard](/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies) support
|
||||
@ -186,7 +185,8 @@ Some things that you can check on the device are:
|
||||
- Is BitLocker Drive Encryption supported and enabled?
|
||||
- Is SecureBoot supported and enabled?
|
||||
|
||||
> **Note** The device must be running Windows 10 and it must support at least TPM 2.0.
|
||||
> [!NOTE]
|
||||
> The device must be running Windows 10 and it must support at least TPM 2.0.
|
||||
|
||||
[Learn how to deploy and manage TPM within your organization](/windows/device-security/tpm//trusted-platform-module-overview).
|
||||
|
||||
@ -198,7 +198,7 @@ You should not turn off UAC because this is not a supported scenario for devices
|
||||
|
||||
For more info about how manage UAC, see [UAC Group Policy Settings and Registry Key Settings](/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings).
|
||||
|
||||
In Windows 10, User Account Control has added some improvements:
|
||||
In Windows 10, User Account Control has added some improvements:
|
||||
|
||||
- **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](/windows/win32/amsi/antimalware-scan-interface-portal) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked.
|
||||
|
||||
@ -219,13 +219,13 @@ Windows 10 provides a set of VPN features that both increase enterprise security
|
||||
|
||||
## Management
|
||||
|
||||
Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices.
|
||||
Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices.
|
||||
|
||||
### MDM support
|
||||
|
||||
MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more.
|
||||
MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more.
|
||||
|
||||
MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification.
|
||||
MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification.
|
||||
|
||||
Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](/windows/client-management/mdm/)
|
||||
|
||||
@ -245,8 +245,8 @@ Enterprises have the following identity and management choices.
|
||||
| Grouping | Domain join; Workgroup; Azure AD join |
|
||||
| Device management | Group Policy; Microsoft Endpoint Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) |
|
||||
|
||||
> **Note**
|
||||
With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](/lifecycle/).
|
||||
> [!NOTE]
|
||||
> With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](/lifecycle/).
|
||||
|
||||
|
||||
### Device lockdown
|
||||
@ -272,9 +272,9 @@ Administrators can also use mobile device management (MDM) or Group Policy to di
|
||||
|
||||
## Updates
|
||||
|
||||
Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service.
|
||||
Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service.
|
||||
|
||||
By using [Group Policy Objects](/previous-versions/cc498727(v=msdn.10)), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing:
|
||||
By using [Group Policy Objects](/previous-versions/cc498727(v=msdn.10)), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing:
|
||||
|
||||
- **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met).
|
||||
|
||||
@ -287,7 +287,7 @@ Together, these Windows Update for Business features help reduce device manageme
|
||||
|
||||
Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
|
||||
|
||||
For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates).
|
||||
For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates).
|
||||
|
||||
## Microsoft Edge
|
||||
|
||||
@ -295,4 +295,4 @@ The new chromium-based Microsoft Edge is not included in the LTSC release of Win
|
||||
|
||||
## See Also
|
||||
|
||||
[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release.
|
||||
[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release.
|
||||
|
||||
@ -17,9 +17,9 @@ ms.topic: article
|
||||
# What's new in Windows 10 Enterprise LTSC 2016
|
||||
|
||||
**Applies to**
|
||||
- Windows 10 Enterprise LTSC 2016
|
||||
- Windows 10 Enterprise LTSC 2016
|
||||
|
||||
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2016 (LTSB), compared to Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md).
|
||||
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2016 (LTSB), compared to Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md).
|
||||
|
||||
>[!NOTE]
|
||||
>Features in Windows 10 Enterprise LTSC 2016 are equivalent to Windows 10, version 1607.
|
||||
@ -76,7 +76,6 @@ Additional changes for Windows Hello in Windows 10 Enterprise LTSC 2016:
|
||||
- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys.
|
||||
- Group Policy settings for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**.
|
||||
- Beginning in this version of Windows 10, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN, enable the Group Policy setting **Turn on convenience PIN sign-in**.
|
||||
<!--- Users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser.-->
|
||||
|
||||
[Learn more about Windows Hello for Business.](/windows/access-protection/hello-for-business/hello-identity-verification)
|
||||
|
||||
@ -88,7 +87,9 @@ Additional changes for Windows Hello in Windows 10 Enterprise LTSC 2016:
|
||||
It provides the following benefits:
|
||||
- The algorithm is FIPS-compliant.
|
||||
- Easy to administer. You can use the BitLocker Wizard, manage-bde, Group Policy, MDM policy, Windows PowerShell, or WMI to manage it on devices in your organization.
|
||||
>**Note:** Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms.
|
||||
|
||||
> [!NOTE]
|
||||
> Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms.
|
||||
|
||||
### Security auditing
|
||||
|
||||
@ -135,7 +136,7 @@ With the growing threat from more sophisticated targeted attacks, a new security
|
||||
- The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Azure Active Directory, to provide a device compliance option for remote clients.
|
||||
- The VPN client can integrate with Windows Information Protection (WIP) policy to provide additional security. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection.
|
||||
- New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [What's new in MDM enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew_1607)
|
||||
- Microsoft Intune: *VPN Profile (Windows 10 Desktop and Mobile and later)* policy template includes support for native VPN plug-ins.
|
||||
- Microsoft Intune: *VPN* profile template includes support for native VPN plug-ins. For more information, see [Create VPN profiles to connect to VPN servers in Intune](/mem/intune/configuration/vpn-settings-configure).
|
||||
|
||||
## Management
|
||||
|
||||
@ -179,4 +180,4 @@ The new chromium-based Microsoft Edge is not included in the LTSC release of Win
|
||||
|
||||
## See Also
|
||||
|
||||
[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release.
|
||||
[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: What's new in Windows 10, versions 1507 and 1511 (Windows 10)
|
||||
description: What's new in Windows 10 for Windows 10 (versions 1507 and 1511) and Windows 10 Mobile.
|
||||
description: What's new in Windows 10 for Windows 10 (versions 1507 and 1511).
|
||||
ms.assetid: 75F285B0-09BE-4821-9B42-37B9BE54CEC6
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
@ -34,11 +34,10 @@ With Windows 10, you can create provisioning packages that let you quickly and e
|
||||
|
||||
### AppLocker
|
||||
|
||||
#### New AppLocker features in Windows 10, version 1507
|
||||
#### New AppLocker features in Windows 10, version 1507
|
||||
|
||||
- A new parameter was added to the [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**.
|
||||
- A new [AppLocker](/windows/client-management/mdm/applocker-csp) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server.
|
||||
- You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](/windows/client-management/mdm/applocker-csp).
|
||||
|
||||
[Learn how to manage AppLocker within your organization](/windows/device-security/applocker/applocker-overview).
|
||||
|
||||
@ -51,10 +50,10 @@ With Windows 10, you can create provisioning packages that let you quickly and e
|
||||
- The algorithm is FIPS-compliant.
|
||||
- Easy to administer. You can use the BitLocker Wizard, manage-bde, Group Policy, MDM policy, Windows PowerShell, or WMI to manage it on devices in your organization.
|
||||
|
||||
>[!NOTE]
|
||||
>Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms.
|
||||
> [!NOTE]
|
||||
> Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms.
|
||||
|
||||
#### New BitLocker features in Windows 10, version 1507
|
||||
#### New BitLocker features in Windows 10, version 1507
|
||||
|
||||
<!-- The link in the first bullet below will need to be refreshed Jan/Feb 2017. -->
|
||||
|
||||
@ -80,7 +79,7 @@ With Windows 10, you can create provisioning packages that let you quickly and e
|
||||
### Easier certificate management
|
||||
|
||||
|
||||
For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](https://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile)
|
||||
For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates.
|
||||
|
||||
### Microsoft Passport
|
||||
|
||||
@ -94,15 +93,15 @@ Microsoft Passport lets users authenticate to a Microsoft account, an Active Dir
|
||||
|
||||
- The [WindowsSecurityAuditing](/windows/client-management/mdm/windowssecurityauditing-csp) and [Reporting](/windows/client-management/mdm/reporting-csp) configuration service providers allow you to add security audit policies to mobile devices.
|
||||
|
||||
#### New features in Windows 10, version 1507
|
||||
#### New features in Windows 10, version 1507
|
||||
|
||||
In Windows 10, security auditing has added some improvements:
|
||||
In Windows 10, security auditing has added some improvements:
|
||||
- [New audit subcategories](#bkmk-auditsubcat)
|
||||
- [More info added to existing audit events](#bkmk-moreinfo)
|
||||
|
||||
##### <a href="" id="bkmk-auditsubcat"></a>New audit subcategories
|
||||
|
||||
In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events:
|
||||
In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events:
|
||||
- [Audit Group Membership](/windows/device-security/auditing/audit-group-membership) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the logon session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource.
|
||||
When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. Multiple events are generated if the group membership information cannot fit in a single security audit event.
|
||||
- [Audit PNP Activity](/windows/device-security/auditing/audit-pnp-activity) Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device.
|
||||
@ -111,7 +110,7 @@ In Windows 10, two new audit subcategories were added to the Advanced Audit Pol
|
||||
|
||||
##### <a href="" id="bkmk-moreinfo"></a>More info added to existing audit events
|
||||
|
||||
With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events:
|
||||
With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events:
|
||||
- [Changed the kernel default audit policy](#bkmk-kdal)
|
||||
- [Added a default process SACL to LSASS.exe](#bkmk-lsass)
|
||||
- [Added new fields in the logon event](#bkmk-logon)
|
||||
@ -122,11 +121,11 @@ With Windows 10, version 1507, we've added more info to existing audit events t
|
||||
|
||||
##### <a href="" id="bkmk-kdal"></a>Changed the kernel default audit policy
|
||||
|
||||
In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts.
|
||||
In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts.
|
||||
|
||||
##### <a href="" id="bkmk-lsass"></a>Added a default process SACL to LSASS.exe
|
||||
|
||||
In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**.
|
||||
In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**.
|
||||
This can help identify attacks that steal credentials from the memory of a process.
|
||||
|
||||
##### <a href="" id="bkmk-logon"></a>New fields in the logon event
|
||||
@ -165,7 +164,7 @@ The logon event ID 4688 has been updated to include more verbose information to
|
||||
|
||||
##### <a href="" id="bkmk-sam"></a>New Security Account Manager events
|
||||
|
||||
In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited:
|
||||
In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited:
|
||||
- SamrEnumerateGroupsInDomain
|
||||
- SamrEnumerateUsersInDomain
|
||||
- SamrEnumerateAliasesInDomain
|
||||
@ -198,13 +197,13 @@ Event ID 6416 has been added to track when an external device is detected throug
|
||||
|
||||
### Trusted Platform Module
|
||||
|
||||
#### New TPM features in Windows 10, version 1511
|
||||
#### New TPM features in Windows 10, version 1511
|
||||
|
||||
- Key Storage Providers (KSPs) and srvcrypt support elliptical curve cryptography (ECC).
|
||||
|
||||
#### New TPM features in Windows 10, version 1507
|
||||
#### New TPM features in Windows 10, version 1507
|
||||
|
||||
The following sections describe the new and changed functionality in the TPM for Windows 10:
|
||||
The following sections describe the new and changed functionality in the TPM for Windows 10:
|
||||
- [Device health attestation](#bkmk-dha)
|
||||
- [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) support
|
||||
- [Device Guard](/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies) support
|
||||
@ -219,7 +218,7 @@ Some things that you can check on the device are:
|
||||
- Is SecureBoot supported and enabled?
|
||||
|
||||
>[!NOTE]
|
||||
>The device must be running Windows 10 and it must support at least TPM 2.0.
|
||||
>The device must be running Windows 10 and it must support at least TPM 2.0.
|
||||
|
||||
[Learn how to deploy and manage TPM within your organization](/windows/device-security/tpm//trusted-platform-module-overview).
|
||||
|
||||
@ -231,9 +230,9 @@ You should not turn off UAC because this is not a supported scenario for devices
|
||||
|
||||
For more info about how manage UAC, see [UAC Group Policy Settings and Registry Key Settings](/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings).
|
||||
|
||||
In Windows 10, User Account Control has added some improvements.
|
||||
In Windows 10, User Account Control has added some improvements.
|
||||
|
||||
#### New User Account Control features in Windows 10, version 1507
|
||||
#### New User Account Control features in Windows 10, version 1507
|
||||
|
||||
- **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](/windows/win32/amsi/antimalware-scan-interface-portal) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked.
|
||||
|
||||
@ -254,13 +253,13 @@ Windows 10 provides a set of VPN features that both increase enterprise security
|
||||
|
||||
## Management
|
||||
|
||||
Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices.
|
||||
Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices.
|
||||
|
||||
### MDM support
|
||||
|
||||
MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more.
|
||||
MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more.
|
||||
|
||||
MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification.
|
||||
MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification.
|
||||
|
||||
Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](/windows/client-management/mdm/)
|
||||
|
||||
@ -282,7 +281,8 @@ Enterprises have the following identity and management choices.
|
||||
| Grouping | Domain join; Workgroup; Azure AD join |
|
||||
| Device management | Group Policy; Microsoft Endpoint Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) |
|
||||
|
||||
**Note:** With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](/lifecycle/).
|
||||
> [!NOTE]
|
||||
> With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](/lifecycle/).
|
||||
|
||||
|
||||
### Device lockdown
|
||||
@ -318,9 +318,9 @@ For more information, see [Microsoft Store for Business overview](/microsoft-sto
|
||||
|
||||
## Updates
|
||||
|
||||
Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service.
|
||||
Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service.
|
||||
|
||||
By using [Group Policy Objects](/previous-versions/cc498727(v=msdn.10)), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing:
|
||||
By using [Group Policy Objects](/previous-versions/cc498727(v=msdn.10)), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing:
|
||||
|
||||
- **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met).
|
||||
|
||||
@ -333,7 +333,7 @@ Together, these Windows Update for Business features help reduce device manageme
|
||||
|
||||
Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
|
||||
|
||||
For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates).
|
||||
For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates).
|
||||
|
||||
## Microsoft Edge
|
||||
Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana.
|
||||
@ -344,9 +344,9 @@ Microsoft Edge takes you beyond just browsing to actively engaging with the web
|
||||
- **Compatibility and security.** Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or that are included on your Enterprise Mode Site List. You must use IE11 to run older, less secure technology, such as ActiveX controls.
|
||||
|
||||
### Enterprise guidance
|
||||
Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Microsoft Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956).
|
||||
Microsoft Edge is the default browser experience for Windows 10. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Microsoft Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956).
|
||||
|
||||
We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10.
|
||||
We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10.
|
||||
|
||||
[Learn more about using Microsoft Edge in the enterprise](/microsoft-edge/deploy/emie-to-improve-compatibility)
|
||||
|
||||
@ -354,7 +354,3 @@ We also recommend that you upgrade to IE11 if you're running any earlier version
|
||||
## Learn more
|
||||
|
||||
- [Windows 10 release information](https://technet.microsoft.com/windows/release-info)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: What's new in Windows 10, version 1607 (Windows 10)
|
||||
description: What's new in Windows 10 for Windows 10 (version 1607) and Windows 10 Mobile.
|
||||
description: What's new in Windows 10 for Windows 10 (version 1607).
|
||||
keywords: ["What's new in Windows 10", "Windows 10", "anniversary update"]
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -19,7 +19,7 @@ Below is a list of some of the new and updated features in Windows 10, version 1
|
||||
|
||||
>[!NOTE]
|
||||
>For release dates and servicing options for each version, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info).
|
||||
|
||||
|
||||
## Deployment
|
||||
|
||||
### Windows Imaging and Configuration Designer (ICD)
|
||||
@ -78,7 +78,6 @@ Additional changes for Windows Hello in Windows 10, version 1607:
|
||||
- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys.
|
||||
- Group Policy settings for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**.
|
||||
- Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**.
|
||||
<!--- Users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser.-->
|
||||
|
||||
[Learn more about Windows Hello for Business.](/windows/access-protection/hello-for-business/hello-identity-verification)
|
||||
|
||||
@ -87,7 +86,7 @@ Additional changes for Windows Hello in Windows 10, version 1607:
|
||||
- The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Azure Active Directory, to provide a device compliance option for remote clients.
|
||||
- The VPN client can integrate with Windows Information Protection (WIP) policy to provide additional security. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection.
|
||||
- New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [What's new in MDM enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew_1607)
|
||||
- Microsoft Intune: *VPN Profile (Windows 10 Desktop and Mobile and later)* policy template includes support for native VPN plug-ins.
|
||||
- Microsoft Intune: *VPN* profile template includes support for native VPN plug-ins. For more information, see [Create VPN profiles to connect to VPN servers in Intune](/mem/intune/configuration/vpn-settings-configure).
|
||||
|
||||
|
||||
### Windows Information Protection (WIP), formerly known as enterprise data protection (EDP)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user