mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 06:17:22 +00:00
Merge branch 'master' into 5102047
This commit is contained in:
Brian Lich
commit
4479f85784
@ -65,25 +65,25 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
|
||||
|-------------|-------------------|-----------------|--------|
|
||||
|AllowAutofill|Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowAutofill</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Autofill to complete form fields.</li><li>**1 (default).** Employees can use Autofill to complete form fields.</li></ul></li></ul>
|
||||
|AllowBrowser |Windows 10 or later |Mobile |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowBrowser</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Microsoft Edge.</li><li>**1 (default).** Employees can use Microsoft Edge.</li></ul></li></ul>|
|
||||
|AllowCookies |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowCookies</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Allows all cookies from all sites.</li><li>**1.** Blocks only cookies from 3rd party websites</li><li>**2.** Blocks all cookies from all sites.</li></ul></li></ul> |
|
||||
|AllowDeveloperTools |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowDeveloperTools</li><li>**Data type:** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can't use the F12 Developer Tools</li><li>**1 (default).** Employees can use the F12 Developer Tools</li></ul></li></ul> |
|
||||
|AllowDoNotTrack |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowDoNotTrack</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Stops employees from sending Do Not Track headers to websites requesting tracking info.</li><li>**1.** Employees can send Do Not Track headers to websites requesting tracking info.</li></ul></li></ul> |
|
||||
|AllowExtensions |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowExtensions</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Edge Extensions.</li><li>**1 (default).** Employees can use Edge Extensions.</li></ul></li></ul> |
|
||||
|AllowInPrivate |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowInPrivate</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use InPrivate browsing.</li><li>**1 (default).** Employees can use InPrivate browsing.</li></ul></li></ul> |
|
||||
|AllowPasswordManager |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPasswordManager</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can't use Password Manager to save passwords locally.</li><li>**1.** Employees can use Password Manager to save passwords locally.</li></ul></li></ul> |
|
||||
|AllowPopups |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPopups</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Turns off Pop-up Blocker, allowing pop-up windows.</li><li>**1.** Turns on Pop-up Blocker, stopping pop-up windows.</li></ul></li></ul> |
|
||||
|AllowSearchSuggestions<br>inAddressBar |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar/</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can’t see search suggestions in the Address bar of Microsoft Edge.</li><li>**1.** Employees can see search suggestions in the Address bar of Microsoft Edge.</li></ul></li></ul> |
|
||||
|AllowSearchSuggestionsinAddressBar |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can’t see search suggestions in the Address bar of Microsoft Edge.</li><li>**1.** Employees can see search suggestions in the Address bar of Microsoft Edge.</li></ul></li></ul> |
|
||||
|AllowSmartScreen |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Turns off SmartScreen Filter.</li><li>**1.** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software.</li></ul></li></ul> |
|
||||
|Cookies |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/Cookies</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Allows all cookies from all sites.</li><li>**1.** Blocks only cookies from 3rd party websites</li><li>**2.** Blocks all cookies from all sites.</li></ul></li></ul> |
|
||||
|EnterpriseModeSiteList |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/EnterpriseModeSiteList</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Not configured.</li><li>**1 (default).** Use the Enterprise Mode Site List, if configured.</li><li>**2.** Specify the location to the site list.</li></ul></li></ul> |
|
||||
|Favorites |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/Favorites</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the **Favorite** URLs for your employees.<p>**Example:**<br>`<contoso.com>`<br>`<fabrikam.com>`<p>**Note**<br> URLs must be on separate lines and aren't shared between Microsoft Edge and Internet Explorer 11.</li></ul> |
|
||||
|FirstRunURL |Windows 10, Version 1511 or later |Mobile |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/ Browser/FirstRunURL</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the first run URL for your employees.<p>**Example:**<br>`<contoso.one>`</li></ul></li></ul> |
|
||||
|FirstRunURL |Windows 10, Version 1511 or later |Mobile |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/FirstRunURL</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the first run URL for your employees.<p>**Example:**<br>`<contoso.one>`</li></ul></li></ul> |
|
||||
|HomePages |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/HomePages</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the Home page URLs for your employees.<p>**Example:**<br>`<contoso.com/support><fabrikam.com/support>`</li></ul></li></ul> |
|
||||
|PreventAccessToAbout<br>FlagsInMicrosoftEdge |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventAccessToAboutFlagsInMicrosoftEdge</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can access the about:flags page in Microsoft Edge.</li><li>**1.** Employees can't access the about:flags page in Microsoft Edge.</li></ul></li></ul> |
|
||||
|PreventSmartScreen<br>PromptOverride |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings.</li><li>**1.** Employees can't ignore SmartScreen warnings.</li></ul></li></ul> |
|
||||
|PreventSmartScreen<br>PromptOverrideForFiles |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles </li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings for files.</li><li>**1.** Employees can't ignore SmartScreen warnings for files.</li></ul></li></ul> |
|
||||
|PreventUsingLocalHostIP<br>AddressForWebRTC |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocalHostIPAddressForWebRTC</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Shows an employee's LocalHost IP address while using the WebRTC protocol.</li><li>**1.** Doesn't show an employee's LocalHost IP address while using the WebRTC protocol.</li></ul></li></ul> |
|
||||
|SendIntranetTraffic<br>toInternetExplorer |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer/</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Automatically opens all websites, including intranet sites, using Microsoft Edge.</li><li>**1.** Automatically opens all intranet sites using Internet Explorer 11.</li></ul></li></ul> |
|
||||
|ShowMessageWhenOpening<br>InteretExplorerSites |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/ShowMessageWhenOpeningSitesInInteretExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li><li>**1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li></ul></li></ul> |
|
||||
|PreventAccessToAboutFlagsInMicrosoftEdge |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventAccessToAboutFlagsInMicrosoftEdge</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can access the about:flags page in Microsoft Edge.</li><li>**1.** Employees can't access the about:flags page in Microsoft Edge.</li></ul></li></ul> |
|
||||
|PreventSmartScreenPromptOverride |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings.</li><li>**1.** Employees can't ignore SmartScreen warnings.</li></ul></li></ul> |
|
||||
|PreventSmartScreenPromptOverrideForFiles |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles </li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings for files.</li><li>**1.** Employees can't ignore SmartScreen warnings for files.</li></ul></li></ul> |
|
||||
|PreventUsingLocalHostIPAddressForWebRTC |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocalHostIPAddressForWebRTC</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Shows an employee's LocalHost IP address while using the WebRTC protocol.</li><li>**1.** Doesn't show an employee's LocalHost IP address while using the WebRTC protocol.</li></ul></li></ul> |
|
||||
|SendIntranetTraffictoInternetExplorer |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Automatically opens all websites, including intranet sites, using Microsoft Edge.</li><li>**1.** Automatically opens all intranet sites using Internet Explorer 11.</li></ul></li></ul> |
|
||||
|ShowMessageWhenOpeningInteretExplorerSites |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/ShowMessageWhenOpeningSitesInInteretExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li><li>**1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li></ul></li></ul> |
|
||||
|
||||
## Microsoft Edge and Windows 10-specific Group Policy settings
|
||||
These are additional Windows 10-specific Group Policy settings that work with Microsoft Edge.
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Install apps on your Microsoft Surface Hub
|
||||
description: Admins can install apps can from either the Windows Store or the Windows Store for Business.
|
||||
ms.assetid: 3885CB45-D496-4424-8533-C9E3D0EDFD94
|
||||
keywords: [install apps, Windows Store, Windows Store for Business
|
||||
keywords: install apps, Windows Store, Windows Store for Business
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -37,7 +37,7 @@ The capabilities of your Surface Hub will depend on what other Microsoft product
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Meetings using Skype for Business</p></td>
|
||||
<td align="left"><p>Device account with Skype for Business (Lync 2010 or later) or Skype for Business Online, and a network connection so the account can be accessed.</p></td>
|
||||
<td align="left"><p>Device account with Skype for Business (Lync Server 2013 or later) or Skype for Business Online, and a network connection so the account can be accessed.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Web browsing through Microsoft Edge</p></td>
|
||||
|
||||
@ -43,7 +43,7 @@ Possible fixes for issues on the Surface Hub after you've completed the first-ru
|
||||
<p>The device account isn't configured to automatically accept/decline messages.</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>Use PowerShell<code>cmdlet Set-CalendarProcessing $upn -AutomateProcessing AutoAccept</code>.</p>
|
||||
<p>Use PowerShell cmdlet <code>Set-CalendarProcessing $upn -AutomateProcessing AutoAccept</code>.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -291,7 +291,7 @@ Possible fixes for issues with Surface Hub first-run program.
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="3">
|
||||
<div class="alert"><b>Note</b> <p class="note">People land on the page titled "There's a problem with this account" regarding ActiveSync.</p>
|
||||
<div><p>People land on the page titled "There's a problem with this account" regarding ActiveSync.</p>
|
||||
</div>
|
||||
<div> </div>
|
||||
</td>
|
||||
@ -456,7 +456,7 @@ This section lists status codes, mapping, user messages, and actions an admin ca
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Status Code</th>
|
||||
<th align="left">Hex Code</th>
|
||||
<th align="left">Mapping</th>
|
||||
<th align="left">User-Friendly Message</th>
|
||||
<th align="left">Action admin should take</th>
|
||||
@ -464,149 +464,148 @@ This section lists status codes, mapping, user messages, and actions an admin ca
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2063532030</p></td>
|
||||
<td align="left"><p>0x85010002</p></td>
|
||||
<td align="left"><p>E_HTTP_DENIED</p></td>
|
||||
<td align="left"><p>The password must be updated.</p></td>
|
||||
<td align="left"><p>Update the password.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2147012867</p></td>
|
||||
<td align="left"><p>0x80072EFD</p></td>
|
||||
<td align="left"><p>WININET_E_CANNOT_CONNECT</p></td>
|
||||
<td align="left"><p>Can’t connect to the server right now. Wait a while and try again, or check the account settings.</p></td>
|
||||
<td align="left"><p>Verify that the server name is correct and reachable. Verify that the device is connected to the network.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2046817239</p></td>
|
||||
<td align="left"><p>0x86000C29</p></td>
|
||||
<td align="left"><p>E_NEXUS_STATUS_DEVICE_NOTPROVISIONED (policies don’t match)</p></td>
|
||||
<td align="left"><p>The account is configured with policies not compatible with Surface Hub</p>
|
||||
.</td>
|
||||
<td align="left"><p>The account is configured with policies not compatible with Surface Hub.</p></td>
|
||||
<td align="left"><p>Disable the <strong>PasswordEnabled</strong> policy for this account.</p>
|
||||
<p>We have a bug were we may surface policy errors if the account doesn’t receive any server notifications within the policy refresh interval.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2046817204</p></td>
|
||||
<td align="left"><p>0x86000C4C</p></td>
|
||||
<td align="left"><p>E_NEXUS_STATUS_MAXIMUMDEVICESREACHED</p></td>
|
||||
<td align="left"><p>The account has too many device partnerships.</p></td>
|
||||
<td align="left"><p>Delete one or more partnerships on the server.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2046817270</p></td>
|
||||
<td align="left"><p>0x86000C0A</p></td>
|
||||
<td align="left"><p>E_NEXUS_STATUS_SERVERERROR_RETRYLATER</p></td>
|
||||
<td align="left"><p>Can’t connect to the server right now.</p></td>
|
||||
<td align="left"><p>Wait until the server comes back online. If the issue persists, re-provision the account.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2063269885</p></td>
|
||||
<td align="left"><p>0x85050003</p></td>
|
||||
<td align="left"><p>E_CREDENTIALS_EXPIRED (Credentials have expired and need to be updated)</p></td>
|
||||
<td align="left"><p>The password must be updated.</p></td>
|
||||
<td align="left"><p>Update the password.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2063269875</p></td>
|
||||
<td align="left"><p>0x8505000D</p></td>
|
||||
<td align="left"><p>E_AIRSYNC_RESET_RETRY</p></td>
|
||||
<td align="left"><p>Can’t connect to the server right now. Wait a while or check the account’s settings.</p></td>
|
||||
<td align="left"><p>This is normally a transient error but if the issue persists check the number of devices associated with the account and delete some of them if the number is large.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2046817258</p></td>
|
||||
<td align="left"><p>0x86000C16</p></td>
|
||||
<td align="left"><p>E_NEXUS_STATUS_USER_HASNOMAILBOX</p></td>
|
||||
<td align="left"><p>The mailbox was migrated to a different server.</p></td>
|
||||
<td align="left"><p>You should never see this error. If the issue persists, re-provision the account.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2063532028</p></td>
|
||||
<td align="left"><p>0x85010004</p></td>
|
||||
<td align="left"><p>E_HTTP_FORBIDDEN</p></td>
|
||||
<td align="left"><p>Can’t connect to the server right now. Wait a while and try again, or check the account’s settings.</p></td>
|
||||
<td align="left"><p>Verify the server name to make sure it is correct. If the account is using cert based authentication make sure the certificate is still valid and update it if not.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2063400920</p></td>
|
||||
<td align="left"><p>0x85030028</p></td>
|
||||
<td align="left"><p>E_ACTIVESYNC_PASSWORD_OR_GETCERT</p></td>
|
||||
<td align="left"><p>The account’s password or client certificate are missing or invalid.</p></td>
|
||||
<td align="left"><p>Update the password and/or deploy the client certificate.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2046817238</p></td>
|
||||
<td align="left"><p>0x86000C2A</p></td>
|
||||
<td align="left"><p>E_NEXUS_STATUS_DEVICE_POLICYREFRESH</p></td>
|
||||
<td align="left"><p>The account is configured with policies not compatible with Surface Hub.</p></td>
|
||||
<td align="left"><p>Disable the PasswordEnabled policy for this account.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2063269886</p></td>
|
||||
<td align="left"><p>0x85050002</p></td>
|
||||
<td align="left"><p>E_CREDENTIALS_UNAVAILABLE</p></td>
|
||||
<td align="left"><p>The password must be updated.</p></td>
|
||||
<td align="left"><p>Update the password.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2147012894</p></td>
|
||||
<td align="left"><p>0x80072EE2</p></td>
|
||||
<td align="left"><p>WININET_E_TIMEOUT</p></td>
|
||||
<td align="left"><p>The network doesn’t support the minimum idle timeout required to receive server notification, or the server is offline.</p></td>
|
||||
<td align="left"><p>Verify that the server is running. Verify the NAT settings.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2063589372</p></td>
|
||||
<td align="left"><p>0x85002004</p></td>
|
||||
<td align="left"><p>E_FAIL_ABORT</p></td>
|
||||
<td align="left"><p>This error is used to interrupt the hanging sync, and will not be exposed to users. It will be shown in the telemetry if you force an interactive sync, delete the account, or update its settings.</p></td>
|
||||
<td align="left"><p>Nothing.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2063532009</p></td>
|
||||
<td align="left"><p>0x85010017</p></td>
|
||||
<td align="left"><p>E_HTTP_SERVICE_UNAVAIL</p></td>
|
||||
<td align="left"><p>Can’t connect to the server right now. Wait a while or check the account’s settings.</p></td>
|
||||
<td align="left"><p>Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2046817267</p></td>
|
||||
<td align="left"><p>0x86000C0D</p></td>
|
||||
<td align="left"><p>E_NEXUS_STATUS_MAILBOX_SERVEROFFLINE</p></td>
|
||||
<td align="left"><p>Can’t connect to the server right now. Wait a while or check the account’s settings.</p></td>
|
||||
<td align="left"><p>Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2063400921</p></td>
|
||||
<td align="left"><p>0x85030027</p></td>
|
||||
<td align="left"><p>E_ACTIVESYNC_GETCERT</p></td>
|
||||
<td align="left"><p>The Exchange server requires a certificate.</p></td>
|
||||
<td align="left"><p>Import the appropriate EAS certificate on the Surface Hub.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2046817237</p></td>
|
||||
<td align="left"><p>0x86000C2B</p></td>
|
||||
<td align="left"><p>E_NEXUS_STATUS_INVALID_POLICYKEY</p></td>
|
||||
<td align="left"><p>The account is configured with policies not compatible with Surface Hub.</p></td>
|
||||
<td align="left"><p>Disable the PasswordEnabled policy for this account.</p>
|
||||
<p>We have a bug were we may surface policy errors if the account doesn’t receive any server notifications within the policy refresh interval.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>-2063532027</p></td>
|
||||
<td align="left"><p>0x85010005</p></td>
|
||||
<td align="left"><p>E_HTTP_NOT_FOUND</p></td>
|
||||
<td align="left"><p>The server name is invalid.</p></td>
|
||||
<td align="left"><p>Verify the server name to make sure it is correct. If the issue persists, re-provision the account.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>-2063532012</p></td>
|
||||
<td align="left"><p>0x85010014</p></td>
|
||||
<td align="left"><p>E_HTTP_SERVER_ERROR</p></td>
|
||||
<td align="left"><p>Can’t connect to the server.</p></td>
|
||||
<td align="left"><p>Verify the server name to make sure it is correct. Trigger a sync and, if the issue persists, re-provision the account.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>0x80072ee7</p></td>
|
||||
<td align="left"></td>
|
||||
<td align="left"><p>0x80072EE7</p></td>
|
||||
<td align="left"><p>WININET_E_NAME_NOT_RESOLVED</p></td>
|
||||
<td align="left"><p>The server name or address could not be resolved.</p></td>
|
||||
<td align="left"><p>Make sure the server name is entered correctly.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>0x8007052f</p></td>
|
||||
<td align="left"></td>
|
||||
<td align="left"><p>0x8007052F</p></td>
|
||||
<td align="left"><p>ERROR_ACCOUNT_RESTRICTION</p></td>
|
||||
<td align="left"><p>While auto-discovering the Exchange server, a policy is applied that prevents the logged-in user from logging in to the server.</p></td>
|
||||
<td align="left"><p>This is a timing issue. Re-verify the account's credentials. Try to re-provision when they're correct.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>0x800c0019</p></td>
|
||||
<td align="left"></td>
|
||||
<td align="left"><p>0x800C0019</p></td>
|
||||
<td align="left"><p>INET_E_INVALID_CERTIFICATE</p></td>
|
||||
<td align="left"><p>Security certificate required to access this resource is invalid.</p></td>
|
||||
<td align="left"><p>Install the correct ActiveSync certificate needed for the provided device account.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>0x80072f0d</p></td>
|
||||
<td align="left"></td>
|
||||
<td align="left"><p>0x80072F0D</p></td>
|
||||
<td align="left"><p>WININET_E_INVALID_CA</p></td>
|
||||
<td align="left"><p>The certificate authority is invalid or is incorrect. Could not auto-discover the Exchange server because a certificate is missing.</p></td>
|
||||
<td align="left"><p>Install the correct ActiveSync certificate needed for the provided device account.</p></td>
|
||||
</tr>
|
||||
@ -616,12 +615,6 @@ This section lists status codes, mapping, user messages, and actions an admin ca
|
||||
<td align="left"><p>The domain provided couldn't be found. The Exchange server could not be auto-discovered and was not provided in the settings.</p></td>
|
||||
<td align="left"><p>Make sure that the domain entered is the FQDN, and that there is an Exchange server entered in the Exchange server text box.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>0x80072efd</p></td>
|
||||
<td align="left"></td>
|
||||
<td align="left"><p>Fail to connect to Exchange server as a result of a networking issue. It's possible the server was misspelled or it just couldn't be found.</p></td>
|
||||
<td align="left"><p>Make sure that the Exchange server ID is entered correctly, and that the device is connected to the right network.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 65 KiB After Width: | Height: | Size: 98 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 68 KiB After Width: | Height: | Size: 103 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 64 KiB After Width: | Height: | Size: 96 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 67 KiB After Width: | Height: | Size: 102 KiB |
BIN
devices/surface/images/surface-diagnostic-kit-fig1-options.png
Normal file
BIN
devices/surface/images/surface-diagnostic-kit-fig1-options.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 51 KiB |
BIN
devices/surface/images/surface-diagnostic-kit-fig2-testdepth.png
Normal file
BIN
devices/surface/images/surface-diagnostic-kit-fig2-testdepth.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 63 KiB |
BIN
devices/surface/images/surface-diagnostic-kit-fig3-results.png
Normal file
BIN
devices/surface/images/surface-diagnostic-kit-fig3-results.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 111 KiB |
BIN
devices/surface/images/surface-diagnostic-kit-fig4-notes.png
Normal file
BIN
devices/surface/images/surface-diagnostic-kit-fig4-notes.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 59 KiB |
BIN
devices/surface/images/surface-diagnostic-kit-gear-icon.png
Normal file
BIN
devices/surface/images/surface-diagnostic-kit-gear-icon.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 567 B |
@ -13,17 +13,17 @@ author: miladCA
|
||||
# Microsoft Surface Deployment Accelerator
|
||||
|
||||
|
||||
Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.
|
||||
Microsoft Surface Deployment Accelerator (SDA) provides a quick and simple deployment mechanism for organizations to reimage Surface devices.
|
||||
|
||||
Microsoft Surface Deployment Accelerator includes a wizard that automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. The resulting deployment solution is complete with everything you need to immediately begin the deployment of Windows to a Surface device. You can also use Microsoft Surface Deployment Accelerator to create and capture a Windows reference image and then deploy it with the latest Windows Updates.
|
||||
SDA includes a wizard that automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. The resulting deployment solution is complete with everything you need to immediately begin the deployment of Windows to a Surface device. You can also use SDA to create and capture a Windows reference image and then deploy it with the latest Windows updates.
|
||||
|
||||
Microsoft Surface Deployment Accelerator is built on the powerful suite of deployment tools available from Microsoft including the Windows Assessment and Deployment Kit (ADK), the Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). The resulting deployment share encompasses the recommended best practices for managing drivers during deployment and automating image creation and can serve as a starting point upon which you build your own customized deployment solution.
|
||||
SDA is built on the powerful suite of deployment tools available from Microsoft including the Windows Assessment and Deployment Kit (ADK), the Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). The resulting deployment share encompasses the recommended best practices for managing drivers during deployment and automating image creation and can serve as a starting point upon which you build your own customized deployment solution.
|
||||
|
||||
You can find more information about how to deploy to Surface devices, including step-by-step walkthroughs of customized deployment solution implementation, on the Deploy page of the [Surface TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=691693).
|
||||
|
||||
**Download Microsoft Surface Deployment Accelerator**
|
||||
|
||||
You can download the installation files for Microsoft Surface Deployment Accelerator from the Microsoft Download Center. To download the installation files:
|
||||
You can download the installation files for SDA from the Microsoft Download Center. To download the installation files:
|
||||
|
||||
1. Go to the [Surface Tools for IT](http://go.microsoft.com/fwlink/p/?LinkId=618121) page on the Microsoft Download Center.
|
||||
|
||||
@ -32,9 +32,9 @@ You can download the installation files for Microsoft Surface Deployment Acceler
|
||||
## Microsoft Surface Deployment Accelerator prerequisites
|
||||
|
||||
|
||||
Before you install Microsoft Surface Deployment Accelerator, your environment must meet the following prerequisites:
|
||||
Before you install SDA, your environment must meet the following prerequisites:
|
||||
|
||||
- Microsoft Surface Deployment Accelerator must be installed on Windows Server 2012 R2 or later
|
||||
- SDA must be installed on Windows Server 2012 R2 or later
|
||||
|
||||
- PowerShell Script Execution Policy must be set to **Unrestricted**
|
||||
|
||||
@ -44,45 +44,74 @@ Before you install Microsoft Surface Deployment Accelerator, your environment mu
|
||||
|
||||
- To support network boot, the Windows Server 2012 R2 environment must have Windows Deployment Services installed and configured to respond to PXE requests
|
||||
|
||||
- Access to Windows source files or installation media is required when you prepare a deployment with Microsoft Surface Deployment Accelerator
|
||||
- Access to Windows source files or installation media is required when you prepare a deployment with SDA
|
||||
|
||||
- At least 6 GB of free space for each version of Windows you intend to deploy
|
||||
|
||||
## How Microsoft Surface Deployment Accelerator works
|
||||
|
||||
|
||||
As you progress through the Microsoft Surface Deployment Accelerator wizard, you will be asked some basic questions about how your deployment solution should be configured. As you select the desired Surface models to be supported and apps to be installed (see Figure 1), the wizard will prepare scripts that download, install, and configure everything needed to perform a complete deployment and capture of a reference image. By using the network boot (PXE) capabilities of Windows Deployment Services (WDS), the resulting solution enables you to boot a Surface device from the network and perform a clean deployment of Windows.
|
||||
As you progress through the SDA wizard, you will be asked some basic questions about how your deployment solution should be configured. As you select the desired Surface models to be supported and apps to be installed (see Figure 1), the wizard will prepare scripts that download, install, and configure everything needed to perform a complete deployment and capture of a reference image. By using the network boot (PXE) capabilities of Windows Deployment Services (WDS), the resulting solution enables you to boot a Surface device from the network and perform a clean deployment of Windows.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 1: Select desired apps and drivers
|
||||
*Figure 1. Select desired apps and drivers*
|
||||
|
||||
When the Microsoft Surface Deployment Accelerator completes, you can use the deployment share to deploy over the network immediately. Simply boot your Surface device from the network using a Surface Ethernet Adapter and select the Surface deployment share you created with the Microsoft Surface Deployment Accelerator wizard. Select the **1- Deploy Microsoft Surface** task sequence and the wizard will walk you through an automated deployment of Windows to your Surface device.
|
||||
When the SDA completes, you can use the deployment share to deploy over the network immediately. Simply boot your Surface device from the network using a Surface Ethernet Adapter and select the Surface deployment share you created with the SDA wizard. Select the **1- Deploy Microsoft Surface** task sequence and the wizard will walk you through an automated deployment of Windows to your Surface device.
|
||||
|
||||
You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](http://go.microsoft.com/fwlink/p/?linkid=691700), or to [pause the automated installation routine](http://go.microsoft.com/fwlink/p/?linkid=691701). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before.
|
||||
|
||||
>**Note:** With Microsoft Surface Deployment Accelerator v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment.
|
||||
>**Note:** With SDA v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment.
|
||||
|
||||
|
||||
|
||||
## <a href="" id="use-microsoft-surface-deployment-accelerator-without-an-internet-connection--"></a>Use Microsoft Surface Deployment Accelerator without an Internet connection
|
||||
|
||||
|
||||
For environments where the Microsoft Surface Deployment Accelerator server will not be able to connect to the Internet, the required Surface files can be downloaded separately. To specify a local source for Surface driver and app files, select the **Copy from a local directory** option and specify the location of your downloaded files (see Figure 2). All of the driver and app files for your selected choices must be placed in the specified folder.
|
||||
For environments where the SDA server will not be able to connect to the Internet, the required Surface files can be downloaded separately. To specify a local source for Surface driver and app files, select the **Copy from a local directory** option and specify the location of your downloaded files (see Figure 2). All of the driver and app files for your selected choices must be placed in the specified folder.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 2. Specify a local source for Surface driver and app files
|
||||
*Figure 2. Specify a local source for Surface driver and app files*
|
||||
|
||||
You can find a full list of available driver downloads at [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)
|
||||
|
||||
>**Note:** Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder.
|
||||
|
||||
>**Note:** Using files from a local directory is not supported when including Office 365 in your deployment share. To include Office 365 in your deployment share, select the **Download from the Internet** check box.
|
||||
|
||||
## Changes and updates
|
||||
|
||||
SDA is periodically updated by Microsoft. For instructions on how these features are used, see [Step-by-Step: Microsoft Surface Deployment Accelerator](https://technet.microsoft.com/en-us/itpro/surface/step-by-step-surface-deployment-accelerator).
|
||||
|
||||
>**Note:** To install a newer version of SDA on a server with a previous version of SDA installed, you only need to run the installation file for the new version of SDA. The installer will handle the upgrade process automatically. If you used SDA to create a deployment share prior to the upgrade and want to use new features of the new version of SDA, you will need to create a new deployment share. SDA does not support upgrades of an existing deployment share.
|
||||
|
||||
### Version 1.96.0405
|
||||
This version of SDA adds support for the following:
|
||||
* Microsoft Deployment Toolkit (MDT) 2013 Update 2
|
||||
* Office 365 Click-to-Run
|
||||
* Surface 3 and Surface 3 LTE
|
||||
* Reduced Windows Assessment and Deployment Kit (Windows ADK) footprint, only the following Windows ADK components are installed:
|
||||
* Deployment tools
|
||||
* Windows Preinstallation Environment (WinPE)
|
||||
* User State Migration Tool (USMT)
|
||||
|
||||
|
||||
### Version 1.90.0258
|
||||
This version of SDA adds support for the following:
|
||||
* Surface Book
|
||||
* Surface Pro 4
|
||||
* Windows 10
|
||||
|
||||
|
||||
### Version 1.90.0000
|
||||
This version of SDA adds support for the following:
|
||||
* Local driver and app files can be used to create a deployment share without access to the Internet
|
||||
|
||||
### Version 1.70.0000
|
||||
This version is the original release of SDA. This version of SDA includes support for:
|
||||
* MDT 2013 Update 1
|
||||
* Windows ADK
|
||||
* Surface Pro 3
|
||||
* Windows 8.1
|
||||
|
||||
|
||||
|
||||
|
||||
@ -26,17 +26,17 @@ For information about prerequisites and instructions for how to download and ins
|
||||
|
||||
3. Accept the End User License Agreement (EULA) by selecting the check box, and then click **Install**, as shown in Figure 1.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 1. SDA setup
|
||||
*Figure 1. SDA setup*
|
||||
|
||||
4. Click **Finish** to complete the installation of SDA.
|
||||
|
||||
The tool installs in the Surface Deployment Accelerator program group, as shown in Figure 2.
|
||||
The tool installs in the SDA program group, as shown in Figure 2.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 2. The Surface Deployment Accelerator program group and icon
|
||||
*Figure 2. The SDA program group and icon*
|
||||
|
||||
>**Note:** At this point the tool has not yet prepared any deployment environment or downloaded any materials from the Internet.
|
||||
|
||||
@ -45,7 +45,7 @@ Figure 2. The Surface Deployment Accelerator program group and icon
|
||||
## Create a deployment share
|
||||
|
||||
|
||||
The following steps show how you create a deployment share for Windows 10 that supports Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, and the Surface Asset Tag Tool. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps.
|
||||
The following steps show you how to create a deployment share for Windows 10 that supports Surface 3, Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, the Surface Asset Tag Tool, and Office 365. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps.
|
||||
|
||||
>**Note:** SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice.
|
||||
|
||||
@ -55,7 +55,14 @@ The following steps show how you create a deployment share for Windows 10 that
|
||||
|
||||
2. On the **Welcome** page, click **Next** to continue.
|
||||
|
||||
3. On the **Verify System** page, the SDA wizard verifies the prerequisites required for an SDA deployment share. This process also checks for the presence of the Windows Assessment and Deployment Kit (ADK) for Windows 10 and the Microsoft Deployment Toolkit (MDT) 2013 Update 1. If these tools are not detected, they are downloaded and installed automatically. Click **Next** to continue.
|
||||
3. On the **Verify System** page, the SDA wizard verifies the prerequisites required for an SDA deployment share. This process also checks for the presence of the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10 and the Microsoft Deployment Toolkit (MDT) 2013 Update 2. If these tools are not detected, they are downloaded and installed automatically. Click **Next** to continue.
|
||||
|
||||
>**Note:** As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows:
|
||||
* Deployment tools
|
||||
* User State Migration Tool (USMT)
|
||||
* Windows Preinstallation Environment (WinPE)</br>
|
||||
|
||||
>**Note:** As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1.
|
||||
|
||||
4. On the **Windows 8.1** page, to create a Windows 10 deployment share, do not select the **Would you like to support Windows 8.1** check box. Click **Next** to continue.
|
||||
|
||||
@ -75,15 +82,17 @@ The following steps show how you create a deployment share for Windows 10 that
|
||||
|
||||
- **Local Path** – Specify or browse to the root directory of Windows 10 installation files. If you have an ISO file, mount it and browse to the root of the mounted drive. You must have a full set of source files, not just **Install.wim**.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 3. Specify Windows 10 deployment share options
|
||||
*Figure 3. Specify Windows 10 deployment share options*
|
||||
|
||||
6. On the **Configure** page, select the check box next to each device or app that you want to include in your deployment share. Note that Surface Pro 4 and Surface Book only support Windows 10 and are not available for the deployment of Windows 8.1. The Surface Firmware Tool is only applicable to Surface Pro 3 and cannot be selected unless Surface Pro 3 drivers are selected, as shown in Figure 4. Click **Next** to continue.
|
||||
6. On the **Configure** page, select the check box next to each device or app that you want to include in your deployment share. Note that Surface Pro 4 and Surface Book only support Windows 10 and are not available for the deployment of Windows 8.1. The Surface Firmware Tool is only applicable to Surface 3 and Surface Pro 3 and cannot be selected unless Surface 3 or Surface Pro 3 drivers are selected, as shown in Figure 4. Click **Next** to continue.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 4. Selecting Surface Firmware Tool requires Surface Pro 3 drivers
|
||||
*Figure 4. Selecting Surface Firmware Tool requires Surface Pro 3 drivers*
|
||||
|
||||
>**Note:** You cannot select both Surface 3 and Surface 3 LTE models at the same time.
|
||||
|
||||
7. On the **Summary** page confirm your selections and click **Finish** to begin the creation of your deployment share. The process can take several minutes as files are downloaded, the tools are installed, and the deployment share is created. While the SDA scripts are creating your deployment share, an **Installation Progress** window will be displayed, as shown in Figure 5. A typical SDA process includes:
|
||||
|
||||
@ -105,9 +114,9 @@ The following steps show how you create a deployment share for Windows 10 that
|
||||
|
||||
- Creation of rules and task sequences for Windows deployment
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 5. The **Installation Progress** window
|
||||
*Figure 5. The **Installation Progress** window*
|
||||
|
||||
8. When the SDA process completes the creation of your deployment share, a **Success** window is displayed. Click **Finish** to close the window. At this point your deployment share is now ready to perform a Windows deployment to Surface devices.
|
||||
|
||||
@ -115,13 +124,15 @@ The following steps show how you create a deployment share for Windows 10 that
|
||||
|
||||
If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver an app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6.
|
||||
|
||||
>**Note:** All of the downloaded driver and applications files must be located in the same folder. The driver and app files do not need to be extracted from the downloaded .zip files.
|
||||
>**Note:** All of the downloaded driver and applications files must be located in the same folder. If a required driver or application file is missing from the selected folder when you click **Next**, a warning is displayed and the wizard will not proceed to the next step.
|
||||
|
||||
|
||||
>**Note:** The driver and app files do not need to be extracted from the downloaded .zip files.
|
||||
|
||||
|
||||
>**Note:** Including Office 365 in your deployment share requires an Internet connection and cannot be performed if you use local files.
|
||||
|
||||
Figure 6. Specify the Surface driver and app files from a local path
|
||||
|
||||
|
||||
*Figure 6. Specify the Surface driver and app files from a local path*
|
||||
|
||||
>**Note:** The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later.
|
||||
|
||||
@ -159,9 +170,9 @@ Before you can create bootable media files within the MDT Deployment Workbench o
|
||||
|
||||
9. **exit** – Exits DiskPart, after which you can close the PowerShell or Command Prompt window.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 7. Use DiskPart to prepare a USB drive for boot
|
||||
*Figure 7. Use DiskPart to prepare a USB drive for boot*
|
||||
|
||||
>**Note:** You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly.
|
||||
|
||||
@ -177,15 +188,15 @@ After you have prepared the USB drive for boot, the next step is to generate off
|
||||
|
||||
4. Right-click the **Media** folder and click **New Media** as shown in Figure 8 to start the New Media Wizard.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 8. The Media folder of the SDA deployment share
|
||||
*Figure 8. The Media folder of the SDA deployment share*
|
||||
|
||||
5. On the **General Settings** page in the **Media path** field, enter or browse to a folder where you will create the files for the new offline media. See the example **E:\\SDAMedia** in Figure 9. Leave the default profile **Everything** selected in the **Selection profile** drop-down menu, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 9. Specify a location and selection profile for your offline media
|
||||
*Figure 9. Specify a location and selection profile for your offline media*
|
||||
|
||||
6. On the **Summary** page verify your selections, and then click **Next** to begin creation of the media.
|
||||
|
||||
@ -195,9 +206,9 @@ After you have prepared the USB drive for boot, the next step is to generate off
|
||||
|
||||
9. Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab as shown in Figure 10.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 10. The Rules of the SDA deployment share
|
||||
*Figure 10. Rules of the SDA deployment share*
|
||||
|
||||
10. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+C** to copy the text.
|
||||
|
||||
@ -229,15 +240,17 @@ After you have prepared the USB drive for boot, the next step is to generate off
|
||||
UserPassword=
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 11. The Bootstrap.ini file of MEDIA001
|
||||
*Figure 11. The Bootstrap.ini file of MEDIA001*
|
||||
|
||||
20. Close Bootstrap.ini and click **OK** in **MEDIA001** deployment share properties to close the window.
|
||||
|
||||
21. In the **Deployment Workbench** under the **Media** folder, right-click the newly created **MEDIA001** and click **Update Media Content**, as shown in Figure 12. This will update the media files with the content of the **Microsoft Surface Deployment Accelerator** deployment share.
|
||||
|
||||
Figure 12. Select **Update Media Content**
|
||||
|
||||
|
||||
*Figure 12. Select the **Update Media Content** option*
|
||||
|
||||
22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.**
|
||||
|
||||
@ -252,11 +265,11 @@ Your USB drive is now configured as bootable offline media that contains all of
|
||||
## SDA task sequences
|
||||
|
||||
|
||||
The SDA deployment share is configured with all of the resources required to perform a Windows deployment to a Surface device. These resources include Windows source files, image, Surface drivers, and Surface apps. The deployment share also contains two pre-configured task sequences, as shown in Figure 13. These task sequences contain the steps required to perform a deployment to a Surface device using the default Windows image from the installation media or to create a reference image complete with Windows updates and applications. To learn more about task sequences, see [MDT 2013 Update 1 Lite Touch components](http://technet.microsoft.com/en-us/itpro/windows/deploy/mdt-2013-lite-touch-components).
|
||||
The SDA deployment share is configured with all of the resources required to perform a Windows deployment to a Surface device. These resources include Windows source files, image, Surface drivers, and Surface apps. The deployment share also contains two pre-configured task sequences, as shown in Figure 13. These task sequences contain the steps required to perform a deployment to a Surface device using the default Windows image from the installation media or to create a reference image complete with Windows updates and applications. To learn more about task sequences, see [MDT 2013 Update 2 Lite Touch components](https://technet.microsoft.com/itpro/windows/deploy/mdt-2013-lite-touch-components).
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 13. Task sequences in the Deployment Workbench
|
||||
*Figure 13. Task sequences in the Deployment Workbench*
|
||||
|
||||
### Deploy Microsoft Surface
|
||||
|
||||
@ -286,7 +299,7 @@ The **2 – Create Windows Reference Image** task sequence is used to perform a
|
||||
|
||||
Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations.
|
||||
|
||||
>**Note:** Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information see [Deploy a Windows 10 image using MDT 2013 Update 1](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).
|
||||
>**Note:** Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).
|
||||
|
||||
|
||||
|
||||
@ -323,9 +336,9 @@ To instruct your Surface device to boot from the network, start with the device
|
||||
|
||||
4. Enter the domain credentials that you use to log on to the server where SDA is installed when you are prompted, as shown in Figure 14.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 14. The prompt for credentials to the deployment share
|
||||
*Figure 14. The prompt for credentials to the deployment share*
|
||||
|
||||
5. The Windows Deployment Wizard will start from the deployment share to walk you through the deployment process.
|
||||
|
||||
@ -343,15 +356,15 @@ To run the Deploy Microsoft Surface task sequence:
|
||||
|
||||
1. On the **Task Sequence** page, select the **1 – Deploy Microsoft Surface** task sequence as shown in Figure 15, and then click **Next.**
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 15. Select the **1 – Deploy Microsoft Surface** task sequence
|
||||
*Figure 15. Select the **1 – Deploy Microsoft Surface** task sequence*
|
||||
|
||||
2. On the **Computer Details** page, type a name for the Surface device in the **Computer Name** box. In the **Join a domain** section, type your domain name and credentials as shown in Figure 16, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 16. Enter the computer name and domain information
|
||||
*Figure 16. Enter the computer name and domain information*
|
||||
|
||||
3. On the **Product Key** page, keep the **No product key is required** check box selected if you are deploying the same version and edition of Windows to your Surface devices as they came with from the factory. If you are deploying a different version or edition of Windows to the device, such as Windows Enterprise, select the licensing option that is applicable to your scenario.
|
||||
|
||||
@ -363,9 +376,9 @@ To run the Deploy Microsoft Surface task sequence:
|
||||
|
||||
7. On the **Ready** page, verify your selections and then click **Begin** to start the automated deployment to this device. The deployment will not require user interaction again. The Windows Deployment Wizard will close and an **Installation Progress** window is displayed to show progress of the task sequence as the image is applied and applications are installed (Figure 17).
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 17. The **Installation Progress** window
|
||||
*Figure 17. The **Installation Progress** window*
|
||||
|
||||
8. When the deployment task sequence completes, a **Success** window is displayed. Click **Finish** to complete the deployment and begin using your Surface device.
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ The [Microsoft Surface Diagnostic Toolkit](http://go.microsoft.com/fwlink/p/?Lin
|
||||
|
||||
- Surface Pro
|
||||
|
||||
>**Note:** Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the .zip archive file as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.)
|
||||
>**Note:** Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the archive file (.zip) as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.)
|
||||
|
||||
Running the Microsoft Surface Diagnostic Toolkit is a hands-on activity. The test sequence includes several tests that require you to perform actions or observe the outcome of the test, and then click the applicable **Pass** or **Fail** button. Some tests require connectivity to external devices, like an external display. Other tests use the built in Windows troubleshooters. At the end of testing, a visual report of the test results is displayed and you are given the option to save a log file or copy the results to the clipboard.
|
||||
|
||||
@ -49,17 +49,73 @@ To run a full set of tests with the Microsoft Surface Diagnostic Toolkit, you sh
|
||||
|
||||
- Room to move the Surface device around
|
||||
|
||||
- External speakers or headphones
|
||||
- External speakers or headphones with a 3.5mm stereo plug
|
||||
|
||||
>**Note:** The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not test or resolve issues with the operating system or software.
|
||||
- A power adapter for your Surface device
|
||||
|
||||
>**Note:** The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not resolve issues with the operating system or software.
|
||||
|
||||
## Configure test options
|
||||
|
||||
Before you select the tests you want to run, you can click the Tools  button in the upper right corner of the window (as shown in Figure 1) to access the Options section of the Microsoft Surface Diagnostic Toolkit. In the Options section, you can configure the depth of testing and logs, as well as the save location for log files. You can also create and use additional language files for the dialog of each test.
|
||||
|
||||
|
||||
|
||||
*Figure 1. The Tools button highlighted in upper right corner of window*
|
||||
|
||||
>**Note:** Any options you want to select must be specified before you run the tests. You cannot change the test options after the testing sequence has started.
|
||||
|
||||
####Test depth
|
||||
You can quickly select among three modes for testing and diagnostics by using the **Test Depth** page. The **Test Depth** page displays a slider with three possible positions, as shown in Figure 2. These positions determine which tests are run and what information is recorded without requiring you to select specific tests with the **Run Specific Tests** button. The three modes allow you to focus the tests of the Microsoft Surface Diagnostic Toolkit on hardware, software, or both hardware and software.
|
||||
|
||||
|
||||
|
||||
*Figure 2. The Test Depth slider to select the depth of data collection*
|
||||
|
||||
When you select a mode by using the Test Depth slider, a configuration file (.ini) with the same name as the Microsoft Surface Diagnostic Toolkit executable (.exe) file is created in the same folder. For example, if the Microsoft Surface Diagnostic Toolkit executable file is SurfaceDiagnosticToolkit.exe, the configuration file will be SurfaceDiagnosticToolkit.ini. When the executable file is run, the options will be automatically set by the configuration file. To run the Microsoft Surface Diagnostic Toolkit in a specific mode on multiple devices, ensure that the .ini file remains in the same folder with the .exe file used on each device.
|
||||
|
||||
When you run the Microsoft Surface Diagnostic Toolkit, you can still use the **Run Specific Tests** button to enable or disable specific tests. The tests selected on the **Please Select Tests to Run** page take priority over the tests enabled or disabled by the mode specified on the **Test Depth** page. When a mode is selected the tests that are applicable to that mode will be enabled by default and the tests that are not required for that mode will be disabled.
|
||||
|
||||
Each mode has a specific focus and records a different level of information in the log files, as follows:
|
||||
|
||||
* **Hardware and Software Focus.** This is the default mode for the Microsoft Surface Diagnostic Toolkit. In this mode all tests that are applicable to the device are run. This mode logs the most information and takes the most time.
|
||||
* **Software Experience Focus.** This mode collects information about the device and records it in the log file. No hardware tests are performed in this mode. The following tests are run in this mode:
|
||||
* Windows Update Check Test
|
||||
* Device Information Test
|
||||
* System Assessment Test
|
||||
* Crash Dump Collection Test
|
||||
* Modern Standby Test
|
||||
* **Hardware Validation Focus.** This mode tests the hardware of the device but does not collect system log files or device information. All diagnostic tests relevant to the device hardware are run in this mode. The exact tests that are run will vary from device to device depending on the hardware configuration. This mode logs the least information and requires the least amount of time.
|
||||
|
||||
|
||||
####Save location
|
||||
Use the **Browse** button on the **Save Location** page to select a default location for the Microsoft Surface Diagnostic Toolkit log files to be saved. When the tests complete the user will still be prompted to save a log file and a log file will not be saved automatically. The user must still click the **Save to File** button to save the log files. As with the Test Depth mode, this save location is stored in the Microsoft Surface Diagnostic Toolkit configuration (.ini) file and if the file does not exist, configuring this option will generate the file.
|
||||
|
||||
####Additional language
|
||||
Refer to the [Localization](#localization) section of this article for information about how to customize the dialog displayed during each test. On the **Additional Language** page, you can generate a localization file that you can use to customize the dialog during each test. You can also specify a specific localization file to be used with the Microsoft Surface Diagnostic Toolkit with the **Browse** button.
|
||||
|
||||
####Feedback
|
||||
You can use the form on the **Feedback** page to inform the product team of any problems that you encounter with the Microsoft Surface Diagnostic Toolkit or to provide any suggestions for how the Microsoft Surface Diagnostic Toolkit could be improved.
|
||||
|
||||
|
||||
|
||||
## The tests
|
||||
|
||||
|
||||
The Microsoft Surface Diagnostic Toolkit runs several individual tests on a Surface device. Not all tests are applicable to every device. For example, the Home button test is not applicable to Surface Pro 4 where there is no Home button. You can specify which tests to run, or you can choose to run all tests. For tests that require external devices (such as testing output to an external display) but you do not have the required external device at the time of the test, you are given the option to skip the test. If a test fails, you are prompted to continue or stop testing at that time.
|
||||
|
||||
When the testing completes, the **Test Results** page is displayed (as shown in Figure 3) and shows the status of each test: passed, failed, or inconclusive (skipped). You can choose to run the tests again; to save a log file, including any additional log files gathered by tests; or to copy the log file text to the clipboard.
|
||||
|
||||
|
||||
|
||||
*Figure 3. View of the results of the tests*
|
||||
|
||||
When the tests have completed, you can also add additional notes to the log files by clicking **Add additional feedback to results ->** on the **Test Results** page. Use the **Type any additional feedback about these tests** field on the **Test Results** page to add your notes, as shown in Figure 4.
|
||||
|
||||
|
||||
|
||||
*Figure 4. Add notes to the log file*
|
||||
|
||||
Notes that you type on this page are displayed in the log files after the results of the selected tests and before the **Files** section. The section header in the log files for these notes is named **User Feedback**.
|
||||
|
||||
#### Windows Update
|
||||
|
||||
This test checks for any outstanding Windows updates and will prompt you to install those updates before you proceed to other tests. It is important to keep a Surface device up to date with the latest Windows updates, including drivers and firmware for the Surface device. The success of some of the tests that are performed later in the task sequence depend on these updated drivers and firmware. You will be prompted to restart the device if required by Windows Update. If you must restart the device, you will need to start the Microsoft Surface Diagnostic Toolkit again.
|
||||
@ -213,7 +269,7 @@ Insert a micro SD or SD card when you are prompted. When the SD card is detected
|
||||
|
||||
#### Microphone test
|
||||
|
||||
This test displays the **Recording** tab of the Sound item in Control Panel. The test prompts you to monitor the meter that is displayed next to the **Microphone Array** recording device. A recommended test is to speak and watch for your speech to be detected in the meter. If the meter moves when you speak, the microphone is working correctly. For Surface Book you will be prompted to tap locations near the microphones. This tapping should produce noticeable spikes in the audio meter.
|
||||
This test displays a meter that shows the microphone sound level and records audio for a short period of time. Say a few words or make noise and make note that the meter displays the sound level accordingly. A countdown timer is displayed to indicate how much time is remaining for you to record sound. When the countdown timer expires, the recorded audio is played back. Verify that the words or noises sound clear and accurate, and then mark the test as passed or failed depending on the results.
|
||||
|
||||
#### Video out test
|
||||
|
||||
@ -231,11 +287,13 @@ After you receive a prompt to put the device in pairing mode, the test opens the
|
||||
|
||||
Use this test to verify that the cameras on your Surface device are operating properly. Images will be displayed from both the front and rear cameras, and the infrared camera on a Surface Pro 4. Continuous autofocus can be enabled on the rear camera. Move the device closer and farther away from an object to verify the operation of continuous autofocus.
|
||||
|
||||
>**Note:** You can also use the **Snapshot to Logs** option to save a snapshot of the video output to the log files.
|
||||
|
||||
#### Speaker test
|
||||
|
||||
>**Note:** Headphones or external speakers are required to test the headphone jack in this test.
|
||||
|
||||
This test plays audio over left and right channels respectively, both for the internal speakers and for speakers or headphones connected to the headphone jack. Mark each channel as a pass or fail as you hear the audio play.
|
||||
This test plays audio over left and right channels respectively, both for the internal speakers and for speakers or headphones connected through the headphone jack. Plug in your headphones or speakers to the 3.5mm stereo jack when prompted. The test will automatically detect that a sound playback device has been connected. Mark each channel as a pass or fail as you hear the audio play through the speakers or headphones.
|
||||
|
||||
#### Network test
|
||||
|
||||
@ -267,15 +325,21 @@ The compass detects which direction the Surface device is facing relative to nor
|
||||
|
||||
The ambient light sensor is used to automatically adjust screen brightness relative to the ambient lighting in the environment. Turn the device toward or away from a light source to cause the screen to dim or brighten in response increased or decreased light. The test automatically passes when the screen brightness automatically changes.
|
||||
|
||||
>**Note:** You can also block the ambient light from the sensor by holding your hand slightly in front of the light sensor, which is located directly next to the camera. Use the provided meter to determine if you are blocking light from the sensor.
|
||||
|
||||
#### Device orientation test
|
||||
|
||||
>**Note:** Before you run this test, disable rotation lock from the Action Center if enabled.
|
||||
|
||||
The device orientation sensor determines what the angle of the Surface device is, relative to the ground. Rotate the display 90 degrees or 180 degrees to cause the screen orientation to switch between portrait and landscape mode. The test automatically passes when the screen orientation switches.
|
||||
The device orientation sensor determines what the angle of the Surface device is, relative to the ground. Rotate the display 90 degrees or 180 degrees to cause the screen orientation to switch between portrait and landscape mode. If you have a Surface Type Cover or the Surface Book keyboard connected, you will be prompted to disconnect the Surface from the keyboard to allow screen rotation. The test automatically passes when the screen orientation switches.
|
||||
|
||||
#### Brightness test
|
||||
|
||||
This test cycles the screen through brightness levels from 0 percent to 100 percent, and then a message is displayed to confirm if the brightness level changed accordingly. You are then prompted to disconnect the power adapter. The screen should automatically dim when power is disconnected.
|
||||
This test cycles the screen through brightness levels from 0 percent to 100 percent, and then a message is displayed to confirm if the brightness level changed accordingly. You are then prompted to test for brightness reaction. To test the reaction of brightness when running on battery, disconnect the power adapter. The screen should automatically dim when power is disconnected.
|
||||
|
||||
#### Surface Dock test
|
||||
The Microsoft Surface Diagnostic Toolkit uses this test only if a Surface Dock is connected to the device. If a Surface Dock is detected, this test verifies that the Surface Dock driver firmware is updated. For more detailed analysis of Surface Dock firmware status and how to manually initiate the firmware update process, see the [Microsoft Surface Dock Updater](https://technet.microsoft.com/en-us/itpro/surface/surface-dock-updater) article.
|
||||
|
||||
|
||||
#### System assessment
|
||||
|
||||
@ -291,6 +355,19 @@ Performance and diagnostic trace logs are recorded from Performance Monitor for
|
||||
|
||||
If your Surface device has encountered an error that caused the device to fail or produce a blue screen error, this stage of the Microsoft Surface Diagnostic Toolkit records the information from the automatically recorded crash dump files in the diagnostic log. You can use these crash dump files to identify a faulty driver, hardware component, or application through analysis. Use the [Windows Debugging Tool](http://go.microsoft.com/fwlink/p/?LinkId=746488) to analyze these files. If you are not familiar with the analysis of crash dump files, you can describe your issue and post a link to your crash dump files (uploaded to OneDrive or another file sharing service) in the [Windows TechNet Forums](http://go.microsoft.com/fwlink/p/?LinkId=746489).
|
||||
|
||||
#### Connected standby text
|
||||
|
||||
>**Note:** This test is only available on Surface devices running Windows 8 or Windows 8.1.
|
||||
|
||||
If connected standby is enabled on the Surface device, this test passes automatically. If connected standby is not enabled, a failure is recorded for this test. Find out more about Connected Standby and Modern Standby at [Modern Standby](https://msdn.microsoft.com/library/windows/hardware/mt282515) on MSDN.
|
||||
|
||||
#### Modern standby test
|
||||
|
||||
>**Note:** This test is only available on Surface devices running Windows 10.
|
||||
|
||||
This test records log files of the power configuration for the Surface device using the **powercfg.exe /a** command. The test completes automatically and a failure is only recorded if the command does not run.
|
||||
|
||||
|
||||
## Command line
|
||||
|
||||
You can run the Microsoft Surface Diagnostic Toolkit from the command line or as part of a script. The tool supports the following arguments:
|
||||
@ -430,25 +507,26 @@ Surface_Diagnostic_Toolkit_1.0.60.0.exe “logpath=C:\Folder with spaces”
|
||||
## Localization
|
||||
|
||||
|
||||
By default, the Microsoft Surface Diagnostic Toolkit is available in English only. If you want to localize the text of the Microsoft Surface Diagnostic Toolkit prompts into another language, you can do so by creating a custom localization file. If the localization file exists, the Microsoft Surface Diagnostic Toolkit will override the default English text and use the text contained in the file instead. To create a localization file, follow these steps:
|
||||
By default, the Microsoft Surface Diagnostic Toolkit is available in English only. If you want to localize the text of the Microsoft Surface Diagnostic Toolkit prompts into another language, you can do so by creating a custom localization file. To create a new localization file (.locale), follow these steps:
|
||||
|
||||
1. Open Notepad.
|
||||
1. Click the Tools  button.
|
||||
2. Click the **Additional Language** page.
|
||||
3. Click the **Generate** button and the new .locale file is created.
|
||||
|
||||
2. Type the following line at the beginning of the file:
|
||||
The locale file that is created when you use these steps will have the same name as your executable file, even if it has been changed from the default. For example, if the Microsoft Surface Diagnostic Toolkit executable file is SurfaceDiagnosticToolkit.exe, the localization file would be SurfaceDiagnosticToolkit.locale. The locale file will be created in the same folder as the executable file. If a localization file with this name already exists, you will be prompted to overwrite the existing file. The file that is created when you click the **Generate** button is always generated in the default language, English.
|
||||
|
||||
``` syntax
|
||||
<root />
|
||||
```
|
||||
To customize the localization file, open the file in a text or XML editor such as Notepad. To edit the dialog for each test, replace the text for each phrase tag. (For example, `<phrase key="testdialog">text</phrase>`.) To use the file automatically when you start the Microsoft Surface Diagnostic Toolkit, simply save the file with the same name it had when it was created. To save the file for use with other instances of Microsoft Surface Diagnostic Toolkit, copy the file to another location or save the file with another name.
|
||||
|
||||
3. Save the file as SurfaceDiagnosticTool\_v1.0.60.0.locale in the same location where the Microsoft Surface Diagnostic Toolkit executable file is stored.
|
||||
If a localization file with the same name and in the same folder as the executable file is detected when Microsoft Surface Diagnostic Toolkit started, the alternate text specified in that localization file replaces the default dialog and prompts. If a custom localization file is not present or the file name is not the same as the executable file, the tool will default to English text. At any point you can also explicitly specify a localization file to be used by the Microsoft Surface Diagnostic Toolkit. To specify a localization file, follow these steps:
|
||||
1. Click the Tools  button.
|
||||
2. Click the **Additional Language** page.
|
||||
3. Click **Browse**.
|
||||
4. Browse to and select your custom localization file.
|
||||
|
||||
4. Run the Microsoft Surface Diagnostic Toolkit executable file, Surface\_Diagnostic\_Toolkit\_v1.0.60.0.exe. The SurfaceDiagnosticTool\_v1.0.60.0.locale file will be populated with all of the text from the default prompts.
|
||||
A custom localization file selected through this process does not need a specific name. After you select the custom localization file, the Microsoft Surface Diagnostic Toolkit will import the contents and write them to a .locale file with the same name as the .exe file, just like if you click the **Generate** button to create a new .locale file.
|
||||
|
||||
5. Open the SurfaceDiagnosticTool\_v1.0.60.0.locale file in Notepad and change the text of each prompt to your custom or localized text.
|
||||
>**Note:** If you import a localization file by clicking the **Browse** button, an existing localization file will be overwritten without prompting if that file has the same name as the Microsoft Surface Diagnostic Toolkit executable file.
|
||||
|
||||
6. Save the SurfaceDiagnosticTool\_v1.0.60.0.locale file.
|
||||
|
||||
>**Note:** The SurfaceDiganosticTool\_v1.0.60.0.locale file must be located in the same folder and have the same name other than the file extension as the Microsoft Surface Diagnostic Toolkit executable file to use the custom prompt text. The SurfaceDiganosticTool\_v1.0.60.0.locale is an .xml file and must use UTF-8 encoding.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -20,7 +20,11 @@ author: eross-msft
|
||||
Microsoft Intune helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.
|
||||
|
||||
## Important note about the June service update
|
||||
We've received some great feedback from you, our Windows 10 Insider Preview customers, about our enterprise data protection experiences and processes. Because of that feedback, we're delighted to deliver an enhanced apps policy experience with the June service update. This means that when you open an existing enterprise data protection policy after we release the June service update in your test environment, your existing Windows 10 enterprise data protection app rules (formerly in the **Protected Apps** area) will be removed.<p>To prepare for this change, we recommend that you make an immediate backup of your current app rules as they are today, so you can use them to help reconfigure your app rules with the enhanced experience. When you open an existing enterprise data protection policy after we release the June service update, you'll get a dialog box telling you about this change. Click the **OK** button to close the box and to begin reconfiguring your app rules.<p><p>Note that if you exit the **Policy** page before you've saved your new policy, your existing deployments won't be affected. However, if you save the policy without reconfiguring your apps, an updated policy will be deployed to your employees with an empty app rules list.
|
||||
We've received some great feedback from you, our Windows 10 Insider Preview customers, about our enterprise data protection experiences and processes. Because of that feedback, we're delighted to deliver an enhanced apps policy experience with the June service update. This means that when you open an existing enterprise data protection policy after we release the June service update in your test environment, your existing Windows 10 enterprise data protection app rules (formerly in the **Protected Apps** area) will be removed.<p>To prepare for this change, we recommend that you make an immediate backup of your current app rules as they are today, so you can use them to help reconfigure your app rules with the enhanced experience. When you open an existing enterprise data protection policy after we release the June service update, you'll get a dialog box telling you about this change. Click the **OK** button to close the box and to begin reconfiguring your app rules.
|
||||
|
||||
|
||||
|
||||
Note that if you exit the **Policy** page before you've saved your new policy, your existing deployments won't be affected. However, if you save the policy without reconfiguring your apps, an updated policy will be deployed to your employees with an empty app rules list.
|
||||
|
||||
## Add an EDP policy
|
||||
After you’ve installed and set up Intune for your organization, you must create an EDP-specific policy.
|
||||
@ -70,13 +74,15 @@ The steps to add your apps are based on the type of app it is; either a Universa
|
||||
}
|
||||
```
|
||||
4. Copy the `publisherCertificateName` value into the **Publisher Name** box and copy the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
<p>**Important**<br>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.
|
||||
|
||||
>**Important**<br>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.
|
||||
<p>For example:<br>
|
||||
``` json
|
||||
{
|
||||
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
|
||||
**To find the Publisher and Product name values for apps installed on Windows 10 Mobile phones**
|
||||
@ -205,6 +211,7 @@ If you're running into compatibility issues where your app is incompatible with
|
||||
After you've added the apps you want to protect with EDP, you'll need to apply a management and protection mode.
|
||||
|
||||
We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your **Protected Apps** list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Mode</th>
|
||||
@ -220,7 +227,7 @@ We recommend that you start with **Silent** or **Override** while verifying with
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Silent</td>
|
||||
<td>EDP runs silently, logging inappropriate data sharing, without blocking anything.</td>
|
||||
<td>EDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Off</td>
|
||||
@ -245,7 +252,8 @@ If you have multiple domains, you must separate them with the "|" character. For
|
||||
|
||||
|
||||
## Choose where apps can access enterprise data
|
||||
After you've added a protection level to your apps, you'll need to decide where those apps can access enterprise data on your network. There are 6 options, including your network domain, cloud domain, proxy server, internal proxy server, IPv4 range, and IPv6 range.
|
||||
After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.<p>
|
||||
There are no default locations included with EDP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).
|
||||
|
||||
>**Important**<br>
|
||||
- Every EDP policy should include policy that defines your enterprise network locations.<p>
|
||||
@ -261,34 +269,34 @@ After you've added a protection level to your apps, you'll need to decide where
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Cloud Domain</td>
|
||||
<td>contoso.sharepoint.com,proxy1.contoso.com|<br>office.com|proxy2.contoso.com</td>
|
||||
<td>Specify the cloud resources traffic to restrict to your protected apps.<p>For each cloud resource, you may also specify an internal proxy server that routes your traffic from your **Enterprise Internal Proxy Server** policy. If you have multiple resources, you must use the | delimiter.<p>Include the "," delimiter just before the "|" if you don’t use proxies. For example:<br> `[URL,Proxy]|[URL,Proxy]`</td>
|
||||
<td>Enterprise Cloud Resources</td>
|
||||
<td>**With proxy:**<p>contoso.sharepoint.com,proxy.contoso.com|<br>contoso.visualstudio.com,proxy.contoso.com<p>**Without proxy:**<p>contoso.sharepoint.com|contoso.visualstudio.com</td>
|
||||
<td>Specify the cloud resources to be treated as corporate and protected by EDP.<p>For each cloud resource, you may also optionally specify an internal proxy server that routes your traffic through your Enterprise Internal Proxy Server.<p>If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example:<p>`URL <,proxy>|URL <,proxy>`<p>If Windows is unable to determine whether an app should be allowed to connect to a network resource, it will automatically block the connection. If instead you want Windows to allow the connections to happen, you can add the `/*AppCompat*/` string to this setting. For example:<p>`URL <,proxy>|URL <,proxy>|/*AppCompat*/`</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Network Domain</td>
|
||||
<td>Enterprise Network Domain Names</td>
|
||||
<td>domain1.contoso.com,domain2.contoso.com</td>
|
||||
<td>Specify the DNS suffix used in your environment. All traffic to the fully-qualified domains using this DNS suffix will be protected. If you have multiple resources, you must use the "," delimiter.<p>This setting works with the IP Ranges settings to detect whether a network endpoint is enterprise or personal on private networks.</td>
|
||||
<td>Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.<p>This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.<p>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Proxy Server</td>
|
||||
<td>domain1.contoso.com:80;domain2.contoso.com:137</td>
|
||||
<td>Specify the proxy server and the port traffic is routed through. If you have multiple resources, you must use the ";" delimiter.<p>This setting is required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when using certain Wi-Fi hotspots at hotels and restaurants.</td>
|
||||
<td>Enterprise Proxy Servers</td>
|
||||
<td>domain1.contoso.com:80;<br>domain2.contoso.com:137</td>
|
||||
<td>Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with EDP.<p>This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for EDP-protected traffic.<p>This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.<p>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Internal Proxy Server</td>
|
||||
<td>proxy1.contoso.com;proxy2.contoso.com</td>
|
||||
<td>Specify the proxy servers your cloud resources will go through. If you have multiple resources, you must use the ";" delimiter.</td>
|
||||
<td>Enterprise Internal Proxy Servers</td>
|
||||
<td>proxy1.contoso.com;<br>proxy2.contoso.com</td>
|
||||
<td>Specify the proxy servers your devices will go through to reach your cloud resources.<p>Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.<p>This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.<p>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise IPv4 Range</td>
|
||||
<td>**Starting IPv4 Address:** 3.4.0.1<br>**Ending IPv4 Address:** 3.4.255.254<br>**Custom URI:** 3.4.0.1-3.4.255.254,10.0.0.1-10.255.255.254</td>
|
||||
<td>Specify the addresses for a valid IPv4 value range within your intranet.<p>If you are adding a single range, you can enter the starting and ending addresses into your management system’s UI. If you want to add multiple addresses, we suggest creating a Custom URI, using the "-" delimiter between start and end of a range, and the "," delimiter to separate ranges.</td>
|
||||
<td>Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.<p>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise IPv6 Range</td>
|
||||
<td>**Starting IPv6 Address:** 2a01:110::<br>**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff<br>**Custom URI:** 2a01:110::-2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</td>
|
||||
<td>Specify the addresses for a valid IPv6 value range within your intranet.<p>If you are adding a single range, you can enter the starting and ending addresses into your management system’s UI. If you want to add multiple addresses, we suggest creating a Custom URI, using the "-" delimiter between start and end of a range, and the "," delimiter to separate ranges.</td>
|
||||
<td>**Starting IPv6 Address:** 2a01:110::<br>**Ending IPv6 Address:** 2a01:110:7fff:ffff:<br>ffff:ffff:ffff:ffff<br>**Custom URI:** 2a01:110::-2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,<br>fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</td>
|
||||
<td>Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.<p>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -296,10 +304,56 @@ After you've added a protection level to your apps, you'll need to decide where
|
||||
|
||||
2. Add as many locations as you need, and then click **OK**.<p>The **Add or Edit Enterprise Network Locations box** closes.
|
||||
|
||||
3. In the **Use a data recovery certificate in case of data loss** box, click **Browse** to add a data recovery certificate for your policy.<p>Adding a data recovery certificate helps you to access locally-protected files on the device. For example, if an employee leaves the company and the IT department has to access EDP-protected data from a Windows 10 company computer. This can also help recover data in case an employee's device is accidentally revoked. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic.<p>
|
||||
3. In the **Use a data recovery certificate in case of data loss** box, click **Browse** to add a data recovery certificate for your policy.<p>After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.<p>For steps about how to create and verify an EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) DRA certificate](#create-and-verify-an-encrypting-file-system-efs-dra-certificate) section of this topic. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic.<p>
|
||||
|
||||
|
||||
|
||||
### Create and verify an Encrypting File System (EFS) DRA certificate
|
||||
If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you.
|
||||
|
||||
>**Important**<br>
|
||||
If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. To add your EFS DRA certificate to your policy by using Microsoft Intune, see Step 3 in the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic.
|
||||
|
||||
**To manually create an EFS DRA certificate**
|
||||
1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate.
|
||||
|
||||
2. Run this command:
|
||||
|
||||
`cipher /r:<EFSRA>`
|
||||
|
||||
Where *<EFSRA>* is the name of the .cer and .pfx files that you want to create.
|
||||
|
||||
3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file.
|
||||
|
||||
The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1.
|
||||
|
||||
>**Important**<br>
|
||||
Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location.
|
||||
|
||||
4. Add your EFS DRA certificate to your EDP policy by using Step 3 of the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic.
|
||||
|
||||
**To verify your data recovery certificate is correctly set up on an EDP client computer**
|
||||
1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP.
|
||||
|
||||
2. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command:
|
||||
|
||||
`cipher /c <filename>`
|
||||
|
||||
Where *<filename>* is the name of the file you created in Step 1.
|
||||
|
||||
3. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list.
|
||||
|
||||
**To recover your data using the EFS DRA certificate in a test environment**
|
||||
1. Copy your EDP-encrypted file to a location where you have admin access.
|
||||
|
||||
2. Install the EFSDRA.pfx file, using your password.
|
||||
|
||||
3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command:
|
||||
|
||||
`cipher /d <encryptedfile.extension>`
|
||||
|
||||
Where *<encryptedfile.extension>* is the name of your encrypted file. For example, corporatedata.docx.
|
||||
|
||||
## Choose your optional EDP-related settings
|
||||
After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional EDP settings.
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Protect your enterprise data using enterprise data protection (EDP) (Windows 10)
|
||||
description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control.
|
||||
ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032
|
||||
keywords: EDP, Enterprise Data Protection
|
||||
keywords: EDP, enterprise data protection
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
@ -18,9 +18,9 @@ author: eross-msft
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
|
||||
With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage.
|
||||
With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures to their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage.
|
||||
|
||||
Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps.
|
||||
Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. Finally, another data protection technology, Azure Rights Management also works alongside EDP to extend data protection for data that leaves the device, such as when email attachments are sent from an enterprise-aware version of a rights management mail client.
|
||||
|
||||
## Prerequisites
|
||||
You’ll need this software to run EDP in your enterprise:
|
||||
@ -32,20 +32,20 @@ You’ll need this software to run EDP in your enterprise:
|
||||
## How EDP works
|
||||
EDP helps address your everyday challenges in the enterprise. Including:
|
||||
|
||||
- Helping to prevent enterprise data leaks, even on employee-owned devices that can't be locked down.
|
||||
- Helping to prevent enterprise data leaks, even on employee-owned devices that can't be locked down.
|
||||
|
||||
- Reducing employee frustrations because of restrictive data management policies on enterprise-owned devices.
|
||||
- Reducing employee frustrations because of restrictive data management policies on enterprise-owned devices.
|
||||
|
||||
- Helping to maintain the ownership and control of your enterprise data.
|
||||
- Helping to maintain the ownership and control of your enterprise data.
|
||||
|
||||
- Helping control the network and data access and data sharing for apps that aren’t enterprise aware.
|
||||
- Helping control the network and data access and data sharing for apps that aren’t enterprise-aware.
|
||||
|
||||
### EDP-protection modes
|
||||
You can set EDP to 1 of 4 protection and management modes:
|
||||
|
||||
|Mode|Description|
|
||||
|----|-----------|
|
||||
|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.|
|
||||
|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.|
|
||||
|Override |EDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459). |
|
||||
|Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.|
|
||||
|Off |EDP is turned off and doesn't help to protect or audit your data.<p>After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives. |
|
||||
@ -60,32 +60,20 @@ EDP gives you a new way to manage data policy enforcement for apps and documents
|
||||
|
||||
- **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using an EDP-protected device, EDP encrypts the data on the device.
|
||||
|
||||
- **Using protected apps.** Managed apps (apps that you've included on the **Protected Apps** list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem.
|
||||
- **Using allowed apps.** Managed apps (apps that you've included on the protected apps list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to Block, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem.
|
||||
|
||||
- **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your **Protected App** list, the app is trusted with enterprise data. All apps that aren’t on this list are blocked from accessing your enterprise network resources and your EDP-protected data.<p>
|
||||
You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in the **Protected App** list.
|
||||
- **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your protected apps list, the app is trusted with enterprise data. All apps not on this list are blocked from accessing your enterprise data, depending on your EDP management-mode.<p>You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in your protected apps list.
|
||||
|
||||
- **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your **Protected App** list.
|
||||
- **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your protected apps list.
|
||||
|
||||
- **Continuous data encryption.** EDP helps protect enterprise data on local files and on removable media.<p>
|
||||
Apps such as Microsoft Word work with EDP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document.
|
||||
- **Data encryption at rest.** EDP helps protect enterprise data on local files and on removable media.<p>Apps such as Microsoft Word work with EDP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document.
|
||||
|
||||
- **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your **Protected App** list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your **Protected Apps** list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the cloud, while maintaining the encryption.
|
||||
- **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your protected apps list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your protected apps list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the business cloud, while maintaining the encryption locally.
|
||||
|
||||
- **Helping prevent accidental data disclosure to removable media.** EDP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t.
|
||||
|
||||
- **Remove access to enterprise data from enterprise-protected devices.** EDP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.<p>**Note**<br>System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device.
|
||||
|
||||
## Current limitations with EDP
|
||||
EDP is still in development and is not yet integrated with Azure Rights Management. This means that while you can deploy an EDP-configured policy to a protected device, that protection is restricted to a single user on the device. Additionally, the EDP-protected data must be stored on NTFS, FAT, or ExFAT file systems.
|
||||
|
||||
Use the following table to identify the scenarios that require Azure Rights Management, the behavior when Azure Rights Management is not used with EDP, and the recommended workarounds.
|
||||
|
||||
|EDP scenario |Without Azure Rights Management |Workaround |
|
||||
|-------------|--------------------------------|-----------|
|
||||
|Saving enterprise data to USB drives |Data in the new location remains encrypted, but becomes inaccessible on other devices or for other users. For example, the file won't open or the file opens, but doesn't contain readable text. |Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.<p>We strongly recommend educating employees about how to limit or eliminate the need for this decryption. |
|
||||
|Synchronizing data to other services or public cloud storage |Synchronized files aren't protected on additional services or as part of public cloud storage. |Stop the app from synchronizing or don't add the app to your **Protected App** list.<p>For more info about adding apps to the **Protected App** list, see either the [Create an enterprise data protection (EDP) policy using Intune](create-edp-policy-using-intune.md) or the [Create and deploy an enterprise data protection (EDP) policy using Configuration Manager](create-edp-policy-using-sccm.md) topic, depending on your management solution.
|
||||
|
||||
## Next steps
|
||||
After deciding to use EDP in your enterprise, you need to:
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user