From e8f9eaac08510c54b31af7e69758eb876900d9ee Mon Sep 17 00:00:00 2001
From: sydbruck <91146756+sydbruck@users.noreply.github.com>
Date: Thu, 14 Dec 2023 17:19:54 -0500
Subject: [PATCH 01/13] Remove note saying Multi-app isn't supported in win11
(it is now supported)
---
windows/configuration/kiosk-methods.md | 3 ---
1 file changed, 3 deletions(-)
diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md
index 7dc2ae5f02..30eca6b168 100644
--- a/windows/configuration/kiosk-methods.md
+++ b/windows/configuration/kiosk-methods.md
@@ -32,9 +32,6 @@ Some desktop devices in an enterprise serve a special purpose. For example, a PC
- **A multi-app kiosk**: Runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the tiles for the apps that are allowed. With this approach, you can configure a locked-down experience for different account types.
- > [!NOTE]
- > [!INCLUDE [Multi-app kiosk mode not supported on Windows 11](./includes/multi-app-kiosk-support-windows11.md)]
-
A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that will affect **all** non-administrator users on the device.
From ede923251b60b1186d70341142ed94927affa156 Mon Sep 17 00:00:00 2001
From: Jason E <31452365+jasonepperly@users.noreply.github.com>
Date: Tue, 9 Jan 2024 09:20:54 -0500
Subject: [PATCH 02/13] Learn Editor: Update start-secondary-tiles.md
---
windows/configuration/start-secondary-tiles.md | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md
index 7600808ed5..e9b63e1772 100644
--- a/windows/configuration/start-secondary-tiles.md
+++ b/windows/configuration/start-secondary-tiles.md
@@ -41,9 +41,10 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE
**Example of secondary tiles in XML generated by Export-StartLayout**
+
```xml
```
-
-
## Export Start layout and assets
1. Follow the instructions in [Customize and export Start layout](customize-and-export-start-layout.md#customize-the-start-screen-on-your-test-computer) to customize the Start screen on your test computer.
@@ -130,6 +129,7 @@ In Microsoft Intune, you create a device restrictions policy to apply to device
The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce XML files. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout and Edge assets sections to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout and Edge assets sections to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters.
+
1. Copy the contents of layout.xml into an online tool that escapes characters.
2. Copy the contents of assets.xml into an online tool that escapes characters.
@@ -139,6 +139,7 @@ The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce
#### Create a provisioning package that contains a customized Start layout
+
Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md)
>[!IMPORTANT]
From 73c60df05404ff69236246e6469cc8763224244f Mon Sep 17 00:00:00 2001
From: Jordan Geurten
Date: Fri, 12 Jan 2024 15:19:44 -0500
Subject: [PATCH 03/13] Added up to 2312 blocks to the recommended blocklist
---
...icrosoft-recommended-driver-block-rules.md | 628 +++++++++++++++---
1 file changed, 543 insertions(+), 85 deletions(-)
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
index 615226657c..5f5bb4b658 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
@@ -80,7 +80,7 @@ To check that the policy was successfully applied on your computer:
```xml
- 10.0.25965.0
+ 10.0.26025.0
{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}
@@ -537,6 +537,26 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -653,6 +673,10 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
@@ -661,6 +685,24 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -868,6 +910,38 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -1038,6 +1112,18 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
@@ -1182,42 +1268,98 @@ To check that the policy was successfully applied on your computer:
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -1240,6 +1382,14 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
@@ -1260,6 +1410,18 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
@@ -1363,35 +1525,45 @@ To check that the policy was successfully applied on your computer:
+
+
+
-
-
+
+
+
+
-
+
+
+
+
+
+
@@ -1407,10 +1579,12 @@ To check that the policy was successfully applied on your computer:
+
+
@@ -1425,27 +1599,39 @@ To check that the policy was successfully applied on your computer:
+
+
-
+
+
-
+
+
+
+
+
+
+
+
+
+
@@ -1462,6 +1648,9 @@ To check that the policy was successfully applied on your computer:
+
+
+
@@ -1472,10 +1661,16 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
@@ -1506,6 +1701,7 @@ To check that the policy was successfully applied on your computer:
+
@@ -1525,12 +1721,14 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
-
-
@@ -1593,16 +1791,19 @@ To check that the policy was successfully applied on your computer:
+
+
-
-
+
+
+
@@ -1610,10 +1811,12 @@ To check that the policy was successfully applied on your computer:
+
+
@@ -1630,9 +1833,11 @@ To check that the policy was successfully applied on your computer:
+
+
@@ -1648,11 +1853,16 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
@@ -1716,12 +1926,21 @@ To check that the policy was successfully applied on your computer:
-
+
+
+
+
+
+
+
+
+
+
@@ -1775,6 +1994,7 @@ To check that the policy was successfully applied on your computer:
+
@@ -1784,22 +2004,26 @@ To check that the policy was successfully applied on your computer:
-
+
+
-
+
+
-
+
+
-
+
+
@@ -1964,11 +2188,13 @@ To check that the policy was successfully applied on your computer:
+
+
@@ -2004,8 +2230,9 @@ To check that the policy was successfully applied on your computer:
-
+
+
@@ -2018,6 +2245,11 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
@@ -2185,6 +2417,54 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -2309,10 +2589,13 @@ To check that the policy was successfully applied on your computer:
+
+
+
@@ -2342,6 +2625,7 @@ To check that the policy was successfully applied on your computer:
+
@@ -2369,10 +2653,13 @@ To check that the policy was successfully applied on your computer:
+
+
+
@@ -2389,17 +2676,22 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
@@ -2881,6 +3173,26 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -2985,6 +3297,10 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
@@ -2993,6 +3309,24 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -3201,6 +3535,38 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -3375,10 +3741,18 @@ To check that the policy was successfully applied on your computer:
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
@@ -3523,38 +3897,98 @@ To check that the policy was successfully applied on your computer:
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -3577,6 +4011,14 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
@@ -3597,6 +4039,18 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
+
+
+
+
+
+
+
+
@@ -3681,6 +4135,10 @@ To check that the policy was successfully applied on your computer:
+
+
+
+
@@ -3713,7 +4171,7 @@ To check that the policy was successfully applied on your computer:
- 10.0.25965.0
+ 10.0.26025.0
From 71bcf7662007d475232dadf3f32d991ad107c80c Mon Sep 17 00:00:00 2001
From: Jordan Geurten
Date: Fri, 12 Jan 2024 15:34:18 -0500
Subject: [PATCH 04/13] Added a link for the policy xml files to be downloaded
---
.../design/microsoft-recommended-driver-block-rules.md | 2 ++
1 file changed, 2 insertions(+)
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
index 5f5bb4b658..e2ad6410e3 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
@@ -77,6 +77,8 @@ To check that the policy was successfully applied on your computer:
> [!NOTE]
> To use this policy with Windows Server 2016, you must convert the policy XML on a device running a newer operating system.
+The below recommended blocklist xml policy file can also be downloaded from the [Microsoft Download Center](https://aka.ms/VulnerableDriverBlockList).
+
```xml
From f04f33d8cd2100ec51037500099e98675dca6fbc Mon Sep 17 00:00:00 2001
From: Jordan Geurten
Date: Fri, 12 Jan 2024 17:31:46 -0500
Subject: [PATCH 05/13] Drive-by update of the MDE AH query for the WDAC Wizard
---
.../design/wdac-wizard-parsing-event-logs.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md
index 6710d78572..fee227057a 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md
@@ -57,7 +57,7 @@ To create rules from the WDAC events in [MDE Advanced Hunting](../operations/que
1. Navigate to the Advanced Hunting section within the MDE console and query the WDAC events. **The Wizard requires the following fields** in the Advanced Hunting csv file export:
```KQL
- | project Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath, SHA1, SHA256, IssuerName, IssuerTBSHash, PublisherName, PublisherTBSHash, AuthenticodeHash, PolicyId, PolicyName
+ | project-keep Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath, SHA1, SHA256, IssuerName, IssuerTBSHash, PublisherName, PublisherTBSHash, AuthenticodeHash, PolicyId, PolicyName
```
The following Advanced Hunting query is recommended:
@@ -76,7 +76,7 @@ To create rules from the WDAC events in [MDE Advanced Hunting](../operations/que
| extend PolicyId = parsejson(AdditionalFields).PolicyID
| extend PolicyName = parsejson(AdditionalFields).PolicyName
// Keep only required fields for the WDAC Wizard
- | project Timestamp,DeviceId,DeviceName,ActionType,FileName,FolderPath,SHA1,SHA256,IssuerName,IssuerTBSHash,PublisherName,PublisherTBSHash,AuthenticodeHash,PolicyId,PolicyName
+ | project-keep Timestamp,DeviceId,DeviceName,ActionType,FileName,FolderPath,SHA1,SHA256,IssuerName,IssuerTBSHash,PublisherName,PublisherTBSHash,AuthenticodeHash,PolicyId,PolicyName
```
2. Export the WDAC event results by selecting the **Export** button in the results view.
From 270351d0a717c8865636e4b34a0c9d9187a15470 Mon Sep 17 00:00:00 2001
From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com>
Date: Wed, 24 Jan 2024 13:29:56 +0100
Subject: [PATCH 06/13] Update event-4624.md
add note that not all fields will be populated always. Hair-splitter customers will complain about empty fields
---
windows/security/threat-protection/auditing/event-4624.md | 3 +++
1 file changed, 3 insertions(+)
diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md
index e49f286567..07fdf70e44 100644
--- a/windows/security/threat-protection/auditing/event-4624.md
+++ b/windows/security/threat-protection/auditing/event-4624.md
@@ -250,6 +250,9 @@ This event generates when a logon session is created (on destination machine). I
- **Source Port** [Type = UnicodeString]: source port which was used for logon attempt from remote machine.
- 0 for interactive logons.
+
+ > [!NOTE]
+ The fields for IP address/port and workstation name are populated depending on the authentication context and protocol used. LSASS will audit the information the authenticating service shares with LSASS. For example, network logons with Kerberos likely have no workstation information, and NTLM logons have no TCP/IP details.
**Detailed Authentication Information:**
From cf6392a820255ed0b48407c2d2ad556156f214a8 Mon Sep 17 00:00:00 2001
From: Jordan Geurten
Date: Wed, 24 Jan 2024 12:56:50 -0500
Subject: [PATCH 07/13] Acrolinx feedback
---
...microsoft-recommended-driver-block-rules.md | 10 +++++-----
.../design/wdac-wizard-parsing-event-logs.md | 18 +++++++++---------
2 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
index e2ad6410e3..2b18eadcc2 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
@@ -5,7 +5,7 @@ ms.localizationpriority: medium
ms.collection:
- tier3
- must-keep
-ms.date: 06/06/2023
+ms.date: 01/24/2024
ms.topic: article
---
@@ -20,7 +20,7 @@ Microsoft has strict requirements for code running in kernel. So, malicious acto
- Malicious behaviors (malware) or certificates used to sign malware
- Behaviors that aren't malicious but circumvent the Windows Security Model and can be exploited by attackers to elevate privileges in the Windows kernel
-Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the vulnerable driver blocklist, including updating a block rule once a driver vulnerability has been patched, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article.
+Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the blocklist, including updating a block rule once a driver has been fixed, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article.
> [!NOTE]
> Blocking drivers can cause devices or software to malfunction, and in rare cases, lead to blue screen. The vulnerable driver blocklist is not guaranteed to block every driver found to have vulnerabilities. Microsoft attempts to balance the security risks from vulnerable drivers with the potential impact on compatibility and reliability to produce the blocklist. As always, Microsoft recommends using an explicit allow list approach to security wherever possible.
@@ -39,7 +39,7 @@ With Windows 11 2022 update, the vulnerable driver blocklist is enabled by defa
The blocklist is updated with each new major release of Windows, typically 1-2 times per year, including most recently with the Windows 11 2022 update released in September 2022. The most current blocklist is now also available for Windows 10 20H2 and Windows 11 21H2 users as an optional update from Windows Update. Microsoft will occasionally publish future updates through regular Windows servicing.
-Customers who always want the most up-to-date driver blocklist can also use Windows Defender Application Control (WDAC) to apply the latest recommended driver blocklist contained in this article. For your convenience, we've provided a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. Otherwise, you can use the XML provided below to create your own custom WDAC policies.
+Customers who always want the most up-to-date driver blocklist can also use Windows Defender Application Control (WDAC) to apply the latest recommended driver blocklist contained in this article. For your convenience, we provide a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. Otherwise, use the following XML to create your own custom WDAC policies.
## Blocking vulnerable drivers using WDAC
@@ -72,12 +72,12 @@ To check that the policy was successfully applied on your computer:
## Vulnerable driver blocklist XML
> [!IMPORTANT]
-> The policy listed below contains **Allow All** rules. If your version of Windows supports WDAC multiple policies, we recommend deploying this policy alongside any existing WDAC policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create a WDAC Deny Policy](/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy#single-policy-considerations).
+> The following policy contains **Allow All** rules. If your version of Windows supports WDAC multiple policies, we recommend deploying this policy alongside any existing WDAC policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create a WDAC Deny Policy](/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy#single-policy-considerations).
> [!NOTE]
> To use this policy with Windows Server 2016, you must convert the policy XML on a device running a newer operating system.
-The below recommended blocklist xml policy file can also be downloaded from the [Microsoft Download Center](https://aka.ms/VulnerableDriverBlockList).
+The following recommended blocklist xml policy file can also be downloaded from the [Microsoft Download Center](https://aka.ms/VulnerableDriverBlockList).
```xml
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md
index fee227057a..5fb5ff24d3 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md
@@ -3,7 +3,7 @@ title: Windows Defender Application Control Wizard WDAC Event Parsing
description: Creating WDAC policy rules from the WDAC event logs and the MDE Advanced Hunting WDAC events.
ms.localizationpriority: medium
ms.topic: conceptual
-ms.date: 02/01/2023
+ms.date: 01/24/2024
---
# Creating WDAC Policy Rules from WDAC Events in the Wizard
@@ -21,11 +21,11 @@ As of [version 2.2.0.0](https://webapp-wdac-wizard.azurewebsites.net/archives.ht
To create rules from the WDAC event logs on the system:
-1. Select **Policy Editor** from the WDAC Wizard main page.
+1. Select **Policy Editor** from the main page.
2. Select **Convert Event Log to a WDAC Policy**.
3. Select the **Parse Event Logs** button under the **Parse Event Logs from the System Event Viewer to Policy** header.
- The Wizard will parse the relevant audit and block events from the CodeIntegrity (WDAC) Operational and AppLocker MSI and Script logs. You'll see a notification when the Wizard successfully finishes reading the events.
+ The Wizard parses the relevant audit and block events from the CodeIntegrity (WDAC) Operational and AppLocker MSI and Script logs. You see a notification when the Wizard successfully finishes reading the events.
> [!div class="mx-imgBorder"]
> [](../images/wdac-wizard-event-log-system-expanded.png)
@@ -37,12 +37,12 @@ To create rules from the WDAC event logs on the system:
To create rules from the WDAC `.EVTX` event logs files on the system:
-1. Select **Policy Editor** from the WDAC Wizard main page.
+1. Select **Policy Editor** from the main page.
2. Select **Convert Event Log to a WDAC Policy**.
3. Select the **Parse Log File(s)** button under the **Parse Event Log evtx Files to Policy** header.
4. Select the WDAC CodeIntegrity Event log EVTX file(s) from the disk to parse.
- The Wizard will parse the relevant audit and block events from the selected log files. You'll see a notification when the Wizard successfully finishes reading the events.
+ The Wizard parses the relevant audit and block events from the selected log files. You see a notification when the Wizard successfully finishes reading the events.
> [!div class="mx-imgBorder"]
> [](../images/wdac-wizard-event-log-files-expanded.png)
@@ -84,12 +84,12 @@ To create rules from the WDAC events in [MDE Advanced Hunting](../operations/que
> [!div class="mx-imgBorder"]
> [](../images/wdac-wizard-event-log-mde-ah-export-expanded.png)
-3. Select **Policy Editor** from the WDAC Wizard main page.
+3. Select **Policy Editor** from the main page.
4. Select **Convert Event Log to a WDAC Policy**.
5. Select the **Parse Log File(s)** button under the "Parse MDE Advanced Hunting Events to Policy" header.
6. Select the WDAC MDE Advanced Hunting export CSV files from the disk to parse.
- The Wizard will parse the relevant audit and block events from the selected Advanced Hunting log files. You'll see a notification when the Wizard successfully finishes reading the events.
+ The Wizard will parse the relevant audit and block events from the selected Advanced Hunting log files. You see a notification when the Wizard successfully finishes reading the events.
> [!div class="mx-imgBorder"]
> [](../images/wdac-wizard-event-log-mde-ah-parsing-expanded.png)
@@ -99,14 +99,14 @@ To create rules from the WDAC events in [MDE Advanced Hunting](../operations/que
## Creating Policy Rules from the Events
-On the "Configure Event Log Rules" page, the unique WDAC log events will be shown in the table. Event Ids, filenames, product names, the policy name that audited or blocked the file, and the file publisher are all shown in the table. The table can be sorted alphabetically by clicking on any of the headers.
+On the "Configure Event Log Rules" page, the unique WDAC log events are shown in the table. Event Ids, filenames, product names, the policy name that audited or blocked the file, and the file publisher are all shown in the table. The table can be sorted alphabetically by clicking on any of the headers.
To create a rule and add it to the WDAC policy:
1. Select an audit or block event in the table by selecting the row of interest.
2. Select a rule type from the dropdown. The Wizard supports creating Publisher, Path, File Attribute, Packaged App and Hash rules.
3. Select the attributes and fields that should be added to the policy rules using the checkboxes provided for the rule type.
-4. Select the **Add Allow Rule** button to add the configured rule to the policy generated by the Wizard. The "Added to policy" label will be added to the selected row confirming that the rule will be generated.
+4. Select the **Add Allow Rule** button to add the configured rule to the policy generated by the Wizard. The "Added to policy" label is shown in the selected row confirming that the rule will be generated.
> [!div class="mx-imgBorder"]
> [](../images/wdac-wizard-event-rule-creation-expanded.png)
From 21ac91f8e566ddcc3c9fbd62541b9b5536d2131f Mon Sep 17 00:00:00 2001
From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com>
Date: Wed, 24 Jan 2024 14:43:38 -0600
Subject: [PATCH 08/13] Update kiosk-methods.md
---
windows/configuration/kiosk-methods.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md
index 30eca6b168..17b0b7375d 100644
--- a/windows/configuration/kiosk-methods.md
+++ b/windows/configuration/kiosk-methods.md
@@ -32,7 +32,7 @@ Some desktop devices in an enterprise serve a special purpose. For example, a PC
- **A multi-app kiosk**: Runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the tiles for the apps that are allowed. With this approach, you can configure a locked-down experience for different account types.
- A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that will affect **all** non-administrator users on the device.
+ A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that affects **all** non-administrator users on the device.
From 37ce65caec018d3d7be5c4e1f61cc4d8f44ca6aa Mon Sep 17 00:00:00 2001
From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com>
Date: Wed, 24 Jan 2024 14:48:05 -0600
Subject: [PATCH 09/13] Update kiosk-methods.md
---
windows/configuration/kiosk-methods.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md
index 17b0b7375d..d722a89cf2 100644
--- a/windows/configuration/kiosk-methods.md
+++ b/windows/configuration/kiosk-methods.md
@@ -24,7 +24,7 @@ ms.date: 12/31/2017
Some desktop devices in an enterprise serve a special purpose. For example, a PC in the lobby that customers use to see your product catalog. Or, a PC displaying visual content as a digital sign. Windows client offers two different locked-down experiences for public or specialized use:
-- **A single-app kiosk**: Runs a single Universal Windows Platform (UWP) app in full screen above the lock screen. People using the kiosk can see only that app. When the kiosk account (a local standard user account) signs in, the kiosk app will launch automatically, and you can configure the kiosk account to sign in automatically as well. If the kiosk app is closed, it will automatically restart.
+- **A single-app kiosk**: Runs a single Universal Windows Platform (UWP) app in full screen above the lock screen. People using the kiosk can see only that app. When the kiosk account (a local standard user account) signs in, the kiosk app launches automatically, and you can configure the kiosk account to sign in automatically as well. If the kiosk app is closed, it will automatically restart.
A single-app kiosk is ideal for public use. Using [Shell Launcher](kiosk-shelllauncher.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. This type of single-app kiosk doesn't run above the lock screen.
From 19baa432aad74c8ba8cf9dd6b4fb5b38aa6d3862 Mon Sep 17 00:00:00 2001
From: Aaron Czechowski
Date: Wed, 24 Jan 2024 13:56:19 -0800
Subject: [PATCH 10/13] fix metadata
---
.../configuration/includes/multi-app-kiosk-support-windows11.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/configuration/includes/multi-app-kiosk-support-windows11.md b/windows/configuration/includes/multi-app-kiosk-support-windows11.md
index 7f90909404..10bfe16e1d 100644
--- a/windows/configuration/includes/multi-app-kiosk-support-windows11.md
+++ b/windows/configuration/includes/multi-app-kiosk-support-windows11.md
@@ -4,7 +4,7 @@ ms.author: aaroncz
ms.date: 09/21/2021
ms.reviewer:
manager: aaroncz
-ms.prod: w10
+ms.service: windows-client
ms.topic: include
---
From f89d7b2ef9a12e52f16779ea6042d4f882a36739 Mon Sep 17 00:00:00 2001
From: Aaron Czechowski
Date: Wed, 24 Jan 2024 13:57:55 -0800
Subject: [PATCH 11/13] fix metadata
---
.../includes/app-v-end-life-statement.md | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/windows/application-management/includes/app-v-end-life-statement.md b/windows/application-management/includes/app-v-end-life-statement.md
index f9844e71b1..932390fc2d 100644
--- a/windows/application-management/includes/app-v-end-life-statement.md
+++ b/windows/application-management/includes/app-v-end-life-statement.md
@@ -4,9 +4,7 @@ ms.author: aaroncz
manager: aaroncz
ms.date: 09/20/2021
ms.topic: include
-ms.prod: w10
-ms.collection: tier1
-ms.reviewer:
+ms.service: windows-client
---
Application Virtualization will be [end of life in April 2026](/lifecycle/announcements/mdop-extended). We recommend looking at Azure Virtual Desktop with MSIX app attach. For more information, see [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) and [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal).
From 8f329a85c7e967df26fded276534d665f8cd210b Mon Sep 17 00:00:00 2001
From: Aaron Czechowski
Date: Thu, 25 Jan 2024 08:53:41 -0800
Subject: [PATCH 12/13] fix link
---
windows/deployment/upgrade/resolve-windows-upgrade-errors.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/upgrade/resolve-windows-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md
index fac9a7f59e..7b2a277708 100644
--- a/windows/deployment/upgrade/resolve-windows-upgrade-errors.md
+++ b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md
@@ -37,7 +37,7 @@ See the following articles in this section:
- [Quick fixes](/troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 100\ Steps to take to eliminate many Windows upgrade errors.
- [SetupDiag](setupdiag.md): \Level 300\ SetupDiag is a new tool to help isolate the root cause of an upgrade failure.
-- [Troubleshooting upgrade errors](/troubleshoot/windows-client/deployment/windows-upgrade-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 300\ General advice and techniques for troubleshooting Windows upgrade errors, and an explanation of phases used during the upgrade process.
+- [Troubleshooting upgrade errors](/troubleshoot/windows-client/deployment/windows-10-upgrade-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 300\ General advice and techniques for troubleshooting Windows upgrade errors, and an explanation of phases used during the upgrade process.
- [Windows Error Reporting](windows-error-reporting.md): \Level 300\ How to use Event Viewer to review details about a Windows upgrade.
- [Upgrade error codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 400\ The components of an error code are explained.
- [Result codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#result-codes): Information about result codes.
From 4f3f74eef4c934be0a0bcd48802514109caff4d6 Mon Sep 17 00:00:00 2001
From: Stacyrch140 <102548089+Stacyrch140@users.noreply.github.com>
Date: Thu, 25 Jan 2024 12:21:16 -0500
Subject: [PATCH 13/13] pencil edits
---
windows/deployment/upgrade/resolve-windows-upgrade-errors.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/deployment/upgrade/resolve-windows-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md
index 7b2a277708..db42df75b3 100644
--- a/windows/deployment/upgrade/resolve-windows-upgrade-errors.md
+++ b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md
@@ -6,8 +6,8 @@ description: Resolve Windows upgrade errors for ITPros. Technical information fo
author: frankroj
ms.localizationpriority: medium
ms.topic: article
-ms.prod: windows-client
-ms.technology: itpro-deploy
+ms.service: windows-client
+ms.subservice: itpro-deploy
ms.date: 01/18/2024
appliesto:
- ✅ Windows 11