+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. New Installation Baseline (*You are here*) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md new file mode 100644 index 0000000000..57457517cd --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -0,0 +1,518 @@ +--- +title: Configure Device Registration for Hybrid Windows Hello for Business +description: Azure Device Registration for Hybrid Certificate Trust Deployment (Windows Hello for Business) +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 09/08/2017 +--- +# Configure Device Registration for Hybrid Windows Hello for Business + +**Applies to** +- Windows 10 + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +You're environment is federated and you are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration and device write-back to enable proper device authentication. + +> [!IMPORTANT] +> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. + +Use this three phased approach for configuring device registration. +1. [Configure devices to register in Azure](#configure-azure-for-device-registration) +2. [Synchronize devices to on-premises Active Directory](#configure-active-directory-to-support-azure-device-syncrhonization) +3. [Configure AD FS to use cloud devices](#configure-ad-fs-to-use-azure-registered-devices) + +> [!NOTE] +> Before proceeding, you should familiarize yourself with device regisration concepts such as: +> * Azure AD registered devices +> * Azure AD joined devices +> * Hybrid Azure AD joined devices +> +> You can learn about this and more by reading [Introduction to Device Management in Azure Active Directory.](https://docs.microsoft.com/en-us/azure/active-directory/device-management-introduction) + +## Configure Azure for Device Registration +Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD. + +To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/) + +## Configure Active Directory to support Azure device syncrhonization + +Azure Active Directory is now configured for device registration. Next, you need to configure the on-premises Active Directory to support synchronizing hybrid Azure AD joined devices. Begin with upgrading the Active Directory Schema + +### Upgrading Active Directory to the Windows Server 2016 Schema + +To use Windows Hello for Business with Hybrid Azure AD joined devices, you must first upgrade your Active Directory schema to Windows Server 2016. + +> [!IMPORTANT] +> If you already have a Windows Server 2016 domain controller in your forest, you can skip **Upgrading Active Directory to the Windows Server 2016 Schema** (this section). + +#### Identify the schema role domain controller + +To locate the schema master role holder, open and command prompt and type: + +```Netdom query fsmo | findstr -i schema``` + + + +The command should return the name of the domain controller where you need to adprep.exe. Update the schema locally on the domain controller hosting the Schema master role. + +#### Updating the Schema + +Windows Hello for Business uses asymmetric keys as user credentials (rather than passwords). During enrollment, the public key is registered in an attribute on the user object in Active Directory. The schema update adds this new attribute to Active Directory. + +Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. Configure Azure Device Registration (*You are here*) +5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md new file mode 100644 index 0000000000..7c56e7ded8 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -0,0 +1,139 @@ +--- +title: Hybrid Windows Hello for Business Prerequistes (Windows Hello for Business) +description: Prerequisites for Hybrid Windows Hello for Business Deployments +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 09/08/2017 +--- +# Hybrid Windows Hello for Business Prerequisites + +**Applies to** +- Windows 10 + + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +Hybrid environments are distributed systems that enable organizations to use on-premises and Azure-based identities and resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication that provides a single sign-in like experience to modern resources. + +The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: +* [Directories](#directories) +* [Public Key Infrastucture](#public-key-infastructure) +* [Directory Synchronization](#directory-synchronization) +* [Federation](#federation) +* [MultiFactor Authetication](#multifactor-authentication) +* [Device Registration](#device-registration) + +## Directories ## +Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain controller, domain functional level, and forest functional level for Windows Hello for Business deployment is Windows Server 2008 R2. + +A hybrid Windows Hello for Busines deployment needs an Azure Active Directory subscription. Different deployment configurations are supported by different Azure subscriptions. The hybrid-certificate trust deployment needs an Azure Active Directory premium subscription because it uses the device write-back synchronization feature. Other deployments, such as the hybrid key-trust deployment, may not require Azure Active Directory premium subscription. + +Windows Hello for Business can be deployed in any environment with Windows Server 2008 R2 or later domain controllers. Azure device registration and Windows Hello for Business require the Windows Server 2016 Active Directory schema. + +Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs. + +### Section Review ### + +> [!div class="checklist"] +> * Active Directory Domain Functional Level +> * Active Directory Forest Functional Level +> * Domain Controller version +> * Windows Server 2016 Schema +> * Azure Active Directory subscription +> * Correct subscription for desired features and outcomes + +
+ +## Public Key Infrastructure ## +The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows 10 devices to trust the domain controller. + +Certificate trust deployments need an enterprise public key infrastructure and a certificate registration authority to issue authentication certificates to users. When using Group Policy, hybrid certificate trust deployment use the Windows Server 2016 Active Directory Federation Server (AS FS) as a certificate registration authority. + +The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. + +### Section Review +> [!div class="checklist"] +> * Windows Server 2012 Issuing Certificate Authority +> * Windows Server 2016 Active Directory Federation Services + +
+ +## Directory Synchronization ## +The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. + +Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect + +### Section Review +> [!div class="checklist"] +> * Azure Active Directory Connect directory synchronization +> * [Upgrade from DirSync](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-dirsync-upgrade-get-started) +> * [Upgrade from Azure AD Sync](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-upgrade-previous-version) + +
+ +## Federation ## +Federating your on-premises Active Directory with Azure Active Directory ensures all identities have access to all resources regardless if they reside in cloud or on-premises. Windows Hello for Business hybrid certificate trust needs Windows Server 2016 Active Directory Federation Services. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices. + +The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4034658 (14393.1593)](https://support.microsoft.com/en-us/help/4034658), which is automatically downloaded and installed through Windows Update. If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) + +### Section Review ### +> [!div class="checklist"] +> * Windows Server 2016 Active Directory Federation Services +> * Minimum update of [KB4034658 (14393.1593)](https://support.microsoft.com/en-us/help/4034658) + +
+ +## Multifactor Authentication ## +Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their username and password as one factor. but needs a second factor of authentication. + +Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication service or they can use multifactor authentication provides by Windows Server 2016 Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS. + +### Section Review +> [!div class="checklist"] +> * Azure MFA Service +> * Windows Server 2016 AD FS and Azure +> * Windows Server 2016 AD FS and third party MFA Adapter + +
+ +## Device Registration ## +Organizations wanting to deploy hybrid certificate trust need thier domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. + +Hybrid certificate trust deployments need the device write back feature. Authentication to the Windows Server 2016 Active Directory Federation Services needs both the user and the computer to authenticate. Typically the users are synchronized, but not devices. This prevents AD FS from authenticating the computer and results in Windows Hello for Business certificate enrollment failures. For this reason, Windows Hello for Business deployments need device writeback, which is an Azure Active Directory premium feature. + +### Section Checklist ### +> [!div class="checklist"] +> * Azure Active Directory Device writeback +> * Azure Active Directory Premium subscription + +
+ +### Next Steps ### +Follow the Windows Hello for Business hybrid certificate trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Basline**. + +If your environment is already federated, but does not include Azure device registration, choose **Configure Azure Device Registration**. + +If your environment is already federated and supports Azure device registration, choose **Configure Windows Hello for Business settings**. + +> [!div class="op_single_selector"] +> - [New Installation Baseline](hello-hybrid-cert-new-install.md) +> - [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +> - [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) + +
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. Prerequistes (*You are here*) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-trust.md new file mode 100644 index 0000000000..576a4d3481 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -0,0 +1,51 @@ +--- +title: Hybrid Certificate Trust Deployment (Windows Hello for Business) +description: Hybrid Certificate Trust Deployment Overview +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 09/08/2017 +--- +# Hybrid Azure AD joined Certificate Trust Deployment + +**Applies to** +- Windows 10 + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + + +Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in a hybrid certificate trust scenario. + +It is recommended that you review the Windows Hello for Business planning guide prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. You can review the [planning guide](https://docs.microsoft.com/en-us/windows/access-protection/hello-for-business/hello-planning-guide) and download the [planning worksheet](https://go.microsoft.com/fwlink/?linkid=852514). + +This deployment guide provides guidance for new deployments and customers who are already federated with Office 365. These two scenarios provide a baseline from which you can begin your deployment. + +## New Deployment Baseline ## +The new deployment baseline helps organizations who are moving to Azure and Office 365 to include Windows Hello for Business as part of their deployments. This baseline is good for organizations who are looking to deploy proof of concepts as well as IT professionals who want to familiarize themselves Windows Hello for Business by deploying a lab environment. + +This baseline provides detailed procedures to move your environment from an on-premises only environment to a hybrid environment using Windows Hello for Business to authenticate to Azure Active Directory and to your on-premises Active Directory using a single Windows sign-in. + +## Federated Baseline ## +The federated baseline helps organizations that have completed their federation with Azure Active Directory and Office 365 and enables them to introduce Windows Hello for Business into their hybrid environment. This baseline exclusively focuses on the procedures needed to add Azure Device Registration and Windows Hello for Business to an existing hybrid deployment. + +Regardless of the baseline you choose, you’re next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. + +> [!div class="nextstepaction"] +> [Prerequistes](hello-hybrid-cert-trust-prereqs.md) + +
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. Overview (*You are here*) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Device Registration](hello-hybrid-cert-trust-devreg.md) +5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md new file mode 100644 index 0000000000..744f4930a3 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -0,0 +1,75 @@ +--- +title: Hybrid Windows Hello for Business Provisioning (Windows Hello for Business) +description: Provisioning for Hybrid Windows Hello for Business Deployments +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 09/08/2017 +--- +# Hybrid Windows Hello for Business Provisioning + +**Applies to** +- Windows 10 + + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +## Provisioning +The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. + + + +The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **EnterpriseJoined** reads **Yes**. + + + + +Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. + + + +The provisioning flow proceeds to the Multi-Factor authentication portion of the enrollment. Provisioning informs the user that it is actively attempting to contact the user through their configured form of MFA. The provisioning process does not proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry. + + + +After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. + +
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings-policy.md) +6. Sign-in and Provision(*You are here*) + diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md new file mode 100644 index 0000000000..27eba8dd44 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md @@ -0,0 +1,81 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Active Directory (AD) +description: Discussing the configuration of Active Directory (AD) in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB, ad +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configuring Windows Hello for Business: Active Directory + +**Applies to** +- Windows 10 + +>[!div class="step-by-step"] +[< Configure Windows Hello for Business](hello-hybrid-cert-whfb-settings.md) +[Configure Azure AD Connect >](hello-hybrid-cert-whfb-settings-dir-sync.md) + +The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +### Creating Security Groups + +Windows Hello for Business uses several security groups to simplify the deployment and managment. + +> [!Important] +> If your environment has one or more Windows Server 2016 domain controllers in the domain to which you are deploying Windows Hello for Business, then skip the **Create the KeyCredentials Admins Security Group**. Domains that include Windows Server 2016 domain controllers use the KeyAdmins group, which is created during the installation of the first Windows Server 2016 domain controller. + +#### Create the KeyCredential Admins Security Group + +Azure Active Directory Connect synchronizes the public key on the user object created during provisioning. You assign write and read permission to this group to the Active Directory attribute to ensure the Azure AD Connect service can add and remove keys as part of its normal workflow. + +Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advance Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **KeyCredential Admins** in the **Group Name** text box. +6. Click **OK**. + +#### Create the Windows Hello for Business Users Security Group + +The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy and Certificate template permissions to this group to simplify the deployment by simply adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business and to enroll in the Windows Hello for Business authentication certificate. + +Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. + +### Section Review + +> [!div class="checklist"] +> * Create the KeyCredential Admins Security group (optional) +> * Create the Windows Hello for Business Users group + +>[!div class="step-by-step"] +[< Configure Windows Hello for Business](hello-hybrid-cert-whfb-settings.md) +[Configure Azure AD Connect >](hello-hybrid-cert-whfb-settings-dir-sync.md) + +
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings: Active Directory (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md new file mode 100644 index 0000000000..e68276a09e --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -0,0 +1,89 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Active Directory Federation Services (ADFS) +description: Discussing the configuration of Active Directory Federation Services (ADFS) in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB, adfs +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configure Windows Hello for Business: Active Directory Federation Services + +**Applies to** +- Windows10 + +## Federation Services + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +>[!div class="step-by-step"] +[< Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) +[Configure policy settings >](hello-hybrid-cert-whfb-settings-policy.md) + + +The Windows Server 2016 Active Directory Fedeartion Server Certificate Registration Authority (AD FS RA) enrolls for an enrollment agent certificate. Once the registration authority verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. + +The Windows Hello for Business Authentication certificate template is configured to only issue certificates to certificate requests that have been signed with an enrollment agent certificate. + +### Configure the Registration Authority + +Sign-in the AD FS server with *Domain Admin* equivalent credentials. + +1. Open a **Windows PowerShell** prompt. +2. Type the following command + + ```PowerShell + Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication + ``` + + +The `Set-AdfsCertificateAuthority` cmdlet should show the following warning: +>WARNING: PS0343: Issuing Windows Hello certificates requires enabling a permitted strong authentication provider, but no usable providers are currently configured. These authentication providers are not supported for Windows Hello certificates: CertificateAuthentication,MicrosoftPassportAuthentication. Windows Hello certificates will not be issued until a permitted strong authentication provider is configured. + +This warning indicates that you have not configured multi-factor authentication in AD FS and until it is configured, the AD FS server will not issue Windows Hello certificates. Windows 10, version 1703 clients check this configuration during prerequisite checks. If detected, the prerequisite check will not succeed and the user will not provision Windows Hello for Business on sign-in. + +>[!NOTE] +> If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the above command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. + + +### Group Memberships for the AD FS Service Account + +The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user. + +Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Click the **Users** container in the navigation pane. +3. Right-click **Windows Hello for Business Users** group +4. Click the **Members** tab and click **Add** +5. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**. +6. Click **OK** to return to **Active Directory Users and Computers**. +7. Restart the AD FS server. + +### Section Review +> [!div class="checklist"] +> * Configure the registration authority +> * Update group memberships for the AD FS service account + + +>[!div class="step-by-step"] +[< Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) +[Configure policy settings >](hello-hybrid-cert-whfb-settings-policy.md) + +
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings: AD FS (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) + diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md new file mode 100644 index 0000000000..51d3af12b8 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -0,0 +1,86 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Directory Synchronization +description: Discussing Directory Synchronization in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configure Hybrid Windows Hello for Business: Directory Synchronization + +**Applies to** +- Windows 10 + +>[!div class="step-by-step"] +[< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) +[Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) + +## Directory Syncrhonization + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +In hybrid deployments, users register the public portion of their Windows Hello for Business crednetial with Azure. Azure AD Connect syncrhonizes the Windows Hello for Business public key to Active Directory. + +The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. + +> [!IMPORTANT] +> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. + +### Configure Permissions for Key Syncrhonization + +Sign-in a domain controller or management workstations with *Domain Admin* equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Right-click your domain name from the navigation pane and click **Properties**. +3. Click **Security** (if the Security tab is missing, turn on Advanced Features from the View menu). +4. Click **Advanced**. Click **Add**. Click **Select a principal**. +5. The **Select User, Computer, Service Account, or Group** dialog box appears. In the **Enter the object name to select** text box, type **KeyCredential Admins**. Click **OK**. +6. In the **Applies to** list box, select **Descendant User objects**. +7. Using the scroll bar, scroll to the bottom of the page and click **Clear all**. +8. In the **Properties** section, select **Read msDS-KeyCredentialLink** and **Write msDS-KeyCrendentialLink**. +9. Click **OK** three times to complete the task. + + +### Group Memberships for the Azure AD Connect Service Account + +The KeyAdmins or KeyCredential Admins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory. + +Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Click the **Users** container in the navigation pane. +>[!IMPORTANT] +> If you already have a Windows Server 2016 domain controller in your domain, use the Keyadmins group in the next step, otherwise use the KeyCredential admins group you previously created. + +3. Right-click either the **KeyAdmins** or **KeyCredential Admins** in the details pane and click **Properties**. +4. Click the **Members** tab and click **Add** +5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**. +6. Click **OK** to return to **Active Directory Users and Computers**. + +### Section Review + +> [!div class="checklist"] +> * Configure Permissions for Key Synchronization +> * Configure group membership for Azure AD Connect + +>[!div class="step-by-step"] +[< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) +[Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) + +
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings: Directory Syncrhonization (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md new file mode 100644 index 0000000000..27ea8e8a47 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -0,0 +1,199 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Public Key Infrastructure (PKI) +description: Discussing the configuration of the Public Key Infrastructure (PKI) in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB, PKI +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- + +# Configure Hybrid Windows Hello for Business: Public Key Infrastructure + +**Applies to** +- Windows 10 + +> [!div class="step-by-step"] +[< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) +[Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +Windows Hello for Business deployments rely on certificates. Hybrid deployments uses publicly issued server authentication certifcates to validate the name of the server to which they are connecting and to encyrpt the data that flows them and the client computer. + +All deployments use enterprise issed certificates for domain controllers as a root of trust. Hybrid certificate trust deployments issue users sign-in certificate that enables them to authenticate using Windows Hello for Business credentials to non-Windows Server 2016 domain controllers. Additionally, hybrid certificate trust deployments issue certificate to registration authorites to provide defenese-in-depth security for issueing user authentication certificates. + +## Certifcate Templates + +This section has you configure certificate templates on your Windows Server 2012 or later issuing certificate authtority. + +### Domain Controller certificate template + +Clients need to trust domain controllers and the best way to do this is to ensure each domain controller has a Kerberos Authentication certificate. Installing a certificate on the domain controller enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. This provides clients a root of trust external to the domain - namely the enterprise certificate authority. + +Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates do not include the **KDC Authentication** object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template. + +By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template a baseline to create an updated domain controller certificate template. + +#### Create a Domain Controller Authentication (Kerberos) Certificate Template + +Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. + +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. + **Note**If you use different template names, you'll need to remember and substitute these names in different portions of the lab. +6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. + +#### Configure Certificate Suspeding for the Domain Controller Authentication (Kerberos) Certificate Template + +Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers--the domain controller certificate template. Later releases provided a new certificate template--the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. + +The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). + +The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template. + +Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. + +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. + +The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. + +### Enrollment Agent certificate template + +Active Directory Federation Server used for Windows Hello for Business certificate enrollment performs its own certificate lifecycle management. Once the registration authority is configured with the proper certificate template, the AD FS server attempts to enroll the certificate on the first certificate request or when the service first starts. + +Approximately 60 days prior to enrollment agent certificate's expiration, the AD FS service attempts to renew the certificate until it is successful. If the certificate fails to renew, and the certificate expires, the AD FS server will request a new enrollment agent certificate. You can view the AD FS event logs to determine the status of the enrollment agent certificate. + +> [!IMPORTANT] +> Follow the procedures below based on the AD FS service account used in your environment. + +#### Creating an Enrollment Agent certificate for Group Managed Service Accounts + +Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. + +1. Open the **Certificate Authority Management** console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right click on the **Exchange Enrollment Agent (Offline request)** template details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. +6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. + **Note:** The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. + +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. +8. On the **Security** tab, click **Add**. +9. Click **Object Types**. Select the **Service Accounts** check box and click **OK**. +10. Type **adfssvc** in the **Enter the object names to select** text box and click **OK**. +11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. +12. Close the console. + +#### Creating an Enrollment Agent certificate for typical Service Acconts + +Sign-in a certificate authority or management workstations with *Domain Admin* equivalent credentials. + +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. +6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. +8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. +9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. +10. Close the console. + +### Creating Windows Hello for Business authentication certificate template + +During Windows Hello for Business provisioning, the Windows 10, version 1703 client requests an authentication certificate from the Active Directory Federation Service, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring. + +Sign-in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. + +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. + **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. +6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. +7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. +8. On the **Issuance Requirements** tab, select the T**his number of authorized signatures** check box. Type **1** in the text box. + * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. +9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. +10. On the **Request Handling** tab, select the **Renew with same key** check box. +11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. +12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Enroll** permission. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. +14. Click on the **Apply** to save changes and close the console. + +#### Mark the template as the Windows Hello Sign-in template + +Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equivalent credentials. +1. Open an elevated command prompt. +2. Run `certutil -dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY` + +>[!NOTE] +>If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. +Publish Templates + +### Publish Certificate Templates to a Certificate Authority + +The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. + +### Unpublish Superseded Certificate Templates + +The certificate authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certificate authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. + +The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. + +Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. + +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. + +### Section Review +> [!div class="checklist"] +> * Domain Controller certificate template +> * Configure superseded domain controller certificate templates +> * Enrollment Agent certifcate template +> * Windows Hello for Business Authentication certificate template +> * Mark the certifcate template as Windows Hello for Business sign-in template +> * Publish Certificate templates to certificate authorities +> * Unpublish superseded certificate templates + + +> [!div class="step-by-step"] +[< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) +[Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) + +
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings: PKI (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) + diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md new file mode 100644 index 0000000000..2c0b6759f9 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -0,0 +1,204 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Group Policy +description: Discussing the configuration of Group Policy in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configure Hybrid Windows Hello for Business: Group Policy + +**Applies to** +- Windows 10 + +> [!div class="step-by-step"] +[< Configure AD FS](hello-hybrid-cert-whfb-settings-adfs.md) + + +## Policy Configuration + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. + +Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. + +Domain controllers of Windows Hello for Business deployments need one Group Policy setting, which enables automatic certificate enrollment for the newly create domain controller authentication certificate. This policy setting ensures domain controllers (new and existing) autoamtically request and renew the correct domain controller certifcate. + +Domain joined clients of hybrid certificate-based deployments of Windows Hello for Business needs three Group Policy settings: +* Enable Windows Hello for Business +* Use certificate for on-premises authentication +* Enable automatic enrollment of certificates + +### Configure Domain Controllers for Automatic Certificate Enrollment + +Domain controllers automatically request a certificate from the *Domain Controller* certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. + +To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU. + +#### Create a Domain Controller Automatic Certifiacte Enrollment Group Policy object + +Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. + +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. + +#### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object + +Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. + +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO�** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. + +### Windows Hello for Business Group Policy + +The Windows Hello for Business Group Policy object delivers the correct Group Policy settings to the user, which enables them to enroll and use Windows Hello for Business to authenticate to Azure and Active Directory + +#### Enable Windows Hello for Business + +The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. + +You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. + +#### Use certificate for on-premises authentication + +The Use certificate for on-premises authentication Group Policy setting determines if the on-premises deployment uses the key-trust or certificate trust on-premises authentication model. You must configure this Group Policy setting to configure Windows to enroll for a Windows Hello for Business authentication certificate. If you do not configure this policy setting, Windows considers the deployment to use key-trust on-premises authentication, which requires a sufficient number of Windows Server 2016 domain controllers to handle the Windows Hello for Business key-trust authentication requests. + +You can configure this Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users requesting a Windows Hello for Business authentication certificate. Deploying this policy setting to a user results in only that user requesting a Windows Hello for Business authentication certificate. Additionally, you can deploy the policy setting to a group of users so only those users request a Windows Hello for Business authentication certificate. If both user and computer policy settings are deployed, the user policy setting has precedence. + +#### Enable automatic enrollment of certificates + +Windows Hello for Business provisioning performs the initial enrollment of the Windows Hello for Business authentication certificate. This certificate expires based on the duration configured in the Windows Hello for Business authentication certificate template. The Windows 10, version 1703 certificate auto enrollment was updated to renew these certificates before they expire, which significantly reduces user authentication failures from expired user certificates. + +The process requires no user interaction provided the user signs-in using Windows Hello for Business. The certificate is renewed in the background before it expires. + +#### Create the Windows Hello for Business Group Policy object + +The Group Policy object contains the policy settings needed to trigger Windows Hello for Business provisioning and to ensure Windows Hello for Business authentication certificates are automatically renewed. + +Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. + +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New**. +4. Type *Enable Windows Hello for Business* in the name box and click **OK**. +5. In the content pane, right-click the **Enable Windows Hello for Business** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **User Configuration**. +7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**. +8. In the content pane, double-click **Use Windows Hello for Business**. Click **Enable** and click **OK**. +9. Double-click **Use certificate for on-premises authentication**. Click **Enable** and click **OK**. Close the **Group Policy Management Editor**. + +#### Configure Automatic Certificate Enrollment + +1. Start the **Group Policy Management Console** (gpmc.msc). +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click the **Enable Windows Hello for Business** Group Policy object and click **Edit**. +4. In the navigation pane, expand **Policies** under **User Configuration**. +5. Expand **Windows Settings > Security Settings**, and click **Public Key Policies**. +6. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. +7. Select **Enabled** from the **Configuration Model** list. +8. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +9. Select the **Update certificates that use certificate templates** check box. +10. Click **OK**. Close the **Group Policy Management Editor**. + +#### Configure Security in the Windows Hello for Business Group Policy object + +The best way to deploy the Windows Hello for Business Group Policy object is to use security group filtering. The enables you to easily manage the users that should receive Windows Hello for Business by simply adding them to a group. This enables you to deploy Windows Hello for Business in phases. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Double-click the **Enable Windows Hello for Business** Group Policy object. +4. In the **Security Filtering** section of the content pane, click **Add**. Type *Windows Hello for Business Users* or the name of the security group you previously created and click **OK**. +5. Click the **Delegation** tab. Select **Authenticated Users** and click **Advanced**. +6. In the **Group or User names** list, select **Authenticated Users**. In the **Permissions for Authenticated Users** list, clear the **Allow** check box for the **Apply Group Policy** permission. Click **OK**. + +#### Deploy the Windows Hello for Business Group Policy object + +The application of the Windows Hello for Business Group Policy object uses security group filtering. This enables you to link the Group Policy object at the domain, ensuring the Group Policy object is within scope to all users. However, the security group filtering ensures only the users included in the *Windows Hello for Business Users* global group receive and apply the Group Policy object, which results in the provisioning of Windows Hello for Business. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO�** +3. In the **Select GPO** dialog box, select **Enable Windows Hello for Business** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. + +Just to reassure, linking the **Windows Hello for Business** Group Policy object to the domain ensures the Group Policy object is in scope for all domain users. However, not all users will have the policy settings applied to them. Only users who are members of the Windows Hello for Business group receive the policy settings. All others users ignore the Group Policy object. + +## Other Related Group Policy settings + +### Windows Hello for Business + +There are other Windows Hello for Business policy settings you can configure to manage your Windows Hello for Business deployment. These policy settings are computer-based policy setting; so they are applicable to any user that sign-in from a computer with these policy settings. + +#### Use a hardware security device + +The default configuration for Windows Hello for Business is to prefer hardware protected credentials; however, not all computers are able to create hardware protected credentials. When Windows Hello for Business enrollment encounters a computer that cannot create a hardware protected credential, it will create a software-based credential. + +You can enable and deploy the **Use a hardware security device** Group Policy Setting to force Windows Hello for Business to only create hardware protected credentials. Users that sign-in from a computer incapable of creating a hardware protected credential do not enroll for Windows Hello for Business. + +Another policy setting becomes available when you enable the **Use a hardware security device** Group Policy setting that enables you to prevent Windows Hello for Business enrollment from using version 1.2 Trusted Platform Modules (TPM). Version 1.2 TPMs typically perform cryptographic operations slower than version 2.0 TPMs and are more unforgiven during anti-hammering and PIN lockout activities. Therefore, some organization may want not want slow sign-in performance and management overhead associated with version 1.2 TPMs. To prevent Windows Hello for Business from using version 1.2 TPMs, simply select the TPM 1.2 check box after you enable the Use a hardware security device Group Policy object. + +#### Use biometrics + +Windows Hello for Business provides a great user experience when combined with the use of biometrics. Rather than providing a PIN to sign-in, a user can use a fingerprint or facial recognition to sign-in to Windows, without sacrificing security. + +The default Windows Hello for Business enables users to enroll and use biometrics. However, some organization may want more time before using biometrics and want to disable their use until they are ready. To not allow users to use biometrics, configure the **Use biometrics** Group Policy setting to disabled and apply it to your computers. The policy setting disabled all biometrics. Currently, Windows does not provide granular policy setting that enable you to disable specific modalities of biometrics such as allow facial recognition, but disallow fingerprint. + +### PIN Complexity + +PIN complexity is not specific to Windows Hello for Business. Windows 10 enables users to use PINs outside of Windows Hello for Business. PIN Complexity Group Policy settings apply to all uses of PINs, even when Windows Hello for Business is not deployed. + +Windows 10 provides eight PIN Complexity Group Policy settings that give you granular control over PIN creation and management. You can deploy these policy settings to computers, where they affect all users creating PINs on that computer; or, you can deploy these settings to users, where they affect those users creating PINs regardless of the computer they use. If you deploy both computer and user PIN complexity Group Policy settings, the user policy settings have precedence over computer policy settings. Also, this conflict resolution is based on the last applied policy. Windows does not merge the policy settings automatically; however, you can deploy Group Policy to provide to accomplish a variety of configurations. The policy settings included are: +* Require digits +* Require lowercase letters +* Maximum PIN length +* Minimum PIN length +* Expiration +* History +* Require special characters +* Require uppercase letters + +Starting with Windows 10, version 1703, the PIN complexity Group Policy settings have moved to remove misunderstanding that PIN complexity policy settings were exclusive to Windows Hello for Business. The new location of these Group Policy settings is under **Computer Configuration\Administrative Templates\System\PIN Complexity** of the Group Policy editor. + +## Add users to the Windows Hello for Business Users group + +Users must receive the Windows Hello for Business group policy settings and have the proper permission to enroll for the Wwindows Hello for Business Authentication certificate. You can provide users with these settings and permissions by adding the group used synchronize users to the Windows Hello for Business Users group. Users and groups who are not members of this group will not attempt to enroll for Windows Hello for Business. + +### Section Review +> [!div class="checklist"] +> * Configure domain controllers for automatic certificate enrollment. +> * Create Windows Hello for Business Group Policy object. +> * Enable the Use Windows Hello for Business policy setting. +> * Enable the Use certificate for on-premises authentication policy setting. +> * Enable user automatic certificate enrollment. +> * Add users or groups to the Windows Hello for Business group + + +> [!div class="nextstepaction"] +[Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) + +
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business policy settings (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md new file mode 100644 index 0000000000..2dbfc5fda4 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -0,0 +1,50 @@ +--- +title: Configure Hybrid Windows Hello for Business Settings (Windows Hello for Business) +description: Configuring Windows Hello for Business Settings in Hybrid deployment +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configure Windows Hello for Business + +**Applies to** +- Windows 10 + +> [!div class="step-by-step"] +[Configure Active Directory >](hello-hybrid-cert-whfb-settings-ad.md) + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +You're environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. +> [!IMPORTANT] +> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. + +The configuration for Windows Hello for Business is grouped in four categories. These categories are: +* [Active Directory](hello-hybrid-cert-whfb-settings-ad.md) +* [Public Key Infrastructure](hello-hybrid-cert-whfb-settings-pki.md) +* [Active Directory Federation Services](hello-hybrid-cert-whfb-settings-adfs.md) +* [Group Policy](hello-hybrid-cert-whfb-settings-policy.md) + +For the most efficent deployment, configure these technologies in order beginning with the Active Directory configuration + +> [!div class="step-by-step"] +[Configure Active Directory >](hello-hybrid-cert-whfb-settings-ad.md) + +
+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-identity-verification.md b/windows/access-protection/hello-for-business/hello-identity-verification.md index 6bc13714ae..59a9bb791e 100644 --- a/windows/access-protection/hello-for-business/hello-identity-verification.md +++ b/windows/access-protection/hello-for-business/hello-identity-verification.md @@ -10,7 +10,7 @@ ms.pagetype: security, mobile author: DaniHalfin ms.localizationpriority: high ms.author: daniha -ms.date: 07/07/2017 +ms.date: 09/08/2017 --- # Windows Hello for Business @@ -78,7 +78,7 @@ There are many deployment options from which to choose. Some of those options re Windows Hello for Business is two-factor authentication based the observed authentication factors of: something you have, something you know, and something part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. Using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". ### Can I use PIN and biometrics to unlock my device? -No. Windows Hello for Business provides two-factor authentication. However, we are investigating the ability to unlock the device with multiple factors. +No. Windows Hello for Business provides two-factor authentication. However, we are investigating the ability to unlock the desktop with additional factors. ### What is the difference between Windows Hello and Windows Hello for Business Windows Hello represents the biometric framework provided in Windows 10. Windows Hello enables users to use biometrics to sign into their devices by securely storing their username and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. @@ -86,6 +86,28 @@ Windows Hello represents the biometric framework provided in Windows 10. Window ### I have extended Active Directory to Azure Active Directory. Can I use the on-prem deployment model? No. If your organization is federated or using online services, such as Office 365 or OneDrive, then you must use a hybrid deployment model. On-premises deployments are exclusive to organization who need more time before moving to the cloud and exclusively use Active Directory. +### Does Windows Hello for Business prevent the use of simple PINs? +Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. This prevents repeating numbers, sequential numbers and simple patterns. +So, for example: +* 1111 has a constant delta of 0, so it is not allowed +* 1234 has a constant delta of 1, so it is not allowed +* 1357 has a constant delta of 2, so it is not allowed +* 9630 has a constant delta of -3, so it is not allowed +* 1231 does not have a constant delta, so it is okay +* 1593 does not have a constant delta, so it is okay + +This algorithm does not apply to alphanumeric PINs. + +### How does PIN caching work with Windows Hello for Business? +Windows Hello for Business provides a PIN caching user experience using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Azure AD and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting as long as the user is interactively signed-in. Microsoft Account sign-in keys are considered transactional keys, which means the user is always prompted when accessing the key. + +Beginning with Windows 10, Fall Creators Update, Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation will prompt the user for the PIN on first use. Subsequent private key operations will not prompt the user for the PIN. + +The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process does not receive the PIN, but rather the ticket that grants them private key operations. Windows 10 does not provide any Group Policy settings to adjust this caching. + +### Can I disable the PIN while using Windows Hello for Business? +No. The movement away from passwords is accomplished by gradually reducing the use of the password. In the occurence where you cannot authenticate with biometrics, you need a fall back mechansim that is not a password. The PIN is the fall back mechansim. Disabling or hiding the PIN credential provider disabled the use of biometrics. + ### Does Windows Hello for Business work with third party federation servers? Windows Hello for Business can work with any third-party federation servers that support the protocols used during provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration) @@ -98,3 +120,4 @@ Windows Hello for Business can work with any third-party federation servers that ### Does Windows Hello for Business work with Mac and Linux clients? Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third parties who are interested in moving these platforms away from passwords. Interested third parties can inqury at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration) + diff --git a/windows/access-protection/hello-for-business/hello-manage-in-organization.md b/windows/access-protection/hello-for-business/hello-manage-in-organization.md index 6d8b9b37a2..52c93015e2 100644 --- a/windows/access-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/access-protection/hello-for-business/hello-manage-in-organization.md @@ -25,7 +25,7 @@ You can create a Group Policy or mobile device management (MDM) policy that will > >Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. > ->Use **Windows Hello for Business** policy settings to manage PINs for Windows Hello for Business. +>Use **PIN Complexity** policy settings to manage PINs for Windows Hello for Business. ## Group Policy settings for Windows Hello for Business @@ -292,71 +292,6 @@ The following table lists the MDM policy settings that you can configure for Win >[!NOTE] > If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. -## Prerequisites - -To deploy Windows Hello for Business, in some modes you must add Windows Server 2016 domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Windows Hello for Business build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Azure Active Directory to deploy Windows Hello for Business in your network. - -You’ll need this software to set Windows Hello for Business policies in your enterprise. -
| Windows Hello for Business mode | -Azure AD | -Active Directory (AD) on-premises (only supported with Windows 10, version 1703 clients) | -Azure AD/AD hybrid (available with production release of Windows Server 2016) | -
|---|---|---|---|
| Key-based authentication | -Azure AD subscription | -
|
-
|
-
| Certificate-based authentication | -
|
-
|
-
|
-
Management tool for the Windows Store for Business
Management tool for the Micosoft Store for Business
New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.
The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:
+-
+
- UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page. +
- ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need. +
- DomainName - fully qualified domain name if the device is domain-joined. +
For examples, see section 4.3.1 RequestSecurityToken of the the MS-MDE2 protocol documentation.
+Added new CSP in Windows 10, version 1709.
Added DeviceTunnel profile in Windows 10, version 1709.
+Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709.
Added new policies.
Windows Store for Business name changed to Microsoft Store for Business.
+Added the following new policies for Windows 10, version 1709:
-
+
- Authentication/AllowAadPasswordReset
- Browser/LockdownFavorites
- Browser/ProvisionFavorites
- CredentialProviders/DisableAutomaticReDeploymentCredentials @@ -1000,6 +1015,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
- DeviceGuard/LsaCfgFlags
- ExploitGuard/ExploitProtectionSettings
- Games/AllowAdvancedGamingServices +
- Handwriting/PanelDefaultModeDocked
- LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
- LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus
- LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus @@ -1043,7 +1059,9 @@ For details about Microsoft mobile device management protocols for Windows 10 s
- Education/DefaultPrinterName
- Education/PreventAddingNewPrinters
- Education/PrinterNames +
- Search/AllowCloudSearch
- Security/ClearTPMIfNotReady +
- System/LimitEnhancedDiagnosticDataWindowsAnalytics
- Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
- Update/DisableDualScan
- Update/ScheduledInstallEveryWeek @@ -1335,6 +1353,52 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Change history in MDM documentation +### September 2017 + +
- Authentication/AllowAadPasswordReset +
- Handwriting/PanelDefaultModeDocked +
- Search/AllowCloudSearch +
- System/LimitEnhancedDiagnosticDataWindowsAnalytics +
- UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page. +
- ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need. +
- DomainName - fully qualified domain name if the device is domain-joined. +
- + Authentication/AllowAadPasswordReset +
- Authentication/AllowEAPCertSSO @@ -1024,6 +1027,14 @@ The following diagram shows the Policy configuration service provider in tree fo
- + Search/AllowCloudSearch +
- Search/AllowIndexingEncryptedStoresOrItems @@ -2646,6 +2660,9 @@ The following diagram shows the Policy configuration service provider in tree fo
- System/DisableSystemRestore +
- + System/LimitEnhancedDiagnosticDataWindowsAnalytics +
- System/TelemetryProxy diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index fcc6506c15..3c483fb097 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/06/2017 --- # Policy CSP - Authentication @@ -19,6 +19,42 @@ ms.date: 08/30/2017 ## Authentication policies + +**Authentication/AllowAadPasswordReset** + + +
- 0 - Disabled (default) +
- 1 - Enabled +
- Enable this policy setting +
- Set Allow Telemetry to level 2 (Enhanced) +
- Error codes and error messages, name and ID of the app, and process reporting the error
- DLL library predicted to be the source of the error -- xyz.dll
- System generated files -- app or product logs and trace files to help diagnose a crash or hang
- System settings such as registry keys
- User generated files – .doc, .ppt, .csv files where they are indicated as a potential cause for a crash or hang
- Details and counts of abnormal shutdowns, hangs, and crashes
- Crash failure data – OS, OS component, driver, device, 1st and 3rd party app data
- Crash and Hang dumps
- The recorded state of the working memory at the point of the crash.
- Memory in use by the kernel at the point of the crash.
- Memory in use by the application at the point of the crash.
- All the physical memory used by Windows at the point of the crash.
- Class and function name within the module that failed.
- User Interface interaction durations -- Start Menu display times, browser tab switch times, app launch and switch times, and Cortana and search performance and reliability.
- Device on/off performance -- Device boot, shutdown, power on/off, lock/unlock times, and user authentication times (fingerprint and face recognition durations).
- In-app responsiveness -- time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction.
- User input responsiveness – onscreen keyboard invocation times for different languages, time to show auto-complete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score.
- UI and media performance and glitches/smoothness -- video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance
- Disk footprint -- Free disk space, out of memory conditions, and disk score.
- Excessive resource utilization – components impacting performance or battery life through high CPU usage during different screen and power states
- Background task performance -- download times, Windows Update scan duration, Windows Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results
- Peripheral and devices -- USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness environmental response times
- Device setup -- first setup experience times (time to install updates, install apps, connect to network etc.), time to recognize connected devices (printer and monitor), and time to setup Microsoft Account.
- Power and Battery life – power draw by component (Process/CPU/GPU/Display), hours of screen off time, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use during screen off, auto-brightness details, time device is plugged into AC vs. battery, battery state transitions
- Service responsiveness - Service URI, operation, latency, service success/error codes, and protocol.
- Diagnostic heartbeat – regular signal to validate the health of the diagnostics system
- Error codes and error messages, name and ID of the app, and process reporting the error
- DLL library predicted to be the source of the error -- xyz.dll
- System generated files -- app or product logs and trace files to help diagnose a crash or hang
- System settings such as registry keys
- User generated files – .doc, .ppt, .csv files where they are indicated as a potential cause for a crash or hang
- Details and counts of abnormal shutdowns, hangs, and crashes
- Crash failure data – OS, OS component, driver, device, 1st and 3rd party app data
- Crash and Hang dumps
- The recorded state of the working memory at the point of the crash.
- Memory in use by the kernel at the point of the crash.
- Memory in use by the application at the point of the crash.
- All the physical memory used by Windows at the point of the crash.
- Class and function name within the module that failed.
- User Interface interaction durations -- Start Menu display times, browser tab switch times, app launch and switch times, and Cortana and search performance and reliability.
- Device on/off performance -- Device boot, shutdown, power on/off, lock/unlock times, and user authentication times (fingerprint and face recognition durations).
- In-app responsiveness -- time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction.
- User input responsiveness – onscreen keyboard invocation times for different languages, time to show auto-complete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score.
- UI and media performance and glitches/smoothness -- video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance
- Disk footprint -- Free disk space, out of memory conditions, and disk score.
- Excessive resource utilization – components impacting performance or battery life through high CPU usage during different screen and power states
- Background task performance -- download times, Windows Update scan duration, Windows Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results
- Peripheral and devices -- USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness environmental response times
- Device setup -- first setup experience times (time to install updates, install apps, connect to network etc.), time to recognize connected devices (printer and monitor), and time to setup Microsoft Account.
- Power and Battery life – power draw by component (Process/CPU/GPU/Display), hours of screen off time, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use during screen off, auto-brightness details, time device is plugged into AC vs. battery, battery state transitions
- Service responsiveness - Service URI, operation, latency, service success/error codes, and protocol.
- Diagnostic heartbeat – regular signal to validate the health of the diagnostics system
- Video Width, height, color pallet, encoding (compression) type, and encryption type
- Instructions for how to stream content for the user -- the smooth streaming manifest of chunks of content files that must be pieced together to stream the content based on screen resolution and bandwidth
- URL for a specific two second chunk of content if there is an error
- Full screen viewing mode details|
+|Music & TV|Information about music and TV consumption on the device. This isn't intended to capture user viewing, listening or habits.
- Service URL for song being downloaded from the music service – collected when an error occurs to facilitate restoration of service
- Content type (video, audio, surround audio)
- Local media library collection statistics -- number of purchased tracks, number of playlists
- Region mismatch -- User OS Region, and Xbox Live region
- App accessing content and status and options used to open a Microsoft Store book
- Language of the book
- Time spent reading content
- Content type and size details
- File source data -- local, SD card, network device, and OneDrive
- Image & video resolution, video length, file sizes types and encoding
- Collection view or full screen viewer use and duration of view
- Kind of query issued and index type (ConstraintIndex, SystemIndex)
- Number of items requested and retrieved
- File extension of search result user interacted with
- Launched item kind, file extension, index of origin, and the App ID of the opening app.
- Name of process calling the indexer and time to service the query.
- A hash of the search scope (file, Outlook, OneNote, IE history)
- The state of the indices (fully optimized, partially optimized, being built)
- Product ID, edition ID and product URI
- Offer details -- price
- Order requested date/time
- Store client type -- web or native client
- Purchase quantity and price
- Payment type -- credit card type and PayPal
- Service subscription status and errors
- DRM and license rights details -- Groove subscription or OS volume license
- Entitlement ID, lease ID, and package ID of the install package
- Entitlement revocation
- License type (trial, offline vs online) and duration
- License usage session
- App, driver, update package, or component’s Name, ID, or Package Family Name
- Product, SKU, availability, catalog, content, and Bundle IDs
- OS component, app or driver publisher, language, version and type (Win32 or UWP)
- Install date, method, and install directory, count of install attempts
- MSI package code and product code
- Original OS version at install time
- User or administrator or mandatory installation/update
- Installation type – clean install, repair, restore, OEM, retail, upgrade, and update
- Update Readiness analysis of device hardware, OS components, apps, and drivers (progress, status, and results)
- Number of applicable updates, importance, type
- Update download size and source -- CDN or LAN peers
- Delay upgrade status and configuration
- OS uninstall and rollback status and count
- Windows Update server and service URL
- Windows Update machine ID
- Windows Insider build details
- Video Width, height, color pallet, encoding (compression) type, and encryption type
- Instructions for how to stream content for the user -- the smooth streaming manifest of chunks of content files that must be pieced together to stream the content based on screen resolution and bandwidth
- URL for a specific two second chunk of content if there is an error
- Full screen viewing mode details
- Service URL for song being downloaded from the music service – collected when an error occurs to facilitate restoration of service
- Content type (video, audio, surround audio)
- Local media library collection statistics -- number of purchased tracks, number of playlists
- Region mismatch -- User OS Region, and Xbox Live region
- App accessing content and status and options used to open a Microsoft Store book
- Language of the book
- Time spent reading content
- Content type and size details
- File source data -- local, SD card, network device, and OneDrive
- Image & video resolution, video length, file sizes types and encoding
- Collection view or full screen viewer use and duration of view
- Text typed in address bar and search box
- Text selected for Ask Cortana search
- Service response time
- Auto-completed text if there was an auto-complete
- Navigation suggestions provided based on local history and favorites
- Browser ID
- URLs (which may include search terms)
- Page title
- Kind of query issued and index type (ConstraintIndex, SystemIndex)
- Number of items requested and retrieved
- File extension of search result user interacted with
- Launched item kind, file extension, index of origin, and the App ID of the opening app.
- Name of process calling the indexer and time to service the query.
- A hash of the search scope (file, Outlook, OneNote, IE history)
- The state of the indices (fully optimized, partially optimized, being built)
- Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
- Pen gestures (click, double click, pan, zoom, rotate)
- Palm Touch x,y coordinates
- Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
- Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as names, email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
- Text of speech recognition results -- result codes and recognized text
- Language and model of the recognizer, System Speech language
- App ID using speech features
- Whether user is known to be a child
- Confidence and Success/Failure of speech recognition
- Product ID, edition ID and product URI
- Offer details -- price
- Order requested date/time
- Store client type -- web or native client
- Purchase quantity and price
- Payment type -- credit card type and PayPal
- Service subscription status and errors
- DRM and license rights details -- Groove subscription or OS volume license
- Entitlement ID, lease ID, and package ID of the install package
- Entitlement revocation
- License type (trial, offline vs online) and duration
- License usage session
- Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
- Pen gestures (click, double click, pan, zoom, rotate)
- Palm Touch x,y coordinates
- Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
- Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values) which could be used to reconstruct the original content or associate the input to the user.
- Text input from Windows Mobile on-screen keyboards except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
- Text of speech recognition results -- result codes and recognized text
- Language and model of the recognizer, System Speech language
- App ID using speech features
- Whether user is known to be a child
- Confidence and Success/Failure of speech recognition
| New or updated topic | +Description | +
|---|---|
| [Policy CSP](policy-configuration-service-provider.md) | +Added the following new policies for Windows 10, version 1709: +
Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709. + |
| Microsoft Store for Business | +Windows Store for Business name changed to Microsoft Store for Business. + |
| The [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/en-us/library/mt221945.aspx) | +The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message: +
For examples, see section 4.3.1 RequestSecurityToken of the the MS-MDE2 protocol documentation. + |
| [VPNv2 CSP](vpnv2-csp.md) | +Added RegisterDNS setting in Windows 10, version 1709. + |
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
 |
+  3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
Added in Windows 10, version 1709. Specifies whether password reset is enabled for Azure Active Directory accounts. This policy allows the Azure AD tenant administrators to enable self service password reset feature on the windows logon screen. + +
The following list shows the supported values: + +- 0 (default) – Not allowed. +- 1 – Allowed. + + + **Authentication/AllowEAPCertSSO** @@ -46,10 +82,6 @@ ms.date: 08/30/2017 -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile. - -
Allows an EAP cert-based authentication for a single sign on (SSO) to access internal resources. > [!IMPORTANT] diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 81e87eb957..3f35e2d4eb 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -572,7 +572,7 @@ ms.date: 08/30/2017
Added in Windows 10, version 1709. This policy setting allows you to prevent Attack Surface reduction rules from matching on files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe".. -Value type is string. +
Value type is string. @@ -609,7 +609,9 @@ Value type is string.
Added in Windows 10, version 1709. This policy setting enables setting the state (Block/Audit/Off) for each Attack surface reduction (ASR) rule. Each ASR rule listed can be set to one of the following states (Block/Audit/Off). The ASR rule ID and state should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid ASR rule ID, while the value contains the status ID indicating the status of the rule. -Value type is string. +
For more information about ASR rule ID and status ID, see [Enable Attack Surface Reduction](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction). + +
Value type is string. diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md new file mode 100644 index 0000000000..b2cdcd1ae0 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -0,0 +1,72 @@ +--- +title: Policy CSP - Handwriting +description: Policy CSP - Handwriting +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 09/07/2017 +--- + +# Policy CSP - Handwriting + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
+ +## Handwriting policies + + +**Handwriting/PanelDefaultModeDocked** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
Added in Windows 10. version 1709. This policy allows an enterprise to configure the default mode for the handwriting panel. + +
The handwriting panel has 2 modes - floats near the text box, or docked to the bottom of the screen. The default configuration to is floating near text box. If you want the panel to be fixed or docked, use this policy to fix it to the bottom of the screen. + +
In floating mode, the content is hidden behind a flying-in panel and results in end-user dissatisfaction. The end-user will need to drag the flying-in panel to see the rest of the content. In the fixed mode, the flying-in panel is fixed to the bottom of the screen and does not require any user interaction. + +
The docked mode is especially useful in Kiosk mode where you do not expect the end-user to drag the flying-in panel out of the way. + +
-
+
+ +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 8c510ae5c1..783aac1e8d 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -19,6 +19,42 @@ ms.date: 08/30/2017 ## Search policies + +**Search/AllowCloudSearch** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+
Added in Windows 10, version 1709. Allow search and Cortana to search cloud sources like OneDrive and SharePoint. This policy allows corporate administrators to control whether employees can turn off/on the search of these cloud sources. The default policy value is to allow employees access to the setting that controls search of cloud sources. + +
The following list shows the supported values: + +- 0 – Not allowed. +- 1 (default) – Allowed. + + + **Search/AllowIndexingEncryptedStoresOrItems** diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 53b9ec2f30..d077ea3454 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -554,6 +554,51 @@ ADMX Info: +**System/LimitEnhancedDiagnosticDataWindowsAnalytics** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+
This policy setting, in combination with the System/AllowTelemetry + policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. + +
To enable this behavior you must complete two steps: +
-
+
When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://go.microsoft.com/fwlink/?linkid=847594). + +
Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. + +
If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. + + + + + **System/TelemetryProxy** diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index e3a796b41d..1bf1c34365 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -471,8 +471,12 @@ This policy is accessible through the Update setting in the user interface or Gr
The following list shows the supported values: -- 16 (default) – User gets all applicable upgrades from Current Branch (CB). -- 32 – User gets upgrades from Current Branch for Business (CBB). +- 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709) +- 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) +- 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709) +- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). +- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. + @@ -1253,12 +1257,12 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. -
Allows the IT admin to set a device to CBB train. +
Allows the IT admin to set a device to Semi-Annual Channel train.
The following list shows the supported values:
-- 0 (default) – User gets upgrades from Current Branch.
-- 1 – User gets upgrades from Current Branch for Business.
+- 0 (default) – User gets upgrades from Semi-Annual Channel (Targeted).
+- 1 – User gets upgrades from Semi-Annual Channel.
diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md
index ee30992445..1319338ddc 100644
--- a/windows/client-management/mdm/reclaim-seat-from-user.md
+++ b/windows/client-management/mdm/reclaim-seat-from-user.md
@@ -1,6 +1,6 @@
---
title: Reclaim seat from user
-description: The Reclaim seat from user operation returns reclaimed seats for a user in the Windows Store for Business.
+description: The Reclaim seat from user operation returns reclaimed seats for a user in the Micosoft Store for Business.
ms.assetid: E2C3C899-D0AD-469A-A319-31A420472A4C
ms.author: maricia
ms.topic: article
@@ -12,7 +12,7 @@ ms.date: 06/19/2017
# Reclaim seat from user
-The **Reclaim seat from user** operation returns reclaimed seats for a user in the Windows Store for Business.
+The **Reclaim seat from user** operation returns reclaimed seats for a user in the Micosoft Store for Business.
## Request
diff --git a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md
index 5016c86ac9..d64e4e1b4d 100644
--- a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md
+++ b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md
@@ -1,6 +1,6 @@
---
-title: REST API reference for Windows Store for Business
-description: REST API reference for Windows Store for Business
+title: REST API reference for Micosoft Store for Business
+description: REST API reference for Micosoft Store for Business
MS-HAID:
- 'p\_phdevicemgmt.business\_store\_portal\_management\_rest\_api\_reference'
- 'p\_phDeviceMgmt.rest\_api\_reference\_windows\_store\_for\_Business'
@@ -13,7 +13,7 @@ author: nickbrower
ms.date: 06/19/2017
---
-# REST API reference for Windows Store for Business
+# REST API reference for Micosoft Store for Business
Here's the list of available operations:
diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md
index 05e8da9fa3..aa98ff54c0 100644
--- a/windows/client-management/mdm/vpnv2-csp.md
+++ b/windows/client-management/mdm/vpnv2-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 07/07/2017
+ms.date: 09/18/2017
---
# VPNv2 CSP
@@ -35,7 +35,7 @@ The XSDs for all EAP methods are shipped in the box and can be found at the foll
The following diagram shows the VPNv2 configuration service provider in tree format.
-
+
**Device or User profile**
For user profile, use **./User/Vendor/MSFT** path and for device profile, use **./Device/Vendor/MSFT** path.
@@ -303,6 +303,14 @@ A device tunnel profile must be deleted before another device tunnel profile can
Value type is bool. Supported operations include Get, Add, Replace, and Delete.
+**VPNv2/***ProfileName***/RegisterDNS**
+Allows registration of the connection's address in DNS.
+
+Valid values:
+
+- False = Do not register the connection's address in DNS (default).
+- True = Register the connection's addresses in DNS.
+
**VPNv2/***ProfileName***/DnsSuffix**
Optional. Specifies one or more comma separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList.
diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md
index 1312ba1a63..3208f1111a 100644
--- a/windows/client-management/mdm/vpnv2-ddf-file.md
+++ b/windows/client-management/mdm/vpnv2-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 07/07/2017
+ms.date: 09/18/2017
---
# VPNv2 DDF file
@@ -992,6 +992,33 @@ The XML below is for Windows 10, version 1709.
+
Default: blank |
-For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx).
+For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/available-policies).
### 13. Network Connection Status Indicator
@@ -1636,7 +1636,7 @@ You can stop sending file samples back to Microsoft.
-or-
-- For Windows 10 only, apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
+- For Windows 10 only, apply the Defender/SubmitSamplesConsent MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender), where:
- **0**. Always prompt.
@@ -1682,9 +1682,9 @@ To remove Windows Media Player on Windows Server 2016:
- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer**
-### 24. Windows spotlight
+### 24. Windows Spotlight
-Windows spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface or through Group Policy.
+Windows Spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface, MDM policy, or through Group Policy.
If you're running Windows 10, version 1607 or later, you only need to enable the following Group Policy:
@@ -1695,6 +1695,10 @@ If you're running Windows 10, version 1607 or later, you only need to enable the
-or-
+- For Windows 10 only, apply the Experience/AllowWindowsSpotlight MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience), with a value of 0 (zero).
+
+ -or-
+
- Create a new REG\_DWORD registry setting in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent!DisableWindowsSpotlightFeatures**, with a value of 1 (one).
If you're not running Windows 10, version 1607 or later, you can use the other options in this section.
@@ -1733,7 +1737,7 @@ If you're not running Windows 10, version 1607 or later, you can use the other o
-or-
- - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent!DisableWindowsConsumerFeatures**, with a value of 1 (one).
+ - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent!DisableWindowsConsumerFeatures**, with a value of 1 (one).
For more info, see [Windows Spotlight on the lock screen](windows-spotlight.md).
@@ -1847,7 +1851,7 @@ You can turn off automatic updates by doing one of the following. This is not re
-or-
-- For Windows 10 only, apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
+- For Windows 10 only, apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update), where:
- **0**. Notify the user before downloading the update.
diff --git a/windows/configuration/manage-tips-and-suggestions.md b/windows/configuration/manage-tips-and-suggestions.md
index 4485b5e7e7..39f2e28ac0 100644
--- a/windows/configuration/manage-tips-and-suggestions.md
+++ b/windows/configuration/manage-tips-and-suggestions.md
@@ -44,7 +44,7 @@ Windows 10, version 1607 (also known as the Anniversary Update), provides organi
| Windows 10 Pro Education | Yes (default) | Yes | No (setting cannot be changed) |
| Windows 10 Education | Yes (default) | Yes | No (setting cannot be changed) |
-
+[Learn more about policy settings for Windows Spotlight.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)
## Related topics
diff --git a/windows/configuration/start-layout-xml-desktop.md b/windows/configuration/start-layout-xml-desktop.md
index e203016bfa..6454a3fe7c 100644
--- a/windows/configuration/start-layout-xml-desktop.md
+++ b/windows/configuration/start-layout-xml-desktop.md
@@ -32,8 +32,7 @@ On Windows 10 for desktop editions, the customized Start works by:
>[!NOTE]
>Using the layout modification XML to configure Start is not supported with roaming user profiles. For more information, see [Deploy Roaming User Profiles](https://technet.microsoft.com/en-US/library/jj649079.aspx).
->[!NOTE]
->Using the layout modification XML to configure Start is not supported with roaming user profiles. For more information, see [Deploy Roaming User Profiles](https://technet.microsoft.com/library/jj649079.aspx).
+
## LayoutModification XML
diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md
index d3dd731cdf..7e89dfdb30 100644
--- a/windows/configuration/wcd/wcd-accounts.md
+++ b/windows/configuration/wcd/wcd-accounts.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-admxingestion.md b/windows/configuration/wcd/wcd-admxingestion.md
index daa6ca5eb8..52223258ad 100644
--- a/windows/configuration/wcd/wcd-admxingestion.md
+++ b/windows/configuration/wcd/wcd-admxingestion.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-applicationmanagement.md b/windows/configuration/wcd/wcd-applicationmanagement.md
index f032ce168c..af27cea5f0 100644
--- a/windows/configuration/wcd/wcd-applicationmanagement.md
+++ b/windows/configuration/wcd/wcd-applicationmanagement.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-assignedaccess.md b/windows/configuration/wcd/wcd-assignedaccess.md
index ad5d7551fb..201fc633e1 100644
--- a/windows/configuration/wcd/wcd-assignedaccess.md
+++ b/windows/configuration/wcd/wcd-assignedaccess.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-automatictime.md b/windows/configuration/wcd/wcd-automatictime.md
index abb8bbd179..52d9845460 100644
--- a/windows/configuration/wcd/wcd-automatictime.md
+++ b/windows/configuration/wcd/wcd-automatictime.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-browser.md b/windows/configuration/wcd/wcd-browser.md
index 787b6fa65b..a8af54b4f9 100644
--- a/windows/configuration/wcd/wcd-browser.md
+++ b/windows/configuration/wcd/wcd-browser.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-callandmessagingenhancement.md b/windows/configuration/wcd/wcd-callandmessagingenhancement.md
index bb07ccc02c..f3905fe8bc 100644
--- a/windows/configuration/wcd/wcd-callandmessagingenhancement.md
+++ b/windows/configuration/wcd/wcd-callandmessagingenhancement.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-cellular.md b/windows/configuration/wcd/wcd-cellular.md
index 64258bbe02..7ea42d279d 100644
--- a/windows/configuration/wcd/wcd-cellular.md
+++ b/windows/configuration/wcd/wcd-cellular.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-certificates.md b/windows/configuration/wcd/wcd-certificates.md
index 6347a4795d..4e414b4677 100644
--- a/windows/configuration/wcd/wcd-certificates.md
+++ b/windows/configuration/wcd/wcd-certificates.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-cleanpc.md b/windows/configuration/wcd/wcd-cleanpc.md
index ec1f5eaadc..fa14dead06 100644
--- a/windows/configuration/wcd/wcd-cleanpc.md
+++ b/windows/configuration/wcd/wcd-cleanpc.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-connections.md b/windows/configuration/wcd/wcd-connections.md
index 1ce0db8e5b..98fdd61592 100644
--- a/windows/configuration/wcd/wcd-connections.md
+++ b/windows/configuration/wcd/wcd-connections.md
@@ -5,14 +5,14 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
# Connections (Windows Configuration Designer reference)
-Use to configure settings related to variou types of phone connections.
+Use to configure settings related to various types of phone connections.
## Applies to
diff --git a/windows/configuration/wcd/wcd-connectivityprofiles.md b/windows/configuration/wcd/wcd-connectivityprofiles.md
index bb7d3366c0..2a71e900c4 100644
--- a/windows/configuration/wcd/wcd-connectivityprofiles.md
+++ b/windows/configuration/wcd/wcd-connectivityprofiles.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-countryandregion.md b/windows/configuration/wcd/wcd-countryandregion.md
index aea53e22de..84e1e611f1 100644
--- a/windows/configuration/wcd/wcd-countryandregion.md
+++ b/windows/configuration/wcd/wcd-countryandregion.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md b/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md
index 1cf770db9b..6f954aec14 100644
--- a/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md
+++ b/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-developersetup.md b/windows/configuration/wcd/wcd-developersetup.md
index e7c4378477..76c7f07631 100644
--- a/windows/configuration/wcd/wcd-developersetup.md
+++ b/windows/configuration/wcd/wcd-developersetup.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-deviceformfactor.md b/windows/configuration/wcd/wcd-deviceformfactor.md
index dc1e5cd524..c9d4434a24 100644
--- a/windows/configuration/wcd/wcd-deviceformfactor.md
+++ b/windows/configuration/wcd/wcd-deviceformfactor.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-devicemanagement.md b/windows/configuration/wcd/wcd-devicemanagement.md
index 9297174468..297225f5a1 100644
--- a/windows/configuration/wcd/wcd-devicemanagement.md
+++ b/windows/configuration/wcd/wcd-devicemanagement.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-dmclient.md b/windows/configuration/wcd/wcd-dmclient.md
index 4efec80320..27a6b9dd36 100644
--- a/windows/configuration/wcd/wcd-dmclient.md
+++ b/windows/configuration/wcd/wcd-dmclient.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-editionupgrade.md b/windows/configuration/wcd/wcd-editionupgrade.md
index cb2fd133b6..76e05d28ae 100644
--- a/windows/configuration/wcd/wcd-editionupgrade.md
+++ b/windows/configuration/wcd/wcd-editionupgrade.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-embeddedlockdownprofiles.md b/windows/configuration/wcd/wcd-embeddedlockdownprofiles.md
index 833b66a43a..2203a1cb2b 100644
--- a/windows/configuration/wcd/wcd-embeddedlockdownprofiles.md
+++ b/windows/configuration/wcd/wcd-embeddedlockdownprofiles.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-firewallconfiguration.md b/windows/configuration/wcd/wcd-firewallconfiguration.md
index 5e394b2f6b..df61861e90 100644
--- a/windows/configuration/wcd/wcd-firewallconfiguration.md
+++ b/windows/configuration/wcd/wcd-firewallconfiguration.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-firstexperience.md b/windows/configuration/wcd/wcd-firstexperience.md
index b3a53776ff..cf0f7c1983 100644
--- a/windows/configuration/wcd/wcd-firstexperience.md
+++ b/windows/configuration/wcd/wcd-firstexperience.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-folders.md b/windows/configuration/wcd/wcd-folders.md
index bbad0c9cb9..08eff6065d 100644
--- a/windows/configuration/wcd/wcd-folders.md
+++ b/windows/configuration/wcd/wcd-folders.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-initialsetup.md b/windows/configuration/wcd/wcd-initialsetup.md
index db5b9cee8b..a579fca408 100644
--- a/windows/configuration/wcd/wcd-initialsetup.md
+++ b/windows/configuration/wcd/wcd-initialsetup.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-internetexplorer.md b/windows/configuration/wcd/wcd-internetexplorer.md
index d1a2e56c56..e3290e6905 100644
--- a/windows/configuration/wcd/wcd-internetexplorer.md
+++ b/windows/configuration/wcd/wcd-internetexplorer.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-licensing.md b/windows/configuration/wcd/wcd-licensing.md
index 5b3ebb4f41..7ae7661ea8 100644
--- a/windows/configuration/wcd/wcd-licensing.md
+++ b/windows/configuration/wcd/wcd-licensing.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-maps.md b/windows/configuration/wcd/wcd-maps.md
index 4a1bfc4a7a..afe5f92c1c 100644
--- a/windows/configuration/wcd/wcd-maps.md
+++ b/windows/configuration/wcd/wcd-maps.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-messaging.md b/windows/configuration/wcd/wcd-messaging.md
index a00378d147..871e87042c 100644
--- a/windows/configuration/wcd/wcd-messaging.md
+++ b/windows/configuration/wcd/wcd-messaging.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-modemconfigurations.md b/windows/configuration/wcd/wcd-modemconfigurations.md
index dc45dff1ef..98bae12f8b 100644
--- a/windows/configuration/wcd/wcd-modemconfigurations.md
+++ b/windows/configuration/wcd/wcd-modemconfigurations.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-multivariant.md b/windows/configuration/wcd/wcd-multivariant.md
index 37a5519dfd..fa8c0d735f 100644
--- a/windows/configuration/wcd/wcd-multivariant.md
+++ b/windows/configuration/wcd/wcd-multivariant.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-networkproxy.md b/windows/configuration/wcd/wcd-networkproxy.md
index 7eb31bc61c..3689226767 100644
--- a/windows/configuration/wcd/wcd-networkproxy.md
+++ b/windows/configuration/wcd/wcd-networkproxy.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-networkqospolicy.md b/windows/configuration/wcd/wcd-networkqospolicy.md
index 5906d70cdd..be9d9f4d69 100644
--- a/windows/configuration/wcd/wcd-networkqospolicy.md
+++ b/windows/configuration/wcd/wcd-networkqospolicy.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-nfc.md b/windows/configuration/wcd/wcd-nfc.md
index c03217c87e..1b56de1940 100644
--- a/windows/configuration/wcd/wcd-nfc.md
+++ b/windows/configuration/wcd/wcd-nfc.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-oobe.md b/windows/configuration/wcd/wcd-oobe.md
index 7a72de6bb0..e609255e3d 100644
--- a/windows/configuration/wcd/wcd-oobe.md
+++ b/windows/configuration/wcd/wcd-oobe.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-otherassets.md b/windows/configuration/wcd/wcd-otherassets.md
index f5f33e19a2..ff79d72f5f 100644
--- a/windows/configuration/wcd/wcd-otherassets.md
+++ b/windows/configuration/wcd/wcd-otherassets.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-personalization.md b/windows/configuration/wcd/wcd-personalization.md
index 27f82ea825..a5aaee541d 100644
--- a/windows/configuration/wcd/wcd-personalization.md
+++ b/windows/configuration/wcd/wcd-personalization.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-policies.md b/windows/configuration/wcd/wcd-policies.md
index 72357237a0..f672b70b05 100644
--- a/windows/configuration/wcd/wcd-policies.md
+++ b/windows/configuration/wcd/wcd-policies.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-provisioningcommands.md b/windows/configuration/wcd/wcd-provisioningcommands.md
index 5ed43d8d18..7ab3bd2e35 100644
--- a/windows/configuration/wcd/wcd-provisioningcommands.md
+++ b/windows/configuration/wcd/wcd-provisioningcommands.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-sharedpc.md b/windows/configuration/wcd/wcd-sharedpc.md
index d771bbee7b..744e0acd11 100644
--- a/windows/configuration/wcd/wcd-sharedpc.md
+++ b/windows/configuration/wcd/wcd-sharedpc.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-shell.md b/windows/configuration/wcd/wcd-shell.md
index 8d7ad0b7ff..a0b581cb04 100644
--- a/windows/configuration/wcd/wcd-shell.md
+++ b/windows/configuration/wcd/wcd-shell.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-smisettings.md b/windows/configuration/wcd/wcd-smisettings.md
index ce6de17758..df459903c7 100644
--- a/windows/configuration/wcd/wcd-smisettings.md
+++ b/windows/configuration/wcd/wcd-smisettings.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-start.md b/windows/configuration/wcd/wcd-start.md
index 25fcc57075..3256dea604 100644
--- a/windows/configuration/wcd/wcd-start.md
+++ b/windows/configuration/wcd/wcd-start.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-startupapp.md b/windows/configuration/wcd/wcd-startupapp.md
index 06c5b20b7a..3e9d1ca9b2 100644
--- a/windows/configuration/wcd/wcd-startupapp.md
+++ b/windows/configuration/wcd/wcd-startupapp.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-startupbackgroundtasks.md b/windows/configuration/wcd/wcd-startupbackgroundtasks.md
index 6b0840c310..2e5c3fa161 100644
--- a/windows/configuration/wcd/wcd-startupbackgroundtasks.md
+++ b/windows/configuration/wcd/wcd-startupbackgroundtasks.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-surfacehubmanagement.md b/windows/configuration/wcd/wcd-surfacehubmanagement.md
index f2da4a2dd6..4a6dbb3dd3 100644
--- a/windows/configuration/wcd/wcd-surfacehubmanagement.md
+++ b/windows/configuration/wcd/wcd-surfacehubmanagement.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-tabletmode.md b/windows/configuration/wcd/wcd-tabletmode.md
index a8d2ea900a..5f454d89bb 100644
--- a/windows/configuration/wcd/wcd-tabletmode.md
+++ b/windows/configuration/wcd/wcd-tabletmode.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-takeatest.md b/windows/configuration/wcd/wcd-takeatest.md
index 75613f3b2e..c498ffd865 100644
--- a/windows/configuration/wcd/wcd-takeatest.md
+++ b/windows/configuration/wcd/wcd-takeatest.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-theme.md b/windows/configuration/wcd/wcd-theme.md
index 2d3e643f85..bc5710c264 100644
--- a/windows/configuration/wcd/wcd-theme.md
+++ b/windows/configuration/wcd/wcd-theme.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-unifiedwritefilter.md b/windows/configuration/wcd/wcd-unifiedwritefilter.md
index fe65f8413f..5ba21b01a3 100644
--- a/windows/configuration/wcd/wcd-unifiedwritefilter.md
+++ b/windows/configuration/wcd/wcd-unifiedwritefilter.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-universalappinstall.md b/windows/configuration/wcd/wcd-universalappinstall.md
index 6ba1b3993a..50f88c2fdc 100644
--- a/windows/configuration/wcd/wcd-universalappinstall.md
+++ b/windows/configuration/wcd/wcd-universalappinstall.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-universalappuninstall.md b/windows/configuration/wcd/wcd-universalappuninstall.md
index 17bbc8f15b..70cd723052 100644
--- a/windows/configuration/wcd/wcd-universalappuninstall.md
+++ b/windows/configuration/wcd/wcd-universalappuninstall.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-usberrorsoemoverride.md b/windows/configuration/wcd/wcd-usberrorsoemoverride.md
index 7175b5e14b..47596e69d3 100644
--- a/windows/configuration/wcd/wcd-usberrorsoemoverride.md
+++ b/windows/configuration/wcd/wcd-usberrorsoemoverride.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
@@ -13,7 +13,7 @@ ms.date: 08/21/2017
# UsbErrorsOEMOverride (reference)
-Use UsbErrorsOEMOverride settings to .
+Allows an OEM to hide the USB option UI in Settings and all USB device errors.
## Applies to
@@ -24,4 +24,4 @@ Use UsbErrorsOEMOverride settings to .
## HideUsbErrorNotifyOptionUI
-
+Configure to **Show** or **Hide** the USB error notification.
diff --git a/windows/configuration/wcd/wcd-weakcharger.md b/windows/configuration/wcd/wcd-weakcharger.md
index f1316bc77a..92f8844d81 100644
--- a/windows/configuration/wcd/wcd-weakcharger.md
+++ b/windows/configuration/wcd/wcd-weakcharger.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-windowsteamsettings.md b/windows/configuration/wcd/wcd-windowsteamsettings.md
index b9ee438e22..26c23a84ce 100644
--- a/windows/configuration/wcd/wcd-windowsteamsettings.md
+++ b/windows/configuration/wcd/wcd-windowsteamsettings.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-wlan.md b/windows/configuration/wcd/wcd-wlan.md
index 6b641db70f..80bbb26cf5 100644
--- a/windows/configuration/wcd/wcd-wlan.md
+++ b/windows/configuration/wcd/wcd-wlan.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd-workplace.md b/windows/configuration/wcd/wcd-workplace.md
index 901e30a048..8db1aa11a4 100644
--- a/windows/configuration/wcd/wcd-workplace.md
+++ b/windows/configuration/wcd/wcd-workplace.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/wcd/wcd.md b/windows/configuration/wcd/wcd.md
index 38f6061d9f..080f9e469f 100644
--- a/windows/configuration/wcd/wcd.md
+++ b/windows/configuration/wcd/wcd.md
@@ -5,7 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
-localizationpriority: medium
+ms.localizationpriority: medium
ms.author: jdecker
ms.date: 08/21/2017
---
diff --git a/windows/configuration/windows-diagnostic-data.md b/windows/configuration/windows-diagnostic-data.md
index 611432abea..9f56ccf841 100644
--- a/windows/configuration/windows-diagnostic-data.md
+++ b/windows/configuration/windows-diagnostic-data.md
@@ -6,12 +6,14 @@ ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.localizationpriority: high
-author: brianlic-msft
+author: eross-msft
+ms.author: lizross
+ms.date: 09/14/2017
---
# Windows 10, version 1703 Diagnostic Data
-Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full telemetry level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1703 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md).
+Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full telemetry level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1703 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md).
The data covered in this article is grouped into the following categories:
@@ -21,10 +23,8 @@ The data covered in this article is grouped into the following categories:
- Product and Service Usage data
- Product and Service Performance data
- Software Setup and Inventory data
-- Content Consumption data
-- Browsing, Search and Query data
+- Browsing History data
- Inking, Typing, and Speech Utterance data
-- Licensing and Purchase data
> [!NOTE]
> The majority of diagnostic data falls into the first four categories.
@@ -66,8 +66,15 @@ This type of data includes details about the health of the device, operating sys
| Category Name | Description and Examples |
| - | - |
-| Device health and crash data | Information about the device and software health such as:
|
-| Device performance and reliability data | Information about the device and software performance such as:
+|Device health and crash data | Information about the device and software health such as:
|
+|Device performance and reliability data | Information about the device and software performance such as:
|
+|Movies|Information about movie consumption functionality on the device. This isn't intended to capture user viewing, listening or habits.
|
+|On-device file query | Information about local search activity on the device such as:
|
+|Purchasing| Information about purchases made on the device such as:
|
+|Entitlements | Information about entitlements on the device such as:
|
## Software Setup and Inventory data
@@ -78,25 +85,13 @@ This type of data includes software installation and update information on the d
| Installed Applications and Install History | Information about apps, drivers, update packages, or OS components installed on the device such as:
|
| Device update information | Information about Windows Update such as:
-## Content Consumption data
+## Browsing History data
-This type of data includes diagnostic details about Microsoft applications that provide media consumption functionality (such as Groove Music), and is not intended to capture user viewing, listening or reading habits.
-
-| Category Name | Examples |
-| - | - |
-| Movies | Information about movie consumption functionality on the device such as:
|
-| Music & TV | Information about music and TV consumption on the device such as:
|
-| Reading | Information about reading consumption functionality on the device such as:
|
-| Photos App | Information about photos usage on the device such as:
-
-## Browsing, Search and Query data
-
-This type of data includes details about web browsing, search and query activity in the Microsoft browsers and Cortana, and local file searches on the device.
+This type of data includes details about web browsing in the Microsoft browsers.
| Category Name | Description and Examples |
| - | - |
| Microsoft browser data | Information about Address bar and search box performance on the device such as:
|
-| On-device file query | Information about local search activity on the device such as:
|
## Inking Typing and Speech Utterance data
@@ -105,13 +100,4 @@ This type of data gathers details about the voice, inking, and typing input feat
| Category Name | Description and Examples |
| - | - |
-| Voice, inking, and typing | Information about voice, inking and typing features such as:
|
-
-## Licensing and Purchase data
-
-This type of data includes diagnostic details about the purchase and entitlement activity on the device.
-
-| Category Name | Data Examples |
-| - | - |
-| Purchase history | Information about purchases made on the device such as:
|
-| Entitlements | Information about entitlements on the device such as:
|
\ No newline at end of file
+| Voice, inking, and typing | Information about voice, inking and typing features such as:
|
\ No newline at end of file
diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md
index b070057f1d..3d057730dc 100644
--- a/windows/deployment/TOC.md
+++ b/windows/deployment/TOC.md
@@ -222,8 +222,6 @@
#### [Windows Insider Program for Business using Azure Active Directory](update/waas-windows-insider-for-business-aad.md)
#### [Windows Insider Program for Business Frequently Asked Questions](update/waas-windows-insider-for-business-faq.md)
#### [Olympia Corp enrollment](update/olympia/olympia-enrollment-guidelines.md)
-##### [Keep your current Windows 10 edition](update/olympia/enrollment-keep-current-edition.md)
-##### [Upgrade your Windows 10 edition from Pro to Enterprise](update/olympia/enrollment-upgrade-to-enterprise.md)
### [Change history for Update Windows 10](update/change-history-for-update-windows-10.md)
## Windows Analytics
diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md
index a05a03bbe9..a3c44c5ab1 100644
--- a/windows/deployment/deploy-enterprise-licenses.md
+++ b/windows/deployment/deploy-enterprise-licenses.md
@@ -15,8 +15,18 @@ author: greg-lindsay
This topic describes how to deploy Windows 10 Enterprise E3 or E5 licenses with [Windows 10 Enterprise Subscription Activation](windows-10-enterprise-subscription-activation.md) or [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) and Azure Active Directory (Azure AD).
->Note: Windows 10 Enterprise Subscription Activation (EA or MPSA) requires Windows 10 Pro, version 1703 or later.
->Windows 10 Enterprise E3 in CSP requires Windows 10 Pro, version 1607 or later.
+>Note: Windows 10 Enterprise Subscription Activation (EA or MPSA) requires Windows 10 Pro, version 1703 or later.
+>Windows 10 Enterprise E3 in CSP requires Windows 10 Pro, version 1607 or later.
+
+## Enabling Subscription Activation with an existing EA
+
+If you are an EA customer with an existing Office 365 tenant, use the following steps to enable Windows 10 Subscription licenses on your existing tenant:
+
+1. Work with your reseller to place an order for $0 SKU. There are two SKUs available, depending on their current Windows Enterprise SA license:
+ a. **AAA-51069** - Win10UsrOLSActv Alng MonthlySub Addon E3
+ b. **AAA-51068** - Win10UsrOLSActv Alng MonthlySub Addon E5
+2. After placing an order, the OLS admin on the agreement will receive a service activation email, indicating their subscription licenses have been provisioned on the tenant.
+3. The admin can now assign subscription licenses to users.
Also in this article:
- [Explore the upgrade experience](#explore-the-upgrade-experience): How to upgrade devices using the deployed licenses.
@@ -195,5 +205,4 @@ Devices must be running Windows 10 Pro, version 1703, and be Azure Active Direct
A popup window will display the Windows 10 version number and detailed OS build information.
- If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be upgraded to Windows 10 Enterprise when a user signs in, even if the user has been assigned a subscription in the CSP portal.
-
+ If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be upgraded to Windows 10 Enterprise when a user signs in, even if the user has been assigned a subscription in the CSP portal.
\ No newline at end of file
diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md
index e11c92867c..95255b68f9 100644
--- a/windows/deployment/deploy-whats-new.md
+++ b/windows/deployment/deploy-whats-new.md
@@ -79,7 +79,7 @@ For more information, see [MBR2GPT.EXE](mbr-to-gpt.md).
### Microsoft Deployment Toolkit (MDT)
-MDT build 884 is available, including support for:
+MDT build 8443 is available, including support for:
- Deployment and upgrade of Windows 10, version 1607 (including Enterprise LTSB and Education editions) and Windows Server 2016.
- The Windows ADK for Windows 10, version 1607.
- Integration with Configuration Manager version 1606.
diff --git a/windows/deployment/update/olympia/enrollment-keep-current-edition.md b/windows/deployment/update/olympia/enrollment-keep-current-edition.md
deleted file mode 100644
index b0016c44ee..0000000000
--- a/windows/deployment/update/olympia/enrollment-keep-current-edition.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-title: Keep your current Windows 10 edition
-description: Olympia Corp enrollment - Keep your current Windows 10 edition
-ms.author: nibr
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: nickbrower
-ms.date: 09/01/2017
----
-
-# Olympia Corp enrollment
-
-## Keep your current Windows 10 edition
-
-1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your PC (see [local administrator](https://support.microsoft.com/en-us/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
-
- 
-
-2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**.
-
-3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
-
- 
-
-4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password.
-
- > [!NOTE]
- > Passwords should contain 8-16 characters, including at least one special character or number.
-
- 
-
-5. Read the **Terms and Conditions**. Click **Accept** to participate in the program.
-
-6. If this is the first time you are logging in, please fill in the additional information to help you retrieve your account details.
-
-7. Create a PIN for signing into your Olympia corporate account.
-
-8. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**.
-
- > [!NOTE]
- > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness).
-
-9. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**.
diff --git a/windows/deployment/update/olympia/enrollment-upgrade-to-enterprise.md b/windows/deployment/update/olympia/enrollment-upgrade-to-enterprise.md
deleted file mode 100644
index 6643971428..0000000000
--- a/windows/deployment/update/olympia/enrollment-upgrade-to-enterprise.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: Upgrade your Windows 10 edition from Pro to Enterprise
-description: Olympia Corp enrollment - Upgrade your Windows 10 edition from Pro to Enterprise
-ms.author: nibr
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: nickbrower
-ms.date: 09/01/2017
----
-
-# Olympia Corp enrollment
-
-## Upgrade your Windows 10 edition from Pro to Enterprise
-
-1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your PC (see [local administrator](https://support.microsoft.com/en-us/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
-
- 
-
-2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**.
-
-3. Click **Connect**, then click **Join this device to Azure Active Directory**.
-
- 
-
-4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
-
- 
-
-5. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password.
-
- > [!NOTE]
- > Passwords should contain 8-16 characters, including at least one special character or number.
-
- 
-
-6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**.
-
-7. If this is the first time you are signing in, please fill in the additional information to help you retrieve your account details.
-
-8. Create a PIN for signing into your Olympia corporate account.
-
-9. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**.
-
-10. Restart your PC.
-
-11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your PC will upgrade to Windows 10 Enterprise*.
-
-12. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**.
-
- > [!NOTE]
- > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness).
-
-13. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**.
-
-\* Please note that your Windows 10 Enterprise license will not be renewed if your PC is not connected to Olympia.
-
diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md
index 17b87bd7b0..fddd959017 100644
--- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md
+++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 09/01/2017
+ms.date: 09/14/2017
---
# Olympia Corp enrollment guidelines
@@ -17,6 +17,87 @@ As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Ent
Choose one of the following two enrollment options:
-1. [Keep your current Windows 10 edition](./enrollment-keep-current-edition.md)
+1. [Keep your current Windows 10 edition](#enrollment-keep-current-edition)
+
+2. [Upgrade your Windows 10 edition from Pro to Enterprise](#enrollment-upgrade-to-enterprise)
+
+
+
+## Keep your current Windows 10 edition
+
+1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your PC (see [local administrator](https://support.microsoft.com/en-us/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
+
+ 
+
+2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**.
+
+3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
+
+ 
+
+4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password.
+
+ > [!NOTE]
+ > Passwords should contain 8-16 characters, including at least one special character or number.
+
+ 
+
+5. Read the **Terms and Conditions**. Click **Accept** to participate in the program.
+
+6. If this is the first time you are logging in, please fill in the additional information to help you retrieve your account details.
+
+7. Create a PIN for signing into your Olympia corporate account.
+
+8. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**.
+
+ > [!NOTE]
+ > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness).
+
+9. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**.
+
+
+
+## Upgrade your Windows 10 edition from Pro to Enterprise
+
+1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your PC (see [local administrator](https://support.microsoft.com/en-us/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
+
+ 
+
+2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**.
+
+3. Click **Connect**, then click **Join this device to Azure Active Directory**.
+
+ 
+
+4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
+
+ 
+
+5. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password.
+
+ > [!NOTE]
+ > Passwords should contain 8-16 characters, including at least one special character or number.
+
+ 
+
+6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**.
+
+7. If this is the first time you are signing in, please fill in the additional information to help you retrieve your account details.
+
+8. Create a PIN for signing into your Olympia corporate account.
+
+9. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**.
+
+10. Restart your PC.
+
+11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your PC will upgrade to Windows 10 Enterprise*.
+
+12. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**.
+
+ > [!NOTE]
+ > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness).
+
+13. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**.
+
+\* Please note that your Windows 10 Enterprise license will not be renewed if your PC is not connected to Olympia.
-2. [Upgrade your Windows 10 edition from Pro to Enterprise](./enrollment-upgrade-to-enterprise.md)
diff --git a/windows/deployment/usmt/usmt-common-issues.md b/windows/deployment/usmt/usmt-common-issues.md
index 118d52b056..7213b01b6c 100644
--- a/windows/deployment/usmt/usmt-common-issues.md
+++ b/windows/deployment/usmt/usmt-common-issues.md
@@ -5,6 +5,7 @@ ms.assetid: 5a37e390-8617-4768-9eee-50397fbbb2e1
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.date: 09/07/2017
author: greg-lindsay
---
@@ -28,6 +29,8 @@ The following sections discuss common issues that you might see when you run the
[Hard Link Migration Problems](#bkmk-hardlink)
+[USMT does not migrate the Start layout](#usmt-does-not-migrate-the-start-layout)
+
## General Guidelines for Identifying Migration Problems
@@ -222,6 +225,28 @@ There are three typical causes for this issue.
**Resolution:** To migrate PST files that are not linked to Outlook profiles, you must create a separate migration rule to capture these files.
+### USMT does not migrate the Start layout
+
+**Description:** You are using USMT to migrate profiles from one installation of Windows 10 to another installation of Windows 10 on different hardware. After migration, the user signs in on the new device and does not have the Start menu layout they had previously configured.
+
+**Cause:** A code change in the Start Menu with Windows 10 version 1607 and later is incompatible with this USMT function.
+
+**Resolution:** The following workaround is available:
+
+1. With the user signed in, back up the Start layout using the following Windows PowerShell command. You can specify a different path if desired:
+
+ ```
+ Export-StartLayout -Path "C:\Layout\user1.xml"
+ ```
+2. Migrate the user's profile with USMT.
+3. Before the user signs in on the new device, import the Start layout using the following Windows PowerShell command:
+
+ ```
+ Import-StartLayout –LayoutPath "C:\Layout\user1.xml" –MountPath %systemdrive%
+ ```
+
+This workaround changes the Default user's Start layout. The workaround does not scale to a mass migrations or multiuser devices, but it can potentially unblock some scenarios. If other users will sign on to the device you should delete layoutmodification.xml from the Default user profile. Otherwise, all users who sign on to that device will use the imported Start layout.
+
## Offline Migration Problems
@@ -286,6 +311,10 @@ USMTutils /rd
Network Unlock allows PCs to start automatically when connected to the internal network. |
-| Users must contact the IT department to change their BitLocker PIN or password. | Modern Windows devices no longer require a PIN in the pre-boot environment to protect BitLocker encryption keys from cold boot attacks.
Users who have standard privileges can change their BitLocker PIN or password on legacy devices that require a PIN. |
+ | Users must contact the IT department to change their BitLocker PIN or password. | Modern Windows devices no longer require a PIN in the pre-boot environment to protect BitLocker encryption keys from cold boot attacks.
Users who have standard privileges can change their BitLocker PIN or password on legacy devices that require a PIN. |
| When BitLocker is enabled, the provisioning process can take several hours. | BitLocker pre-provisioning, encrypting hard drives, and Used Space Only encryption allow administrators to enable BitLocker quickly on new computers. |
| There is no support for using BitLocker with self-encrypting drives (SEDs). | BitLocker supports offloading encryption to encrypted hard drives. |
| Administrators have to use separate tools to manage encrypted hard drives. | BitLocker supports encrypted hard drives with onboard encryption hardware built in, which allows administrators to use the familiar BitLocker administrative tools to manage them. |
@@ -66,7 +66,7 @@ Beginning in Windows 8.1, Windows automatically enables BitLocker Device Encryp
Unlike a standard BitLocker implementation, BitLocker Device Encryption is enabled automatically so that the device is always protected. The following list outlines how this happens:
-* When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, BitLocker Device Encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state).
+* When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, BitLocker Device Encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). In this state, the drive is shown with a warning icon in Windows Explorer. The yellow warning icon is removed after the TPM protector is created and the recovery key is backed up, as explained in the following bullet points.
* If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials.
* If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** Group Policy setting, and select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed.
* Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed.
diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md
index 9f7bef9162..8b11311fb6 100644
--- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md
+++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md
@@ -36,6 +36,8 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
- bginfo.exe[1]
- cdb.exe
- csi.exe
+- dbghost.exe
+- dbgsvc.exe
- dnx.exe
- fsi.exe
- fsiAnyCpu.exe
@@ -106,11 +108,14 @@ Microsoft recommends that you block the following Microsoft-signed applications
-
+> [!div class="mx-tableFixed"]
+| Portal label | SIEM field name | ArcSight field | Example value | Description |
+|------------------|---------------------------|---------------------|------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 1 | AlertTitle | name | A dll was unexpectedly loaded into a high integrity process without a UAC prompt | Value available for every alert. |
+| 2 | Severity | deviceSeverity | Medium | Value available for every alert. |
+| 3 | Category | deviceEventCategory | Privilege Escalation | Value available for every alert. |
+| 4 | Source | sourceServiceName | WindowsDefenderATP | Windows Defender Antivirus or Windows Defender ATP. Value available for every alert. |
+| 5 | MachineName | sourceHostName | liz-bean | Value available for every alert. |
+| 6 | FileName | fileName | Robocopy.exe | Available for alerts associated with a file or process. |
+| 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for alerts associated with a file or process. |
+| 8 | UserDomain | sourceNtDomain | contoso | The domain of the user context running the activity, available for Windows Defender ATP behavioral based alerts. |
+| 9 | UserName | sourceUserName | liz-bean | The user context running the activity, available for Windows Defender ATP behavioral based alerts. |
+| 10 | Sha1 | fileHash | 5b4b3985339529be3151d331395f667e1d5b7f35 | Available for alerts associated with a file or process. |
+| 11 | Md5 | deviceCustomString5 | 55394b85cb5edddff551f6f3faa9d8eb | Available for Windows Defender AV alerts. |
+| 12 | Sha256 | deviceCustomString6 | 9987474deb9f457ece2a9533a08ec173a0986fa3aa6ac355eeba5b622e4a43f5 | Available for Windows Defender AV alerts. |
+| 13 | ThreatName | eviceCustomString1 | Trojan:Win32/Skeeyah.A!bit | Available for Windows Defender AV alerts. |
+| 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for alerts associated to network events. For example, 'Communication to a malicious network destination'. |
+| 15 | Url | requestUrl | down.esales360.cn | Available for alerts associated to network events. For example, 'Communication to a malicious network destination'. |
+| 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE. |
+| 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE. |
+| 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every alert. |
+| 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every alert. |
+| 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the activity relevant to the alert occurred. Value available for every alert. |
+| 21 | MachineDomain | sourceDnsDomain | contoso.com | Domain name not relevant for AAD joined machines. Value available for every alert. |
+| 22 | Actor | deviceCustomString4 | | Available for alerts related to a known actor group. |
+| 21+5 | ComputerDnsName | No mapping | liz-bean.contoso.com | The machine fully qualified domain name. Value available for every alert. |
+| | LogOnUsers | sourceUserId | contoso\liz-bean; contoso\jay-hardee | The domain and user of the interactive logon user/s at the time of the event. Note: For machines on Windows 10 version 1607, the domain information will not be available. |
+| | InternalIPv4List | No mapping | 192.168.1.7, 10.1.14.1 | List of IPV4 internal IPs for active network interfaces. |
+| | InternalIPv6List | No mapping | fd30:0000:0000:0001:ff4e:003e:0009:000e, FE80:CD00:0000:0CDE:1257:0000:211E:729C | List of IPV6 internal IPs for active network interfaces. |
+| Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that alerts are retrieved. |
+| | Not part of the schema | deviceVendor | | Static value in the ArcSight mapping - 'Microsoft'. |
+| | Not part of the schema | deviceProduct | | Static value in the ArcSight mapping - 'Windows Defender ATP'. |
+| | Not part of the schema | deviceVersion | | Static value in the ArcSight mapping - '2.0', used to identify the mapping versions.
diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
index a1f1d75d60..42a6f77d4d 100644
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
@@ -29,6 +29,11 @@ You can use mobile device management (MDM) solutions to configure endpoints. Win
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
+## Before you begin
+If you're using Microsoft Intune, you must have the device MDM Enrolled. Otherwise, settings will not be applied successfully.
+
+For more information on enabling MDM with Microsoft Intune, see [Setup Windows Device Management](https://docs.microsoft.com/intune-classic/deploy-use/set-up-windows-device-management-with-microsoft-intune).
+
## Configure endpoints using Microsoft Intune
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md
index 8d28359a61..8a90f8cb96 100644
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md
@@ -33,6 +33,9 @@ Windows Defender ATP supports non-persistent VDI session onboarding. There might
You can onboard VDI machines using a single entry or multiple entries for each machine. The following steps will guide you through onboarding VDI machines and will highlight steps for single and multiple entries.
+>[!WARNING]
+> For environments where there are low resource configurations, the VDI boot proceedure might slow the Windows Defender ATP sensor onboarding.
+
1. Open the VDI configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
diff --git a/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
index b10e923513..c482403b20 100644
--- a/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
@@ -73,5 +73,9 @@ Your data will be kept for a period of at least 90 days, during which it will be
## Can Microsoft help us maintain regulatory compliance?
-Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Windows Defender ATP services against their own legal and regulatory requirements. Windows Defender ATP has a roadmap for obtaining national, regional and industry-specific certifications, starting with ISO 27001. The service is designed, implemented, and maintained according to the compliance and privacy principles of ISO 27001, as well as Microsoft’s compliance standards.
-By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run, including this new Microsoft cloud service.
+Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Windows Defender ATP services against their own legal and regulatory requirements. Windows Defender ATP is ISO 27001 certified and has a roadmap for obtaining national, regional and industry-specific certifications.
+
+
+By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run.
+
+For more information on the Windows Defender ATP ISO certification reports, see [Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/compliance/iso-iec-27001).
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-preview-features.png b/windows/threat-protection/windows-defender-atp/images/atp-preview-features.png
new file mode 100644
index 0000000000..aeae7b6a42
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-preview-features.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-region-control-panel.png b/windows/threat-protection/windows-defender-atp/images/atp-region-control-panel.png
new file mode 100644
index 0000000000..58d25e0f9d
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-region-control-panel.png differ
diff --git a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
index 158de675fc..b43ff9eb93 100644
--- a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
@@ -38,7 +38,7 @@ Windows Defender Advanced Threat Protection requires one of the following Micros
- Windows 10 Enterprise E5
- Windows 10 Education E5
-- Secure Productive Enterprise E5 (SPE E5) which includes Windows 10 Enterprise E5
+- Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5
For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2).
diff --git a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
index 7a8e8393e6..9e98297388 100644
--- a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
@@ -30,7 +30,7 @@ Enterprise security teams can use the Windows Defender ATP portal to monitor and
You can use the [Windows Defender ATP portal](https://securitycenter.windows.com/) to:
- View, sort, and triage alerts from your endpoints
- Search for more information on observed indicators such as files and IP Addresses
-- Change Windows Defender ATP settings, including time zone and alert suppression rules
+- Change Windows Defender ATP settings, including time zone and licensing information.
## Windows Defender ATP portal
When you open the portal, you’ll see the main areas of the application:
@@ -48,10 +48,10 @@ You can navigate through the portal using the menu options available in all sect
Area | Description
:---|:---
-(1) Search bar, Feedback, Settings, Help and support | **Search** - Provides access to the search bar where you can search for file, IP, machine, URL, and user. Displays the Search box: the drop-down list allows you to select the entity type and then enter the search query text. **Feedback** -Access the feedback button to provide comments about the portal. **Settings** - Gives you access to the configuration settings where you can set time zones, alert suppression rules, and license information. **Help and support** - Gives you access to the Windows Defender ATP guide, Microsoft support, and Premier support.
+(1) Search bar, Feedback, Settings, Help and support | **Search** - Provides access to the search bar where you can search for file, IP, machine, URL, and user. Displays the Search box: the drop-down list allows you to select the entity type and then enter the search query text. **Feedback** -Access the feedback button to provide comments about the portal. **Settings** - Gives you access to the configuration settings where you can set time zones and view license information. **Help and support** - Gives you access to the Windows Defender ATP guide, Microsoft support, and Premier support.
(2) Navigation pane | Use the navigation pane to move between the **Dashboards**, **Alerts queue**, **Machines list**, **Service health**, **Preferences setup**, and **Endpoint management**.
**Dashboards** | Enables you to view the Security operations or the Security analytics dashboard.
-**Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts.
+**Alerts queue** | Enables you to view separate queues of new, in progress, resolved alerts, alerts assigned to you, and suppression rules.
**Machines list** | Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts.
**Service health** | Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues.
**Preferences setup** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set email notifications, activate the preview experience, and enable or turn off advanced features.
diff --git a/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
index 1419c95077..703b227b63 100644
--- a/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
@@ -78,9 +78,12 @@ You can create a custom dashboard in Power BI Desktop to create visualizations t
7. Click **File** > **Options and settings** > **Custom data connectors**.
8. Select **New table and matrix visuals** and **Custom data connectors** and click **OK**.
+
+ >[!NOTE]
+ >If you are using Power BI Desktop July 2017 version (or later), you won't need to select **New table and matrix visuals**. You'll only need to select **Custom data connectors**.
-
+
9. Restart Power BI Desktop.
## Customize the Windows Defender ATP Power BI dashboard
diff --git a/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
index 096f49bab4..e9237f713e 100644
--- a/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
@@ -34,6 +34,9 @@ You'll have access to upcoming features which you can provide feedback on to hel
Turn on the preview experience setting to be among the first to try upcoming features.
1. In the navigation pane, select **Preferences setup** > **Preview experience**.
+
+ 
+
2. Toggle the setting between **On** and **Off** and select **Save preferences**.
## Preview features
diff --git a/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
index 328a0ff719..89beeaac45 100644
--- a/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
@@ -93,11 +93,15 @@ You can roll back and remove a file from quarantine if you’ve determined that
> Windows Defender ATP will remove all files that were quarantined on this machine in the last 30 days.
## Block files in your network
-You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious file, you can block it. This operation will prevent it from being read, written, or executed on machines in your organization.
+You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation will prevent it from being read, written, or executed on machines in your organization.
>[!NOTE]
>This feature is only available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md).
-This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. The coverage will be extended over time. The action takes effect on machines with the latest Windows 10 Insider Preview build.
+This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. This response action is available for machines on Windows 10, version 1703 or later.
+
+>[!IMPORTANT]
+> The PE file needs to be in the machine timeline for you to be able to take this action.
+
### Enable the block file feature
1. In the navigation pane, select **Preference Setup** > **Advanced features** > **Block file**.
@@ -109,9 +113,7 @@ This feature is designed to prevent suspected malware (or potentially malicious
3. Type a comment and select **Yes, block file** to take action on the file.
-
The Action center shows the submission information:
-
- **Submission time** - Shows when the action was submitted.
-
- Portal label
- SIEM field name
- ArcSight field
- Example value
- Description
-
-
-
- 1
- AlertTitle
- name
- A dll was unexpectedly loaded into a high integrity process without a UAC prompt
- Value available for every alert.
-
-
-
- 2
- Severity
- deviceSeverity
- Medium
- Value available for every alert.
-
-
-
- 3
- Category
- deviceEventCategory
- Privilege Escalation
- Value available for every alert.
-
-
-
- 4
- Source
- sourceServiceName
- WindowsDefenderATP
- Windows Defender Antivirus or Windows Defender ATP. Value available for every alert.
-
-
-
- 5
- MachineName
- sourceHostName
- liz-bean
- Value available for every alert.
-
-
-
- 6
- FileName
- fileName
- Robocopy.exe
- Available for alerts associated with a file or process.
-
-
-
- 7
- FilePath
- filePath
- C:\Windows\System32\Robocopy.exe
- Available for alerts associated with a file or process. \
-
-
-
- 8
- UserDomain
- sourceNtDomain
- contoso
- The domain of the user context running the activity, available for Windows Defender ATP behavioral based alerts.
-
-
-
- 9
- UserName
- sourceUserName
- liz-bean
- The user context running the activity, available for Windows Defender ATP behavioral based alerts.
-
-
-
- 10
- Sha1
- fileHash
- 5b4b3985339529be3151d331395f667e1d5b7f35
- Available for alerts associated with a file or process.
-
-
-
- 11
- Md5
- deviceCustomString5
- 55394b85cb5edddff551f6f3faa9d8eb
- Available for Windows Defender AV alerts.
-
-
-
- 12
- Sha256
- deviceCustomString6
- 9987474deb9f457ece2a9533a08ec173a0986fa3aa6ac355eeba5b622e4a43f5
- Available for Windows Defender AV alerts.
-
-
-
- 13
- ThreatName
- eviceCustomString1
- Trojan:Win32/Skeeyah.A!bit
- Available for Windows Defender AV alerts.
-
-
-
- 14
- IpAddress
- sourceAddress
- 218.90.204.141
- Available for alerts associated to network events. For example, 'Communication to a malicious network destination'.
-
-
-
- 15
- Url
- requestUrl
- down.esales360.cn
- Availabe for alerts associated to network events. For example, 'Communication to a malicious network destination'.
-
-
-
- 16
- RemediationIsSuccess
- deviceCustomNumber2
- TRUE
- Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE.
-
-
-
- 17
- WasExecutingWhileDetected
- deviceCustomNumber1
- FALSE
- Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE.
-
-
-
- 18
- AlertId
- externalId
- 636210704265059241_673569822
- Value available for every alert.
-
-
-
- 19
- LinkToWDATP
- flexString1
- `https://securitycenter.windows.com/alert/636210704265059241_673569822`
- Value available for every alert.
-
-
-
- 20
- AlertTime
- deviceReceiptTime
- 2017-05-07T01:56:59.3191352Z
- The time the activity relevant to the alert occurred. Value available for every alert.
-
-
-
- 21
- MachineDomain
- sourceDnsDomain
- contoso.com
- Domain name not relevant for AAD joined machines. Value available for every alert.
-
-
-
- 22
- Actor
- deviceCustomString4
-
- Available for alerts related to a known actor group.
-
-
-
- 21+5
- ComputerDnsName
- No mapping
- liz-bean.contoso.com
- The machine fully qualified domain name. Value available for every alert.
-
-
-
-
- LogOnUsers
- sourceUserId
- contoso\liz-bean; contoso\jay-hardee
- The domain and user of the interactive logon user/s at the time of the event. Note: For machines on Windows 10 version 1607, the domain information will not be available.
-
-
-
- Internal field
- LastProcessedTimeUtc
- No mapping
- 2017-05-07T01:56:58.9936648Z
- Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that alerts are retrieved.
-
-
-
-
- Not part of the schema
- deviceVendor
-
- Static value in the ArcSight mapping - 'Microsoft'.
-
-
-
-
- Not part of the schema
- deviceProduct
-
- Static value in the ArcSight mapping - 'Windows Defender ATP'.
-
-
-
-
- Not part of the schema
- deviceVersion
-
- Static value in the ArcSight mapping - '2.0', used to identify the mapping versions.
-
-
diff --git a/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md
index 0d217af685..81b976e914 100644
--- a/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md
@@ -25,7 +25,7 @@ ms.date: 09/05/2017
[!include[Prerelease information](prerelease.md)]
-Use the **Settings** menu  to configure the time zone, suppression rules, and view license information.
+Use the **Settings** menu  to configure the time zone and view license information.
## Time zone settings
The aspect of time is important in the assessment and analysis of perceived and actual cyberattacks.
@@ -39,7 +39,7 @@ Your current time zone setting is shown in the Windows Defender ATP menu. You ca
### UTC time zone
Windows Defender ATP uses UTC time by default.
-Setting the Windows Defender ATP time zone to UTC will display all system timestamps (alerts, events, and others) in UTC for all users. Choosing this setting means that all users will see the same timestamps in Windows Defender ATP, regardless of their regional settings. This can help security analysts working in different locations across the globe to use the same time stamps while investigating events.
+Setting the Windows Defender ATP time zone to UTC will display all system timestamps (alerts, events, and others) in UTC for all users. This can help security analysts working in different locations across the globe to use the same time stamps while investigating events.
### Local time zone
You can choose to have Windows Defender ATP use local time zone settings. All alerts and events will be displayed using your local time zone.
@@ -55,10 +55,36 @@ To set the time zone:
1. Click the **Settings** menu .
2. Select the **Timezone UTC** indicator.
-3. Select **Timezone Local** or **-8:00**.
+3. Select **Timezone UTC** or your local time zone, for example -7:00.
-## Suppression rules
-The suppression rules control what alerts are suppressed. You can suppress alerts so that certain activities are not flagged as suspicious. For more information see, [Suppress alerts](manage-alerts-windows-defender-advanced-threat-protection.md#suppress-alerts).
+### Regional settings
+To apply different date formats for Windows Defender ATP, use regional settings for IE and Edge. If you're using another browser such as Google Chrome, follow the required steps to change the time and date settings for that browser.
+
+
+**Internet Explorer (IE) and Microsoft Edge (Edge)**
+
+IE and Edge use the **Region** settings configured in the **Clocks, Language, and Region** option in the Control panel.
+
+
+#### Known issues with regional formats
+
+**Date and time formats**
+There are some known issues with the time and date formats.
+
+The following date formats are supported:
+- MM/dd/yyyy
+- dd/MM/yyyy
+
+The following date and time formats are currently not supported:
+- Date format yyyy-MM-dd
+- Date format dd-MMM-yy
+- Date format dd/MM/yy
+- Date format MM/dd/yy
+- Date format with yy. Will only show yyyy.
+- Time format HH:mm:ss is not supported (the 12 hour AM/PM format is not supported). Only the 24-hour format is supported.
+
+**Decimal symbol used in numbers**
+Decimal symbol used is always a dot, even if a comma is selected in the **Numbers** format settings in **Region** settings. For example, 15,5K is displayed as 15.5K.
## License
Click the license link in the **Settings** menu to view the license agreement information for Windows Defender ATP.
diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md
index 00ddbd8987..de337b11fd 100644
--- a/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md
@@ -50,6 +50,24 @@ If onboarding endpoints successfully completes but Windows Defender ATP does not
For more information, see [Ensure that Windows Defender is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-is-not-disabled-by-a-policy).
+#### Known issues with regional formats
+
+**Date and time formats**
+There are some known issues with the time and date formats.
+
+The following date formats are supported:
+- MM/dd/yyyy
+- dd/MM/yyyy
+
+The following date and time formats are currently not supported:
+- Date format yyyy/MM/dd
+- Date format dd/MM/yy
+- Date format with yy. Will only show yyyy.
+- Time format HH:mm:ss is not supported (the 12 hour AM/PM format is not supported). Only the 24-hour format is supported.
+
+**Use of comma to indicate thousand**
+Support of use of comma as a separator in numbers are not supported. Regions where a number is separated with a comma to indicate a thousand, will only see the use of a dot as a separator. For example, 15,5K is displayed as 15.5K.
+
### Related topic
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
index 0916abe7b6..0817855e6a 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
@@ -129,7 +129,7 @@ The following requirements must be met before Attack Surface Reduction will work
Windows 10 version | Windows Defender Antivirus
- | -
-Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled
+Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) must be enabled
diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
index 2cda929649..2945821a44 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
@@ -62,7 +62,7 @@ The following requirements must be met before Controlled Folder Access will work
Windows 10 version | Windows Defender Antivirus
-|-
-Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled
+Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) must be enabled
## Review Controlled Folder Access events in Windows Event Viewer
diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
index 910db87d44..d128c1da67 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
@@ -79,8 +79,7 @@ See the [Attack Surface Reduction](attack-surface-reduction-exploit-guard.md) to
- Disabled = 0
- Audit mode = 2
-
- 
+
@@ -91,13 +90,13 @@ See the [Attack Surface Reduction](attack-surface-reduction-exploit-guard.md) to
2. Enter the following cmdlet:
```PowerShell
- Add-MpPreference -AttackSurfaceReductionRules_Ids