diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index bdab5d4f94..f88a7df806 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -8583,6 +8583,9 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
Update/ConfigureDeadlineGracePeriod
+
+ Update/ConfigureDeadlineGracePeriodForFeatureUpdates
+
Update/ConfigureDeadlineNoAutoReboot
@@ -8610,6 +8613,9 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
Update/DisableWUfBSafeguards
+
+ Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection
+
Update/EngagedRestartDeadline
@@ -8706,6 +8712,18 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
Update/SetEDURestart
+
+ Update/SetPolicyDrivenUpdateSourceForDriver
+
+
+ Update/SetPolicyDrivenUpdateSourceForFeature
+
+
+ Update/SetPolicyDrivenUpdateSourceForOther
+
+
+ Update/SetPolicyDrivenUpdateSourceForQuality
+
Update/SetProxyBehaviorForUpdateDetection
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md
index a89fed4218..4607d36baa 100644
--- a/windows/client-management/mdm/policy-csp-update.md
+++ b/windows/client-management/mdm/policy-csp-update.md
@@ -73,6 +73,9 @@ ms.collection: highpri
Update/ConfigureDeadlineGracePeriod
+
+ Update/ConfigureDeadlineGracePeriodForFeatureUpdates
+
Update/ConfigureDeadlineNoAutoReboot
@@ -100,6 +103,9 @@ ms.collection: highpri
Update/DisableWUfBSafeguards
+
+ Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection
+
Update/EngagedRestartDeadline
@@ -196,6 +202,18 @@ ms.collection: highpri
Update/SetEDURestart
+
+ Update/SetPolicyDrivenUpdateSourceForDriver
+
+
+ Update/SetPolicyDrivenUpdateSourceForFeature
+
+
+ Update/SetPolicyDrivenUpdateSourceForOther
+
+
+ Update/SetPolicyDrivenUpdateSourceForQuality
+
Update/SetProxyBehaviorForUpdateDetection
@@ -1108,6 +1126,53 @@ Default value is 2.
+
+**Update/ConfigureDeadlineGracePeriodForFeatureUpdates**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Allows IT admins to set different grace periods for both Quality Updates and Feature Updates. Specifically, when used with used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates).
+
+IT Admins will be able to specify a minimum number of days until restarts occur automatically for Featur Updates. Setting the grace period may extend the effective deadline set by the deadline policies specifically for Feature Updates.
+
+
+
+
+Supports a numeric value from 0 - 7, which indicates the minimum number of days.
+
+Default value is 2.
+
+
+
+
+
+
+
+
+
+
+
**Update/ConfigureDeadlineNoAutoReboot**
@@ -1573,6 +1638,56 @@ The following list shows the supported values:
+
+**Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+To ensure the highest levels of security, we recommended leveraging WSUS TLS certificate pinning on all devices.
+
+By default, certificate pinning for Windows Update client is not enforced.
+
+
+
+ADMX Info:
+- GP Friendly name: *Allow user proxy to be used as a fallback if detection using system proxy fails*
+- GP name: *Allow user proxy to be used as a fallback if detection using system proxy fails*
+- GP path: *Windows Update\SpecifyintranetMicrosoftupdateserviceLocation*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0 (default) -Do not enforce certificate pinning
+- 1 - Do not enforce certificate pinning
+
+
+
+
+
+
**Update/EngagedRestartDeadline**
@@ -3190,6 +3305,229 @@ The following list shows the supported values:
+
+**Update/SetPolicyDrivenUpdateSourceForDriver**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
+
+If you configure this policy, please also configure the scan source policies for other update types:
+- SetPolicyDrivenUpdateSourceForFeature
+- SetPolicyDrivenUpdateSourceForQuality
+- SetPolicyDrivenUpdateSourceForOther
+
+>[!NOTE]
+>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
+
+
+
+ADMX Info:
+- GP Friendly name: *Specify source service for specific classes of Windows Updates*
+- GP name: *SetPolicyDrivenUpdateSourceForDriver*
+- GP path: *Windows Components/Windows Update*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0: (Default) Detect, download and deploy Driver from Windows Update
+- 1: Enabled, Detect, download and deploy Driver from Windows Server Update Server (WSUS)
+
+
+
+
+
+
+
+**Update/SetPolicyDrivenUpdateSourceForFeature**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
+
+If you configure this policy, please also configure the scan source policies for other update types:
+- SetPolicyDrivenUpdateSourceForQuality
+- SetPolicyDrivenUpdateSourceForDriver
+- SetPolicyDrivenUpdateSourceForOther
+
+>[!NOTE]
+>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
+
+
+
+ADMX Info:
+- GP Friendly name: *Specify source service for specific classes of Windows Updates*
+- GP name: *SetPolicyDrivenUpdateSourceForFeature*
+- GP path: *Windows Components/Windows Update*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0: (Default) Detect, download and deploy Feature from Windows Update
+- 1: Enabled, Detect, download and deploy Feature from Windows Server Update Server (WSUS)
+
+
+
+
+
+
+
+**Update/SetPolicyDrivenUpdateSourceForOther**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
+
+If you configure this policy, please also configure the scan source policies for other update types:
+- SetPolicyDrivenUpdateSourceForFeature
+- SetPolicyDrivenUpdateSourceForQuality
+- SetPolicyDrivenUpdateSourceForDriver
+
+>[!NOTE]
+>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
+
+
+
+ADMX Info:
+- GP Friendly name: *Specify source service for specific classes of Windows Updates*
+- GP name: *SetPolicyDrivenUpdateSourceForOther*
+- GP path: *Windows Components/Windows Update*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0: (Default) Detect, download and deploy Other from Windows Update
+- 1: Enabled, Detect, download and deploy Other from Windows Server Update Server (WSUS)
+
+
+
+
+
+
+
+**Update/SetPolicyDrivenUpdateSourceForQuality**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
+
+If you configure this policy, please also configure the scan source policies for other update types:
+- SetPolicyDrivenUpdateSourceForFeature
+- SetPolicyDrivenUpdateSourceForDriver
+- SetPolicyDrivenUpdateSourceForOther
+
+>[!NOTE]
+>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
+
+
+
+ADMX Info:
+- GP Friendly name: *Specify source service for specific classes of Windows Updates*
+- GP name: *SetPolicyDrivenUpdateSourceForQuality*
+- GP path: *Windows Components/Windows Update*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0: (Default) Detect, download and deploy Quality from Windows Update
+- 1: Enabled, Detect, download and deploy Quality from Windows Server Update Server (WSUS)
+
+
+
+
+
**Update/SetProxyBehaviorForUpdateDetection**
diff --git a/windows/security/threat-protection/intelligence/criteria.md b/windows/security/threat-protection/intelligence/criteria.md
index 1f07f8975c..12e405077b 100644
--- a/windows/security/threat-protection/intelligence/criteria.md
+++ b/windows/security/threat-protection/intelligence/criteria.md
@@ -13,7 +13,7 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
-ms.date: 10/04/2021
+ms.date: 12/13/2021
search.appverid: met150
ms.technology: windows-sec
---
@@ -49,6 +49,8 @@ Microsoft classifies most malicious software into one of the following categorie
* **Backdoor:** A type of malware that gives malicious hackers remote access to and control of your device.
+* **Command and Control:** A type of malware that infects your device and establishes communication with the hackers’ command-and-control server to receive instructions. Once communication is established, hackers can send commands that can steal data, shut down and reboot the device, and disrupt web services.
+
* **Downloader:** A type of malware that downloads other malware onto your device. It must connect to the internet to download files.
* **Dropper:** A type of malware that installs other malware files onto your device. Unlike a downloader, a dropper doesn't have to connect to the internet to drop malicious files. The dropped files are typically embedded in the dropper itself.