diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 359a00110d..1965f039f3 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -19114,46 +19114,6 @@ "source_path": "windows/security/identity-protection/change-history-for-access-protection.md", "redirect_url": "/windows/security/", "redirect_document_id": false - }, - { - "source_path": "windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment", - "redirect_document_id": false - }, - { - "source_path": "windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image", - "redirect_document_id": false - }, - { - "source_path": "windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt", - "redirect_document_id": false - }, - { - "source_path": "windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11", - "redirect_document_id": false - }, - { - "source_path": "windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer", - "redirect_document_id": false - }, - { - "source_path": "windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/simulate-a-windows-11-deployment-in-a-test-environment", - "redirect_document_id": false - }, - { - "source_path": "windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit", - "redirect_document_id": false - }, - { - "source_path": "windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-11-deployment-information", - "redirect_document_id": false }, { "source_path": "windows/deploy-windows-cm/upgrade-to-windows-with-configuraton-manager.md", diff --git a/education/itadmins.yml b/education/itadmins.yml index 849c8bb478..2847e59b71 100644 --- a/education/itadmins.yml +++ b/education/itadmins.yml @@ -79,7 +79,7 @@ productDirectory: - url: https://techcommunity.microsoft.com/t5/Azure-Information-Protection/Azure-Information-Protection-Deployment-Acceleration-Guide/ba-p/334423 text: Azure information protection deployment acceleration guide - url: /cloud-app-security/getting-started-with-cloud-app-security - text: Microsoft Cloud app security + text: Microsoft Defender for Cloud Apps - url: /microsoft-365/compliance/create-test-tune-dlp-policy text: Office 365 data loss prevention - url: /microsoft-365/compliance/ @@ -117,4 +117,4 @@ productDirectory: - url: https://support.office.com/en-us/education text: Education help center - url: https://support.office.com/en-us/article/teacher-training-packs-7a9ee74a-8fe5-43d3-bc23-a55185896921 - text: Teacher training packs \ No newline at end of file + text: Teacher training packs diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 10787af567..2c43aa28c6 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -643,7 +643,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T |-------|---------------------------------------------| |Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren't comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)).| |VBScript|This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)) and [ADSI Scriptomatic](https://technet.microsoft.com/scriptcenter/dd939958.aspx).| -|Windows PowerShell|This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| +|Windows PowerShell|This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Windows PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| *Table 12. AD DS bulk-import account methods* @@ -863,7 +863,7 @@ The first step in preparing for Windows 10 deployment is to configure—that is, |1. Import operating systems|Import the operating systems that you selected in the [Select the operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench)| |2. Import device drivers|Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.
Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench)| |3. Create MDT applications for Microsoft Store apps|Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the **Add-AppxPackage** Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10.
Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you will need to obtain the .appx files by performing one of the following tasks:
  • For offline-licensed apps, download the .appx files from the Microsoft Store for Business.
  • For apps that are not offline licensed, obtain the .appx files from the app software vendor directly.

    If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.
    If you have Intune or Microsoft Endpoint Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune) and [Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager). This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.
    In addition, you must prepare your environment for sideloading Microsoft Store apps. For more information about how to:
  • Prepare your environment for sideloading, see [Try it out: sideload Microsoft Store apps](/previous-versions/windows/).
  • Create an MDT application, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench).| -|4. Create MDT applications for Windows desktop apps|You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.
    To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in[Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source).
    If you have Intune, you can [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune), as described in the Deploy and manage apps by using Intune section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps.
    This is the preferred method for deploying and managing Windows desktop apps.
    **Note:**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)
    For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt).| +|4. Create MDT applications for Windows desktop apps|You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.
    To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in[Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source).
    If you have Intune, you can [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune), as described in the Deploy and manage apps by using Intune section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps.
    This is the preferred method for deploying and managing Windows desktop apps.
    **Note:**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)
    For more information about how to create an MDT application for Windows desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt).| |5. Create task sequences|You must create separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education, (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education, or (3) if you want to run deployments and upgrades for both 32-bit and 64-bit versions of Windows 10. To do so, you must create task sequences that will:
  • Deploy 64-bit Windows 10 Education to devices.
  • Deploy 32-bit Windows 10 Education to devices.
  • Upgrade existing devices to 64-bit Windows 10 Education.
  • Upgrade existing devices to 32-bit Windows 10 Education.

    Again, you will create the task sequences based on the operating systems that you imported in step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench).| |6. Update the deployment share|Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32-bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.
    For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#UpdateaDeploymentShareintheDeploymentWorkbench).| @@ -903,7 +903,7 @@ Deploying a new Configuration Manager infrastructure is beyond the scope of this Create a Configuration Manager application for each Windows desktop or Microsoft Store app that you want to deploy after you apply the reference image to a device. For more information, see [Deploy and manage applications with Configuration Manager](/mem/configmgr/apps/deploy-use/deploy-applications). -### Configure Window Deployment Services for MDT +### Configure Windows Deployment Services for MDT You can use Windows Deployment Services in conjunction with MDT to automatically initiate boot images on target devices. These boot images can be Windows PE images (which you generated in step 6 in Table 16) or custom images that can deploy operating systems directly to the target devices. @@ -925,7 +925,7 @@ You can use Windows Deployment Services in conjunction with MDT to automatically For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](/mem/configmgr/mdt/use-the-mdt#AddLTIBootImagestoWindowsDeploymentServices). -### Configure Window Deployment Services for Microsoft Endpoint Configuration Manager +### Configure Windows Deployment Services for Microsoft Endpoint Configuration Manager > [!NOTE] > If you have already configured your Microsoft Endpoint Manager infrastructure to support PXE boot or selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next. diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index d06c0039c5..c0e52a36d6 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -441,7 +441,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T |---|---| | **Ldifde.exe** | This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)). | | **VBScript** | This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx). | -| **Windows PowerShell** | This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). | +| **Windows PowerShell** | This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Windows PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). | --- @@ -670,13 +670,13 @@ The first step in preparation for Windows 10 deployment is to configure—that i | **1. Import operating systems** | Import the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportanOperatingSystemintotheDeploymentWorkbench). | | **2. Import device drives** | Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.

    Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench). | | **3. Create MDT applications for Microsoft Store apps** | Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the Add-AppxPackage Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10.

    Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you will need to obtain the .appx files from the app software vendor directly. If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.

    If you have Intune, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.

    In addition, you must prepare your environment for sideloading (deploying) Microsoft Store apps. For more information about how to:

    - Prepare your environment for sideloading, see [Sideload LOB apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10).
    - Create an MDT application, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench). | -| **4. Create MDT applications for Windows desktop apps** | You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.

    To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source?f=255&MSPPError=-2147217396).

    If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.

    You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

    For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench). | +| **4. Create MDT applications for Windows desktop apps** | You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.

    To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source?f=255&MSPPError=-2147217396).

    If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.

    You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

    For more information about how to create an MDT application for Windows desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench). | | **5. Create task sequences.** | You must create a separate task sequence for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in Step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education; (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education; or (3) if you want to run deployments and upgrades for both 32 bit and 64-bit versions of Windows 10. To do so, you must create task sequences that will:

    - Deploy Windows 10 Education 64-bit to devices.
    - Deploy Windows 10 Education 32-bit to devices.
    - Upgrade existing devices to Windows 10 Education 64-bit.
    - Upgrade existing devices to Windows 10 Education 32-bit.

    Again, you will create the task sequences based on the operating systems that you imported in Step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench). | | **6. Update the deployment share.** | Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32 bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.

    For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#UpdateaDeploymentShareintheDeploymentWorkbench).| --- -### Configure Window Deployment Services for MDT +### Configure Windows Deployment Services for MDT You can use Windows Deployment Services with MDT to automatically initiate boot images on target computers. These boot images can be Windows PE images (which you generated in Step 6 in Table 9) or custom images that can deploy operating systems directly to the target computers. diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index a728b75a41..38b068d300 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -250,7 +250,7 @@ You'll download a .zip file, extract the files, and then use one of the files to - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProYesYes
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -109,31 +91,13 @@ ADMX Info: **ADMX_AdmPwd/POL_AdmPwd_Enabled** - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProYesYes
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -172,31 +136,13 @@ ADMX Info: **ADMX_AdmPwd/POL_AdmPwd_AdminName** - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProYesYes
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -235,31 +181,13 @@ ADMX Info: **ADMX_AdmPwd/POL_AdmPwd** - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProYesYes
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index 110c13b38f..c25bbf261a 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -72,36 +72,14 @@ manager: dansimp **ADMX_AppCompat/AppCompatPrevent16BitMach** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Edition
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -147,38 +125,14 @@ ADMX Info: **ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -218,38 +172,14 @@ ADMX Info: **ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -293,38 +223,14 @@ ADMX Info: **ADMX_AppCompat/AppCompatTurnOffSwitchBack** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -369,37 +275,13 @@ ADMX Info: **ADMX_AppCompat/AppCompatTurnOffEngine** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -446,38 +328,14 @@ ADMX Info: **ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -513,38 +371,14 @@ ADMX Info: **ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -587,38 +421,14 @@ ADMX Info: **ADMX_AppCompat/AppCompatTurnOffUserActionRecord** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -660,38 +470,14 @@ ADMX Info: **ADMX_AppCompat/AppCompatTurnOffProgramInventory** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md index 4e924cb2a7..b3a9d9197f 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md +++ b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md @@ -39,38 +39,14 @@ manager: dansimp **ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-appxruntime.md b/windows/client-management/mdm/policy-csp-admx-appxruntime.md index 74860dbb38..7440cfbb70 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxruntime.md +++ b/windows/client-management/mdm/policy-csp-admx-appxruntime.md @@ -48,37 +48,14 @@ manager: dansimp **ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -117,38 +94,14 @@ ADMX Info: **ADMX_AppXRuntime/AppxRuntimeBlockFileElevation** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -187,38 +140,14 @@ ADMX Info: **ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -259,38 +188,14 @@ ADMX Info: **ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md index 9ddc5dc7bc..60757b10f3 100644 --- a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md @@ -51,38 +51,14 @@ manager: dansimp **ADMX_AttachmentManager/AM_EstimateFileHandlerRisk** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -126,37 +102,14 @@ ADMX Info: **ADMX_AttachmentManager/AM_SetFileRiskLevel** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes
    @@ -202,38 +155,14 @@ ADMX Info: **ADMX_AttachmentManager/AM_SetHighRiskInclusion** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -273,38 +202,14 @@ ADMX Info: **ADMX_AttachmentManager/AM_SetLowRiskInclusion** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -344,38 +249,14 @@ ADMX Info: **ADMX_AttachmentManager/AM_SetModRiskInclusion** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md index 5e4ce66ca3..4ade562c8f 100644 --- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -39,38 +39,14 @@ manager: dansimp **ADMX_AuditSettings/IncludeCmdLine** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-bits.md b/windows/client-management/mdm/policy-csp-admx-bits.md index db5b7fc71f..f14750b59c 100644 --- a/windows/client-management/mdm/policy-csp-admx-bits.md +++ b/windows/client-management/mdm/policy-csp-admx-bits.md @@ -78,38 +78,14 @@ manager: dansimp **ADMX_Bits/BITS_DisableBranchCache** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -150,38 +126,14 @@ ADMX Info: **ADMX_Bits/BITS_DisablePeercachingClient** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -223,38 +175,14 @@ ADMX Info: **ADMX_Bits/BITS_DisablePeercachingServer** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -297,38 +225,14 @@ ADMX Info: **ADMX_Bits/BITS_EnablePeercaching** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -370,38 +274,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxBandwidthServedForPeers** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -446,38 +326,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxBandwidthV2_Maintenance** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -521,38 +377,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxBandwidthV2_Work** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -593,38 +425,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxCacheSize** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -665,38 +473,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxContentAge** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -737,38 +521,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxDownloadTime** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -811,38 +571,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxFilesPerJob** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -884,38 +620,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxJobsPerMachine** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -957,38 +669,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxJobsPerUser** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1030,38 +718,14 @@ ADMX Info: **ADMX_Bits/BITS_MaxRangesPerFile** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index 514efdce81..1aafb0d27a 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -42,38 +42,14 @@ manager: dansimp **ADMX_CipherSuiteOrder/SSLCipherSuiteOrder** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -116,38 +92,14 @@ ADMX Info: **ADMX_CipherSuiteOrder/SSLCurveOrder** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md index abac5580d8..6ddb16921c 100644 --- a/windows/client-management/mdm/policy-csp-admx-com.md +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -42,38 +42,14 @@ manager: dansimp **ADMX_COM/AppMgmt_COM_SearchForCLSID_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -118,38 +94,14 @@ ADMX Info: **ADMX_COM/AppMgmt_COM_SearchForCLSID_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index bdd6e7f313..fd6ce7faed 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -48,38 +48,14 @@ manager: dansimp **ADMX_ControlPanel/DisallowCpls** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -126,38 +102,14 @@ ADMX Info: **ADMX_ControlPanel/ForceClassicControlPanel** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -201,38 +153,14 @@ ADMX Info: **ADMX_ControlPanel/NoControlPanel** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -283,42 +211,14 @@ ADMX Info: **ADMX_ControlPanel/RestrictCpls** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index 644cc93fd2..8005489dba 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -108,38 +108,14 @@ manager: dansimp **ADMX_ControlPanelDisplay/CPL_Display_Disable** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -178,43 +154,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Display_HideSettings** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -251,44 +198,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -328,43 +245,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -405,43 +293,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -479,43 +338,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -557,43 +387,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -636,43 +437,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -710,43 +482,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -784,43 +527,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -862,43 +576,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11 -
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -938,43 +623,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1018,43 +674,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1094,43 +721,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1168,43 +766,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1242,43 +811,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1314,43 +854,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1388,43 +899,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1462,43 +944,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1543,42 +996,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1626,43 +1051,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1707,43 +1103,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1781,43 +1148,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -1864,43 +1202,14 @@ ADMX Info: **ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-cpls.md b/windows/client-management/mdm/policy-csp-admx-cpls.md index 71ba7fb9c0..4e1d864337 100644 --- a/windows/client-management/mdm/policy-csp-admx-cpls.md +++ b/windows/client-management/mdm/policy-csp-admx-cpls.md @@ -39,43 +39,14 @@ manager: dansimp **ADMX_Cpls/UseDefaultTile** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md index 92d2b7cfc2..e7951df443 100644 --- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -45,43 +45,15 @@ manager: dansimp **ADMX_CredentialProviders/AllowDomainDelayLock** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11 -
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -124,43 +96,14 @@ ADMX Info: **ADMX_CredentialProviders/DefaultCredentialProvider** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -202,43 +145,14 @@ ADMX Info: **ADMX_CredentialProviders/ExcludedCredentialProviders** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 2c66db1203..cb4c42d7af 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -69,42 +69,14 @@ manager: dansimp **ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -154,43 +126,14 @@ ADMX Info: **ADMX_CredSsp/AllowDefaultCredentials** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -244,43 +187,14 @@ ADMX Info: **ADMX_CredSsp/AllowEncryptionOracle** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -329,43 +243,14 @@ ADMX Info: **ADMX_CredSsp/AllowFreshCredentials** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -416,43 +301,14 @@ ADMX Info: **ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -503,43 +359,14 @@ ADMX Info: **ADMX_CredSsp/AllowSavedCredentials** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -590,43 +417,14 @@ ADMX Info: **ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -677,43 +475,14 @@ ADMX Info: **ADMX_CredSsp/DenyDefaultCredentials** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -762,43 +531,14 @@ ADMX Info: **ADMX_CredSsp/DenyFreshCredentials** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -847,43 +587,14 @@ ADMX Info: **ADMX_CredSsp/DenySavedCredentials** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -932,43 +643,14 @@ ADMX Info: **ADMX_CredSsp/RestrictedRemoteAdministration** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md index b6e48f936c..31ef959ed4 100644 --- a/windows/client-management/mdm/policy-csp-admx-credui.md +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -42,43 +42,14 @@ manager: dansimp **ADMX_CredUI/EnableSecureCredentialPrompting** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -119,43 +90,14 @@ ADMX Info: **ADMX_CredUI/NoLocalPasswordResetQuestions** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProNoNo
    BusinessNoNo
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index e5b1bcf653..281f374dc7 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -507,10 +507,10 @@ ADMX Info: Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off. Disabled (Default): -Microsoft Defender will exclude pre-defined list of paths from the scan to improve performance. +Microsoft Defender Antivirus will exclude pre-defined list of paths from the scan to improve performance. Enabled: -Microsoft Defender will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios. +Microsoft Defender Antivirus will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios. Not configured: Same as Disabled. @@ -1415,7 +1415,7 @@ ADMX Info: Enable or disable file hash computation feature. Enabled: -When this feature is enabled Microsoft Defender will compute hash value for files it scans. +When this feature is enabled Microsoft Defender Antivirus will compute hash value for files it scans. Disabled: File hash value is not computed diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 79a75e5fb3..bbbcfee611 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -1188,12 +1188,12 @@ The following list shows the supported values: Home No - No + Yes Pro No - No + Yes Business @@ -1234,6 +1234,9 @@ The values for this policy are 0, 1, 2, and 3. This policy defaults to 0 if not - 2 - Hide: The Chat icon will be hidden by default. Users can show or hide it in Settings. - 3 - Disabled: The Chat icon will not be displayed, and users cannot show or hide it in Settings. +> [!NOTE] +> Option 1 (Show) and Option 2 (Hide) only work on the first sign-in attempt. Option 3 (Disabled) works on all attempts. + diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index c14e27b61c..3be3903b4b 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -3564,7 +3564,7 @@ The options are: - 0 - Disabled: Admin Approval Mode and all related UAC policy settings are disabled. > [!NOTE] - > If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. + > If this policy setting is disabled, Windows Security notifies you that the overall security of the operating system has been reduced. - 1 - Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 91ba6acd2b..c38caf5830 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -2141,7 +2141,7 @@ Do not allow update deferral policies to cause scans against Windows Update. If For more information about dual scan, see [Demystifying "Dual Scan"](/archive/blogs/wsus/demystifying-dual-scan) and [Improving Dual Scan on 1607](/archive/blogs/wsus/improving-dual-scan-on-1607). -This is the same as the Group Policy in Windows Components > Window Update "Do not allow update deferral policies to cause scans against Windows Update." +This is the same as the Group Policy in Windows Components > Windows Update "Do not allow update deferral policies to cause scans against Windows Update." Value type is integer. Supported operations are Add, Get, Replace, and Delete. diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 6b2e339e43..1236c6edd8 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -210,7 +210,7 @@ ADMX Info: -Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area. +Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area. @@ -282,7 +282,7 @@ Valid values: -Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area. +Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area. Value type is integer. Supported operations are Add, Get, Replace and Delete. @@ -444,7 +444,7 @@ ADMX Info: -Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area. +Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area. @@ -593,7 +593,7 @@ The following list shows the supported values: -Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area. +Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area. Value type is integer. Supported operations are Add, Get, Replace and Delete. @@ -667,7 +667,7 @@ The following list shows the supported values: -Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area. +Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area. Value type is integer. Supported operations are Add, Get, Replace and Delete. @@ -741,7 +741,7 @@ The following list shows the supported values: -Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area. +Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area. Value type is integer. Supported operations are Add, Get, Replace and Delete. @@ -977,7 +977,7 @@ ADMX Info: -Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area. +Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area. Value type is integer. Supported operations are Add, Get, Replace and Delete. @@ -1733,4 +1733,3 @@ ADMX Info:
    - diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index 4550b1717b..a0be6b4e19 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -19,7 +19,7 @@ Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy confi ## Background -In addition to standard MDM policies, the Policy CSP can also handle selected set of ADMX policies. In an ADMX policy, an administrative template contains the metadata of a Window Group Policy and can be edited in the Local Group Policy Editor on a PC. Each administrative template specifies the registry keys (and their values) that are associated with a Group Policy and defines the policy settings that can be managed. Administrative templates organize Group Policies in a hierarchy in which each segment in the hierarchical path is defined as a category. Each setting in a Group Policy administrative template corresponds to a specific registry value. These Group Policy settings are defined in a standards-based, XML file format known as an ADMX file. For more information, see [Group Policy ADMX Syntax Reference Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753471(v=ws.10)). +In addition to standard MDM policies, the Policy CSP can also handle selected set of ADMX policies. In an ADMX policy, an administrative template contains the metadata of a Windows Group Policy and can be edited in the Local Group Policy Editor on a PC. Each administrative template specifies the registry keys (and their values) that are associated with a Group Policy and defines the policy settings that can be managed. Administrative templates organize Group Policies in a hierarchy in which each segment in the hierarchical path is defined as a category. Each setting in a Group Policy administrative template corresponds to a specific registry value. These Group Policy settings are defined in a standards-based, XML file format known as an ADMX file. For more information, see [Group Policy ADMX Syntax Reference Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753471(v=ws.10)). ADMX files can either describe operating system (OS) Group Policies that are shipped with Windows or they can describe settings of applications, which are separate from the OS and can usually be downloaded and installed on a PC. Depending on the specific category of the settings that they control (OS or application), the administrative template settings are found in the following two locations in the Local Group Policy Editor: diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md index a894ed2312..1fc466b83d 100644 --- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md +++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md @@ -171,12 +171,11 @@ Here’s a table describing this relationship, using the PowerShell example from | ProvisioningCommands/DeviceContext/CommandFiles | PowerShell_Example.bat | The single orchestrator script referenced by the command line that handles calling into the required installers or performing any other actions such as expanding cab files. This script must do the required logging. | | ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example, there is only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. | - ### Add script to provisioning package - -When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Window Configuration Designer. -Using Windows Configuration Designer, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to: +When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Windows Configuration Designer. + +Using Windows Configuration Designer, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to: ```bat cmd /c InstallMyApp.bat diff --git a/windows/deployment/deploy-windows-mdt/TOC.yml b/windows/deployment/deploy-windows-mdt/TOC.yml index 3f4a5f1d0d..51493a1083 100644 --- a/windows/deployment/deploy-windows-mdt/TOC.yml +++ b/windows/deployment/deploy-windows-mdt/TOC.yml @@ -1,23 +1,23 @@ -- name: Deploy Windows 11 with the Microsoft Deployment Toolkit (MDT) +- name: Deploy Windows 10 with the Microsoft Deployment Toolkit (MDT) items: - name: Get started with MDT href: get-started-with-the-microsoft-deployment-toolkit.md - - name: Deploy Windows 11 with MDT + - name: Deploy Windows 10 with MDT items: - name: Prepare for deployment with MDT href: prepare-for-windows-deployment-with-mdt.md - - name: Create a Windows 11 reference image - href: create-a-windows-11-reference-image.md - - name: Deploy a Windows 11 image using MDT - href: deploy-a-windows-11-image-using-mdt.md - - name: Build a distributed environment for Windows 11 deployment - href: build-a-distributed-environment-for-windows-deployment.md - - name: Refresh a Windows 10 computer with Windows 11 - href: refresh-a-windows-10-computer-with-windows-11.md - - name: Replace a Windows 10 computer with a Windows 11 computer - href: replace-a-windows-10-computer-with-a-windows-11-computer.md - - name: Perform an in-place upgrade to Windows 11 with MDT - href: upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md + - name: Create a Windows 10 reference image + href: create-a-windows-10-reference-image.md + - name: Deploy a Windows 10 image using MDT + href: deploy-a-windows-10-image-using-mdt.md + - name: Build a distributed environment for Windows 10 deployment + href: build-a-distributed-environment-for-windows-10-deployment.md + - name: Refresh a Windows 7 computer with Windows 10 + href: refresh-a-windows-7-computer-with-windows-10.md + - name: Replace a Windows 7 computer with a Windows 10 computer + href: replace-a-windows-7-computer-with-a-windows-10-computer.md + - name: Perform an in-place upgrade to Windows 10 with MDT + href: upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md - name: Customize MDT items: - name: Configure MDT settings @@ -28,10 +28,10 @@ href: configure-mdt-deployment-share-rules.md - name: Configure MDT for UserExit scripts href: configure-mdt-for-userexit-scripts.md - - name: Simulate a Windows 11 deployment in a test environment - href: simulate-a-windows-11-deployment-in-a-test-environment.md - - name: Use the MDT database to stage Windows deployment information - href: use-the-mdt-database-to-stage-windows-deployment-information.md + - name: Simulate a Windows 10 deployment in a test environment + href: simulate-a-windows-10-deployment-in-a-test-environment.md + - name: Use the MDT database to stage Windows 10 deployment information + href: use-the-mdt-database-to-stage-windows-10-deployment-information.md - name: Assign applications using roles in MDT href: assign-applications-using-roles-in-mdt.md - name: Use web services in MDT diff --git a/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md b/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md index 21bf379b8e..453515a466 100644 --- a/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md +++ b/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md @@ -18,10 +18,6 @@ ms.topic: article # Assign applications using roles in MDT -**Applies to** -- Windows 10 -- Windows 11 - This topic will show you how to add applications to a role in the MDT database and then assign that role to a computer. For the purposes of this topic, the application we are adding is Adobe Reader XI. In addition to using computer-specific entries in the database, you can use roles in MDT to group settings together. ## Create and assign a role entry in the database diff --git a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md similarity index 85% rename from windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md rename to windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md index b47530ab45..c05e2b7c67 100644 --- a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md +++ b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md @@ -1,12 +1,12 @@ --- -title: Build a distributed environment for Windows 11 deployment (Windows 11) -description: In this topic, you will learn how to replicate your Windows 11 deployment shares to facilitate the deployment of Windows 11 in remote or branch locations. +title: Build a distributed environment for Windows 10 deployment (Windows 10) +description: In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations. ms.assetid: a6cd5657-6a16-4fff-bfb4-44760902d00c ms.reviewer: manager: dougeby ms.author: greglin keywords: replication, replicate, deploy, configure, remote -ms.prod: w11 +ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library @@ -16,13 +16,12 @@ author: greg-lindsay ms.topic: article --- -# Build a distributed environment for Windows 11 deployment +# Build a distributed environment for Windows 10 deployment **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 -Perform the steps in this article to build a distributed environment for Windows 11 deployment. A distributed environment for deployment is useful when you have a segmented network, for example one that is segmented geographically into two branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of a deployment solution because images of 5 GB or more in size can present bandwidth issues when deployed over the wire. Replicating this content enables clients to do local deployments. +Perform the steps in this article to build a distributed environment for Windows 10 deployment. A distributed environment for deployment is useful when you have a segmented network, for example one that is segmented geographically into two branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of a deployment solution because images of 5 GB or more in size can present bandwidth issues when deployed over the wire. Replicating this content enables clients to do local deployments. Four computers are used in this topic: DC01, MDT01, MDT02, and PC0006. DC01 is a domain controller, MDT01 and MDT02 are domain member computers running Windows Server 2019, and PC0006 is a blank device where we will deploy Windows 10. The second deployment server (MDT02) will be configured for a remote site (Stockholm) by replicating the deployment share on MDT01 at the original site (New York). All devices are members of the domain contoso.com for the fictitious Contoso Corporation. @@ -32,7 +31,7 @@ For the purposes of this article, we assume that MDT02 is prepared with the same Computers used in this topic. -> HV01 is also used in this topic to host the PC0006 virtual machine. +>HV01 is also used in this topic to host the PC0006 virtual machine. ## Replicate deployment shares @@ -63,7 +62,7 @@ On **MDT01**: Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools ``` -2. Wait for installation to comlete, and then verify that the installation was successful. See the following output: +2. Wait for installation to complete, and then verify that the installation was successful. See the following output: ```output PS C:\> Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools @@ -83,7 +82,7 @@ On **MDT02**: Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools ``` -2. Wait for installation to comlete, and then verify that the installation was successful. See the following output: +2. Wait for installation to complete, and then verify that the installation was successful. See the following output: ```output PS C:\> Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools @@ -120,7 +119,7 @@ When you have multiple deployment servers sharing the same content, you need to On **MDT01**: -1. Using Notepad, navigate to the **D:\\MDTProduction\\Control** folder and modify the Boostrap.ini file as follows. Under [DefaultGateway] enter the IP addresses for the default gateway of client devices in your locations (replace 10.10.10.1 and 10.10.20.1 with your default gateways). The default gateway setting is what tells the client which deployment share (i.e. server) to use. +1. Using Notepad, navigate to the **D:\\MDTProduction\\Control** folder and modify the Boostrap.ini file as follows. Under [DefaultGateway] enter the IP addresses for the client's default gateway in New York and Stockholm, respectively (replace 10.10.10.1 and 10.10.20.1 with your default gateways). The default gateway setting is what tells the client which deployment share (i.e. server) to use. ```ini [Settings] @@ -142,8 +141,8 @@ On **MDT01**: UserPassword=pass@word1 SkipBDDWelcome=YES ``` - > [!NOTE] - > The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 10 computer with Windows 11](refresh-a-windows-10-computer-with-windows-11.md) and [Replace a Windows 10 computer with a Windows 11 computer](replace-a-windows-10-computer-with-a-windows-11-computer.md). + >[!NOTE] + >The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md). 2. Save the Bootstrap.ini file. 3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**. Use the default settings for the Update Deployment Share Wizard. This process will take a few minutes. @@ -154,8 +153,8 @@ On **MDT01**: Replacing the updated boot image in WDS. - > [!TIP] - > If you modify bootstrap.ini again later, be sure to repeat the process of updating the deployment share in the Deployment Workbench and replacing the boot image in the WDS console. + >[!TIP] + >If you modify bootstrap.ini again later, be sure to repeat the process of updating the deployment share in the Deployment Workbench and replacing the boot image in the WDS console. ## Replicate the content @@ -228,7 +227,7 @@ On **MDT02**: The DFS Replication Health Report. -> If there are replication errors you can review the DFS event log in Event Viewer under **Applications and Services Logs**. +>If there are replication errors you can review the DFS event log in Event Viewer under **Applications and Services Logs**. ## Configure Windows Deployment Services (WDS) in a remote site @@ -251,19 +250,21 @@ Now you should have a solution ready for deploying the Windows 10 client to the 6. Install an operating system from a network-based installation server 2. Start the PC0006 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from the WDS server. 3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: - 1. Select a task sequence to execute on this computer: Windows 11 Enterprise x64 Custom Image + 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image 2. Computer Name: PC0006 3. Applications: Select the Install - Adobe Reader 4. Setup will now start and perform the following: - 1. Install the Windows 11 Enterprise operating system. + 1. Install the Windows 10 Enterprise operating system. 2. Install applications. 3. Update the operating system using your local Windows Server Update Services (WSUS) server. +![pc0001.](../images/pc0006.png) + ## Related topics [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    -[Create a Windows 11 reference image](create-a-windows-11-reference-image.md)
    -[Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md)
    -[Refresh a Windows 10 computer with Windows 11](refresh-a-windows-10-computer-with-windows-11.md)
    -[Replace a Windows 10 computer with a Windows 11 computer](replace-a-windows-10-computer-with-a-windows-11-computer.md)
    +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    [Configure MDT settings](configure-mdt-settings.md) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md index 187f8fb4cc..0fb4725b6b 100644 --- a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md +++ b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md @@ -18,10 +18,6 @@ ms.topic: article # Configure MDT deployment share rules -**Applies to** -- Windows 10 -- Windows 11 - In this topic, you will learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine. The rules engine in MDT is powerful: most of the settings used for operating system deployments are retrieved and assigned via the rules engine. In its simplest form, the rules engine is the CustomSettings.ini text file. ## Assign settings diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md b/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md index 22a7921c84..342cec9742 100644 --- a/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md +++ b/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md @@ -18,10 +18,6 @@ ms.topic: article # Configure MDT for UserExit scripts -**Applies to** -- Windows 10 -- Windows 11 - In this topic, you will learn how to configure the MDT rules engine to use a UserExit script to generate computer names based on a prefix and the computer MAC Address. MDT supports calling external VBScripts as part of the Gather process; these scripts are referred to as UserExit scripts. The script also removes the colons in the MAC Address. ## Configure the rules to call a UserExit script diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md index 05f03ea220..731550645c 100644 --- a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md +++ b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md @@ -18,10 +18,6 @@ ms.topic: article # Configure MDT settings -**Applies to** -- Windows 10 -- Windows 11 - One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. In this topic, you learn about configuring customizations for your environment. For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 Standard server, and PC0001 is a Windows 10 Enterprise x64 client used for the MDT simulation environment. OR01 has Microsoft System Center 2012 R2 Orchestrator installed. MDT01, OR01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](./prepare-for-windows-deployment-with-mdt.md). diff --git a/windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md similarity index 81% rename from windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md rename to windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md index a548b5c748..9dd26e0e66 100644 --- a/windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md +++ b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md @@ -1,12 +1,12 @@ --- -title: Create a Windows 11 reference image (Windows 11) +title: Create a Windows 10 reference image (Windows 10) description: Creating a reference image is important because that image serves as the foundation for the devices in your organization. ms.assetid: 9da2fb57-f2ff-4fce-a858-4ae4c237b5aa ms.reviewer: manager: dougeby ms.author: greglin keywords: deploy, deployment, configure, customize, install, installation -ms.prod: w11 +ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library @@ -16,25 +16,22 @@ author: greg-lindsay ms.topic: article --- -# Create a Windows 11 reference image +# Create a Windows 10 reference image **Applies to** - Windows 10 -- Windows 11 -In this topic, you will learn how to create a Windows 11 reference image using the Microsoft Deployment Toolkit (MDT). You will create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 11 reference image. After completing the steps outlined in this topic, you will have a Windows 11 reference image that can be used in your deployment solution. +Creating a reference image is important because that image serves as the foundation for the devices in your organization. In this topic, you will learn how to create a Windows 10 reference image using the Microsoft Deployment Toolkit (MDT). You will create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 10 reference image. After completing the steps outlined in this topic, you will have a Windows 10 reference image that can be used in your deployment solution. -All procedures in this article can also be used to create a Windows 10 reference image by using Windows 10 media instead of Windows 11 media in the [Add setup files](#add-setup-files) section below. - -> [!NOTE] -> This guide assumes that you have already installed and configured deployment tools. See [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) for more information. +>[!NOTE] +>See [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) for more information about the server, client, and network infrastructure used in this guide. For the purposes of this topic, we will use three computers: DC01, MDT01, and HV01. - DC01 is a domain controller for the contoso.com domain. - MDT01 is a contoso.com domain member server. - HV01 is a Hyper-V server that will be used to build the reference image. -  ![devices.](../images/mdt-08-fig01.png) + ![devices.](../images/mdt-08-fig01.png) Computers used in this topic. @@ -48,20 +45,19 @@ The reference image described in this guide is designed primarily for deployment ## Set up the MDT build lab deployment share -With Windows 10 and Windows 11, there is no hard requirement to create reference images. However, to reduce the time needed for deployment, you might want to create a reference image that contains a few base applications as well as all of the latest updates. This section will show you how to create and configure the MDT Build Lab deployment share to create a Windows 11 reference image. Because reference images will be deployed only to virtual machines during the creation process and have specific settings (rules), you should always create a separate deployment share specifically for this process. +With Windows 10, there is no hard requirement to create reference images. However, to reduce the time needed for deployment, you might want to create a reference image that contains a few base applications as well as all of the latest updates. This section will show you how to create and configure the MDT Build Lab deployment share to create a Windows 10 reference image. Because reference images will be deployed only to virtual machines during the creation process and have specific settings (rules), you should always create a separate deployment share specifically for this process. ### Create the MDT build lab deployment share On **MDT01**: - Sign in as contoso\\administrator using a password of pass@word1 (credentials from the [prepare for deployment](prepare-for-windows-deployment-with-mdt.md) topic). -- Start the MDT deployment workbench, and pin the console to the taskbar for easy access. - - If it is your first time starting the console, search for **Deployment Workbench**. +- Start the MDT deployment workbench, and pin this to the taskbar for easy access. - Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. - Use the following settings for the New Deployment Share Wizard: - Deployment share path: **D:\\MDTBuildLab** - Share name: **MDTBuildLab$** - - Descriptive name: **MDT Build Lab** + - Deployment share description: **MDT Build Lab** - Accept the default selections on the Options page and click **Next**. - Review the Summary page, click **Next**, wait for the deployment share to be created, then click **Finish**. - Verify that you can access the \\\\MDT01\\MDTBuildLab$ share. @@ -72,7 +68,7 @@ On **MDT01**: ### Enable monitoring -To monitor the task sequence as it happens, right-click the **MDT Build Lab** deployment share in the Deployment Workbench, click **Properties**, click the **Monitoring** tab, and select **Enable monitoring for this deployment share**. This step is optional. +To monitor the task sequence as it happens, right-click the **MDT Build Lab** deployment share, click **Properties**, click the **Monitoring** tab, and select **Enable monitoring for this deployment share**. This step is optional. ### Configure permissions for the deployment share @@ -90,41 +86,34 @@ On **MDT01**: ## Add setup files -This section will show you how to populate the MDT deployment share with the Windows 11 operating system source files, commonly referred to as setup files, which will be used to create a reference image. Setup files are used during the reference image creation process and are the foundation for the reference image. +This section will show you how to populate the MDT deployment share with the Windows 10 operating system source files, commonly referred to as setup files, which will be used to create a reference image. Setup files are used during the reference image creation process and are the foundation for the reference image. -### Add the Windows 11 installation files +### Add the Windows 10 installation files -MDT supports adding both full source Windows 11 DVDs (ISOs) and custom images that you have created. In this case, you create a reference image, so you add the full source setup files from Microsoft. +MDT supports adding both full source Windows 10 DVDs (ISOs) and custom images that you have created. In this case, you create a reference image, so you add the full source setup files from Microsoft. -> [!NOTE] -> Windows 11 media is pre-release as of the date this article was last updated. To obtain Windows 11 pre-release media, join the Windows Insider program and visit [Windows Insider Preview Downloads](https://www.microsoft.com/software-download/windowsinsiderpreviewiso).
    -> The build selected in this example is **Windows 11 Insider Preview Enterprise (Dev Channel) - Build 22454**. +>[!NOTE] +>Due to the Windows limits on path length, we are purposely keeping the operating system destination directory short, using the folder name W10EX64RTM rather than a more descriptive name like Windows 10 Enterprise x64 RTM. -### Add Windows 11 Enterprise x64 (full source) +### Add Windows 10 Enterprise x64 (full source) On **MDT01**: -1. Sign in as **contoso\\administrator** and copy the content of a Windows 11 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 11 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. The following example shows the files copied to the D:\\Downloads folder, but you can also choose to import the OS directly from an ISO or DVD. +1. Sign in as **contoso\\administrator** and copy the content of a Windows 10 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 10 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. The following example shows the files copied to the D:\\Downloads folder, but you can also choose to import the OS directly from an ISO or DVD. ![ISO.](../images/iso-data.png) 2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Build Lab**. -3. Right-click the **Operating Systems** node, and create a new folder named **Windows 11**. -4. Expand the **Operating Systems** node, right-click the **Windows 11** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: +3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. +4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: - Full set of source files - Source directory: (location of your source files) - - Destination directory name: W11EX64 - - > [!NOTE] - > Due to the Windows limits on path length, we are purposely keeping the operating system destination directory short, using the folder name W11EX64 rather than a more descriptive name like Windows 11 Enterprise x64.

    - > Depending on the DVD or ISO you used, there might be multiple editions added by the import process. For the purposes of this guide, we are using the Windows 11 Enterprise image, but other images will also work. In the example shown, editions that will not be used are deleted from the list. - -5. After adding the operating system, in the **Operating Systems / Windows 11** folder, double-click it and change the name to: **Windows 11 Enterprise x64 Default Image**. See the following example. + - Destination directory name: W10EX64RTM +5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. See the following example. ![Default image.](../images/deployment-workbench01.png) - > [!NOTE] - > The pre-release version of Windows 11 used here has "Windows 10" in the description. You can ignore this. +>Depending on the DVD you used, there might be multiple editions available. For the purposes of this guide, we are using the Windows 10 Enterprise image, but other images will also work. ## Add applications @@ -308,7 +297,7 @@ On **MDT01**: ## Create the reference image task sequence -In order to build and capture your Windows 11 reference image for deployment using MDT, you will create a task sequence. The task sequence will reference the operating system and applications that you previously imported into the MDT Build Lab deployment share to build a Windows 11 reference image. +In order to build and capture your Windows 10 reference image for deployment using MDT, you will create a task sequence. The task sequence will reference the operating system and applications that you previously imported into the MDT Build Lab deployment share to build a Windows 10 reference image. After creating the task sequence, you configure it to enable patching against the Windows Server Update Services (WSUS) server. The Task Sequence Windows Update action supports getting updates directly from Microsoft Update, but you get more stable patching if you use a local WSUS server. WSUS also allows for an easy process of approving the patches that you are deploying. ### Drivers and the reference image @@ -317,31 +306,31 @@ Because we use modern virtual platforms for creating our reference images, we do ### Create a task sequence for Windows 10 Enterprise -To create a Windows 11 reference image task sequence, the process is as follows: +To create a Windows 10 reference image task sequence, the process is as follows: On **MDT01**: -1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab** right-click **Task Sequences**, and create a **New Folder** named **Windows 11**. -2. Right-click the new **Windows 11** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - 1. Task sequence ID: REFW11X64-001 - 2. Task sequence name: Windows 11 Enterprise x64 Default Image +1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab** right-click **Task Sequences**, and create a **New Folder** named **Windows 10**. +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + 1. Task sequence ID: REFW10X64-001 + 2. Task sequence name: Windows 10 Enterprise x64 RTM Default Image 3. Task sequence comments: Reference Build 4. Template: Standard Client Task Sequence - 5. Select OS: Windows 11 Enterprise x64 Default Image + 5. Select OS: Windows 10 Enterprise x64 RTM Default Image 6. Specify Product Key: Do not specify a product key at this time 7. Full Name: Contoso 8. Organization: Contoso - 9. Internet Explorer home page: https://www.contoso.com + 9. Internet Explorer home page: http://www.contoso.com 10. Admin Password: Do not specify an Administrator Password at this time -### Edit the Windows 11 task sequence +### Edit the Windows 10 task sequence The steps below walk you through the process of editing the Windows 10 reference image task sequence to include the actions required to update the reference image with the latest updates from WSUS, install roles and features, and utilities, and install Microsoft Office365 ProPlus x64. On **MDT01**: -1. In the **Task Sequences / Windows 11** folder, right-click the **Windows 11 Enterprise x64 Default Image** task sequence, and select **Properties**. -2. On the **Task Sequence** tab, configure the Windows 11 Enterprise x64 Default Image task sequence with the following settings: +1. In the **Task Sequences / Windows 10** folder, right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence, and select **Properties**. +2. On the **Task Sequence** tab, configure the Windows 10 Enterprise x64 RTM Default Image task sequence with the following settings: 1. **State Restore > Windows Update (Pre-Application Installation)** action: Enable this action by clicking the **Options** tab and clearing the **Disable this step** check box. 2. **State Restore > Windows Update (Post-Application Installation)** action: Also enable this action. @@ -351,7 +340,7 @@ On **MDT01**: - **Note**: The reason for adding the applications after the Tattoo action but before running Windows Update is simply to save time during the deployment. This way we can add all applications that will upgrade some of the built-in components and avoid unnecessary updating. 5. **State Restore > Custom Tasks (Pre-Windows Update)**: Add a new **Install Roles and Features** action with the following settings: 1. Name: Install - Microsoft NET Framework 3.5.1 - 2. Select the operating system for which roles are to be installed: Windows 10 (this also works for Windows 11) + 2. Select the operating system for which roles are to be installed: Windows 10 3. Select the roles and features that should be installed: .NET Framework 3.5 (includes .NET 2.0 and 3.0) >[!IMPORTANT] @@ -364,7 +353,7 @@ On **MDT01**: 6. **State Restore > Custom Tasks (Pre-Windows Update)**: After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action (selected from the **General** group) with the following settings: 1. Name: Microsoft Visual C++ Redistributable 2019 - x86 2. Install a Single Application: browse to **Install - MSVC 2019 - x86** - 7. Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Office 365 ProPlus - x64 as well. + 7. Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Microsoft 365 Apps for enterprise as well. 3. Click **OK**. ![apps.](../images/mdt-apps.png) @@ -396,18 +385,26 @@ Follow these steps to configure Internet Explorer settings in Unattend.xml for t On **MDT01**: -1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab > Task Sequences** right-click the **Windows 11 Enterprise x64 Default Image** task sequence and select **Properties**. +1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab > Task Sequences** right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence and select **Properties**. 2. In the **OS Info** tab, click **Edit Unattend.xml**. MDT now generates a catalog file. This will take a few minutes, and then Windows System Image Manager (Windows SIM) will start. + + > [!IMPORTANT] + > The ADK version 1903 has a [known issue](/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1903) generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error "Could not load file or assembly" in in the console output. To avoid this issue, [install the ADK, version 2004 or a later version](/windows-hardware/get-started/adk-install). A workaround is also available for the ADK version 1903: + > - Close the Deployment Workbench and install the [WSIM 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334). This will update imagecat.exe and imgmgr.exe to version 10.0.18362.144. + > - Manually run imgmgr.exe (C:\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imgmgr.exe). + > - Generate a catalog (Tools/Create Catalog) for the selected install.wim (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install.wim). + > - After manually creating the catalog file (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install_Windows 10 Enterprise.clg), open the Deployment Workbench and proceed to edit unattend.xml. + 3. In Windows SIM, expand the **4 specialize** node in the **Answer File** pane and select the amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral entry. 4. In the **amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral properties** window (right-hand window), set the following values: - DisableDevTools: true -5. Save the Answer File, and close Windows SIM. - - Note: If validation errors are reported that certain display values are incorrect, you can ignore this or browse to **7oobeSystem\\amd64_Microsoft-Windows-Shell-Setup__neutral\\Display** and enter the following: ColorDepth 32, HorizontalResolution 1, RefreshRate 60, VerticalResolution 1. -6. On the Windows 11 Enterprise x64 Default Image Properties, click **OK**. +5. Save the Unattend.xml file, and close Windows SIM. + - Note: If errors are reported that certain display values are incorrect, you can ignore this or browse to **7oobeSystem\\amd64_Microsoft-Windows-Shell-Setup__neutral\\Display** and enter the following: ColorDepth 32, HorizontalResolution 1, RefreshRate 60, VerticalResolution 1. +6. On the Windows 10 Enterprise x64 RTM Default Image Properties, click **OK**. ![figure 10.](../images/fig10-unattend.png) - Windows System Image Manager with the Windows 11 Unattend.xml. + Windows System Image Manager with the Windows 10 Unattend.xml. ## Configure the MDT deployment share rules @@ -478,7 +475,7 @@ On **MDT01**: ``` >[!NOTE] - >For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it is acceptable to do so in this situation. Obviously if you are not using the same password (pass@word1) that is provided in this lab, you must enter your own custom password on the Rules tab and in Bootstrap.ini. + >For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it is acceptable to do so in this situation. Obviously if you are not using the same password (pass@word3) that is provided in this lab, you must enter your own custom password on the Rules tab and in Bootstrap.ini. 4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x86**. 5. In the **Lite Touch Boot Image Settings** area, configure the following settings: @@ -609,11 +606,11 @@ SkipFinalSummary=YES - **SkipCapture.** Skips the Capture pane. - **SkipFinalSummary.** Skips the final Windows Deployment Wizard summary. Because you use FinishAction=Shutdown, you don't want the wizard to stop in the end so that you need to click OK before the machine shuts down. -## Build the Windows 11 reference image +## Build the Windows 10 reference image As previously described, this section requires a Hyper-V host. See [Hyper-V requirements](prepare-for-windows-deployment-with-mdt.md#hyper-v-requirements) for more information. -Once you have created your task sequence, you are ready to create the Windows 11 reference image. This will be performed by launching the task sequence from a virtual machine which will then automatically perform the reference image creation and capture process. +Once you have created your task sequence, you are ready to create the Windows 10 reference image. This will be performed by launching the task sequence from a virtual machine which will then automatically perform the reference image creation and capture process. The steps below outline the process used to boot a virtual machine using an ISO boot image created by MDT, and then run the reference image task sequence image to create and capture the Windows 10 reference image. @@ -624,67 +621,56 @@ The steps below outline the process used to boot a virtual machine using an ISO On **HV01**: 2. Create a new virtual machine with the following settings: - 1. Name: REFW11X64-001 + 1. Name: REFW10X64-001 2. Store the virtual machine in a different location: C:\VM 3. Generation 1 4. Memory: 1024 MB 5. Network: Must be able to connect to \\MDT01\MDTBuildLab$ 7. Hard disk: 60 GB (dynamic disk) 8. Install OS with image file: C:\\ISO\\MDT Build Lab x86.iso -1. Before you start the VM, add a checkpoint for REFW11X64-001, and name it **Clean with MDT Build Lab x86 ISO**. +1. Before you start the VM, add a checkpoint for REFW10X64-001, and name it **Clean with MDT Build Lab x86 ISO**. **Note**: Checkpoints are useful if you need to restart the process and want to make sure you can start clean. -4. Start the REFW11X64-001 virtual machine and connect to it. +4. Start the REFW10X64-001 virtual machine and connect to it. - > [!IMPORTANT] - > Up to this point we have not discussed IP addressing or DHCP. In the initial setup for this guide, DC01 was provisioned as a DHCP server to provide IP address leases to client computers. You might have a different DHCP server on your network that you wish to use. The REFW11X64-001 virtual machine requires an IP address lease that provides it with connectivity to MDT01 so that it can connect to the \\MDT01\MDTBuildLab$ share, and optionally the WSUS server on your network. A connection to the Internet is also used to download and updates during the image creation process. In the current scenario, this is accomplished with a DHCP scope that provides IP addresses in the 10.10.10.100 - 10.10.10.200 range, with a 10.10.10.1 gateway, as part of a /24 subnet so that the client can connect to MDT01 at 10.10.10.11, and also connect to external networks.

    - > If you receive a message that "A connection to the deployment share could not be made, check that the DHCP service is available to the REFW11X64-001 VM, and it has been issued a valid IP address lease (check your DHCP server). + **Note**: Up to this point we have not discussed IP addressing or DHCP. In the initial setup for this guide, DC01 was provisioned as a DHCP server to provide IP address leases to client computers. You might have a different DHCP server on your network that you wish to use. The REFW10X64-001 virtual machine requires an IP address lease that provides it with connectivity to MDT01 so that it can connect to the \\MDT01\MDTBuildLab$ share. In the current scenario this is accomplished with a DHCP scope that provides IP addresses in the 10.10.10.100 - 10.10.10.200 range, as part of a /24 subnet so that the client can connect to MDT01 at 10.10.10.11. -5. After booting into Windows PE, complete the Windows Deployment Wizard with the following settings: - - Select a task sequence to execute on this computer: Windows 11 Enterprise x64 Default Image - - Specify whether to capture an image: Capture an image of this reference computer - - Location: \\\\MDT01\\MDTBuildLab$\\Captures - - File name: REFW11X64-001.wim + After booting into Windows PE, complete the Windows Deployment Wizard with the following settings: + 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Default Image + 2. Specify whether to capture an image: Capture an image of this reference computer + - Location: \\\\MDT01\\MDTBuildLab$\\Captures + 3. File name: REFW10X64-001.wim - ![capture image.](../images/captureimage.png) + ![capture image.](../images/captureimage.png) - The Windows Deployment Wizard for the Windows 11 reference image. + The Windows Deployment Wizard for the Windows 10 reference image. -The image creation process starts and does the following: - 1. Installs the Windows 11 Enterprise operating system. - 2. Installs the added applications, roles, and features. - 3. Updates the operating system via your local Windows Server Update Services (WSUS) server (if provisioned). - 4. Stages Windows PE on the local disk. - 5. Runs System Preparation (Sysprep) and reboots into Windows PE. - 6. Captures the installation to a Windows Imaging (WIM) file. - 7. Turns off the virtual machine. +5. The setup now starts and does the following: + 1. Installs the Windows 10 Enterprise operating system. + 2. Installs the added applications, roles, and features. + 3. Updates the operating system via your local Windows Server Update Services (WSUS) server. + 4. Stages Windows PE on the local disk. + 5. Runs System Preparation (Sysprep) and reboots into Windows PE. + 6. Captures the installation to a Windows Imaging (WIM) file. + 7. Turns off the virtual machine. -After some time (30-90 minutes depending on resources available), you will have a Windows 11 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is **REFW11X64-001.wim**. +After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim. ![image.](../images/image-captured.png) ## Troubleshooting +> [!IMPORTANT] +> If you encounter errors applying the image when using a BIOS firmware type, see [Windows 10 deployments fail with Microsoft Deployment Toolkit on computers with BIOS type firmware](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7). This + If you [enabled monitoring](#enable-monitoring), you can check the progress of the task sequence. ![monitoring.](../images/mdt-monitoring.png) -If monitoring is not working, check that http://localhost:9801/MDTMonitorData/ loads on MDT01, and try turning monitoring off and on again. +If there are problems with your task sequence, you can troubleshoot in Windows PE by pressing F8 to open a command prompt. There are several [MDT log files](/configmgr/mdt/troubleshooting-reference#mdt-logs) created that can be helpful determining the origin of an error, such as BDD.log. From the command line in Windows PE you can copy these logs from the client to your MDT server for viewing with CMTrace. For example: copy BDD.log \\\\mdt01\\logs$. -If there are problems with your task sequence, you can troubleshoot in Windows PE by pressing F8 to open a command prompt. There are several [MDT log files](/configmgr/mdt/troubleshooting-reference#mdt-logs) created that can be helpful determining the origin of an error, such as BDD.log. From the command line in Windows PE you can copy these logs from the client to your MDT server for viewing with CMTrace. For example: copy BDD.log \\\\mdt01\\logs$. An example is shown below. - -```cmd -X:\>net use G: \\mdt01\c$\tmp /user:contoso\administrator pass@word1 -The command completed successfully. - -X:\>copy X:\MININT\SMSOSD\OSDLOGS\*.log G: - 6 files copied. -X:\>copp X:\Windows\Temp\SMSTSLog\smsts.log G: - 1 file copied. -``` - -If you have trouble connecting to the deployment share, verify that your DHCP server (DC01 in this lab) has issued a lease to the VM. The DHCP client name will be something like minint-p1st75s.contoso.com. +After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim. ## Related topics diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md similarity index 88% rename from windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md rename to windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md index 435f937e56..9d20892e07 100644 --- a/windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md +++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md @@ -1,12 +1,12 @@ --- -title: Deploy a Windows 11 image using MDT (Windows 11) -description: This topic will show you how to take your reference image for Windows 11, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). +title: Deploy a Windows 10 image using MDT (Windows 10) +description: This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). ms.assetid: 1d70a3d8-1b1d-4051-b656-c0393a93f83c ms.reviewer: manager: dougeby ms.author: greglin keywords: deployment, automate, tools, configure -ms.prod: w11 +ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library @@ -16,13 +16,12 @@ author: greg-lindsay ms.topic: article --- -# Deploy a Windows 11 image using MDT +# Deploy a Windows 10 image using MDT **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 -This topic will show you how to take your reference image for Windows 11 [that was just created](create-a-windows-11-reference-image.md), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). +This topic will show you how to take your reference image for Windows 10 (that was just [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). We will prepare for this by creating an MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. We will configure Active Directory permissions, configure the deployment share, create a new task sequence, and add applications, drivers, and rules. @@ -31,7 +30,7 @@ For the purposes of this topic, we will use four computers: DC01, MDT01, HV01 an - DC01 is a domain controller - MDT01 is a domain member server - HV01 is a Hyper-V server -- PC0005 is a blank device to which we will deploy Windows 11 +- PC0005 is a blank device to which we will deploy Windows 10 MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. HV01 used to test deployment of PC0005 in a virtual environment. @@ -90,8 +89,11 @@ The steps for creating the deployment share for production are the same as when 1. Ensure you are signed on as: contoso\administrator. 2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. 3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**. + 4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**. + 5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**. + 6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. 7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. @@ -111,22 +113,26 @@ On **MDT01**: ## Step 3: Add a custom image -The next step is to add a reference image into the deployment share with the setup files required to successfully deploy Windows 11. When adding a custom image, you still need to copy setup files (an option in the wizard) because Windows 10/11 stores additional components in the Sources\\SxS folder which is outside the image and may be required when installing components. +The next step is to add a reference image into the deployment share with the setup files required to successfully deploy Windows 10. When adding a custom image, you still need to copy setup files (an option in the wizard) because Windows 10 stores additional components in the Sources\\SxS folder which is outside the image and may be required when installing components. -### Add the Windows 11 Enterprise x64 custom image +### Add the Windows 10 Enterprise x64 RTM custom image -In these steps, we assume that you have completed the steps in the [Create a Windows 11 reference image](create-a-windows-11-reference-image.md) topic, so you have a Windows 11 reference image at **D:\\MDTBuildLab\\Captures\REFW11X64-001.wim** on MDT01. +In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image at **D:\\MDTBuildLab\\Captures\REFW10X64-001.wim** on MDT01. -1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 11**. +1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**. 2. Right-click the **Windows 10** folder and select **Import Operating System**. -3. On the **OS Type** page, select **Custom image file** and click **Next**. -4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW11X64-001.wim** and click **Next**. -5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W11EX64** and click **Next**. -6. On the **Destination** page, in the **Destination directory name** text box, type **W11EX64**, click **Next** twice, and then click **Finish**. -7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 11** node and change the name to **Windows 11 Enterprise x64 Custom Image**. -> [!NOTE] -> The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT now uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image. +3. On the **OS Type** page, select **Custom image file** and click **Next**. + +4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and click **Next**. + +5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and click **Next**. + +6. On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, click **Next** twice, and then click **Finish**. +7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**. + +>[!NOTE] +>The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image. ![imported OS.](../images/fig2-importedos.png) @@ -139,15 +145,21 @@ When you configure your MDT Build Lab deployment share, you can also add applica On **MDT01**: -1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2100720091_en_US.exe) to **D:\\setup\\adobe** on MDT01. -2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC2100720091_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne). +1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2100520060_en_US.exe) to **D:\\setup\\adobe** on MDT01. +2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC2100520060_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne). 3. In the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node. 4. Right-click the **Applications** node, and create a new folder named **Adobe**. + 5. In the **Applications** node, right-click the **Adobe** folder and select **New Application**. + 6. On the **Application Type** page, select the **Application with source files** option and click **Next**. + 7. On the **Details** page, in the **Application Name** text box, type **Install - Adobe Reader** and click *Next**. + 8. On the **Source** page, in the **Source Directory** text box, browse to **D:\\setup\\adobe\\install** and click **Next**. + 9. On the **Destination** page, in the **Specify the name of the directory that should be created** text box, type **Install - Adobe Reader** and click **Next**. + 10. On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AcroRead.msi /q**, click **Next** twice, and then click **Finish**. ![acroread image.](../images/acroread.png) @@ -156,10 +168,7 @@ On **MDT01**: ## Step 5: Prepare the drivers repository -> [!IMPORTANT] -> The section below on preparing the drivers repository uses Windows 10-compatible devices and drivers as examples. These examples do not infer Windows 11 compatibility. Check with your device manufacturer before deploying drivers, and verify that the device meets Windows 11 hardware requirements. For more information, see [Windows 11 requirements](/windows/whats-new/windows-11-requirements). - -In order to deploy Windows 10 or Windows 11 with MDT successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples: +In order to deploy Windows 10 with MDT successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples: - Lenovo ThinkPad T420 - Dell Latitude 7390 - HP EliteBook 8560w @@ -167,8 +176,8 @@ In order to deploy Windows 10 or Windows 11 with MDT successfully, you need dri For boot images, you need to have storage and network drivers; for the operating system, you need to have the full suite of drivers. -> [!NOTE] -> You should only add drivers to the Windows PE images if the default drivers don't work. Adding drivers that are not necessary will only make the boot image larger and potentially delay the download time. +>[!NOTE] +>You should only add drivers to the Windows PE images if the default drivers don't work. Adding drivers that are not necessary will only make the boot image larger and potentially delay the download time. ### Create the driver source structure in the file system @@ -183,8 +192,8 @@ On **MDT01**: 2. In the **D:\\drivers** folder, create the following folder structure: 1. WinPE x86 2. WinPE x64 - 3. Windows 11 x64 -3. In the new Windows 11 x64 folder, create the following folder structure: + 3. Windows 10 x64 +3. In the new Windows 10 x64 folder, create the following folder structure: - Dell Inc. - Latitude E7450 - Hewlett-Packard @@ -204,8 +213,8 @@ When you import drivers to the MDT driver repository, MDT creates a single insta 2. In the **Out-Of-Box Drivers** node, create the following folder structure: 1. WinPE x86 2. WinPE x64 - 3. Windows 11 x64 -3. In the **Windows 11 x64** folder, create the following folder structure: + 3. Windows 10 x64 +3. In the **Windows 10 x64** folder, create the following folder structure: - Dell Inc. - Latitude E7450 - Hewlett-Packard @@ -236,28 +245,32 @@ The Out-of-Box Drivers structure in the Deployment Workbench. ### Create the selection profiles for boot image drivers By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles. -The drivers that are used for the boot images (Windows PE) are Windows 11 drivers. If you can’t locate Windows 11 drivers for your device, a Windows 10, Windows 8.1 or Windows 7 driver will most likely work, but Windows 11 drivers should be your first choice. +The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice. On **MDT01**: 1. In the Deployment Workbench, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**. 2. In the New Selection Profile Wizard, create a selection profile with the following settings: - 1. Selection Profile name: **WinPE x86** + 1. Selection Profile name: WinPE x86 2. Folders: Select the WinPE x86 folder in Out-of-Box Drivers. 3. Click **Next**, **Next** and **Finish**. 3. Right-click the **Selection Profiles** node again, and select **New Selection Profile**. 4. In the New Selection Profile Wizard, create a selection profile with the following settings: - 1. Selection Profile name: **WinPE x64** + 1. Selection Profile name: WinPE x64 2. Folders: Select the WinPE x64 folder in Out-of-Box Drivers. 3. Click **Next**, **Next** and **Finish**. + ![figure 5.](../images/fig5-selectprofile.png) + + Creating the WinPE x64 selection profile. + ### Extract and import drivers for the x64 boot image Windows PE supports all the hardware models that we have, but here you learn to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image. On **MDT01**: -1. Download **PROWinx64.exe** from Intel.com (ex: [Intel® Network Adapter Driver](https://www.intel.com/content/www/us/en/download/16765/intel-network-adapter-driver-for-windows-8-final-release.html)). +1. Download **PROWinx64.exe** from Intel.com (ex: [PROWinx64.exe](https://downloadcenter.intel.com/downloads/eula/25016/Intel-Network-Adapter-Driver-for-Windows-10?httpDown=https%3A%2F%2Fdownloadmirror.intel.com%2F25016%2Feng%2FPROWinx64.exe)). 2. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. a. **Note**: Extracting the .exe file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the .exe terminates. 3. Using File Explorer, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. @@ -279,11 +292,11 @@ In this example, we assume you have downloaded and extracted the drivers using T On **MDT01**: -1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 11 x64** node, expand the **Lenovo** node. +1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Lenovo** node. 2. Right-click the **30A6003TUS** folder and select **Import Drivers** and use the following Driver source directory to import drivers: - **D:\\Drivers\\Windows 11 x64\\Lenovo\\ThinkStation P500 (30A6003TUS)** + **D:\\Drivers\\Windows 10 x64\\Lenovo\\ThinkStation P500 (30A6003TUS)** The folder you select and all sub-folders will be checked for drivers, expanding any .cab files that are present and searching for drivers. @@ -295,29 +308,29 @@ In these steps, we assume you have downloaded and extracted the CAB file for the On **MDT01**: -1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 11 x64** node, expand the **Dell Inc.** node. +1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Dell Inc.** node. 2. Right-click the **Latitude E7450** folder and select **Import Drivers** and use the following Driver source directory to import drivers: - **D:\\Drivers\\Windows 11 x64\\Dell Inc.\\Latitude E7450** + **D:\\Drivers\\Windows 10 x64\\Dell Inc.\\Latitude E7450** ### For the HP EliteBook 8560w For the HP EliteBook 8560w, you use HP Image Assistant to get the drivers. The HP Image Assistant can be accessed on the [HP Support site](https://ftp.ext.hp.com/pub/caps-softpaq/cmit/HPIA.html). -In these steps, we assume you have downloaded and extracted the drivers for the HP EliteBook 8650w model to the **D:\\Drivers\\Windows 11 x64\\Hewlett-Packard\\HP EliteBook 8560w** folder. +In these steps, we assume you have downloaded and extracted the drivers for the HP EliteBook 8650w model to the **D:\\Drivers\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w** folder. On **MDT01**: -1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 11 x64** node, expand the **Hewlett-Packard** node. +1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Hewlett-Packard** node. 2. Right-click the **HP EliteBook 8560w** folder and select **Import Drivers** and use the following Driver source directory to import drivers: - **D:\\Drivers\\Windows 11 x64\\Hewlett-Packard\\HP EliteBook 8560w** + **D:\\Drivers\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w** ### For the Microsoft Surface Laptop -For the Microsoft Surface Laptop model, you find the drivers on the Microsoft website. In these steps we assume you have downloaded and extracted the Surface Laptop drivers to the **D:\\Drivers\\Windows 11 x64\\Microsoft\\Surface Laptop** folder. +For the Microsoft Surface Laptop model, you find the drivers on the Microsoft website. In these steps we assume you have downloaded and extracted the Surface Laptop drivers to the **D:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Laptop** folder. On **MDT01**: @@ -325,40 +338,40 @@ On **MDT01**: 2. Right-click the **Surface Laptop** folder and select **Import Drivers**; and use the following Driver source directory to import drivers: - **D:\\Drivers\\Windows 11 x64\\Microsoft\\Surface Laptop** + **D:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Laptop** ## Step 6: Create the deployment task sequence -This section will show you how to create the task sequence used to deploy your production Windows 11 reference image. You will then configure the task sequence to enable patching via a Windows Server Update Services (WSUS) server. +This section will show you how to create the task sequence used to deploy your production Windows 10 reference image. You will then configure the task sequence to enable patching via a Windows Server Update Services (WSUS) server. -### Create a task sequence for Windows 11 Enterprise +### Create a task sequence for Windows 10 Enterprise On **MDT01**: -1. In the Deployment Workbench, under the **MDT Production** node, right-click **Task Sequences**, and create a folder named **Windows 11**. +1. In the Deployment Workbench, under the **MDT Production** node, right-click **Task Sequences**, and create a folder named **Windows 10**. -2. Right-click the new **Windows 11** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: W11-X64-001 - - Task sequence name: Windows 11 Enterprise x64 Custom Image +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: W10-X64-001 + - Task sequence name: Windows 10 Enterprise x64 RTM Custom Image - Task sequence comments: Production Image - Template: Standard Client Task Sequence - - Select OS: Windows 11 Enterprise x64 Custom Image + - Select OS: Windows 10 Enterprise x64 RTM Custom Image - Specify Product Key: Do not specify a product key at this time - Full Name: Contoso - Organization: Contoso - Internet Explorer home page: https://www.contoso.com - Admin Password: Do not specify an Administrator Password at this time -### Edit the Windows 11 task sequence +### Edit the Windows 10 task sequence -1. Continuing from the previous procedure, right-click the **Windows 11 Enterprise x64 Custom Image** task sequence, and select **Properties**. +1. Continuing from the previous procedure, right-click the **Windows 10 Enterprise x64 RTM Custom Image** task sequence, and select **Properties**. -2. On the **Task Sequence** tab, configure the **Windows 11 Enterprise x64 Custom Image** task sequence with the following settings: +2. On the **Task Sequence** tab, configure the **Windows 10 Enterprise x64 RTM Custom Image** task sequence with the following settings: 1. Preinstall: After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings: 1. Name: Set DriverGroup001 2. Task Sequence Variable: DriverGroup001 - 3. Value: Windows 11 x64\\%Manufacturer%\\%Model% + 3. Value: Windows 10 x64\\%Manufacturer%\\%Model% 2. Configure the **Inject Drivers** action with the following settings: - Choose a selection profile: Nothing @@ -473,7 +486,7 @@ On **MDT01**: 11. Click **OK**. >[!NOTE] - >It might take a while for the Deployment Workbench to create the monitoring database and web service. + >It will take a while for the Deployment Workbench to create the monitoring database and web service. ![figure 8.](../images/mdt-07-fig08.png) @@ -604,13 +617,13 @@ Like the MDT Build Lab deployment share, the MDT Production deployment share nee >[!NOTE] >The update process will take 5 to 10 minutes. -## Step 8: Deploy the Windows 11 client image +## Step 8: Deploy the Windows 10 client image These steps will walk you through the process of using task sequences to deploy Windows 10 images through a fully automated process. First, you need to add the boot image to Windows Deployment Services (WDS) and then start the deployment. In contrast with deploying images from the MDT Build Lab deployment share, we recommend using the Pre-Installation Execution Environment (PXE) to start the full deployments in the datacenter, even though you technically can use an ISO/CD or USB to start the process. ### Configure Windows Deployment Services -You need to add the MDT Production Lite Touch x64 Boot image to WDS in preparation for the deployment. In this procedure, we assume that WDS is already installed and initialized on MDT01 as described in the [Prepare for Windows deployment](prepare-for-windows-deployment-with-mdt.md#install-and-initialize-wds) article. +You need to add the MDT Production Lite Touch x64 Boot image to WDS in preparation for the deployment. In this procedure, we assume that WDS is already installed and initialized on MDT01 as described in the [Prepare for Windows deployment](prepare-for-windows-deployment-with-mdt.md#install-and-initialize-windows-deployment-services-wds) article. On **MDT01**: @@ -624,7 +637,7 @@ On **MDT01**: The boot image added to the WDS console. -### Deploy the Windows 11 client +### Deploy the Windows 10 client At this point, you should have a solution ready for deploying the Windows 10 client. We recommend starting by trying a few deployments at a time until you are confident that your configuration works as expected. We find it useful to try some initial tests on virtual machines before testing on physical hardware. This helps rule out hardware issues when testing or troubleshooting. Here are the steps to deploy your Windows 10 image to a virtual machine: @@ -654,9 +667,9 @@ On **HV01**: 4. Setup now begins and does the following: - - Installs the Windows 11 Enterprise operating system. + - Installs the Windows 10 Enterprise operating system. - Installs the added application. - - Updates the operating system via your local Windows Server Update Services (WSUS) server (if configured). + - Updates the operating system via your local Windows Server Update Services (WSUS) server. ![pc0005 image1.](../images/pc0005-vm.png) @@ -714,9 +727,9 @@ On **MDT01**: The newly created multicast namespace. -## Use offline media to deploy Windows 11 +## Use offline media to deploy Windows 10 -In addition to network-based deployments, MDT supports the use of offline media-based deployments of Windows 11. You can very easily generate an offline version of your deployment share - either the full deployment share or a subset of it - through the use of selection profiles. The generated offline media can be burned to a DVD or copied to a USB stick for deployment. +In addition to network-based deployments, MDT supports the use of offline media-based deployments of Windows 10. You can very easily generate an offline version of your deployment share - either the full deployment share or a subset of it - through the use of selection profiles. The generated offline media can be burned to a DVD or copied to a USB stick for deployment. Offline media are useful not only when you do not have network connectivity to the deployment share, but also when you have limited connection to the deployment share and do not want to copy 5 GB of data over the wire. Offline media can still join the domain, but you save the transfer of operating system images, drivers, and applications over the wire. @@ -735,10 +748,10 @@ On **MDT01**: - Folders - Applications / Adobe - - Operating Systems / Windows 11 + - Operating Systems / Windows 10 - Out-Of-Box Drivers / WinPE x64 - - Out-Of-Box Drivers / Windows 11 x64 - - Task Sequences / Windows 11 + - Out-Of-Box Drivers / Windows 10 x64 + - Task Sequences / Windows 10 ![offline media.](../images/mdt-offline-media.png) @@ -756,7 +769,7 @@ In these steps, you generate offline media from the MDT Production deployment sh 3. Use the following settings for the New Media Wizard: - General Settings - Media path: **D:\\MDTOfflineMedia** - - Selection profile: **Windows 11 Offline Media** + - Selection profile: **Windows 10 Offline Media** ### Configure the offline media @@ -770,7 +783,7 @@ On **MDT01**: 3. In the **General** tab, configure the following: - Clear the Generate x86 boot image check box. - - ISO file name: Windows 11 Offline Media.iso + - ISO file name: Windows 10 Offline Media.iso 4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. @@ -803,10 +816,15 @@ The ISO that you got when updating the offline media item can be burned to a DVD Follow these steps to create a bootable USB stick from the offline media content: 1. On a physical machine running Windows 7 or later, insert the USB stick you want to use. + 2. Copy the content of the **MDTOfflineMedia\\Content** folder to the root of the USB stick. + 3. Start an elevated command prompt (run as Administrator), and start the Diskpart utility by typing **Diskpart** and pressing **Enter**. + 4. In the Diskpart utility, you can type **list volume** (or the shorter **list vol**) to list the volumes, but you really only need to remember the drive letter of the USB stick to which you copied the content. In our example, the USB stick had the drive letter F. + 5. In the Diskpart utility, type **select volume F** (replace F with your USB stick drive letter). + 6. In the Diskpart utility, type **active**, and then type **exit**. ## Unified Extensible Firmware Interface (UEFI)-based deployments diff --git a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md index 0d0b8199c5..df26acb90f 100644 --- a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md @@ -1,5 +1,5 @@ --- -title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10/11) +title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10) description: This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), as part of a Windows operating system deployment. ms.assetid: a256442c-be47-4bb9-a105-c831f58ce3ee ms.reviewer: @@ -20,7 +20,6 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 11 This article provides an overview of the features, components, and capabilities of the [Microsoft Deployment Toolkit (MDT)](/mem/configmgr/mdt/). When you have finished reviewing this information, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). @@ -30,14 +29,17 @@ MDT is a unified collection of tools, processes, and guidance for automating des In addition to reducing deployment time and standardizing desktop and server images, MDT enables you to more easily manage security and ongoing configurations. MDT builds on top of the core deployment tools in the [Windows Assessment and Deployment Kit](/windows-hardware/get-started/adk-install) (Windows ADK) with additional guidance and features designed to reduce the complexity and time required for deployment in an enterprise environment. -MDT supports the deployment of Windows 11, as well as Windows 7, Windows 8.1, Windows 10, and Windows Server. It also includes support for zero-touch installation (ZTI) with [Microsoft Endpoint Configuration Manager](/configmgr/). +MDT supports the deployment of Windows 10, as well as Windows 7, Windows 8.1, and Windows Server. It also includes support for zero-touch installation (ZTI) with [Microsoft Endpoint Configuration Manager](/configmgr/). + +> [!IMPORTANT] +> For more information about MDT supported platforms, see [MDT Release Notes](/mem/configmgr/mdt/release-notes#supported-platforms) and [MDT FAQ](/mem/configmgr/mdt/faq#is-this-release-only-supported-with-version--x--of-windows-client--windows-adk--or-configuration-manager-). ## Key features in MDT MDT has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. The toolkit has evolved, both in functionality and popularity, and today it is considered fundamental to Windows operating system and enterprise application deployment. MDT has many useful features, such as: -- **Windows Client support.** Supports Windows 7, Windows 8.1, Windows 10, and Windows 11. +- **Windows Client support.** Supports Windows 7, Windows 8.1, and Windows 10. - **Windows Server support.** Supports Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019. - **Additional operating systems support.** Supports Windows Thin PC and [Windows Embedded POSReady 7](https://www.microsoft.com/en-us/download/details.aspx?id=26558), as well as Windows 8.1 Embedded Industry. - **UEFI support.** Supports deployment to machines using Unified Extensible Firmware Interface (UEFI) version 2.3.1. @@ -69,11 +71,11 @@ MDT has many useful features, such as: - **Support for Microsoft Office.** Provides added support for deploying Microsoft Office. - **Support for Modern UI app package provisioning.** Provisions applications based on the new Windows app package standard, which is used in Windows 8 and later. - **Extensibility.** Provides the capability to extend MDT far beyond the built-in features by adding custom scripts, web services, System Center Orchestrator runbooks, PowerShell scripts, and VBScripts. -- **Upgrade task sequence.** Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, Windows 8.1, and Windows 10 systems directly to Windows 11, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, refer to the [Microsoft Deployment Toolkit resource page](/mem/configmgr/mdt/). +- **Upgrade task sequence.** Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, and Windows 8.1 systems directly to Windows 10, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, refer to the [Microsoft Deployment Toolkit resource page](/mem/configmgr/mdt/). ## MDT Lite Touch components -Many features in MDT support Lite Touch Installation (LTI) for Windows 11. An LTI deployment strategy requires very little infrastructure or user interaction, and can be used to deploy an operating system from a network share or from a physical media, such as a USB flash drive or disc. +Many features in MDT support Lite Touch Installation (LTI) for Windows 10. An LTI deployment strategy requires very little infrastructure or user interaction, and can be used to deploy an operating system from a network share or from a physical media, such as a USB flash drive or disc. When deploying the Windows operating system using MDT, most of the administration and configuration is done through the Deployment Workbench, but you also can perform many of the tasks using Windows PowerShell. The easiest way to find out how to use PowerShell in MDT is to use the Deployment Workbench to perform an operation and at the end of that task, click View Script. That will give you the PowerShell command. diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index bd9599c6e4..186a8fe7bd 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -1,12 +1,12 @@ --- -title: Prepare for deployment with MDT (Windows 11) -description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 11 operating system using the Microsoft Deployment Toolkit (MDT). +title: Prepare for deployment with MDT (Windows 10) +description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT). ms.assetid: 5103c418-0c61-414b-b93c-a8e8207d1226 ms.reviewer: manager: dougeby ms.author: greglin keywords: deploy, system requirements -ms.prod: w11 +ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library @@ -19,68 +19,51 @@ ms.topic: article # Prepare for deployment with MDT **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 +This article will walk you through the steps necessary to prepare your network and server infrastructure to deploy Windows 10 with the Microsoft Deployment Toolkit (MDT). It covers the installation of the necessary system prerequisites, the creation of shared folders and service accounts, and the configuration of security permissions in the file system and in Active Directory. -This article will walk you through the steps necessary to prepare your network and server infrastructure to deploy Windows 11 with the Microsoft Deployment Toolkit (MDT). All procedures in this guide can also be used to deploy Windows 10. For an overview of the features, components, and capabilities of MDT, see [Get started with MDT](get-started-with-the-microsoft-deployment-toolkit.md). - -This article covers installation of necessary system prerequisites, creation of shared folders and service accounts, and configuration of security permissions in the file system and in Active Directory. Steps to complete the following procedures are provided: - -1. Install the Windows Assessment and Deployment Kit (ADK) -2. Install and initialize Windows Deployment Services (WDS) -3. Install MDT -4. Create an Active Directory Organizational Unit structure to support deployment -5. Create the MDT service account -6. Create and share the logs folder - -After completing these steps, you can create a [Windows 11 reference image](create-a-windows-11-reference-image.md) that will be used to deploy Windows 11. If you are installing Windows 10 instead of Windows 11, use [source media](create-a-windows-11-reference-image.md#add-setup-files) for Windows 10 instead of Windows 11 to create your reference image. - -> [!IMPORTANT] -> Before deploying Windows 11, verify that the device meets [requirements](/windows/whats-new/windows-11-requirements). - -## Infrastructure and requirements +## Infrastructure The procedures in this guide use the following names and infrastructure. -#### Network and servers +### Network and servers For the purposes of this topic, we will use three server computers: **DC01**, **MDT01**, and **HV01**. - All servers are running Windows Server 2019. - You can use an earlier version of Windows Server with minor modifications to some procedures. - Note: Although MDT supports Windows Server 2008 R2, at least Windows Server 2012 R2 or later is required to perform the procedures in this guide. - **DC01** is a domain controller, DHCP server, and DNS server for contoso.com, representing the fictitious Contoso Corporation. - - The DHCP scope used in this lab is 10.10.10.0/24 with a gateway of 10.10.10.1. but you can adjust the scope settings to your environment. - **MDT01** is a domain member server in contoso.com with a data (D:) drive that can store at least 200GB. MDT01 will host deployment shares and run the Windows Deployment Service. Optionally, MDT01 is also a WSUS server. - - A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-deployment.md) for Windows 11 deployment. This server is located on a different subnet than MDT01 and has a different default gateway. -- **HV01** is a Hyper-V host computer that is used to build a Windows 11 reference image. + - A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-10-deployment.md) for Windows 10 deployment. This server is located on a different subnet than MDT01 and has a different default gateway. +- **HV01** is a Hyper-V host computer that is used to build a Windows 10 reference image. - See [Hyper-V requirements](#hyper-v-requirements) below for more information about HV01. -#### Client computers +### Client computers Several client computers are referenced in this guide with hostnames of PC0001 to PC0007. -- **PC0001**: A computer running Windows 11 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. +- **PC0001**: A computer running Windows 10 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. - Client name: PC0001 - IP Address: DHCP -- **PC0002**: A computer running Windows 10 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This computer is referenced during the migration scenarios. +- **PC0002**: A computer running Windows 7 SP1 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This computer is referenced during the migration scenarios. - Client name: PC0002 - IP Address: DHCP -- **PC0003 - PC0007**: These are other client computers similar to PC0001 and PC0002 that are used in this guide and another guide for various scenarios. The device names are incremented for clarity within each scenario. For example, PC0003 and PC0004 are running Windows 10 just like PC0002, but are used for Configuration Manager refresh and replace scenarios, respectively. +- **PC0003 - PC0007**: These are other client computers similar to PC0001 and PC0002 that are used in this guide and another guide for various scenarios. The device names are incremented for clarity within each scenario. For example, PC0003 and PC0004 are running Windows 7 just like PC0002, but are used for Configuration Manager refresh and replace scenarios, respectively. -#### Storage requirements +### Storage requirements MDT01 and HV01 should have the ability to store up to 200 GB of files on a data drive (D:). If you use a computer with a single system partition (C:), you will need to adjust some procedures in this guide to specify the C: drive instead of the D: drive. -#### Hyper-V requirements +### Hyper-V requirements -If you do not have access to a Hyper-V server, you can install Hyper-V on a Windows 8.1, Windows 10, or Windows 11 computer temporarily to use for building reference images. For instructions on how to enable Hyper-V on Windows 10, see the [Verify support and install Hyper-V](../windows-10-poc.md#verify-support-and-install-hyper-v) section in the Windows 10 deployment test lab guide. This guide is a proof-of-concept guide that has detailed instructions for installing Hyper-V. +If you do not have access to a Hyper-V server, you can install Hyper-V on a Windows 10 or Windows 8.1 computer temporarily to use for building reference images. For instructions on how to enable Hyper-V on Windows 10, see the [Verify support and install Hyper-V](../windows-10-poc.md#verify-support-and-install-hyper-v) section in the Windows 10 deployment test lab guide. This guide is a proof-of-concept guide that has detailed instructions for installing Hyper-V. -#### Network requirements +### Network requirements All server and client computers referenced in this guide are on the same subnet. This is not required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. -#### Domain credentials +### Domain credentials The following generic credentials are used in this guide. You should replace these credentials as they appear in each procedure with your credentials. @@ -88,7 +71,7 @@ The following generic credentials are used in this guide. You should replace the **Domain administrator username**: administrator
    **Domain administrator password**: pass@word1 -#### Organizational unit structure +### Organizational unit structure The following OU structure is used in this guide. Instructions are provided [below](#create-the-ou-structure) to help you create the required OUs. @@ -101,8 +84,11 @@ These steps assume that you have the MDT01 member server running and configured On **MDT01**: Visit the [Download and install the Windows ADK](/windows-hardware/get-started/adk-install) page and download the following items to the **D:\\Downloads\\ADK** folder on MDT01 (you will need to create this folder): -- [The Windows ADK](https://go.microsoft.com/fwlink/?linkid=2165884) -- [The Windows PE add-on for the ADK](https://go.microsoft.com/fwlink/?linkid=2166133) +- [The Windows ADK for Windows 10](https://go.microsoft.com/fwlink/?linkid=2086042) +- [The Windows PE add-on for the ADK](https://go.microsoft.com/fwlink/?linkid=2087112) +- [The Windows System Image Manager (WSIM) 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334) +- (Optional) [The MDT_KB4564442 patch for BIOS firmware](https://download.microsoft.com/download/3/0/6/306AC1B2-59BE-43B8-8C65-E141EF287A5E/KB4564442/MDT_KB4564442.exe) + - This patch is needed to resolve a bug that causes detection of BIOS-based machines as UEFI-based machines. If you have a UEFI deployment, you do not need this patch. >[!TIP] >You might need to temporarily disable IE Enhanced Security Configuration for administrators in order to download files from the Internet to the server. This setting can be disabled by using Server Manager (Local Server/Properties). @@ -110,9 +96,12 @@ Visit the [Download and install the Windows ADK](/windows-hardware/get-started/a 1. On **MDT01**, ensure that you are signed in as an administrator in the CONTOSO domain. - For the purposes of this guide, we are using a Domain Admin account of **administrator** with a password of pass@word1. You can use your own administrator username and password as long as you properly adjust all steps in this guide that use these login credentials. 2. Start the **ADK Setup** (D:\\Downloads\\ADK\\adksetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page accept the default list of features by clicking **Install**. This will install deployment tools and the USMT. Verify that the installation completes successfully before moving to the next step. -3. Start the **WinPE Setup** (D:\\Downloads\\ADK\\adkwinpesetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page click **Install**. This will install Windows PE for x86, AMD64, ARM, and ARM64. Verify that the installation completes successfully. +3. Start the **WinPE Setup** (D:\\Downloads\\ADK\\adkwinpesetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page click **Install**. This will install Windows PE for x86, AMD64, ARM, and ARM64. Verify that the installation completes successfully before moving to the next step. +4. Extract the **WSIM 1903 update** (D:\\Downloads\ADK\\WSIM1903.zip) and then run the **UpdateWSIM.bat** file. + - You can confirm that the update is applied by viewing properties of the ImageCat.exe and ImgMgr.exe files at **C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM** and verifying that the **Details** tab displays a **File version** of **10.0.18362.144** or later. +5. If you downloaded the optional MDT_KB4564442 patch for BIOS based deployment, see [this support article](https://support.microsoft.com/en-us/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7) for instructions on how to install the patch. -## Install and initialize WDS +## Install and initialize Windows Deployment Services (WDS) On **MDT01**: @@ -141,7 +130,7 @@ To install WSUS on MDT01, enter the following at an elevated Windows PowerShell >[!NOTE] >MDT installation requires the following: ->- The Windows ADK (installed in the previous procedure) +>- The Windows ADK for Windows 10 (installed in the previous procedure) >- Windows PowerShell ([version 5.1](https://www.microsoft.com/download/details.aspx?id=54616) is recommended; type **$host** to check) >- Microsoft .NET Framework @@ -149,10 +138,8 @@ On **MDT01**: 1. Visit the [MDT resource page](/mem/configmgr/mdt/) and click **Download MDT**. 2. Save the **MicrosoftDeploymentToolkit_x64.msi** file to the D:\\Downloads\\MDT folder on MDT01. -3. Save the [MDT update](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7) to D:\\Downloads\\MDT folder on MDT01. - **Note**: As of the publishing date for this guide, the current version of MDT is 8456 (6.3.8456.1000), but a later version will also work. -4. Install **MDT** (D:\\Downloads\\MDT\\MicrosoftDeploymentToolkit_x64.exe) with the default settings. -5. If you are using MDT version 8456, download, extract, and update MDT per the instructions on [Windows 10 deployments fail with Microsoft Deployment Toolkit on computers with BIOS type firmware](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7). This will update **Microsoft.BDD.Utility.dll** from version 6.3.8456.1000 to 6.3.8456.1001. +3. Install **MDT** (D:\\Downloads\\MDT\\MicrosoftDeploymentToolkit_x64.exe) with the default settings. ## Create the OU structure @@ -231,8 +218,6 @@ If you have the Active Directory Users and Computers console open you can refres ## Create and share the logs folder -Switch back to the MDT01 computer. - By default MDT stores the log files locally on the client. In order to capture a reference image, you will need to enable server-side logging and, to do that, you will need to have a folder in which to store the logs. For more information, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). On **MDT01**: @@ -265,5 +250,13 @@ After installing the ConfigMgrTools.msi file, you can search for **cmtrace** and ## Next steps -When you have completed all the steps in this section to prepare for deployment, see [Create a Windows 11 reference image](create-a-windows-11-reference-image.md). +When you have completed all the steps in this section to prepare for deployment, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). +## Appendix + +**Sample files** + +The following sample files are also available to help automate some MDT deployment tasks. This guide does not use these files, but they are made available here so you can see how some tasks can be automated with Windows PowerShell. +- [Gather.ps1](/samples/browse/?redirectedfrom=TechNet-Gallery). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment. +- [Set-OUPermissions.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU. +- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT. diff --git a/windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md similarity index 53% rename from windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md rename to windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md index 1ec5026bb1..57a26f04a9 100644 --- a/windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md +++ b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md @@ -1,6 +1,6 @@ --- -title: Refresh a Windows 10 computer with Windows 11 (Windows 11) -description: This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 10 computer to a Windows 11 computer using the computer refresh process. +title: Refresh a Windows 7 computer with Windows 10 (Windows 10) +description: This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process. ms.assetid: 2866fb3c-4909-4c25-b083-6fc1f7869f6f ms.reviewer: manager: dougeby @@ -16,18 +16,17 @@ author: greg-lindsay ms.topic: article --- -# Refresh a Windows 10 computer with Windows 11 +# Refresh a Windows 7 computer with Windows 10 **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 -This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 10 computer to a Windows 11 computer using the online computer refresh process. The computer refresh scenario is a reinstallation of an updated operating system on the same computer. You can also use this procedure to reinstall the same OS version. In this article, the computer refresh will be done while the computer is online. MDT also supports an offline computer refresh. For more info on that scenario, see the USMTOfflineMigration property on the [MDT resource page](/mem/configmgr/mdt/). +This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the online computer refresh process. The computer refresh scenario is a reinstallation of an updated operating system on the same computer. You can also use this procedure to reinstall the same OS version. In this article, the computer refresh will be done while the computer is online. MDT also supports an offline computer refresh. For more info on that scenario, see the USMTOfflineMigration property on the [MDT resource page](/mem/configmgr/mdt/). For the purposes of this topic, we will use three computers: DC01, MDT01, and PC0001. - DC01 is a domain controller for the contoso.com domain. - MDT01 is domain member server that hosts your deployment share. -- PC0001 is a domain member computer running a previous version of Windows that is going to be refreshed to Windows 11, with data and settings restored. The example used here is a computer running Windows 10, version 1909. +- PC0001 is a domain member computer running a previous version of Windows that is going to be refreshed to a new version of Windows 10, with data and settings restored. The example used here is a computer running Windows 7 SP1. Both DC01 and MDT01 are running Windows Server 2019; however any supported version of Windows Server can be used. For more details on the setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). @@ -39,7 +38,7 @@ The computers used in this topic. A computer refresh is not the same as an in-place upgrade because a computer refresh involves exporting user data and settings then wiping the device before installing a fresh OS and restoring the user's data and settings. -For a computer refresh with MDT, you use the User State Migration Tool (USMT), which is part of the Windows Assessment and Deployment Kit (ADK), to migrate user data and settings. To complete a computer refresh you will: +For a computer refresh with MDT, you use the User State Migration Tool (USMT), which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, to migrate user data and settings. To complete a computer refresh you will: 1. Back up data and settings locally, in a backup folder. 2. Wipe the partition, except for the backup folder. @@ -49,8 +48,8 @@ For a computer refresh with MDT, you use the User State Migration Tool (USMT), w During the computer refresh, USMT uses a feature called Hard-Link Migration Store. When you use this feature, the files are simply linked in the file system, which allows for fast migration, even when there is a lot of data. -> [!NOTE] -> In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file contains the entire volume from the computer and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire computer is not a supported scenario. +>[!NOTE] +>In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file contains the entire volume from the computer and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire computer is not a supported scenario. ### Multi-user migration @@ -58,8 +57,8 @@ By default, ScanState in USMT backs up all profiles on the machine, including lo For example, the following line configures USMT to migrate only domain user profiles and not profiles from the local SAM account database: ScanStateArgs=/ue:\*\\\* /ui:CONTOSO\\\* -> [!NOTE] -> You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days. +>[!NOTE] +>You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days. ### Support for additional settings @@ -69,32 +68,29 @@ In addition to the command-line switches that control which profiles to migrate, Multicast is a technology designed to optimize simultaneous deployment to multiple devices. If you have a limited number of simultaneous deployments, you should disable multicast which was [configured in a previous procedure](deploy-a-windows-10-image-using-mdt.md#set-up-mdt-for-multicast) in this guide. Disabling multicast will speed up deployment for a small number of computers. You will need to update the deployment share after changing this setting. -## Refresh a Windows 10 client +## Refresh a Windows 7 SP1 client In these section, we assume that you have already performed the prerequisite procedures in the following topics, so that you have a deployment share named **MDTProduction$** on MDT01: - [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) -- [Create a Windows 11 reference image](create-a-windows-11-reference-image.md) -- [Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md) +- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) +- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) -It is also assumed that you have a domain member client computer named PC0001 in your environment running Windows 7, 8.1 or 10 that is ready for a refresh to Windows 11. For demonstration purposes, we will refreshing a Windows 10 PC to Windows 11. - -> [!IMPORTANT] -> The computer refresh process can be used to install Windows 11 on a device that doesn't meet Windows 11 hardware requirements, resulting in an unsupported configuration. Before upgrading to Windows 11, verify that the device meets [Windows 11 hardware requirements](/windows/whats-new/windows-11-requirements). +It is also assumed that you have a domain member client computer named PC0001 in your environment running Windows 7, 8.1 or 10 that is ready for a refresh to the latest version of Windows 10. For demonstration purposes, we will refreshing a Windows 7 SP1 PC to Windows 10, version 1909. -### Upgrade (refresh) a Windows 10 client +### Upgrade (refresh) a Windows 7 SP1 client -> [!IMPORTANT] -> Domain join details [specified in the deployment share rules](deploy-a-windows-11-image-using-mdt.md#configure-the-rules) will be used to rejoin the computer to the domain during the refresh process. If the Windows 10 client is domain-jonied in a different OU than the one specified by MachineObjectOU, the domain join process will initially fail and then retry without specifying an OU. If the domain account that is specified (ex: **MDT_JD**) has [permissions limited to a specific OU](deploy-a-windows-11-image-using-mdt.md#step-1-configure-active-directory-permissions) then the domain join will ultimately fail, the refresh process will proceed, and the client computer object will be orphaned in Active Directory. In the current guide, computer objects should be located in Contoso > Computers > Workstations. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. To diagnose MDT domain join errors, see **ZTIDomainJoin.log** in the C:\Windows\Temp\DeploymentLogs directory on the client computer. +>[!IMPORTANT] +>Domain join details [specified in the deployment share rules](deploy-a-windows-10-image-using-mdt.md#configure-the-rules) will be used to rejoin the computer to the domain during the refresh process. If the Windows 7 client is domain-jonied in a different OU than the one specified by MachineObjectOU, the domain join process will initially fail and then retry without specifying an OU. If the domain account that is specified (ex: **MDT_JD**) has [permissions limited to a specific OU](deploy-a-windows-10-image-using-mdt.md#step-1-configure-active-directory-permissions) then the domain join will ultimately fail, the refresh process will proceed, and the client computer object will be orphaned in Active Directory. In the current guide, computer objects should be located in Contoso > Computers > Workstations. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. To diagnose MDT domain join errors, see **ZTIDomainJoin.log** in the C:\Windows\Temp\DeploymentLogs directory on the client computer. 1. On PC0001, sign in as **contoso\\Administrator** and start the Lite Touch Deploy Wizard by opening **\\\\MDT01\\MDTProduction$\\Scripts\\Litetouch.vbs**. 2. Complete the deployment guide using the following settings: - * Select a task sequence to execute on this computer: Windows 11 Enterprise x64 Custom Image + * Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image * Computer name: <default> * Specify where to save a complete computer backup: Do not back up the existing computer - > [!NOTE] - > Skip this optional full WIM backup that we are choosing not to perform. The USMT backup will still run. + >[!NOTE] + >Skip this optional full WIM backup that we are choosing not to perform. The USMT backup will still run. * Select one or more applications to install: Install - Adobe Reader ![Computer refresh.](../images/fig2-taskseq.png "Start the computer refresh") @@ -102,23 +98,23 @@ It is also assumed that you have a domain member client computer named PC0001 in 4. Setup starts and does the following: * Backs up user settings and data using USMT. - * Installs the Windows 11 Enterprise x64 operating system. + * Installs the Windows 10 Enterprise x64 operating system. * Installs any added applications. - * Updates the operating system using your local Windows Server Update Services (WSUS) server (if applicable). + * Updates the operating system using your local Windows Server Update Services (WSUS) server. * Restores user settings and data using USMT. 5. You can monitor progress of the deployment using the deployment workbench on MDT01. See the following example: ![monitor deployment.](../images/monitor-pc0001.png) -6. After the refresh process completes, sign in to the Windows 11 computer and verify that user accounts, data and settings were migrated. +6. After the refresh process completes, sign in to the Windows 10 computer and verify that user accounts, data and settings were migrated. ## Related topics [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md)
    -[Create a Windows 11 reference image](create-a-windows-11-reference-image.md)
    -[Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md)
    -[Build a distributed environment for Windows 11 deployment](build-a-distributed-environment-for-windows-deployment.md)
    -[Replace a Windows 10 computer with a Windows 11 computer](replace-a-windows-10-computer-with-a-windows-11-computer.md)
    +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    [Configure MDT settings](configure-mdt-settings.md) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md similarity index 85% rename from windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md rename to windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md index 951872540b..baa35a0260 100644 --- a/windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md +++ b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md @@ -1,13 +1,13 @@ --- -title: Replace a Windows 10 computer with a Windows 11 computer (Windows 11) -description: In this article, you will learn how to replace a Windows 10 device with a Windows 11 device. +title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10) +description: In this article, you will learn how to replace a Windows 7 device with a Windows 10 device. ms.custom: seo-marvel-apr2020 ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a ms.reviewer: manager: dougeby ms.author: greglin keywords: deploy, deployment, replace -ms.prod: w11 +ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library @@ -17,19 +17,18 @@ author: greg-lindsay ms.topic: article --- -# Replace a Windows 10 computer with a Windows 11 computer +# Replace a Windows 7 computer with a Windows 10 computer **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 -A computer replace scenario for Windows 11 is quite similar to a computer refresh for Windows 11. However, because you are replacing a device, you cannot store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. The User State Migration Tool (USMT) will be used to back up and restore data and settings. +A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10. However, because you are replacing a device, you cannot store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. The User State Migration Tool (USMT) will be used to back up and restore data and settings. For the purposes of this topic, we will use four computers: DC01, MDT01, PC0002, and PC0007. - DC01 is a domain controller for the contoso.com domain. - MDT01 is domain member server that hosts your deployment share. -- PC0002 is an old computer running Windows 10 that will be replaced by PC0007. -- PC0007 is a new computer will have the Windows 11 OS installed prior to data from PC0002 being migrated. Both PC0002 and PC0007 are members of the contoso.com domain. +- PC0002 is an old computer running Windows 7 SP1 that will be replaced by PC0007. +- PC0007 is a new computer will have the Windows 10 OS installed prior to data from PC0002 being migrated. Both PC0002 and PC0007 are members of the contoso.com domain. For more details on the setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). @@ -49,7 +48,7 @@ On **MDT01**: 1. Open the Deployment Workbench, under **Deployment Shares** right-click **MDT Production**, click **Properties**, and then click the **Rules** tab. 2. Change the **SkipUserData=YES** option to **NO**, and click **OK**. -3. Right-click **MDT Production** and click **Update Deployment Share**. Click **Next**, **Next**, and **Finish** to complete the Update Deployment Share Wizard with the default setttings. +3. Right-click **MDT Production** and click **Update Deployment Share**. Click **Next**, **Next**, and **Finish** to complete the Update Deployment Share Wizard with the default settings. ### Create and share the MigData folder @@ -82,7 +81,7 @@ On **MDT01**: During a computer replace, these are the high-level steps that occur: -1. On the computer you are replacing, a special replace task sequence runs the USMT backup and, if you configured it, runs the optional full Window Imaging (WIM) backup. +1. On the computer you are replacing, a special replace task sequence runs the USMT backup and, if you configured it, runs the optional full Windows Imaging (WIM) backup. 2. On the new computer, you perform a standard bare-metal deployment. At the end of the bare-metal deployment, the USMT backup from the old computer is restored. ### Run the replace task sequence @@ -97,8 +96,8 @@ On **PC0002**: * Specify where to save your data and settings: Specify a location * Location: \\\\MDT01\\MigData$\\PC0002 - > [!NOTE] - > If you are replacing the computer at a remote site you should create the MigData folder on MDT02 and use that share instead. + >[!NOTE] + >If you are replacing the computer at a remote site you should create the MigData folder on MDT02 and use that share instead. 2. Specify where to save a complete computer backup: Do not back up the existing computer @@ -152,16 +151,15 @@ On **HV01**: * Updates the operating system via your local Windows Server Update Services (WSUS) server. * Restores the USMT backup from PC0002. -You can view progress of the process by clicking the Monitoring node in the Deployment Workbrench on MDT01. +You can view progress of the process by clicking the Monitoring node in the Deployment Workbench on MDT01. ![Monitor progress.](../images/mdt-replace.png) - ## Related topics [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    -[Create a Windows 11 reference image](create-a-windows-11-reference-image.md)
    -[Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md)
    -[Build a distributed environment for Windows 11 deployment](build-a-distributed-environment-for-windows-deployment.md)
    -[Refresh a Windows 10 computer with Windows 11](refresh-a-windows-10-computer-with-windows-11.md)
    +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    [Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md index 481df59b4a..64938b8f63 100644 --- a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md +++ b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md @@ -19,10 +19,6 @@ ms.custom: seo-marvel-mar2020 # Set up MDT for BitLocker -**Applies to** -- Windows 10 -- Windows 11 - This topic will show you how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. BitLocker in Windows 10 has two requirements in regard to an operating system deployment: - A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password. Technically, you can also use a USB stick to store the protector, but it's not a practical approach as the USB stick can be lost or stolen. We, therefore, recommend that you instead use a TPM chip and/or a password. diff --git a/windows/deployment/deploy-windows-mdt/simulate-a-windows-11-deployment-in-a-test-environment.md b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md similarity index 76% rename from windows/deployment/deploy-windows-mdt/simulate-a-windows-11-deployment-in-a-test-environment.md rename to windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md index 877add3082..d538a02412 100644 --- a/windows/deployment/deploy-windows-mdt/simulate-a-windows-11-deployment-in-a-test-environment.md +++ b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md @@ -1,12 +1,12 @@ --- -title: Simulate a Windows 11 deployment in a test environment (Windows 11) -description: This topic will walk you through the process of creating a simulated environment on which to test your Windows 11 deployment using MDT. +title: Simulate a Windows 10 deployment in a test environment (Windows 10) +description: This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. ms.assetid: 2de86c55-ced9-4078-b280-35e0329aea9c ms.reviewer: manager: dougeby ms.author: greglin keywords: deploy, script -ms.prod: w11 +ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library @@ -16,11 +16,7 @@ author: greg-lindsay ms.topic: article --- -# Simulate a Windows 11 deployment in a test environment - -**Applies to** -- Windows 10 -- Windows 11 +# Simulate a Windows 10 deployment in a test environment This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. When working with advanced settings and rules, especially those like database calls, it is most efficient to be able to test the settings without having to run through a complete deployment. Luckily, MDT enables you to perform a simulated deployment by running the Gather process by itself. The simulation works best when you are using a domain-joined client. @@ -29,8 +25,8 @@ This topic will walk you through the process of creating a simulated environment - A Windows 10 client named **PC0001** will be used to simulate deployment. The client is joined to the contoso.com domain and has access to the Internet to required download tools and scripts. - It is assumed that you have performed (at least) the following procedures so that you have an MDT service account and an MDT production deployment share: - [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) - - [Create a Windows 11 reference image](create-a-windows-11-reference-image.md) - - [Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md) + - [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) + - [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) ## Simulate deployment @@ -39,23 +35,21 @@ On **PC0001**: 1. Sign as **contoso\\Administrator**. 2. Copy the following to a PowerShell script named gather.ps1 and copy it to a directory named **C:\MDT** on PC0001. -``` -# Check for elevation -If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(` - [Security.Principal.WindowsBuiltInRole] "Administrator")) -{ - Write-Warning "Oupps, you need to run this script from an elevated PowerShell prompt!`nPlease start the PowerShell prompt as an Administrator and re-run the script." - Write-Warning "Aborting script..." - Break -} - -cls -if (Test-Path -Path "C:\MININT") {Write-Host "C:\MININT exists, deleting...";Remove-Item C:\MININT -Recurse} -cscript.exe ZTIGather.wsf /debug:true - -# Optional, comment out if you want the script to open the log in CMTrace -& "C:\MDT\CMTrace" C:\MININT\SMSOSD\OSDLOGS\ZTIGather.log -``` + ```powershell + # Check for elevation + If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(` + [Security.Principal.WindowsBuiltInRole] "Administrator")) + { + Write-Warning "Oupps, you need to run this script from an elevated PowerShell prompt!`nPlease start the PowerShell prompt as an Administrator and re-run the script." + Write-Warning "Aborting script..." + Break + } + cls + if (Test-Path -Path "C:\MININT") {Write-Host "C:\MININT exists, deleting...";Remove-Item C:\MININT -Recurse} + cscript.exe ZTIGather.wsf /debug:true + # Optional, comment out if you want the script to open the log in CMTrace + & "C:\MDT\CMTrace" C:\MININT\SMSOSD\OSDLOGS\ZTIGather.log + ``` 3. Download and install the free [Microsoft System Center 2012 R2 Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717) on PC0001 so that you have access to the Configuration Manager Trace (cmtrace.exe) tool. 4. Using Local Users and Groups (lusrmgr.msc), add the **contoso\\MDT\_BA** user account to the local **Administrators** group. diff --git a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md new file mode 100644 index 0000000000..8760205a12 --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md @@ -0,0 +1,114 @@ +--- +title: Perform an in-place upgrade to Windows 10 with MDT (Windows 10) +description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. +ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 +ms.reviewer: +manager: dougeby +ms.author: greglin +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Perform an in-place upgrade to Windows 10 with MDT + +**Applies to** +- Windows 10 + +The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. + +>[!TIP] +>In-place upgrade is the preferred method to use when migrating from Windows 10 to a later release of Windows 10, and is also a preferred method for upgrading from Windows 7 or 8.1 if you do not plan to significantly change the device's configuration or applications. MDT includes an in-place upgrade task sequence template that makes the process really simple. + +In-place upgrade differs from [computer refresh](refresh-a-windows-7-computer-with-windows-10.md) in that you cannot use a custom image to perform the in-place upgrade. In this article we will add a default Windows 10 image to the production deployment share specifically to perform an in-place upgrade. + +Three computers are used in this topic: DC01, MDT01, and PC0002. + +- DC01 is a domain controller for the contoso.com domain +- MDT01 is a domain member server +- PC0002 is a domain member computer running Windows 7 SP1, targeted for the Windows 10 upgrade + + ![computers.](../images/mdt-upgrade.png) + + The computers used in this topic. + +>[!NOTE] +>For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). + +>If you have already completed all the steps in [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md), then you already have a production deployment share and you can skip to [Add Windows 10 Enterprise x64 (full source)](#add-windows-10-enterprise-x64-full-source). + +## Create the MDT production deployment share + +On **MDT01**: + +1. Ensure you are signed on as: contoso\administrator. +2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. +3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**. +4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**. +5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**. +6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. +7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. + +## Add Windows 10 Enterprise x64 (full source) + +>If you have already have a Windows 10 [reference image](create-a-windows-10-reference-image.md) in the **MDT Build Lab** deployment share, you can use the deployment workbench to copy and paste this image from the MDT Build Lab share to the MDT Production share and skip the steps in this section. + +On **MDT01**: + +1. Sign in as contoso\\administrator and copy the content of a Windows 10 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 10 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. +2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**. +3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. +4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: + - Full set of source files + - Source directory: (location of your source files) + - Destination directory name: W10EX64RTM +5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. + +## Create a task sequence to upgrade to Windows 10 Enterprise + +On **MDT01**: + +1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**. +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: W10-X64-UPG + - Task sequence name: Windows 10 Enterprise x64 RTM Upgrade + - Template: Standard Client Upgrade Task Sequence + - Select OS: Windows 10 Enterprise x64 RTM Default Image + - Specify Product Key: Do not specify a product key at this time + - Organization: Contoso + - Admin Password: Do not specify an Administrator password at this time + +## Perform the Windows 10 upgrade + +To initiate the in-place upgrade, perform the following steps on PC0002 (the device to be upgraded). + +On **PC0002**: + +1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs** +2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then click **Next**. +3. Select one or more applications to install (will appear if you use custom image): Install - Adobe Reader +4. On the **Ready** tab, click **Begin** to start the task sequence. + When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. + +![upgrade1.](../images/upgrademdt-fig5-winupgrade.png) + +
    + +![upgrade2.](../images/mdt-upgrade-proc.png) + +
    + +![upgrade3.](../images/mdt-post-upg.png) + +After the task sequence completes, the computer will be fully upgraded to Windows 10. + +## Related topics + +[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
    +[Microsoft Deployment Toolkit downloads and resources](/mem/configmgr/mdt/) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md deleted file mode 100644 index ccbb15d9c5..0000000000 --- a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md +++ /dev/null @@ -1,134 +0,0 @@ ---- -title: Perform an in-place upgrade to Windows 11 with MDT (Windows 11) -description: The simplest path to upgrade PCs that are currently running an earlier version of Windows client to Windows 11 is through an in-place upgrade. -ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 -ms.reviewer: -manager: dougeby -ms.author: greglin -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro -author: greg-lindsay -ms.topic: article ---- - -# Perform an in-place upgrade to Windows 11 with MDT - -**Applies to** -- Windows 10 -- Windows 11 - -The simplest path to upgrade PCs that are currently running an earlier version of Windows client to Windows 11 is through an in-place upgrade. - -> [!TIP] -> In-place upgrade is the preferred method to use when migrating to a newer version of the same OS, or upgrading to a new OS. This is especially true when you do not plan to significantly change the device's configuration or applications. MDT includes an in-place upgrade task sequence template that makes the process really simple. - -In-place upgrade differs from [computer refresh](refresh-a-windows-10-computer-with-windows-11.md) in that you cannot use a custom image to perform the in-place upgrade. In this article we will add a default Windows 11 image to the production deployment share specifically to perform an in-place upgrade. - -> [!IMPORTANT] -> Windows 11 setup will block the upgrade process on devices that do not meet [Windows 11 hardware requirements](/windows/whats-new/windows-11-requirements). Be sure to verify that your device meets these requirements before attempting to upgrade to Windows 11. - -Three computers are used in this topic: DC01, MDT01, and PC0002. - -- DC01 is a domain controller for the contoso.com domain -- MDT01 is a domain member server -- PC0002 is a domain member computer running Windows 10, targeted for the Windows 11 upgrade - - ![computers.](../images/mdt-upgrade.png) - - The computers used in this topic. - -> [!NOTE] -> For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). - -> If you have already completed all the steps in [Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md), then you already have a production deployment share and you can skip to [Add Windows 11 Enterprise x64 (full source)](#add-windows-11-enterprise-x64-full-source). - -## Create the MDT production deployment share - -On **MDT01**: - -1. Ensure you are signed on as: contoso\administrator. -2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. -3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**. -4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**. -5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**. -6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. -7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. - -## Add Windows 11 Enterprise x64 (full source) - -> If you have already have a Windows 11 [reference image](create-a-windows-11-reference-image.md) in the **MDT Build Lab** deployment share, you can use the deployment workbench to copy and paste this image from the MDT Build Lab share to the MDT Production share and skip the steps in this section. - - ![copy reference image.](../images/mdt-copy-image.png) - - Copying the reference image to the production deployment share - - If you copy the reference image using the above process, you should verify that all the files on MDT01 in **D:\\MDTBuildLab\\Operating Systems\\W11EX64** were successfully copied to **D:\\MDTProduction\\Operating Systems\\W11EX64** and then skip to [Create a task sequence to upgrade to Windows 11 Enterprise](#create-a-task-sequence-to-upgrade-to-windows11-enterprise). - -On **MDT01**: - -1. Sign in as contoso\\administrator and copy the content of a Windows 11 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 11 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. -2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**. -3. Right-click the **Operating Systems** node, and create a new folder named **Windows 11**. -4. Expand the **Operating Systems** node, right-click the **Windows 11** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: - - Full set of source files - - Source directory: (location of your source files) - - Destination directory name: W11EX64 -5. After adding the operating system, in the **Operating Systems / Windows 11** folder, double-click it and change the name to: **Windows 11 Enterprise x64 Default Image**. - -## Create a task sequence to upgrade to Windows 11 Enterprise - -On **MDT01**: - -1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 11**. -2. Right-click the new **Windows 11** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: W11-X64-UPG - - Task sequence name: Windows 11 Enterprise x64 Upgrade - - Template: Standard Client Upgrade Task Sequence - - Select OS: Windows 11 Enterprise x64 Default Image - - Specify Product Key: Do not specify a product key at this time - - Organization: Contoso - - Admin Password: Do not specify an Administrator password at this time - -### Specify additional command line options - -Before running the upgrade task sequence, an additional step is required if you are upgrading to Windows 11. This step is not necessary if you are upgrading to Windows 10. - -The **/EULA accept** command line option is required starting with Windows 11. For more information, see [Windows Setup command-line options](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#eula). To add this command line option: - -1. In the Windows 11 Enterprise x64 Upgrade task sequence that you just created, in the Preparation section, click **Add** > **General** > **Set Task Sequence Variable** and provide the following values: - - Name: WindowsUpgradeAdditionalOptions - - Task Sequence Variable: WindowsUpgradeAdditionalOptions - - Value: /EULA accept -2. Make the Set Task Sequence Variable step the first step in the Preparation phase by moving it up above the other steps. See the following example: - -![Specify EULA](../images/windowsupgradeadditionaloptions.png) - -Using the WindowsUpgradeAdditionalOptions variable to set command line options. - -## Perform the Windows 11 upgrade - -To initiate the in-place upgrade, perform the following steps on PC0002 (the device to be upgraded). - -On **PC0002**: - -1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs** -2. Select the **Windows 11 Enterprise x64 Upgrade** task sequence, and then click **Next**. -3. Select one or more applications to install (will appear if you use custom image): Install - Adobe Reader -4. On the **Ready** tab, click **Begin** to start the task sequence. - When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. - -![upgrade1.](../images/upgrademdt-fig5-winupgrade.png) - -
    - -After the task sequence completes, the computer will be fully upgraded to Windows 11. - -## Related topics - -[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
    -[Microsoft Deployment Toolkit downloads and resources](/mem/configmgr/mdt/) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md index 1a2a665f6a..600f2dec3e 100644 --- a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md @@ -1,5 +1,5 @@ --- -title: Use Orchestrator runbooks with MDT (Windows 11) +title: Use Orchestrator runbooks with MDT (Windows 10) description: Learn how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. ms.assetid: 68302780-1f6f-4a9c-9407-b14371fdce3f ms.reviewer: @@ -18,10 +18,6 @@ ms.topic: article # Use Orchestrator runbooks with MDT -**Applies to** -- Windows 10 -- Windows 11 - This topic will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. MDT can integrate with System Center 2012 R2 Orchestrator, which is a component that ties the Microsoft System Center products together, as well as other products from both Microsoft and third-party vendors. The difference between using Orchestrator and "normal" web services, is that with Orchestrator you have a rich drag-and-drop style interface when building the solution, and little or no coding is required. diff --git a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-deployment-information.md b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md similarity index 96% rename from windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-deployment-information.md rename to windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md index 85da7682da..235c3ecedb 100644 --- a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-deployment-information.md +++ b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md @@ -1,6 +1,6 @@ --- -title: Use MDT database to stage Windows 11 deployment info (Windows 11) -description: Learn how to use the MDT database to pre-stage information on your Windows 11 deployment in a Microsoft SQL Server 2012 SP1 Express database. +title: Use MDT database to stage Windows 10 deployment info (Windows 10) +description: Learn how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database. ms.assetid: 8956ab54-90ba-45d3-a384-4fdec72c4d46 ms.reviewer: manager: dougeby @@ -18,10 +18,6 @@ ms.topic: article # Use the MDT database to stage Windows 10 deployment information -**Applies to** -- Windows 10 -- Windows 11 - This topic is designed to teach you how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database, rather than include the information in a text file (CustomSettings.ini). You can use this process, for example, to add the client machines you want to deploy, specify their computer names and IP addresses, indicate applications to be deployed, and determine many additional settings for the machines. ## Database prerequisites diff --git a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md index f9c72cfd2c..21536126c8 100644 --- a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md +++ b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md @@ -1,12 +1,12 @@ --- -title: Use web services in MDT (Windows 11) -description: Learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 11 deployment. +title: Use web services in MDT (Windows 10) +description: Learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. ms.assetid: 8f47535e-0551-4ccb-8f02-bb97539c6522 ms.reviewer: manager: dougeby ms.author: greglin keywords: deploy, web apps -ms.prod: w11 +ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.pagetype: mdt @@ -18,10 +18,6 @@ ms.topic: article # Use web services in MDT -**Applies to** -- Windows 10 -- Windows 11 - In this topic, you will learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. Web services provide a powerful way to assign settings during a deployment. Simply put, web services are web applications that run code on the server side, and MDT has built-in functions to call these web services. Using a web service in MDT is straightforward, but it does require that you have enabled the Web Server (IIS) role on the server. Developing web services involves a little bit of coding, but for most web services used with MDT, you can use the free Microsoft Visual Studio Express 2013 for Web. diff --git a/windows/deployment/images/acroread.png b/windows/deployment/images/acroread.png index 13bc5c84e1..142e7b6d74 100644 Binary files a/windows/deployment/images/acroread.png and b/windows/deployment/images/acroread.png differ diff --git a/windows/deployment/images/captureimage.png b/windows/deployment/images/captureimage.png index 9cccb88a1f..e9ebbf3aad 100644 Binary files a/windows/deployment/images/captureimage.png and b/windows/deployment/images/captureimage.png differ diff --git a/windows/deployment/images/deployment-workbench01.png b/windows/deployment/images/deployment-workbench01.png index 34a03a5e1d..c68ee25db1 100644 Binary files a/windows/deployment/images/deployment-workbench01.png and b/windows/deployment/images/deployment-workbench01.png differ diff --git a/windows/deployment/images/fig2-importedos.png b/windows/deployment/images/fig2-importedos.png index 8aa48d1b25..90cf910c24 100644 Binary files a/windows/deployment/images/fig2-importedos.png and b/windows/deployment/images/fig2-importedos.png differ diff --git a/windows/deployment/images/fig2-taskseq.png b/windows/deployment/images/fig2-taskseq.png index d3deca7024..bdd81ddbde 100644 Binary files a/windows/deployment/images/fig2-taskseq.png and b/windows/deployment/images/fig2-taskseq.png differ diff --git a/windows/deployment/images/fig4-oob-drivers.png b/windows/deployment/images/fig4-oob-drivers.png index 11eb769926..14d93fb278 100644 Binary files a/windows/deployment/images/fig4-oob-drivers.png and b/windows/deployment/images/fig4-oob-drivers.png differ diff --git a/windows/deployment/images/fig5-selectprofile.png b/windows/deployment/images/fig5-selectprofile.png index 61c795dcee..452ab4f581 100644 Binary files a/windows/deployment/images/fig5-selectprofile.png and b/windows/deployment/images/fig5-selectprofile.png differ diff --git a/windows/deployment/images/fig6-taskseq.png b/windows/deployment/images/fig6-taskseq.png index d77e99d70d..8696cc04c4 100644 Binary files a/windows/deployment/images/fig6-taskseq.png and b/windows/deployment/images/fig6-taskseq.png differ diff --git a/windows/deployment/images/fig8-cust-tasks.png b/windows/deployment/images/fig8-cust-tasks.png index 5a0c7c2ac7..3ab40d730a 100644 Binary files a/windows/deployment/images/fig8-cust-tasks.png and b/windows/deployment/images/fig8-cust-tasks.png differ diff --git a/windows/deployment/images/image-captured.png b/windows/deployment/images/image-captured.png index 281e8ea0ff..69c5d5ef15 100644 Binary files a/windows/deployment/images/image-captured.png and b/windows/deployment/images/image-captured.png differ diff --git a/windows/deployment/images/iso-data.png b/windows/deployment/images/iso-data.png index 27075a9502..f188046b7f 100644 Binary files a/windows/deployment/images/iso-data.png and b/windows/deployment/images/iso-data.png differ diff --git a/windows/deployment/images/mdt-03-fig03.png b/windows/deployment/images/mdt-03-fig03.png index 7e128451d6..a387923d80 100644 Binary files a/windows/deployment/images/mdt-03-fig03.png and b/windows/deployment/images/mdt-03-fig03.png differ diff --git a/windows/deployment/images/mdt-03-fig04.png b/windows/deployment/images/mdt-03-fig04.png index 9ac1267b22..437531d2f6 100644 Binary files a/windows/deployment/images/mdt-03-fig04.png and b/windows/deployment/images/mdt-03-fig04.png differ diff --git a/windows/deployment/images/mdt-07-fig10.png b/windows/deployment/images/mdt-07-fig10.png index 23037de07d..2c61e0eb3d 100644 Binary files a/windows/deployment/images/mdt-07-fig10.png and b/windows/deployment/images/mdt-07-fig10.png differ diff --git a/windows/deployment/images/mdt-10-fig05.png b/windows/deployment/images/mdt-10-fig05.png index 94ce5cd310..8625f2972b 100644 Binary files a/windows/deployment/images/mdt-10-fig05.png and b/windows/deployment/images/mdt-10-fig05.png differ diff --git a/windows/deployment/images/mdt-10-fig09.png b/windows/deployment/images/mdt-10-fig09.png index 77b8960921..bb5010a93d 100644 Binary files a/windows/deployment/images/mdt-10-fig09.png and b/windows/deployment/images/mdt-10-fig09.png differ diff --git a/windows/deployment/images/mdt-apps.png b/windows/deployment/images/mdt-apps.png index 73587506af..72ee2268f2 100644 Binary files a/windows/deployment/images/mdt-apps.png and b/windows/deployment/images/mdt-apps.png differ diff --git a/windows/deployment/images/mdt-offline-media.png b/windows/deployment/images/mdt-offline-media.png index d31ad0f27d..d81ea4e0d8 100644 Binary files a/windows/deployment/images/mdt-offline-media.png and b/windows/deployment/images/mdt-offline-media.png differ diff --git a/windows/deployment/images/mdt-replace.png b/windows/deployment/images/mdt-replace.png index 950ec3d6f7..d731037d38 100644 Binary files a/windows/deployment/images/mdt-replace.png and b/windows/deployment/images/mdt-replace.png differ diff --git a/windows/deployment/images/monitor-pc0001.PNG b/windows/deployment/images/monitor-pc0001.PNG index 10708e3f71..072b9cb58c 100644 Binary files a/windows/deployment/images/monitor-pc0001.PNG and b/windows/deployment/images/monitor-pc0001.PNG differ diff --git a/windows/deployment/images/pc0005-vm-office.png b/windows/deployment/images/pc0005-vm-office.png index d572ae77e9..bb8e96f5af 100644 Binary files a/windows/deployment/images/pc0005-vm-office.png and b/windows/deployment/images/pc0005-vm-office.png differ diff --git a/windows/deployment/images/pc0005-vm.png b/windows/deployment/images/pc0005-vm.png index 9d4c46dfac..4b2af635c4 100644 Binary files a/windows/deployment/images/pc0005-vm.png and b/windows/deployment/images/pc0005-vm.png differ diff --git a/windows/deployment/images/upgrademdt-fig5-winupgrade.png b/windows/deployment/images/upgrademdt-fig5-winupgrade.png index f346380b98..f3bc05508a 100644 Binary files a/windows/deployment/images/upgrademdt-fig5-winupgrade.png and b/windows/deployment/images/upgrademdt-fig5-winupgrade.png differ diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 8ad4b1b6a3..f925f48fd4 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -422,7 +422,7 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from 1. Mount the Windows PE WIM to a path (for example, C:\WinPE_Mount). For more information about how to mount WIM files, see [Mount an image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#mount-an-image). -2. Copy the ReAgent files and the ReAgent localization files from the Window 10, version 1903 ADK source folder to the mounted WIM. +2. Copy the ReAgent files and the ReAgent localization files from the Windows 10, version 1903 ADK source folder to the mounted WIM. For example, if the ADK is installed to the default location of C:\Program Files (x86)\Windows Kits\10 and the Windows PE image is mounted to C:\WinPE_Mount, run the following commands from an elevated Command Prompt window: diff --git a/windows/deployment/update/WIP4Biz-intro.md b/windows/deployment/update/WIP4Biz-intro.md index c5e07f7751..b73c7cb293 100644 --- a/windows/deployment/update/WIP4Biz-intro.md +++ b/windows/deployment/update/WIP4Biz-intro.md @@ -52,12 +52,12 @@ Windows 10 Insider Preview builds offer organizations a valuable and exciting op ## Validate Insider Preview builds Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits: - -- Get a head start on your Windows validation process -- Identify issues sooner to accelerate your Windows deployment -- Engage Microsoft earlier for help with potential compatibility issues -- Deploy Windows 10 General Availability Channel releases faster and more confidently -- Maximize the support Window that comes with each General Availability Channel release. + +- Get a head start on your Windows validation process. +- Identify issues sooner to accelerate your Windows deployment. +- Engage Microsoft earlier for help with potential compatibility issues. +- Deploy Windows 10 General Availability Channel releases faster and more confidently. +- Maximize the support window that comes with each General Availability Channel release. |Objective |Feature exploration| |---------|---------| diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md index 3ea447d2c4..4614f94847 100644 --- a/windows/deployment/update/prepare-deploy-windows.md +++ b/windows/deployment/update/prepare-deploy-windows.md @@ -94,7 +94,7 @@ Enable update services on devices. Ensure that every device is running all the s - Windows Management Service - Windows Module Installer - Windows Push Notification -- Windows Security Center Service +- Windows Security Service - Windows Time Service - Windows Update - Windows Update Medic Service diff --git a/windows/deployment/update/safeguard-holds.md b/windows/deployment/update/safeguard-holds.md index 0bb65fedd7..8ff5849aaa 100644 --- a/windows/deployment/update/safeguard-holds.md +++ b/windows/deployment/update/safeguard-holds.md @@ -14,8 +14,8 @@ ms.topic: article **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 +- Windows 11 Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When we find such an issue, we might apply safeguard holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use safeguard holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available. diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md index 1bb916cf7a..9134680979 100644 --- a/windows/deployment/usmt/usmt-requirements.md +++ b/windows/deployment/usmt/usmt-requirements.md @@ -91,15 +91,15 @@ You can migrate a 32-bit operating system to a 64-bit operating system. However, USMT does not support any of the Windows Server® operating systems, Windows 2000, Windows XP, or any of the starter editions for Windows Vista or Windows 7. USMT for Windows 10 should not be used for migrating from Windows 7 to Windows 8.1. It is meant to migrate to Windows 10. -For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](/previous-versions/windows/server/dd560801(v=ws.10)).  +For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](/previous-versions/windows/server/dd560801(v=ws.10)). ## Windows PE -- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](/windows-hardware/manufacture/desktop/whats-new-in-windows-pe-s14). +- **Must use latest version of Windows PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](/windows-hardware/manufacture/desktop/whats-new-in-windows-pe-s14). ## Credentials -- **Run as administrator** +- **Run as administrator** When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. To open an elevated command prompt: diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index 99a97d2f55..c59e537d48 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -528,7 +528,7 @@ This section will demonstrate how to export user data from an existing client co ## Replace a computer with Windows 10 At a high level, the computer replace process consists of:
    -- A special replace task sequence that runs the USMT backup and an optional full Window Imaging (WIM) backup.
    +- A special replace task sequence that runs the USMT backup and an optional full Windows Imaging (WIM) backup.
    - A standard OS deployment on a new computer. At the end of the deployment, the USMT backup from the old computer is restored. ### Create a backup-only task sequence diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 99c3bb9e74..c4cac4808b 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -261,11 +261,15 @@ The Windows diagnostic data processor configuration enables you to be the contro ### Prerequisites -- The device must be any of the following releases of Windows: - - Windows 11 Enterprise, Professional, or Education edition - - Windows 10 Enterprise, Education, or Professional edition, version 1809 with July 2021 update or later. +- Use a supported version of Windows 10 or Windows 11 +- The following editions are supported: + - Enterprise + - Professional + - Education - The device must be joined to Azure Active Directory. +For the best experience, use the most current build of any operating system specified above. Configuration functionality and availability may vary on older systems. See [Lifecycle Policy](/lifecycle/products/windows-10-enterprise-and-education) + The diagnostic data setting on the device should be set to Required diagnostic data or higher, and the following endpoints need to be reachable: - v10c.events.data.microsoft.com diff --git a/windows/privacy/windows-diagnostic-data.md b/windows/privacy/windows-diagnostic-data.md index 32e8f6917f..711144eaff 100644 --- a/windows/privacy/windows-diagnostic-data.md +++ b/windows/privacy/windows-diagnostic-data.md @@ -255,7 +255,7 @@ This type of data includes details about the health of the device, operating sys - Data about the reliability of content that appears in the [Windows Spotlight](/windows/configuration/windows-spotlight) (rotating lock screen images) is used for Windows Spotlight reliability investigations. - Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening performance. - Timing data about how quickly the facial recognition feature starts up and finishes is used to improve facial recognition performance. -- Data about when an Application Window fails to appear is used to investigate issues with Application Window reliability and performance. +- Data about when an application window fails to appear is used to investigate issues with application window reliability and performance. **With (optional) Tailored experiences:**
    If a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Performance data from Windows 10 and Windows 11 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 and Windows 11 users. Also, if a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Performance data from Windows 10 and Windows 11 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 and Windows 11 users. diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index a4ae0b4d3d..8f6746eee7 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -150,7 +150,7 @@ The options are: - **Enabled.** (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the **Administrators** group to run in Admin Approval Mode. - **Disabled.** Admin Approval Mode and all related UAC policy settings are disabled. -**Note** If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. +**Note** If this policy setting is disabled, the Windows Security app notifies you that the overall security of the operating system has been reduced. ### User Account Control: Switch to the secure desktop when prompting for elevation diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md index 9a6cb42323..f811afcaa3 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md @@ -91,7 +91,7 @@ This policy setting controls whether applications that request to run with a Use This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. - **Enabled** (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. -- **Disabled** Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. +- **Disabled** Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Windows Security app notifies you that the overall security of the operating system has been reduced. ## User Account Control: Switch to the secure desktop when prompting for elevation diff --git a/windows/security/includes/microsoft-defender.md b/windows/security/includes/microsoft-defender.md index ec183caa51..cf62bf3732 100644 --- a/windows/security/includes/microsoft-defender.md +++ b/windows/security/includes/microsoft-defender.md @@ -1,6 +1,6 @@ --- -title: Microsoft Defender important guidance -description: A note in regard to important Microsoft Defender guidance. +title: Microsoft 365 Defender important guidance +description: A note in regard to important Microsoft 365 Defender guidance. ms.date: ms.reviewer: manager: dansimp @@ -11,4 +11,4 @@ ms.topic: include --- > [!IMPORTANT] -> The improved [Microsoft 365 security center](https://security.microsoft.com) is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. [Learn what's new](/microsoft-365/security/mtp/overview-security-center). \ No newline at end of file +> The improved [Microsoft 365 Defender portal](https://security.microsoft.com) is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 Defender portal. [Learn what's new](/microsoft-365/security/mtp/overview-security-center). diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index bca11cfd78..e89b66ca77 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -73,11 +73,11 @@ Systems released prior to Windows 10 version 1803 do not support Kernel DMA Prot Systems running Windows 10 version 1803 that do support Kernel DMA Protection do have this security feature enabled automatically by the OS with no user or IT admin configuration required. -### Using Security Center +### Using the Windows Security app -Beginning with Windows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. +Beginning with Windows 10 version 1809, you can use the Windows Security app to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. -![Kernel DMA protection in Security Center.](bitlocker/images/kernel-dma-protection-security-center.png) +![Kernel DMA protection in Windows Security](bitlocker/images/kernel-dma-protection-security-center.png) ### Using System information @@ -146,4 +146,4 @@ The policy can be enabled by using: ## Related topics - [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) -- [DmaGuard MDM policies](/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies) \ No newline at end of file +- [DmaGuard MDM policies](/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies) diff --git a/windows/security/threat-protection/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md index 380cc917cd..9f97418b4d 100644 --- a/windows/security/threat-protection/auditing/event-4625.md +++ b/windows/security/threat-protection/auditing/event-4625.md @@ -182,7 +182,7 @@ This event generates on domain controllers, member servers, and workstations. | 0x0 | Status OK. | > [!NOTE] -> To see the meaning of other status or substatus codes, you might also check for status code in the Window header file ntstatus.h in Windows SDK. +> To see the meaning of other status or substatus codes, you might also check for status code in the Windows header file ntstatus.h in Windows SDK. More information: diff --git a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md index 3fff0198ed..7057f8c90f 100644 --- a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md +++ b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md @@ -13,7 +13,7 @@ author: dansimp ms.author: dansimp ms.date: 08/14/2017 ms.localizationpriority: medium -ms.technology: other +ms.technology: windows-sec --- # Block untrusted fonts in an enterprise diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index fc40dc48df..5c8dd1358e 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -1,7349 +1,7349 @@ ---- -title: Federal Information Processing Standard (FIPS) 140 Validation -description: Learn how Microsoft products and cryptographic modules follow the U.S. Federal government standard FIPS 140. -ms.prod: m365-security -audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -ms.localizationpriority: medium -ms.reviewer: -ms.technology: other ---- - -# FIPS 140-2 Validation - -## FIPS 140-2 standard overview - -The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard. FIPS is based on Section 5131 of the Information Technology Management Reform Act of 1996. It defines the minimum security requirements for cryptographic modules in IT products. - -The [Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/Projects/cryptographic-module-validation-program) is a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS). It validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover 11 areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. - -## Microsoft’s approach to FIPS 140-2 validation - -Microsoft maintains an active commitment to meeting the requirements of the FIPS 140-2 standard, having validated cryptographic modules against it since it was first established in 2001. Microsoft validates its cryptographic modules under the NIST CMVP, as described above. Multiple Microsoft products, including Windows 10, Windows Server, and many cloud services, use these cryptographic modules. - -## Using Windows in a FIPS 140-2 approved mode of operation - -Windows 10 and Windows Server may be configured to run in a FIPS 140-2 approved mode of operation, commonly referred to as "FIPS mode."  If you turn on FIPS mode, the Cryptographic Primitives Library (bcryptprimitives.dll) and Kernel Mode Cryptographic Primitives Library (CNG.sys) modules will run self-tests before Windows runs cryptographic operations. These self-tests are run according to FIPS 140-2 Section 4.9. They ensure that the modules are functioning properly. - -The Cryptographic Primitives Library and the Kernel Mode Cryptographic Primitives Library are the only modules affected by FIPS mode. FIPS mode won't prevent Windows and its subsystems from using non-FIPS validated cryptographic algorithms. FIPS mode is merely advisory for applications or components other than the Cryptographic Primitives Library and the Kernel Mode Cryptographic Primitives Library. - -US government regulations continue to mandate FIPS mode for government devices running Windows. Other customers should decide for themselves if FIPS mode is right for them. There are many applications and protocols that use FIPS mode policy to determine which cryptographic functionality to run. Customers seeking to follow the FIPS 140-2 standard should research the configuration settings of their applications and protocols. This research will help ensure that they can be configured to use FIPS 140-2 validated cryptography. - -Achieving this FIPS 140-2 approved mode of operation of Windows requires administrators to complete all four steps outlined below. - -### Step 1: Ensure FIPS 140-2 validated cryptographic modules are installed - -Administrators must ensure that all cryptographic modules installed are FIPS 140-2 validated. Tables listing validated modules, organized by operating system release, are available later in this article. - -### Step 2: Ensure all security policies for all cryptographic modules are followed - -Each of the cryptographic modules has a defined security policy that must be met for the module to operate in its FIPS 140-2 approved mode. The security policy may be found in each module’s published Security Policy Document (SPD). The SPDs for each module may be found in the table of validated modules at the end of this article. Select the module version number to view the published SPD for the module. - -### Step 3: Enable the FIPS security policy - -Windows provides the security policy setting, *System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing*. This setting is used by some Microsoft products to determine whether to run in FIPS mode. When this policy is turned on, the validated cryptographic modules in Windows will also operate in FIPS mode. This policy may be set using Local Security Policy, as part of Group Policy, or through a Modern Device Management (MDM) solution. For more information on the policy, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](./security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md). - -### Step 4: Ensure that only FIPS validated cryptographic algorithms are used - -FIPS mode is enforced at the level of the application or service. It is not enforced by the operating system or by individual cryptographic modules. Applications or services running in FIPS mode must follow the security policies of validated modules. They must not use a cryptographic algorithm that isn't FIPS-compliant. - -In short, an application or service is running in FIPS mode if it: - -* Checks for the policy flag -* Enforces security policies of validated modules - -## Frequently asked questions - -### How long does it take to certify a cryptographic module? - -Microsoft begins certification of cryptographic modules after each major feature release of Windows 10 and Windows Server. The duration of each evaluation varies, depending on many factors. - -### When does Microsoft undertake a FIPS 140 validation? - -The cadence for starting module validation aligns with the feature updates of Windows 10 and Windows Server. As the software industry evolves, operating systems release more frequently. Microsoft completes validation work on major releases but, in between releases, seeks to minimize the changes to the cryptographic modules. - -### What is the difference between *FIPS 140 validated* and *FIPS 140 compliant*? - -*FIPS 140 validated* means that the cryptographic module, or a product that embeds the module, has been validated ("certified") by the CMVP as meeting the FIPS 140-2 requirements. *FIPS 140 compliant* is an industry term for IT products that rely on FIPS 140 validated products for cryptographic functionality. - -### How do I know if a Windows service or application is FIPS 140-2 validated? - -The cryptographic modules used in Windows are validated through the CMVP. They aren't validated by individual services, applications, hardware peripherals, or other solutions. Any compliant solution must call a FIPS 140-2 validated cryptographic module in the underlying OS, and the OS must be configured to run in FIPS mode. Contact the vendor of the service, application, or product for information on whether it calls a validated cryptographic module. - -### What does *When operated in FIPS mode* mean on a certificate? - -This label means that certain configuration and security rules must be followed to use the cryptographic module in compliance with its FIPS 140-2 security policy. Each module has its own security policy—a precise specification of the security rules under which it will operate—and employs approved cryptographic algorithms, cryptographic key management, and authentication techniques. The security rules are defined in the Security Policy Document (SPD) for each module. - -### What is the relationship between FIPS 140-2 and Common Criteria? - -FIPS 140-2 and Common Criteria are two separate security standards with different, but complementary, purposes. FIPS 140-2 is designed specifically for validating software and hardware cryptographic modules. Common Criteria are designed to evaluate security functions in IT software and hardware products. Common Criteria evaluations often rely on FIPS 140-2 validations to provide assurance that basic cryptographic functionality is implemented properly. - -### How does FIPS 140 relate to Suite B? - -Suite B is a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. The Suite B cryptographic algorithms are a subset of the FIPS approved cryptographic algorithms allowed by the FIPS 140-2 standard. - -### Is SMB3 (Server Message Block) FIPS 140 compliant in Windows? - -SMB3 can be FIPS 140 compliant, if Windows is configured to operate in FIPS 140 mode on both client and server. In FIPS mode, SMB3 relies on the underlying Windows FIPS 140 validated cryptographic modules for cryptographic operations. - -## Microsoft FIPS 140-2 validated cryptographic modules - -The following tables identify the cryptographic modules used in an operating system, organized by release. - -## Modules used by Windows - -##### Windows 10 Fall 2018 Update (Version 1809) - -Validated Editions: Home, Pro, Enterprise, Education - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17763#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17763#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17763#3644See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17763#3615See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17763#3651See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17763#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17763#3089See Security Policy and Certificate page for algorithm information
    Virtual TPM10.0.17763#3690See Security Policy and Certificate page for algorithm information
    - -##### Windows 10 Spring 2018 Update (Version 1803) - -Validated Editions: Home, Pro, Enterprise, Education - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17134#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17134#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17134#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17134#3480See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17134#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17134#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17134#3089See Security Policy and Certificate page for algorithm information
    - -##### Windows 10 Fall Creators Update (Version 1709) - -Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.16299#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.16299#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.16299#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.16299#3194See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.16299#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.16299#3092See Security Policy and Certificate page for algorithm information
    Windows Resume10.0.16299#3091See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.16299#3089See Security Policy and Certificate page for algorithm information
    - -##### Windows 10 Creators Update (Version 1703) - -Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile - - -- ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.15063#3095

    FIPS approved algorithms: AES (Cert. #4624); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2522); SHS (Cert. #3790); Triple-DES (Cert. #2459)
    -
    -Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #1281); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #1278)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.15063#3094

    #3094

    -

    FIPS approved algorithms: AES (Certs. #4624 and #4626); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2523); SHS (Cert. #3790); Triple-DES (Cert. #2459)
    -
    -Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert.#1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert.#2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert.#1281)

    Boot Manager10.0.15063#3089

    FIPS approved algorithms: AES (Certs. #4624 and #4625); CKG (vendor affirmed); HMAC (Cert. #3061); PBKDF (vendor affirmed); RSA (Cert. #2523); SHS (Cert. #3790)

    -

    Other algorithms: PBKDF (vendor affirmed); VMK KDF (vendor affirmed)

    Windows OS Loader10.0.15063#3090

    FIPS approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)

    -

    Other algorithms: NDRNG

    Windows Resume[1]10.0.15063#3091FIPS approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)
    BitLocker® Dump Filter[2]10.0.15063#3092FIPS approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2522); SHS (Cert. #3790)
    Code Integrity (ci.dll)10.0.15063#3093

    FIPS approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

    Secure Kernel Code Integrity (skci.dll)[3]10.0.15063#3096

    FIPS approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

    - - -\[1\] Applies only to Home, Pro, Enterprise, Education, and S. - -\[2\] Applies only to Pro, Enterprise, Education, S, Mobile, and Surface Hub - -\[3\] Applies only to Pro, Enterprise, Education, and S - -##### Windows 10 Anniversary Update (Version 1607) - -Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.14393#2937

    FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    -
    -Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.14393#2936

    FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    -
    -Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887)

    Boot Manager10.0.14393#2931

    FIPS approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

    -

    Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

    BitLocker® Windows OS Loader (winload)10.0.14393#2932FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: NDRNG; MD5
    BitLocker® Windows Resume (winresume)[1]10.0.14393#2933FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[2]10.0.14393#2934FIPS approved algorithms: AES (Certs. #4061 and #4064)
    Code Integrity (ci.dll)10.0.14393#2935

    FIPS approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: AES (non-compliant); MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

    Secure Kernel Code Integrity (skci.dll)[3]10.0.14393#2938

    FIPS approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
    -
    -Other algorithms: MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

    - - -\[1\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB - -\[2\] Applies only to Pro, Enterprise, Enterprise LTSB, and Mobile - -\[3\] Applies only to Pro, Enterprise, and Enterprise LTSB - -##### Windows 10 November 2015 Update (Version 1511) - -Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10586#2606

    FIPS approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888, and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
    -
    -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10586#2605

    FIPS approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs.  #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888, and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
    -
    -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663)

    Boot Manager[4]10.0.10586#2700FIPS approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
    -
    -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)[5]10.0.10586#2701FIPS approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
    -
    -Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[6]10.0.10586#2702FIPS approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[7]10.0.10586#2703FIPS approved algorithms: AES (Certs. #3653)
    Code Integrity (ci.dll)10.0.10586#2604

    FIPS approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
    -
    -Other algorithms: AES (non-compliant); MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

    Secure Kernel Code Integrity (skci.dll)[8]10.0.10586#2607

    FIPS approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
    -
    -Other algorithms: MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

    - - -\[4\] Applies only to Home, Pro, Enterprise, Mobile, and Surface Hub - -\[5\] Applies only to Home, Pro, Enterprise, Mobile, and Surface Hub - -\[6\] Applies only to Home, Pro, and Enterprise - -\[7\] Applies only to Pro, Enterprise, Mobile, and Surface Hub - -\[8\] Applies only to Enterprise and Enterprise LTSB - -##### Windows 10 (Version 1507) - -Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Hub - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10240#2606

    FIPS approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
    -
    -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10240#2605

    FIPS approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
    -
    -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576)

    Boot Manager[9]10.0.10240#2600FIPS approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
    -
    -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)[10]10.0.10240#2601FIPS approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
    -
    -Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[11]10.0.10240#2602FIPS approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[12]10.0.10240#2603FIPS approved algorithms: AES (Certs. #3497 and #3498)
    Code Integrity (ci.dll)10.0.10240#2604

    FIPS approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
    -
    -Other algorithms: AES (non-compliant); MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

    Secure Kernel Code Integrity (skci.dll)[13]10.0.10240#2607

    FIPS approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
    -
    -Other algorithms: MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

    - - -\[9\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB - -\[10\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB - -\[11\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB - -\[12\] Applies only to Pro, Enterprise, and Enterprise LTSB - -\[13\] Applies only to Enterprise and Enterprise LTSB - -##### Windows 8.1 - -Validated Editions: RT, Pro, Enterprise, Phone, Embedded - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.17031#2357

    FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
    -
    -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323)

    Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.17042#2356

    FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
    -
    -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

    Boot Manager6.3.9600 6.3.9600.17031#2351FIPS approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    -
    -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.17031#2352FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
    -
    -Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[14]6.3.9600 6.3.9600.17031#2353FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)6.3.9600 6.3.9600.17031#2354FIPS approved algorithms: AES (Cert. #2832)
    -
    -Other algorithms: N/A
    Code Integrity (ci.dll)6.3.9600 6.3.9600.17031#2355#2355

    FIPS approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
    -
    -Other algorithms: MD5

    -

    Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

    - - -\[14\] Applies only to Pro, Enterprise, and Embedded 8. - -##### Windows 8 - -Validated Editions: RT, Home, Pro, Enterprise, Phone - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.9200#1892FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    -
    -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert.); ECDSA (Cert.); HMAC (Cert.); KAS (Cert); KBKDF (Cert.); PBKDF (vendor affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    -
    -
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.9200#1891FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    -
    -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and); ECDSA (Cert.); HMAC (Cert.); KAS (Cert.); KBKDF (Cert.); PBKDF (vendor affirmed); RNG (Cert.); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    -
    -Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.2.9200#1895FIPS approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    BitLocker® Windows OS Loader (WINLOAD)6.2.9200#1896FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
    BitLocker® Windows Resume (WINRESUME)[15]6.2.9200#1898FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (DUMPFVE.SYS)6.2.9200#1899FIPS approved algorithms: AES (Certs. #2196 and #2198)
    -
    -Other algorithms: N/A
    Code Integrity (CI.DLL)6.2.9200#1897FIPS approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.9200#1893FIPS approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert.); Triple-DES MAC (Triple-DES Certificate, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Certificate, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced Cryptographic Provider (RSAENH.DLL)6.2.9200#1894FIPS approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
    -
    -Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    - - -\[15\] Applies only to Home and Pro - -**Windows 7** - -Validated Editions: Windows 7, Windows 7 SP1 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)

    6.1.7600.16385

    -

    6.1.7601.17514

    		1329FIPS approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 bits to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
    -
    -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and); SHS (Cert.); Triple-DES (Cert.)
    -
    -Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Kernel Mode Cryptographic Primitives Library (cng.sys)

    6.1.7600.16385

    -

    6.1.7600.16915

    -

    6.1.7600.21092

    -

    6.1.7601.17514

    -

    6.1.7601.17725

    -

    6.1.7601.17919

    -

    6.1.7601.21861

    -

    6.1.7601.22076

    		1328FIPS approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 bits to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
    -
    -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Boot Manager

    6.1.7600.16385

    -

    6.1.7601.17514

    		1319FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
    -
    -Other algorithms: MD5#1168 and); HMAC (Cert.); RSA (Cert.); SHS (Cert.)
    -
    -Other algorithms: MD5
    Winload OS Loader (winload.exe)

    6.1.7600.16385

    -

    6.1.7600.16757

    -

    6.1.7600.20897

    -

    6.1.7600.20916

    -

    6.1.7601.17514

    -

    6.1.7601.17556

    -

    6.1.7601.21655

    -

    6.1.7601.21675

    		1326FIPS approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    BitLocker™ Drive Encryption

    6.1.7600.16385

    -

    6.1.7600.16429

    -

    6.1.7600.16757

    -

    6.1.7600.20536

    -

    6.1.7600.20873

    -

    6.1.7600.20897

    -

    6.1.7600.20916

    -

    6.1.7601.17514

    -

    6.1.7601.17556

    -

    6.1.7601.21634

    -

    6.1.7601.21655

    -

    6.1.7601.21675

    		1332FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
    -
    -Other algorithms: Elephant Diffuser
    Code Integrity (CI.DLL)

    6.1.7600.16385

    -

    6.1.7600.17122

    -

    6.1.7600.21320

    -

    6.1.7601.17514

    -

    6.1.7601.17950

    -

    6.1.7601.22108

    		1327FIPS approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.1.7600.16385
    -(no change in SP1)    		1331FIPS approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
    Enhanced Cryptographic Provider (RSAENH.DLL)6.1.7600.16385
    -(no change in SP1)    		1330FIPS approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
    -
    -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    - - -##### Windows Vista SP1 - -Validated Editions: Ultimate Edition - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.0.6001.18000 and 6.0.6002.18005978FIPS approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753)
    Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596979FIPS approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
    -
    -Other algorithms: MD5
    Code Integrity (ci.dll)6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005980FIPS approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
    -
    -Other algorithms: MD5
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228691000

    FIPS approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and); ECDSA (Cert.); HMAC (Cert.); RNG (Cert.  and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)

    -

    Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228721001

    FIPS approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)

    -

    Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)

    Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180051002

    FIPS approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)

    -

    Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180051003

    FIPS approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

    -

    Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4

    - - -##### Windows Vista - -Validated Editions: Ultimate Edition - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider (RSAENH)6.0.6000.16386893FIPS approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
    -
    -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6000.16386894FIPS approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
    BitLocker™ Drive Encryption6.0.6000.16386947FIPS approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
    -
    -Other algorithms: Elephant Diffuser
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067891FIPS approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
    -
    -Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 bits to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5
    - - -##### Windows XP SP3 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.1.2600.5512997

    FIPS approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)

    -

    Other algorithms: DES; MD5; HMAC MD5

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.1.2600.5507990

    FIPS approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)

    -

    Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4

    Enhanced Cryptographic Provider (RSAENH)5.1.2600.5507989

    FIPS approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)

    -

    Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits)

    - - -##### Windows XP SP2 - - ------ - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    DSS/Diffie-Hellman Enhanced Cryptographic Provider5.1.2600.2133240

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)

    -

    Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement)

    Microsoft Enhanced Cryptographic Provider5.1.2600.2161238

    FIPS approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

    -

    Other algorithms: DES (Cert. #156); RC2; RC4; MD5

    - - -##### Windows XP SP1 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Microsoft Enhanced Cryptographic Provider5.1.2600.1029238

    FIPS approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

    -

    Other algorithms: DES (Cert. #156); RC2; RC4; MD5

    - - -##### Windows XP - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module5.1.2600.0241

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)

    -

    Other algorithms: DES (Cert. #89)

    - - -##### Windows 2000 SP3 - - ------ - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

    FIPS approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

    -

    Other algorithms: DES (Certs. #89)

    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS: 5.0.2195.3665 [SP3])

    -

    (Base: 5.0.2195.3839 [SP3])

    -

    (DSS/DH Enh: 5.0.2195.3665 [SP3])

    -

    (Enh: 5.0.2195.3839 [SP3]

    		103

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    - - -##### Windows 2000 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

    FIPS approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

    -

    Other algorithms: DES (Certs. #89)

    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS:

    -

    5.0.2195.2228 [SP2])

    -

    (Base:

    -

    5.0.2195.2228 [SP2])

    -

    (DSS/DH Enh:

    -

    5.0.2195.2228 [SP2])

    -

    (Enh:

    -

    5.0.2195.2228 [SP2])

    		103

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    - - -##### Windows 2000 SP1 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS: 5.0.2150.1391 [SP1])

    -

    (Base: 5.0.2150.1391 [SP1])

    -

    (DSS/DH Enh: 5.0.2150.1391 [SP1])

    -

    (Enh: 5.0.2150.1391 [SP1])

    		103

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    - - -##### Windows 2000 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.2150.176

    FIPS approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

    - - -##### Windows 95 and Windows 98 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.1877.6 and 5.0.1877.775

    FIPS approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

    -

    Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

    - - -##### Windows NT 4.0 - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base Cryptographic Provider5.0.1877.6 and 5.0.1877.768FIPS approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
    -
    -Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)
    - -## Modules used by Windows Server - -##### Windows Server 2019 (Version 1809) - -Validated Editions: Standard, Datacenter - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17763#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17763#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17763#3644See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17763#3615See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17763#3651See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17763#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17763#3089See Security Policy and Certificate page for algorithm information
    Virtual TPM10.0.17763#3690See Security Policy and Certificate page for algorithm information
    - -##### Windows Server (Version 1803) - -Validated Editions: Standard, Datacenter - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17134#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17134#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17134#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17134#3480See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17134#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17134#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17134#3089See Security Policy and Certificate page for algorithm information
    - -##### Windows Server (Version 1709) - -Validated Editions: Standard, Datacenter - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.16299#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.16299#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.16299#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.16299#3194See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.16299#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.16299#3092See Security Policy and Certificate page for algorithm information
    Windows Resume10.0.16299#3091See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.16299#3089See Security Policy and Certificate page for algorithm information
    - -##### Windows Server 2016 - -Validated Editions: Standard, Datacenter, Storage Server - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.143932937FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    -
    -Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.143932936FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    -
    -Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager10.0.143932931

    FIPS approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

    -

    Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

    BitLocker® Windows OS Loader (winload)10.0.143932932FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: NDRNG; MD5
    BitLocker® Windows Resume (winresume)10.0.143932933FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)10.0.143932934FIPS approved algorithms: AES (Certs. #4061 and #4064)
    Code Integrity (ci.dll)10.0.143932935FIPS approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: AES (non-compliant); MD5
    Secure Kernel Code Integrity (skci.dll)10.0.143932938FIPS approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
    -
    -Other algorithms: MD5
    - - -##### Windows Server 2012 R2 - -Validated Editions: Server, Storage Server, - -**StorSimple 8000 Series, Azure StorSimple Virtual Array Windows Server 2012 R2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.170312357FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
    -
    -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.170422356FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
    -
    -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.3.9600 6.3.9600.170312351FIPS approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    -
    -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.170312352FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
    -
    -Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[16]6.3.9600 6.3.9600.170312353FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[17]6.3.9600 6.3.9600.170312354FIPS approved algorithms: AES (Cert. #2832)
    -
    -Other algorithms: N/A
    Code Integrity (ci.dll)6.3.9600 6.3.9600.170312355FIPS approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
    -
    -Other algorithms: MD5
    - - -\[16\] Doesn't apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** - -\[17\] Doesn't apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** - -**Windows Server 2012** - -Validated Editions: Server, Storage Server - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.92001892FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    -
    -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert.); HMAC (Cert. #); KAS (Cert.); KBKDF (Cert.); PBKDF (vendor affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    -
    -Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.92001891FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    -
    -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    -
    -Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.2.92001895FIPS approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    BitLocker® Windows OS Loader (WINLOAD)6.2.92001896FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
    BitLocker® Windows Resume (WINRESUME)6.2.92001898FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (DUMPFVE.SYS)6.2.92001899FIPS approved algorithms: AES (Certs. #2196 and #2198)
    -
    -Other algorithms: N/A
    Code Integrity (CI.DLL)6.2.92001897FIPS approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.92001893FIPS approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced Cryptographic Provider (RSAENH.DLL)6.2.92001894FIPS approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
    -
    -Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    - - -##### Windows Server 2008 R2 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.1.7600.16385 or 6.1.7601.175141321FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    Winload OS Loader (winload.exe)6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216751333FIPS approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    Code Integrity (ci.dll)6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221081334FIPS approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220761335FIPS approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 bits and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
    -
    --Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Cryptographic Primitives Library (bcryptprimitives.dll)66.1.7600.16385 or 6.1.7601.175141336FIPS approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 bits and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
    -
    -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4
    Enhanced Cryptographic Provider (RSAENH)6.1.7600.163851337FIPS approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
    -
    -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.1.7600.163851338FIPS approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
    BitLocker™ Drive Encryption6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216751339FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
    -
    -Other algorithms: Elephant Diffuser
    - - -##### Windows Server 2008 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224971004FIPS approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
    -
    -Other algorithms: N/A
    Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225961005FIPS approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
    -
    -Other algorithms: MD5
    Code Integrity (ci.dll)6.0.6001.18000 and 6.0.6002.180051006FIPS approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
    -
    -Other algorithms: MD5
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228691007FIPS approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
    -
    -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert.); RNG (Cert.  and SP800-90 AES-CTR, vendor affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    -
    -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228721008FIPS approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
    -
    -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180051009FIPS approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
    -
    --Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
    Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180051010FIPS approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
    -
    -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    - - -##### Windows Server 2003 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.3959875

    FIPS approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)

    -

    Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4

    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.3959869

    FIPS approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)

    -

    Other algorithms: DES; HMAC-MD5

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.3959868

    FIPS approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)

    -

    Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 bits and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    - - -##### Windows Server 2003 SP1 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.1830 [SP1]405

    FIPS approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

    -

    Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.1830 [Service Pack 1])382

    FIPS approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

    -

    Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.1830 [Service Pack 1]381

    FIPS approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

    -

    Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    - - -##### Windows Server 2003 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.0405

    FIPS approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

    -

    Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.0382

    FIPS approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

    -

    Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.0381

    FIPS approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

    -

    Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    - - -#### Other Products - -##### Windows Embedded Compact 7 and Windows Embedded Compact 8 - - ------ - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider7.00.2872 [1] and 8.00.6246 [2]2957

    FIPS approved algorithms: AES (Certs.#4433and#4434); CKG (vendor affirmed); DRBG (Certs.#1432and#1433); HMAC (Certs.#2946and#2945); RSA (Certs.#2414and#2415); SHS (Certs.#3651and#3652); Triple-DES (Certs.#2383and#2384)

    -

    Allowed algorithms: HMAC-MD5, MD5, NDRNG

    Cryptographic Primitives Library (bcrypt.dll)7.00.2872 [1] and 8.00.6246 [2]2956

    FIPS approved algorithms: AES (Certs.#4430and#4431); CKG (vendor affirmed); CVL (Certs.#1139and#1140); DRBG (Certs.#1429and#1430); DSA (Certs.#1187and#1188); ECDSA (Certs.#1072and#1073); HMAC (Certs.#2942and#2943); KAS (Certs.#114and#115); RSA (Certs.#2411and#2412); SHS (Certs.#3648and#3649); Triple-DES (Certs.#2381and#2382)

    -

    Allowed algorithms: MD5, NDRNG, RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength

    - - - -##### Windows CE 6.0 and Windows Embedded Compact 7 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider6.00.1937 [1] and 7.00.1687 [2]825

    FIPS approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])

    -

    Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES

    - - -##### Outlook Cryptographic Provider - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Outlook Cryptographic Provider (EXCHCSP)SR-1A (3821)110

    FIPS approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5

    - - - -### Cryptographic Algorithms - -The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate. - -### Advanced Encryption Standard (AES) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-OFB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -

    Microsoft Surface Hub Virtual TPM Implementations #4904

    -

    Version 10.0.15063.674

      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-OFB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903

    -

    Version 10.0.16299

      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CCM:
      • -
      • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • -
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • -
      • Plain Text Length: 0-32
        • -
      • Additional authenticated data length: 0-65536
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CMAC:
      • -
      • -
      • Generation:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • Verification:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-GCM:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • -
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • -
      • Additional authenticated data lengths: 0, 8, 1016, 1024 (bits)
        • -
      • 96 bit IV supported
        • -
      • -
    • AES-XTS:
      • -
      • -
      • Key Size: 128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • Key Size: 256:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #4902

    -

    Version 10.0.15063.674

      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CCM:
      • -
      • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • -
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • -
      • Plain Text Length: 0-32
        • -
      • Additional authenticated data length: 0-65536
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CMAC:
      • -
      • -
      • Generation:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • Verification:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-GCM:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • -
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • -
      • Additional authenticated data lengths: 0, 8, 1016, 1024 (bits)
        • -
      • 96 bit IV supported
        • -
      • -
    • AES-XTS:
      • -
      • -
      • Key Size: 128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • Key Size: 256:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4901

    -

    Version 10.0.15254

      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CCM:
      • -
      • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • -
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • -
      • Plain Text Length: 0-32
        • -
      • Additional authenticated data length: 0-65536
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CMAC:
      • -
      • -
      • Generation:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • Verification:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-GCM:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • IV Generation: External
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • -
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • -
      • Additional authenticated data lengths: 0, 8, 1016, 1024 (bits)
        • -
      • 96 bit IV supported
        • -
      • -
    • AES-XTS:
      • -
      • -
      • Key Size: 128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • Key Size: 256:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897

    -

    Version 10.0.16299

    AES-KW:

    -
      -
    • Modes: Decrypt, Encrypt
      • -
    • CIPHK transformation direction: Forward
      • -
    • Key Lengths: 128, 192, 256 (bits)
      • -
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • -
    -

    AES validation number 4902

    Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900

    -

    Version 10.0.15063.674

    AES-KW:

    -
      -
    • Modes: Decrypt, Encrypt
      • -
    • CIPHK transformation direction: Forward
      • -
    • Key Lengths: 128, 192, 256 (bits)
      • -
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • -
    -

    AES validation number 4901

    Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899

    -

    Version 10.0.15254

    AES-KW:

    -
      -
    • Modes: Decrypt, Encrypt
      • -
    • CIPHK transformation direction: Forward
      • -
    • Key Lengths: 128, 192, 256 (bits)
      • -
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • -
    -

    AES validation number 4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898

    -

    Version 10.0.16299

    AES-CCM:

    -
      -
    • Key Lengths: 256 (bits)
      • -
    • Tag Lengths: 128 (bits)
      • -
    • IV Lengths: 96 (bits)
      • -
    • Plain Text Length: 0-32
      • -
    • Additional authenticated data length: 0-65536
      • -
    -

    AES validation number 4902

    Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896

    -

    Version 10.0.15063.674

    AES-CCM:

    -
      -
    • Key Lengths: 256 (bits)
      • -
    • Tag Lengths: 128 (bits)
      • -
    • IV Lengths: 96 (bits)
      • -
    • Plain Text Length: 0-32
      • -
    • Additional authenticated data length: 0-65536
      • -
    -

    AES validation number 4901

    Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895

    -

    Version 10.0.15254

    AES-CCM:

    -
      -
    • Key Lengths: 256 (bits)
      • -
    • Tag Lengths: 128 (bits)
      • -
    • IV Lengths: 96 (bits)
      • -
    • Plain Text Length: 0-32
      • -
    • Additional authenticated data length: 0-65536
      • -
    -

    AES validation number 4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894

    -

    Version 10.0.16299

    CBC (e/d; 128, 192, 256);

    -

    CFB128 (e/d; 128, 192, 256);

    -

    OFB (e/d; 128, 192, 256);

    -

    CTR (int only; 128, 192, 256)

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627

    -

    Version 10.0.15063

    KW (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 256, 192, 320, 2048)

    -

    AES validation number 4624

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626

    -

    Version 10.0.15063

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    -

    AES validation number 4624

    -

     

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625

    -

    Version 10.0.15063

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CFB8 (e/d; 128, 192, 256);

    -

    CFB128 (e/d; 128, 192, 256);

    -

    CTR (int only; 128, 192, 256)

    -

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    -

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16)

    -

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)

    -

    (KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)

    -

    IV Generated: (External); PT Lengths Tested: (0, 1024, 8, 1016); Additional authenticated data lengths tested: (0, 1024, 8, 1016); 96 bit IV supported

    -

    GMAC supported

    -

    XTS((KS: XTS_128((e/d)(f)) KS: XTS_256((e/d)(f))

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624

    -

    Version 10.0.15063

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434

    -

    Version 7.00.2872

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433

    -

    Version 8.00.6246

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CTR (int only; 128, 192, 256)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431

    -

    Version 7.00.2872

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CTR (int only; 128, 192, 256)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430

    -

    Version 8.00.6246

    CBC (e/d; 128, 192, 256);

    -

    CFB128 (e/d; 128, 192, 256);

    -

    OFB (e/d; 128, 192, 256);

    -

    CTR (int only; 128, 192, 256)

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074

    -

    Version 10.0.14393

    ECB (e/d; 128, 192, 256); CBC (e/d; 128, 192, 256); CFB8 (e/d; 128, 192, 256); CFB128 (e/d; 128, 192, 256); CTR (int only; 128, 192, 256)

    -

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    -

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    -

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    -(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    -IV Generated:  (Externally); PT Lengths Tested:  (0, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 1024, 8, 1016); IV Lengths Tested: (0, 0); 96 bit IV supported
    -GMAC supported

    -

    XTS((KS: XTS_128((e/d)(f)) KS: XTS_256((e/d)(f))

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064

    -

    Version 10.0.14393

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CFB8 (e/d; 128, 192, 256);

    -

     

    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
    -Version 10.0.14393

    KW  (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 192, 256, 320, 2048)

    -

    AES validation number 4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062

    -

    Version 10.0.14393

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    -

    AES validation number 4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061

    -

    Version 10.0.14393

    KW  (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 256, 192, 320, 2048)

    -

    AES validation number 3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652

    -

    Version 10.0.10586

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    -

    AES validation number 3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653

    -

    Version 10.0.10586

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CFB8 (e/d; 128, 192, 256);

    -

     

    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
    -Version 10.0.10586

    ECB (e/d; 128, 192, 256); CBC (e/d; 128, 192, 256); CFB8 (e/d; 128, 192, 256); CFB128 (e/d; 128, 192, 256); CTR (int only; 128, 192, 256)

    -

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    -

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    -

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    -(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    -IV Generated:  (Externally); PT Lengths Tested:  (0, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 1024, 8, 1016); IV Lengths Tested: (0, 0); 96 bit IV supported
    -GMAC supported

    -

    XTS((KS: XTS_128((e/d) (f)) KS: XTS_256((e/d) (f))

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629
    -
    -

    -

    Version 10.0.10586

    KW  (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 256, 192, 320, 2048)

    -

    AES validation number 3497

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507

    -

    Version 10.0.10240

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    -

    AES validation number 3497

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498

    -

    Version 10.0.10240

    ECB (e/d; 128, 192, 256); CBC (e/d; 128, 192, 256); CFB8 (e/d; 128, 192, 256); CFB128 (e/d; 128, 192, 256); CTR (int only; 128, 192, 256)

    -

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    -

    CMAC(Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    -

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    -(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    -IV Generated:  (Externally); PT Lengths Tested:  (0, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 1024, 8, 1016); IV Lengths Tested:  (0, 0); 96 bit IV supported
    -GMAC supported

    -

    XTS((KS: XTS_128((e/d)(f)) KS: XTS_256((e/d)(f))

    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
    -Version 10.0.10240

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CFB8 (e/d; 128, 192, 256);

    -

     

    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
    -Version 10.0.10240

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CFB8 (e/d; 128, 192, 256);

    -

     

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853

    -

    Version 6.3.9600

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    -

    AES validation number 2832

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 BitLocker Cryptographic Implementations #2848

    -

    Version 6.3.9600

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 0 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    -

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    -

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)

    -

    (KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)

    -

    IV Generated:  (Externally); PT Lengths Tested:  (0, 128, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 128, 1024, 8, 1016); IV Lengths Tested:  (8, 1024); 96 bit IV supported;
    -OtherIVLen_Supported
    -GMAC supported

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832

    -

    Version 6.3.9600

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)
    -AES validation number 2197

    -

    CMAC (Generation/Verification) (KS: 128; Block Size(s); Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 192; Block Size(s); Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 256; Block Size(s); Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16)
    -AES validation number 2197

    -

    GCM(KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    -(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    -IV Generated: (Externally); PT Lengths Tested: (0, 128, 1024, 8, 1016); Additional authenticated data lengths tested: (0, 128, 1024, 8, 1016); IV Lengths Tested: (8, 1024); 96 bit IV supported
    -GMAC supported

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216

    CCM (KS: 256) (Assoc. Data Len Range: 0 - 0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    -

    AES validation number 2196

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CFB8 (e/d; 128, 192, 256);

    -

    CFB128 (e/d; 128, 192, 256);

    -

    CTR (int only; 128, 192, 256)

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CFB8 (e/d; 128, 192, 256);

    -

     

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196
    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0 – 0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)
    -AES validation number 1168

    Windows Server 2008 R2 and SP1 CNG algorithms #1187

    -

    Windows 7 Ultimate and SP1 CNG algorithms #1178

    CCM (KS: 128, 256) (Assoc. Data Len Range: 0 - 8) (Payload Length Range: 4 - 32 (Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16)
    -AES validation number 1168    		Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CFB8 (e/d; 128, 192, 256);

    -

     

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168

    GCM

    -

    GMAC

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168, vendor-affirmed
    CCM (KS: 128, 256) (Assoc. Data Len Range: 0 - 8) (Payload Length Range: 4 - 32 (Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16)Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760
    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0 - 0, 2^16) (Payload Length Range: 1 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    Windows Server 2008 CNG algorithms #757

    -

    Windows Vista Ultimate SP1 CNG algorithms #756

    CBC (e/d; 128, 256);

    -

    CCM (KS: 128, 256) (Assoc. Data Len Range: 0 - 8) (Payload Length Range: 4 - 32 (Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16)

    Windows Vista Ultimate BitLocker Drive Encryption #715

    -

    Windows Vista Ultimate BitLocker Drive Encryption #424

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CFB8 (e/d; 128, 192, 256);

    Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739

    -

    Windows Vista Symmetric Algorithm Implementation #553

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    -

    CTR (int only; 128, 192, 256)

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023

    ECB (e/d; 128, 192, 256);

    -

    CBC (e/d; 128, 192, 256);

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818

    -

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781

    -

    Windows 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #548

    -

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #516

    -

    Windows CE and Windows Mobile 6, 6.1, and 6.5 Enhanced Cryptographic Provider (RSAENH) #507

    -

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #290

    -

    Windows CE 5.0 and 5.1 Enhanced Cryptographic Provider (RSAENH) #224

    -

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #80

    -

    Windows XP, SP1, and SP2 Enhanced Cryptographic Provider (RSAENH) #33

    - - -### Deterministic Random Bit Generator (DRBG) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function not used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4904

    Microsoft Surface Hub Virtual TPM Implementations #1734

    -

    Version 10.0.15063.674

      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function not used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4903

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733

    -

    Version 10.0.16299

      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4902

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1732

    -

    Version 10.0.15063.674

      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4901

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1731

    -

    Version 10.0.15254

      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730

    -

    Version 10.0.16299

    CTR_DRBG: [Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4627)]

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556

    -

    Version 10.0.15063

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 4624)]

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555

    -

    Version 10.0.15063

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4434)]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433

    -

    Version 7.00.2872

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4433)]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432

    -

    Version 8.00.6246

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4431)]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430

    -

    Version 7.00.2872

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4430)]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429

    -

    Version 8.00.6246

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4074)]

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222

    -

    Version 10.0.14393

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 4064)]

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217

    -

    Version 10.0.14393

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 3629)]

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955

    -

    Version 10.0.10586

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 3497)]

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868

    -

    Version 10.0.10240

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 2832)]

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489

    -

    Version 6.3.9600

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 2197)]Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258
    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 2023)]Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193
    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 1168)]Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23
    DRBG (SP 800–90)Windows Vista Ultimate SP1, vendor-affirmed
    - - -#### Digital Signature Algorithm (DSA) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • DSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • PQGGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • PQGVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • KeyPair:
          • -
          • -
          • L = 2048, N = 256
            • -
          • L = 3072, N = 256
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1303

    -

    Version 10.0.15063.674

      -
    • DSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • PQGGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • PQGVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • KeyPair:
          • -
          • -
          •  
            • -
          •  
            • -
          • L = 2048, N = 256
            • -
          • L = 3072, N = 256
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1302

    -

    Version 10.0.15254

      -
    • DSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • PQGGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • PQGVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • KeyPair:
          • -
          • -
          • L = 2048, N = 256
            • -
          • L = 3072, N = 256
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301

    -

    Version 10.0.16299

    FIPS186-4:

    -

    PQG(gen)PARMS TESTED:   [(2048,256)SHA(256); (3072,256) SHA(256)]

    -

    PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    -

    KeyPairGen:   [(2048,256); (3072,256)]

    -

    SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    -

    SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    -

    SHS: validation number 3790

    -

    DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223

    -

    Version 10.0.15063

    FIPS186-4:
    -PQG(ver)PARMS TESTED:       [(1024,160) SHA(1)]
    -SIG(ver)PARMS TESTED:   [(1024,160) SHA(1)]
    -SHS: validation number 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188

    -

    Version 7.00.2872

    FIPS186-4:
    -PQG(ver)PARMS TESTED:       [(1024,160) SHA(1)]
    -SIG(ver)PARMS TESTED:   [(1024,160) SHA(1)]
    -SHS: validation number 3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187

    -

    Version 8.00.6246

    FIPS186-4:
    -PQG(gen)    PARMS TESTED: [
    -(2048,256)SHA(256); (3072,256) SHA(256)]
    -PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    -KeyPairGen:    [(2048,256); (3072,256)]
    -SIG(gen)PARMS TESTED:   [(2048,256)
    -SHA(256); (3072,256) SHA(256)]
    -SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    -

    SHS: validation number 3347
    -DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098

    -

    Version 10.0.14393

    FIPS186-4:
    -PQG(gen)    PARMS TESTED:   [(2048,256)SHA(256); (3072,256) SHA(256)] PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    -KeyPairGen:    [(2048,256); (3072,256)] SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    -SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    -

    SHS: validation number 3047
    -DRBG: validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024

    -

    Version 10.0.10586

    FIPS186-4:
    -PQG(gen)    PARMS TESTED:   [(2048,256)SHA(256); (3072,256) SHA(256)]
    -PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    -KeyPairGen:    [(2048,256); (3072,256)]
    -SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)] SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    -

    SHS: validation number 2886
    -DRBG: validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983

    -

    Version 10.0.10240

    FIPS186-4:
    -PQG(gen)    PARMS TESTED:   [
    -(2048,256)SHA(256); (3072,256) SHA(256)]
    -PQG(ver)PARMS TESTED:   [(2048,256)
    -SHA(256); (3072,256) SHA(256)]
    -KeyPairGen:    [(2048,256); (3072,256)]
    -SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    -SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    -

    SHS: validation number 2373
    -DRBG: validation number 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855

    -

    Version 6.3.9600

    FIPS186-2:
    -PQG(ver) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: #1903
    -DRBG: #258

    -

    FIPS186-4:
    -PQG(gen)PARMS TESTED    : [(2048,256)SHA(256); (3072,256) SHA(256)]
    -PQG(ver)PARMS TESTED: [(2048,256) SHA(256); (3072,256) SHA(256)]
    -SIG(gen)PARMS TESTED: [(2048,256) SHA(256); (3072,256) SHA(256)]
    -SIG(ver)PARMS TESTED: [(2048,256) SHA(256); (3072,256) SHA(256)]
    -SHS: #1903
    -DRBG: #258
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 687.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687
    FIPS186-2:
    -PQG(ver)     MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: #1902
    -DRBG: #258
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 686.    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686
    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: validation number 1773
    -DRBG: validation number 193
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 645.    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645
    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: validation number 1081
    -DRBG: validation number 23
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 391. See Historical DSA List validation number 386.

    Windows Server 2008 R2 and SP1 CNG algorithms #391

    -

    Windows 7 Ultimate and SP1 CNG algorithms #386

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: validation number 1081
    -RNG: validation number 649
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 390. See Historical DSA List validation number 385.

    Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390

    -

    Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: validation number 753
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 284. See Historical DSA List validation number 283.

    Windows Server 2008 CNG algorithms #284

    -

    Windows Vista Ultimate SP1 CNG algorithms #283

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: validation number 753
    -RNG: validation number 435
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 282. See Historical DSA List validation number 281.

    Windows Server 2008 Enhanced DSS (DSSENH) #282

    -

    Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: validation number 618
    -RNG: validation number 321
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 227. See Historical DSA List validation number 226.

    Windows Vista CNG algorithms #227

    -

    Windows Vista Enhanced DSS (DSSENH) #226

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: validation number 784
    -RNG: validation number 448
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 292.    		Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292
    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: validation number 783
    -RNG: validation number 447
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 291.    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291
    FIPS186-2:
    -PQG(gen)     MOD(1024);
    -PQG(ver) MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: validation number 611
    -RNG: validation number 314    		Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221
    FIPS186-2:
    -PQG(gen)     MOD(1024);
    -PQG(ver) MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: validation number 385    		Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146
    FIPS186-2:
    -PQG(ver)     MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: validation number 181
    -
    -    		Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95
    FIPS186-2:
    -PQG(gen)     MOD(1024);
    -PQG(ver) MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SHS: SHA-1 (BYTE)
    -SIG(ver) MOD(1024);
    -SHS: SHA-1 (BYTE)

    Windows 2000 DSSENH.DLL #29

    -

    Windows 2000 DSSBASE.DLL #28

    -

    Windows NT 4 SP6 DSSENH.DLL #26

    -

    Windows NT 4 SP6 DSSBASE.DLL #25

    FIPS186-2: PRIME;
    -FIPS186-2:

    -

    KEYGEN(Y):
    -SHS: SHA-1 (BYTE)

    -

    SIG(gen):
    -SIG(ver)     MOD(1024);
    -SHS: SHA-1 (BYTE)

    		Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17
    - - -#### Elliptic Curve Digital Signature Algorithm (ECDSA) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #2373, DRBG #489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263

    -

    Version 6.3.9600

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384
            • -
          • Generation Methods: Testing Candidates
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #1253

    -

    Version 10.0.15063.674

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384
            • -
          • Generation Methods: Testing Candidates
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252

    -

    Version 10.0.16299

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1251

    -

    Version 10.0.15063.674

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1250

    -

    Version 10.0.15063.674

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1249

    -

    Version 10.0.15254

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1248

    -

    Version 10.0.15254

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247

    -

    Version 10.0.16299

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246

    -

    Version 10.0.16299

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 TestingCandidates)
    -SHS: validation number 3790
    -DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136

    -

    Version 10.0.15063

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -PKV: CURVES(P-256 P-384 P-521)
    -SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    -SHS: validation number 3790
    -DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135

    -

    Version 10.0.15063

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -PKV: CURVES(P-256 P-384 P-521)
    -SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    -SHS: validation number 3790
    -DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133

    -

    Version 10.0.15063

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -PKV: CURVES(P-256 P-384 P-521)
    -SigGen: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SigVer: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512))
    -SHS:validation number 3649
    -DRBG:validation number 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073

    -

    Version 7.00.2872

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -PKV: CURVES(P-256 P-384 P-521)
    -SigGen: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SigVer: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512))
    -SHS:validation number 3648
    -DRBG:validation number 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072

    -

    Version 8.00.6246

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 TestingCandidates)
    -PKV: CURVES(P-256 P-384)
    -SigGen: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SigVer: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384))

    -

    SHS: validation number 3347
    -DRBG: validation number 1222

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920

    -

    Version 10.0.14393

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -PKV: CURVES(P-256 P-384 P-521)
    -SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    -

    SHS: validation number 3347
    -DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911

    -

    Version 10.0.14393

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    -

    SHS: validation number 3047
    -DRBG: validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760

    -

    Version 10.0.10586

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    -

    SHS: validation number 2886
    -DRBG: validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706

    -

    Version 10.0.10240

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    -

    SHS: validation number 2373
    -DRBG: validation number 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505

    -

    Version 6.3.9600

    FIPS186-2:
    -PKG: CURVES    (P-256 P-384 P-521)
    -SHS: #1903
    -DRBG: #258
    -SIG(ver): CURVES(P-256 P-384 P-521)
    -SHS: #1903
    -DRBG: #258

    -

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    -SHS: #1903
    -DRBG: #258
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 341.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341

    FIPS186-2:
    -PKG: CURVES    (P-256 P-384 P-521)
    -SHS: validation number 1773
    -DRBG: validation number 193
    -SIG(ver): CURVES(P-256 P-384 P-521)
    -SHS: validation number 1773
    -DRBG: validation number 193

    -

    FIPS186-4:
    -PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    -SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    -SHS: validation number 1773
    -DRBG: validation number 193
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 295.

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295
    FIPS186-2:
    -PKG: CURVES    (P-256 P-384 P-521)
    -SHS: validation number 1081
    -DRBG: validation number 23
    -SIG(ver): CURVES(P-256 P-384 P-521)
    -SHS: validation number 1081
    -DRBG: validation number 23
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 142. See Historical ECDSA List validation number 141.

    Windows Server 2008 R2 and SP1 CNG algorithms #142

    -

    Windows 7 Ultimate and SP1 CNG algorithms #141

    FIPS186-2:
    -PKG: CURVES    (P-256 P-384 P-521)
    -SHS: validation number 753
    -SIG(ver): CURVES(P-256 P-384 P-521)
    -SHS: validation number 753
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 83. See Historical ECDSA List validation number 82.

    Windows Server 2008 CNG algorithms #83

    -

    Windows Vista Ultimate SP1 CNG algorithms #82

    FIPS186-2:
    -PKG: CURVES    (P-256 P-384 P-521)
    -SHS: validation number 618
    -RNG: validation number 321
    -SIG(ver): CURVES(P-256 P-384 P-521)
    -SHS: validation number 618
    -RNG: validation number 321
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 60.    		Windows Vista CNG algorithms #60
    - - -#### Keyed-Hash Message Authentication Code (HMAC) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4011

    Microsoft Surface Hub Virtual TPM Implementations #3271

    -

    Version 10.0.15063.674

      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4009

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270

    -

    Version 10.0.16299

      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-512:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4011

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #3269

    -

    Version 10.0.15063.674

      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-512:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4010

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #3268

    -

    Version 10.0.15254

      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-512:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4009

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267

    -

    Version 10.0.16299

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3790

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062

    -

    Version 10.0.15063

    HMAC-SHA1(Key Sizes Ranges Tested: KSBS) SHS validation number 3790

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061

    -

    Version 10.0.15063

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3652

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3652

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3652

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946

    -

    Version 7.00.2872

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3651

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3651

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3651

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945

    -

    Version 8.00.6246

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3649

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3649

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3649

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943

    -

    Version 7.00.2872

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3648

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3648

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3648

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942

    -

    Version 8.00.6246

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    -SHS validation number 3347

    -

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    -SHS validation number 3347

    -

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    -SHS validation number 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661

    -

    Version 10.0.14393

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3347

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3347

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3347

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS validation number 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651

    -

    Version 10.0.14393

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    -SHS validation number 3047

    -

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    -SHS validation number 3047

    -

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    -SHS validation number 3047

    -

    HMAC-SHA512 (Key Size Ranges Tested:  KSBS)
    -SHS validation number 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381

    -

    Version 10.0.10586

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    -SHSvalidation number 2886

    -

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    -SHSvalidation number 2886

    -

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    - SHSvalidation number 2886

    -

    HMAC-SHA512 (Key Size Ranges Tested:  KSBS)
    -SHSvalidation number 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233

    -

    Version 10.0.10240

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    -SHS validation number 2373

    -

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    -SHS validation number 2373

    -

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    -SHS validation number 2373

    -

    HMAC-SHA512 (Key Size Ranges Tested:  KSBS)
    -SHS validation number 2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773

    -

    Version 6.3.9600

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 2764

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 2764

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 2764

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS validation number 2764

    Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122

    -

    Version 5.2.29344

    HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902

    -

    HMAC-SHA256 (Key Size Ranges Tested: KS#1902

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS#1902

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS#1902

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS#1902

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS#1902

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS)

    -

    SHS#1903

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS)

    -

    SHS#1903

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS)

    -

    SHS#1903

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS)

    -

    SHS#1903

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 1773

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 1773

    -

    Tinker HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 1773

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 1773

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 1774

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 1774

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 1774

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 1774

    		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 1081

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 1081

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 1081

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 1081

    Windows Server 2008 R2 and SP1 CNG algorithms #686

    -

    Windows 7 and SP1 CNG algorithms #677

    -

    Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687

    -

    Windows 7 Enhanced Cryptographic Provider (RSAENH) #673

    HMAC-SHA1(Key Sizes Ranges Tested: KSvalidation number 1081

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 1081

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 816

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 816

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 816

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 816

    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452

    HMAC-SHA1 (Key Sizes Ranges Tested: KSvalidation number 753

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 753

    		Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 753

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS)SHS validation number 753

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408

    -

    Windows Vista Enhanced Cryptographic Provider (RSAENH) #407

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS)SHSvalidation number 618

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    		Windows Vista Enhanced Cryptographic Provider (RSAENH) #297
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 785

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429

    -

    Windows XP, vendor-affirmed

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 783

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 783

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 783

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 783

    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 613

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 613

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 613

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 613

    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 610Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 753

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    Windows Server 2008 CNG algorithms #413

    -

    Windows Vista Ultimate SP1 CNG algorithms #412

    HMAC-SHA1 (Key Sizes Ranges Tested: KSvalidation number 737

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 737

    		Windows Vista Ultimate BitLocker Drive Encryption #386

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 618

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    		Windows Vista CNG algorithms #298

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 589

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS)SHSvalidation number 589

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 589

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 589

    		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 578

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 578

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 578

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 578

    		Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260

    HMAC-SHA1 (Key Sizes Ranges Tested: KSvalidation number 495

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 495

    		Windows Vista BitLocker Drive Encryption #199
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 364

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99

    -

    Windows XP, vendor-affirmed

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 305

    -

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 305

    -

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 305

    -

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 305

    		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31
    - - -#### Key Agreement Scheme (KAS) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Full Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, ECDSA #1253, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #150

    -

    Version 10.0.15063.674

      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Full Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, ECDSA #1252, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149

    -

    Version 10.0.16299

      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Ephemeral Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • One-Pass DH:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • Static Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, ECDSA #1250, DRBG #1732

    -
      -
    • KAS FFC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • -
      • Schemes:
        • -
        • -
        • dhEphem:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhOneFlow:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhStatic:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DSA #1303, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #148

    -

    Version 10.0.15063.674

      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Ephemeral Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • One-Pass DH:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • Static Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, ECDSA #1249, DRBG #1731

    -
      -
    • KAS FFC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • -
      • Schemes:
        • -
        • -
        • dhEphem:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhOneFlow:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhStatic:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DSA #1302, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #147

    -

    Version 10.0.15254

      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Ephemeral Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • One-Pass DH:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • Static Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, ECDSA #1246, DRBG #1730

    -
      -
    • KAS FFC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • -
      • Schemes:
        • -
        • -
        • dhEphem:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhOneFlow:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhStatic:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DSA #1301, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146

    -

    Version 10.0.16299

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration) SCHEMES [FullUnified (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC)]

    -

    SHS validation number 3790
    -DSA validation number 1135
    -DRBG validation number 1556

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128

    -

    Version 10.0.15063

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    -(FB: SHA256) (FC: SHA256)]
    -[dhOneFlow (FB: SHA256) (FC: SHA256)] [dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB: SHA256 HMAC) (FC: SHA256   HMAC)]
    -SHS validation number 3790
    -DSA validation number 1223
    -DRBG validation number 1555

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [EphemeralUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    -[OnePassDH (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    -[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    -
    -SHS validation number 3790
    -ECDSA validation number 1133
    -DRBG validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127

    -

    Version 10.0.15063

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    -(FB: SHA256) (FC: SHA256)]
    -[dhOneFlow (KARole(s): Initiator / Responder) (FB: SHA256) (FC: SHA256)] [dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB: SHA256 HMAC) (FC: SHA256   HMAC)]
    -SHS validation number 3649
    -DSA validation number 1188
    -DRBG validation number 1430

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES [EphemeralUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    -[OnePassDH (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    -[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115

    -

    Version 7.00.2872

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    -(FB: SHA256) (FC: SHA256)]
    -[dhHybridOneFlow (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB:SHA256 HMAC) (FC: SHA256   HMAC)]
    -[dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB:SHA256 HMAC) (FC: SHA256   HMAC)]
    -SHS validation number 3648
    -DSA validation number 1187
    -DRBG validation number 1429

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES [EphemeralUnified (No_KC) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    -[OnePassDH (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    -[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    -
    -SHS validation number 3648
    -ECDSA validation number 1072
    -DRBG validation number 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114

    -

    Version 8.00.6246

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration)
    -SCHEMES  [FullUnified  (No_KC  &lt; KARole(s): Initiator / Responder &gt; &lt; KDF: CONCAT &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC)]

    -

    SHS validation number 3347 ECDSA validation number 920 DRBG validation number 1222

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93

    -

    Version 10.0.14393

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation)
    -SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    -(FB: SHA256) (FC: SHA256)]
    -[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    -

    SHS validation number 3347 DSA validation number 1098 DRBG validation number 1217

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    -[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    -[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    -

    SHS validation number 3347 DSA validation number 1098 ECDSA validation number 911 DRBG validation number 1217 HMAC validation number 2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92

    -

    Version 10.0.14393

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    -(FB: SHA256) (FC: SHA256)]
    -[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    -

    SHS validation number 3047 DSA validation number 1024 DRBG validation number 955

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    -[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    -[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    -

    SHS validation number 3047 ECDSA validation number 760 DRBG validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72

    -

    Version 10.0.10586

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    -(FB: SHA256) (FC: SHA256)]
    -[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    -

    SHS validation number 2886 DSA validation number 983 DRBG validation number 868

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    -[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    -[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    -

    SHS validation number 2886 ECDSA validation number 706 DRBG validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64

    -

    Version 10.0.10240

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    -(FB: SHA256) (FC: SHA256)]
    -[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    -

    SHS validation number 2373 DSA validation number 855 DRBG validation number 489

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    -[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    -[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    -

    SHS validation number 2373 ECDSA validation number 505 DRBG validation number 489

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47

    -

    Version 6.3.9600

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    -(FA: SHA256) (FB: SHA256) (FC: SHA256)]
    -[dhOneFlow (KARole(s): Initiator / Responder) (FA: SHA256) (FB: SHA256) (FC: SHA256)]
    -[dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FA: SHA256 HMAC) (FB: SHA256 HMAC) (FC: SHA256 HMAC)]
    -SHS #1903 DSA validation number 687 DRBG #258

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration) SCHEMES [EphemeralUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256 SHA256 HMAC) (ED: P-384 SHA384 HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    -[OnePassDH(No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256 SHA256) (ED: P-384 SHA384) (EE: P-521 (SHA512, HMAC_SHA512)))]
    -[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256 SHA256 HMAC) (ED: P-384 SHA384 HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512))]
    -
    -SHS #1903 ECDSA validation number 341 DRBG #258

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36

    KAS (SP 800–56A)

    -

    key agreement

    -

    key establishment methodology provides 80 bits to 256 bits of encryption strength

    Windows 7 and SP1, vendor-affirmed

    -

    Windows Server 2008 R2 and SP1, vendor-affirmed

    - - -SP 800-108 Key-Based Key Derivation Functions (KBKDF) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • Counter:
      • -
      • -
      • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
        • -
      • -
    -

    MAC prerequisite: HMAC #3271

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    -
    -

    K prerequisite: DRBG #1734, KAS #150

    Microsoft Surface Hub Virtual TPM Implementations #161

    -

    Version 10.0.15063.674

      -
    • Counter:
      • -
      • -
      • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
        • -
      • -
    -

    MAC prerequisite: HMAC #3270

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    -
    -

    K prerequisite: DRBG #1733, KAS #149

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160

    -

    Version 10.0.16299

      -
    • Counter:
      • -
      • -
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • -
      • -
    -

    MAC prerequisite: AES #4902, HMAC #3269

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    • K prerequisite: KAS #148
      • -
    -

    Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #159

    -

    Version 10.0.15063.674

      -
    • Counter:
      • -
      • -
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • -
      • -
    -

    MAC prerequisite: AES #4901, HMAC #3268

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    -
    -

    K prerequisite: KAS #147

    Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #158

    -

    Version 10.0.15254

      -
    • Counter:
      • -
      • -
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • -
      • -
    -

    MAC prerequisite: AES #4897, HMAC #3267

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    -
    -

    K prerequisite: KAS #146

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157

    -

    Version 10.0.16299

    CTR_Mode: (Llength(Min0 Max0) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA384]) LocationCounter([BeforeFixedData]) rlength([32]))
    -
    -KAS validation number 128
    -DRBG validation number 1556
    -MAC validation number 3062

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141

    -

    Version 10.0.15063

    CTR_Mode: (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))
    -
    -KAS validation number 127
    -AES validation number 4624
    -DRBG validation number 1555
    -MAC validation number 3061

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140

    -

    Version 10.0.15063

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA384]) LocationCounter([BeforeFixedData]) rlength([32]))

    -

    KAS validation number 93 DRBG validation number 1222 MAC validation number 2661

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102

    -

    Version 10.0.14393

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    -

    KAS validation number 92 AES validation number 4064 DRBG validation number 1217 MAC validation number 2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101

    -

    Version 10.0.14393

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    -

    KAS validation number 72 AES validation number 3629 DRBG validation number 955 MAC validation number 2381

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72

    -

    Version 10.0.10586

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    -

    KAS validation number 64 AES validation number 3497 RBG validation number 868 MAC validation number 2233

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66

    -

    Version 10.0.10240

    CTR_Mode:  (Llength(Min0 Max0) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    -

    DRBG validation number 489 MAC validation number 1773

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30

    -

    Version 6.3.9600

    CTR_Mode: (Llength(Min0 Max4) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    -

    DRBG #258 HMAC validation number 1345

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3
    - - -Random Number Generator (RNG) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #

    FIPS 186-2 General Purpose

    -

    [(x-Original); (SHA-1)]

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110
    FIPS 186-2
    -[(x-Original); (SHA-1)]

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060

    -

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292

    -

    Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286

    -

    Windows CE 5.00 and Window CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66

    FIPS 186-2
    -[(x-Change Notice); (SHA-1)]

    -

    FIPS 186-2 General Purpose
    -[(x-Change Notice); (SHA-1)]

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649

    -

    Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435

    -

    Windows Vista RNG implementation #321

    FIPS 186-2 General Purpose
    -[(x-Change Notice); (SHA-1)]

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470

    -

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449

    -

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #316

    -

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313

    FIPS 186-2
    -[(x-Change Notice); (SHA-1)]

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448

    -

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314

    - - -#### RSA - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #2677

    -

    Version 10.0.15063.674

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 240 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676

    -

    Version 10.0.16299

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub RSA32 Algorithm Implementations #2675

    -

    Version 10.0.15063.674

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674

    -

    Version 10.0.16299

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) RSA32 Algorithm Implementations #2673

    -

    Version 10.0.15254

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Public Key Exponent: Fixed (10001)
          • -
        • Provable Primes with Conditions:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.3
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #2672

    -

    Version 10.0.15063.674

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Probable Random Primes:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.2
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #2671

    -

    Version 10.0.15063.674

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Probable Random Primes:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.2
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2670

    -

    Version 10.0.15254

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Public Key Exponent: Fixed (10001)
          • -
        • Provable Primes with Conditions:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.3
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #2669

    -

    Version 10.0.15254

      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Public Key Exponent: Fixed (10001)
          • -
        • Provable Primes with Conditions:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.3
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668

    -

    Version 10.0.16299

      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Probable Random Primes:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.2
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667

    -

    Version 10.0.16299

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(1, 256, 384)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA(1, 256, 384)) (2048 SHA(1, 256, 384))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48)))
    -SHA validation number 3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524

    -

    Version 10.0.15063

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    -SHA validation number 3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523

    -

    Version 10.0.15063

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    -PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    -SHA validation number 3790
    -DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522

    -

    Version 10.0.15063

    FIPS186-4:
    -186-4KEY(gen):
    -PGM(ProbRandom:     (2048, 3072) PPTT:(C.2)
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    -SHA validation number 3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521

    -

    Version 10.0.15063

    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3652
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096, SHS: SHA-256validation number 3652, SHA-384validation number 3652, SHA-512validation number 3652
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3652, SHA-256validation number 3652, SHA-384validation number 3652, SHA-512validation number 3652

    -

    FIPS186-4:
    -ALG[ANSIX9.31]     Sig(Gen): (2048 SHA(1)) (3072 SHA(1))
    -SIG(gen) with SHA-1 affirmed for use with protocols only.     Sig(Ver): (1024 SHA(1)) (2048 SHA(1)) (3072 SHA(1))
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    -SHA validation number 3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415

    -

    Version 7.00.2872

    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3651
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096, SHS: SHA-256validation number 3651, SHA-384validation number 3651, SHA-512validation number 3651
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3651, SHA-256validation number 3651, SHA-384validation number 3651, SHA-512validation number 3651

    -

    FIPS186-4:
    -ALG[ANSIX9.31]     Sig(Gen): (2048 SHA(1)) (3072 SHA(1))
    -SIG(gen) with SHA-1 affirmed for use with protocols only.     Sig(Ver): (1024 SHA(1)) (2048 SHA(1)) (3072 SHA(1))
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    -SHA validation number 3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414

    -

    Version 8.00.6246

    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 4096, SHS: SHA-256validation number 3649, SHA-384validation number 3649, SHA-512validation number 3649
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3649, SHA-256validation number 3649, SHA-384validation number 3649, SHA-512validation number 3649

    -

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    -PGM(ProbRandom: (2048, 3072) PPTT:(C.2)
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    -SHA validation number 3649
    -DRBG: validation number 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412

    -

    Version 7.00.2872

    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 4096, SHS: SHA-256validation number 3648, SHA-384validation number 3648, SHA-512validation number 3648
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3648, SHA-256validation number 3648, SHA-384validation number 3648, SHA-512validation number 3648

    -

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    -PGM(ProbRandom: (2048, 3072) PPTT:(C.2)
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    -SHA validation number 3648
    -DRBG: validation number 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411

    -

    Version 8.00.6246

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(1, 256, 384)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SIG(Ver) (1024 SHA(1, 256, 384)) (2048 SHA(1, 256, 384))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48)))

    -

    SHA validation number 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206

    -

    Version 10.0.14393

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    -PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    -

    SHA validation number 3347 DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195

    -

    Version 10.0.14393

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    -

    SHA validation number 3346

    soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194

    -

    Version 10.0.14393

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    -SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    -

    SHA validation number 3347 DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193

    -

    Version 10.0.14393

    FIPS186-4:
    -[RSASSA-PSS]: Sig(Gen):     (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    -

    Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    -

    SHA validation number 3347 DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192

    -

    Version 10.0.14393

    FIPS186-4:
    -186-4KEY(gen)    :  FIPS186-4_Fixed_e (10001);
    -PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    -

    SHA validation number 3047 DRBG: validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889

    -

    Version 10.0.10586

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    -

    SHA validation number 3048

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871

    -

    Version 10.0.10586

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    -SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    -

    SHA validation number 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888

    -

    Version 10.0.10586

    FIPS186-4:
    -[RSASSA-PSS]: Sig(Gen)    : (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    -Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    -

    SHA validation number 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887

    -

    Version 10.0.10586

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    -PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    -

    SHA validation number 2886 DRBG: validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798

    -

    Version 10.0.10240

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    -

    SHA validation number 2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784

    -

    Version 10.0.10240

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    -

    SHA validation number 2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783

    -

    Version 10.0.10240

    FIPS186-4:
    -[RSASSA-PSS]:     Sig(Gen): (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    -Sig(Ver): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    -

    SHA validation number 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802

    -

    Version 10.0.10240

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e;
    -PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    -

    SHA validation number 2373 DRBG: validation number 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487

    -

    Version 6.3.9600

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    -

    SHA validation number 2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494

    -

    Version 6.3.9600

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5    ] SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    -SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    -

    SHA validation number 2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493

    -

    Version 6.3.9600

    FIPS186-4:
    -[RSASSA-PSS]:     Sig(Gen): (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    - Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    -

    SHA validation number 2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519

    -

    Version 6.3.9600

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(256, 384, 512-256)) (3072 SHA(256, 384, 512-256))
    -SIG(Ver) (1024 SHA(1, 256, 384, 512-256)) (2048 SHA(1, 256, 384, 512-256)) (3072 SHA(1, 256, 384, 512-256))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    -Sig(Ver): (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512, 512))
    -SHA #1903

    -

    Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1134.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134
    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e, FIPS186-4_Fixed_e_Value
    -PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)
    -SHA #1903 DRBG: #258    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133
    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 DRBG: #258
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1132.    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1774
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1774, SHA-384validation number 1774, SHA-512validation number 1774,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1774, SHA-256validation number 1774, SHA-384validation number 1774, SHA-512validation number 1774,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1052.    		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052
    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 DRBG: validation number 193
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1773, SHA-384validation number 1773, SHA-512validation number 1773,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1773, SHA-256validation number 1773, SHA-384validation number 1773, SHA-512validation number 1773,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1051.    		Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 568.    		Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    -ALG[RSASSA-PSS]: SIG(gen); 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 567. See Historical RSA List validation number 560.

    Windows Server 2008 R2 and SP1 CNG algorithms #567

    -

    Windows 7 and SP1 CNG algorithms #560

    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 DRBG: validation number 23
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 559.    		Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 557.    		Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 816, SHA-384validation number 816, SHA-512validation number 816,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 816, SHA-256validation number 816, SHA-384validation number 816, SHA-512validation number 816,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 395.    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 783
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 783, SHA-384validation number 783, SHA-512validation number 783,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 371.    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753, SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    -ALG[RSASSA-PSS]: SIG(gen); 2048, 3072, 4096, SHS: SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753, SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 358. See Historical RSA List validation number 357.

    Windows Server 2008 CNG algorithms #358

    -

    Windows Vista SP1 CNG algorithms #357

    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753, SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 355. See Historical RSA List validation number 354.

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355

    -

    Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354

    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 353.    		Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353
    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 RNG: validation number 321
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 258.    		Windows Vista RSA key generation implementation #258
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 618, SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    -ALG[RSASSA-PSS]: SIG(gen); 2048, 3072, 4096, SHS: SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 618, SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 257.    		Windows Vista CNG algorithms #257
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 618, SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 255.    		Windows Vista Enhanced Cryptographic Provider (RSAENH) #255
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 613
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 613, SHA-384validation number 613, SHA-512validation number 613,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 613, SHA-256validation number 613, SHA-384validation number 613, SHA-512validation number 613,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 245.    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 589
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 589, SHA-384validation number 589, SHA-512validation number 589,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 589, SHA-256validation number 589, SHA-384validation number 589, SHA-512validation number 589,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 230.    		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 578
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 578, SHA-384validation number 578, SHA-512validation number 578,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 578, SHA-256validation number 578, SHA-384validation number 578, SHA-512validation number 578,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 222.    		Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 364
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 81.    		Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 305
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 305, SHA-384validation number 305, SHA-512validation number 305,
    -SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 305, SHA-256validation number 305, SHA-384validation number 305, SHA-512validation number 305,
    -Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 52.    		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52

    FIPS186-2:

    -

    – PKCS#1 v1.5, signature generation, and verification

    -

    – Mod sizes: 1024, 1536, 2048, 3072, 4096

    -

    – SHS: SHA–1/256/384/512

    Windows XP, vendor-affirmed

    -

    Windows 2000, vendor-affirmed

    - - -#### Secure Hash Standard (SHS) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • SHA-1:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-256:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-384:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-512:
      • -
      • -
      • Supports Empty Message
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #4011

    -

    Version 10.0.15063.674

      -
    • SHA-1:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-256:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-384:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-512:
      • -
      • -
      • Supports Empty Message
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4010

    -

    Version 10.0.15254

      -
    • SHA-1:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-256:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-384:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-512:
      • -
      • -
      • Supports Empty Message
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009

    -

    Version 10.0.16299

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790

    -

    Version 10.0.15063

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652

    -

    Version 7.00.2872

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651

    -

    Version 8.00.6246

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649

    -

    Version 7.00.2872

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648

    -

    Version 8.00.6246

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
    -Version 10.0.14393
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
    -Version 10.0.14393
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
    -Version 10.0.10586
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
    -Version 10.0.10586
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
    -Version 10.0.10240
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
    -Version 10.0.10240
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
    -Version 6.3.9600
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
    -Version 6.3.9600

    SHA-1 (BYTE-only)

    -

    SHA-256 (BYTE-only)

    -

    SHA-384 (BYTE-only)

    -

    SHA-512 (BYTE-only)

    -

    Implementation does not support zero-length (null) messages.

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903

    -

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774

    -

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

    SHA-1 (BYTE-only)

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785

    -

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753

    -

    Windows Vista Symmetric Algorithm Implementation #618

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)

    Windows Vista BitLocker Drive Encryption #737

    -

    Windows Vista Beta 2 BitLocker Drive Encryption #495

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613

    -

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364

    SHA-1 (BYTE-only)

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611

    -

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610

    -

    Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385

    -

    Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #371

    -

    Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #181

    -

    Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #177

    -

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589

    -

    Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578

    -

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305

    SHA-1 (BYTE-only)

    Windows XP Microsoft Enhanced Cryptographic Provider #83

    -

    Crypto Driver for Windows 2000 (fips.sys) #35

    -

    Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32

    -

    Windows 2000 RSAENH.DLL #24

    -

    Windows 2000 RSABASE.DLL #23

    -

    Windows NT 4 SP6 RSAENH.DLL #21

    -

    Windows NT 4 SP6 RSABASE.DLL #20

    - - -#### Triple DES - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • TDES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB64:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #2558

    -

    Version 10.0.15063.674

      -
    • TDES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB64:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2557

    -

    Version 10.0.15254

      -
    • TDES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB64:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556

    -

    Version 10.0.16299

    TECB(KO 1 e/d); TCBC(KO 1 e/d); TCFB8(KO 1 e/d); TCFB64(KO 1 e/d)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459

    -

    Version 10.0.15063

    TECB(KO 1 e/d);

    -

    TCBC(KO 1 e/d)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384

    -

    Version 8.00.6246

    TECB(KO 1 e/d);

    -

    TCBC(KO 1 e/d)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383

    -

    Version 8.00.6246

    TECB(KO 1 e/d);

    -

    TCBC(KO 1 e/d);

    -

    CTR (int only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382

    -

    Version 7.00.2872

    TECB(KO 1 e/d);

    -

    TCBC(KO 1 e/d)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381

    -

    Version 8.00.6246

    TECB(KO 1 e/d);

    -

    TCBC(KO 1 e/d);

    -

    TCFB8(KO 1 e/d);

    -

    TCFB64(KO 1 e/d)

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227
    -
    -

    -

    Version 10.0.14393

    TECB(KO 1 e/d);

    -

    TCBC(KO 1 e/d);

    -

    TCFB8(KO 1 e/d);

    -

    TCFB64(KO 1 e/d)

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024
    -
    -

    -

    Version 10.0.10586

    TECB(KO 1 e/d);

    -

    TCBC(KO 1 e/d);

    -

    TCFB8(KO 1 e/d);

    -

    TCFB64(KO 1 e/d)

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969
    -
    -

    -

    Version 10.0.10240

    TECB(KO 1 e/d);

    -

    TCBC(KO 1 e/d);

    -

    TCFB8(KO 1 e/d);

    -

    TCFB64(KO 1 e/d)

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692

    -

    Version 6.3.9600

    TECB(e/d; KO 1, 2);

    -

    TCBC(e/d; KO 1, 2);

    -

    TCFB8(e/d; KO 1, 2);

    -

    TCFB64(e/d; KO 1, 2)

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387

    TECB(e/d; KO 1, 2);

    -

    TCBC(e/d; KO 1, 2);

    -

    TCFB8(e/d; KO 1, 2)

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386

    TECB(e/d; KO 1, 2);

    -

    TCBC(e/d; KO 1, 2);

    -

    TCFB8(e/d; KO 1, 2)

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846

    TECB(e/d; KO 1, 2);

    -

    TCBC(e/d; KO 1, 2);

    -

    TCFB8(e/d; KO 1, 2)

    		Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656

    TECB(e/d; KO 1, 2);

    -

    TCBC(e/d; KO 1, 2);

    -

    TCFB8(e/d; KO 1, 2)

    		Windows Vista Symmetric Algorithm Implementation #549
    Triple DES MAC

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed

    -

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed

    TECB(e/d; KO 1, 2);

    -

    TCBC(e/d; KO 1, 2)

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308

    -

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691

    -

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #677

    -

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #676

    -

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #675

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #544

    -

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #543

    -

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #542

    -

    Windows CE 6.0 and Window CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #526

    -

    Windows CE and Windows Mobile 6 and Windows Mobile 6.1 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #517

    -

    Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #381

    -

    Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #370

    -

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #365

    -

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #315

    -

    Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #201

    -

    Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #199

    -

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #192

    -

    Windows XP Microsoft Enhanced Cryptographic Provider #81

    -

    Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #18

    -

    Crypto Driver for Windows 2000 (fips.sys) #16

    - - -#### SP 800-132 Password-Based Key Derivation Function (PBKDF) - - - - - - - - - - - - - - -
    - Modes / States / Key Sizes - - Algorithm Implementation and Certificate # -
    - PBKDF (vendor affirmed) -

     Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
    (Software Version: 10.0.14393)

    -

    Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    -

    Code Integrity (ci.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2935
    (Software Version: 10.0.14393)

    -

    Boot Manager in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2931
    (Software Version: 10.0.14393)

    -
    - PBKDF (vendor affirmed) -

    Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    -

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed

    -
    - - -#### Component Validation List - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Publication / Component Validated / DescriptionImplementation and Certificate #
      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540

    -

    Version 6.3.9600

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Microsoft Surface Hub Virtual TPM Implementations #1519

    -

    Version 10.0.15063.674

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518

    -

    Version 10.0.16299

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1517

    -

    Version 10.0.15063.674

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1516

    -

    Version 10.0.15063.674

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

     Prerequisite: DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1515

    -

    Version 10.0.15063.674

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1514

    -

    Version 10.0.15063.674

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1513

    -

    Version 10.0.15063.674

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1512

    -

    Version 10.0.15063.674

      -
    • IKEv1:
      • -
      • -
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • -
      • Pre-shared Key Length: 64-2048
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, HMAC #3269

    -
      -
    • IKEv2:
      • -
      • -
      • Derived Keying Material length: 192-1792
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, HMAC #3269

    -
      -
    • TLS:
      • -
      • -
      • Supports TLS 1.0/1.1
        • -
      • Supports TLS 1.2:
        • -
        • -
        • SHA Functions: SHA-256, SHA-384
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, HMAC #3269

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1511

    -

    Version 10.0.15063.674

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1510

    -

    Version 10.0.15254

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1509

    -

    Version 10.0.15254

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1508

    -

    Version 10.0.15254

      -
    • IKEv1:
      • -
      • -
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • -
      • Pre-shared Key Length: 64-2048
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, HMAC #3268

    -
      -
    • IKEv2:
      • -
      • -
      • Derived Keying Material length: 192-1792
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, HMAC #3268

    -
      -
    • TLS:
      • -
      • -
      • Supports TLS 1.0/1.1
        • -
      • Supports TLS 1.2:
        • -
        • -
        • SHA Functions: SHA-256, SHA-384
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, HMAC #3268

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1507

    -

    Version 10.0.15254

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1506

    -

    Version 10.0.15254

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1505

    -

    Version 10.0.15254

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1504

    -

    Version 10.0.15254

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503

    -

    Version 10.0.16299

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502

    -

    Version 10.0.16299

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501

    -

    Version 10.0.16299

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499

    -

    Version 10.0.16299

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498

    -

    Version 10.0.16299

    -

     

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1497

    -

    Version 10.0.16299

      -
    • IKEv1:
      • -
      • -
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • -
      • Pre-shared Key Length: 64-2048
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, HMAC #3267

    -
      -
    • IKEv2:
      • -
      • -
      • Derived Keying Material length: 192-1792
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, HMAC #3267

    -
      -
    • TLS:
      • -
      • -
      • Supports TLS 1.0/1.1
        • -
      • Supports TLS 1.2:
        • -
        • -
        • SHA Functions: SHA-256, SHA-384
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, HMAC #3267

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    -

    Version 10.0.16299

    FIPS186-4 ECDSA

    -

    Signature Generation of hash sized messages

    -

    ECDSA SigGen Component: CURVES(P-256 P-384 P-521)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
    -Version 10.0. 15063

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
    -Version 10.0. 15063

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
    -Version 10.0.14393

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
    -Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
    -Version 10.0.10586

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
    -Version 6.3.9600

    FIPS186-4 RSA; PKCS#1 v2.1

    -

    RSASP1 Signature Primitive

    -

    RSASP1: (Mod2048: PKCS1.5 PKCSPSS)

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1285
    -Version 10.0.15063

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1282
    -Version 10.0.15063

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
    -Version 10.0.15063

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
    -Version 10.0.14393

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
    -Version 10.0.14393

    -

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
    -Version 10.0.10586

    -

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
    -Version  10.0.10240

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry MsBignum Cryptographic Implementations #289
    -Version 6.3.9600

    FIPS186-4 RSA; RSADP

    -

    RSADP Primitive

    -

    RSADP: (Mod2048)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1283
    -Version 10.0.15063

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
    -Version 10.0.15063

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
    -Version 10.0.14393

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
    -Version 10.0.14393

    -

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #663
    -Version 10.0.10586

    -

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #576
    -Version  10.0.10240

    SP800-135

    -

    Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    -

    Version 10.0.16299

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
    -Version 10.0.15063

    -

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1140
    -Version 7.00.2872

    -

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1139
    -Version 8.00.6246

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BcryptPrimitives and NCryptSSLp #886
    -Version 10.0.14393

    -

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BCryptPrimitives and NCryptSSLp #664
    -Version 10.0.10586

    -

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
    -Version  10.0.10240

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
    -Version 6.3.9600

    - -## Contact - -fips@microsoft.com - -## References - -* [FIPS 140-2, Security Requirements for Cryptographic Modules](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)) -* [Cryptographic Module Validation Program (CMVP) FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf) -* [SP 800-57 - Recommendation for Key Management – Part 1: General (Revised)](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) +--- +title: Federal Information Processing Standard (FIPS) 140 Validation +description: Learn how Microsoft products and cryptographic modules follow the U.S. Federal government standard FIPS 140. +ms.prod: m365-security +audience: ITPro +author: dansimp +ms.author: dansimp +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +ms.localizationpriority: medium +ms.reviewer: +ms.technology: windows-sec +--- + +# FIPS 140-2 Validation + +## FIPS 140-2 standard overview + +The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard. FIPS is based on Section 5131 of the Information Technology Management Reform Act of 1996. It defines the minimum security requirements for cryptographic modules in IT products. + +The [Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/Projects/cryptographic-module-validation-program) is a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS). It validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover 11 areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. + +## Microsoft’s approach to FIPS 140-2 validation + +Microsoft maintains an active commitment to meeting the requirements of the FIPS 140-2 standard, having validated cryptographic modules against it since it was first established in 2001. Microsoft validates its cryptographic modules under the NIST CMVP, as described above. Multiple Microsoft products, including Windows 10, Windows Server, and many cloud services, use these cryptographic modules. + +## Using Windows in a FIPS 140-2 approved mode of operation + +Windows 10 and Windows Server may be configured to run in a FIPS 140-2 approved mode of operation, commonly referred to as "FIPS mode."  If you turn on FIPS mode, the Cryptographic Primitives Library (bcryptprimitives.dll) and Kernel Mode Cryptographic Primitives Library (CNG.sys) modules will run self-tests before Windows runs cryptographic operations. These self-tests are run according to FIPS 140-2 Section 4.9. They ensure that the modules are functioning properly. + +The Cryptographic Primitives Library and the Kernel Mode Cryptographic Primitives Library are the only modules affected by FIPS mode. FIPS mode won't prevent Windows and its subsystems from using non-FIPS validated cryptographic algorithms. FIPS mode is merely advisory for applications or components other than the Cryptographic Primitives Library and the Kernel Mode Cryptographic Primitives Library. + +US government regulations continue to mandate FIPS mode for government devices running Windows. Other customers should decide for themselves if FIPS mode is right for them. There are many applications and protocols that use FIPS mode policy to determine which cryptographic functionality to run. Customers seeking to follow the FIPS 140-2 standard should research the configuration settings of their applications and protocols. This research will help ensure that they can be configured to use FIPS 140-2 validated cryptography. + +Achieving this FIPS 140-2 approved mode of operation of Windows requires administrators to complete all four steps outlined below. + +### Step 1: Ensure FIPS 140-2 validated cryptographic modules are installed + +Administrators must ensure that all cryptographic modules installed are FIPS 140-2 validated. Tables listing validated modules, organized by operating system release, are available later in this article. + +### Step 2: Ensure all security policies for all cryptographic modules are followed + +Each of the cryptographic modules has a defined security policy that must be met for the module to operate in its FIPS 140-2 approved mode. The security policy may be found in each module’s published Security Policy Document (SPD). The SPDs for each module may be found in the table of validated modules at the end of this article. Select the module version number to view the published SPD for the module. + +### Step 3: Enable the FIPS security policy + +Windows provides the security policy setting, *System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing*. This setting is used by some Microsoft products to determine whether to run in FIPS mode. When this policy is turned on, the validated cryptographic modules in Windows will also operate in FIPS mode. This policy may be set using Local Security Policy, as part of Group Policy, or through a Modern Device Management (MDM) solution. For more information on the policy, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](./security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md). + +### Step 4: Ensure that only FIPS validated cryptographic algorithms are used + +FIPS mode is enforced at the level of the application or service. It is not enforced by the operating system or by individual cryptographic modules. Applications or services running in FIPS mode must follow the security policies of validated modules. They must not use a cryptographic algorithm that isn't FIPS-compliant. + +In short, an application or service is running in FIPS mode if it: + +* Checks for the policy flag +* Enforces security policies of validated modules + +## Frequently asked questions + +### How long does it take to certify a cryptographic module? + +Microsoft begins certification of cryptographic modules after each major feature release of Windows 10 and Windows Server. The duration of each evaluation varies, depending on many factors. + +### When does Microsoft undertake a FIPS 140 validation? + +The cadence for starting module validation aligns with the feature updates of Windows 10 and Windows Server. As the software industry evolves, operating systems release more frequently. Microsoft completes validation work on major releases but, in between releases, seeks to minimize the changes to the cryptographic modules. + +### What is the difference between *FIPS 140 validated* and *FIPS 140 compliant*? + +*FIPS 140 validated* means that the cryptographic module, or a product that embeds the module, has been validated ("certified") by the CMVP as meeting the FIPS 140-2 requirements. *FIPS 140 compliant* is an industry term for IT products that rely on FIPS 140 validated products for cryptographic functionality. + +### How do I know if a Windows service or application is FIPS 140-2 validated? + +The cryptographic modules used in Windows are validated through the CMVP. They aren't validated by individual services, applications, hardware peripherals, or other solutions. Any compliant solution must call a FIPS 140-2 validated cryptographic module in the underlying OS, and the OS must be configured to run in FIPS mode. Contact the vendor of the service, application, or product for information on whether it calls a validated cryptographic module. + +### What does *When operated in FIPS mode* mean on a certificate? + +This label means that certain configuration and security rules must be followed to use the cryptographic module in compliance with its FIPS 140-2 security policy. Each module has its own security policy—a precise specification of the security rules under which it will operate—and employs approved cryptographic algorithms, cryptographic key management, and authentication techniques. The security rules are defined in the Security Policy Document (SPD) for each module. + +### What is the relationship between FIPS 140-2 and Common Criteria? + +FIPS 140-2 and Common Criteria are two separate security standards with different, but complementary, purposes. FIPS 140-2 is designed specifically for validating software and hardware cryptographic modules. Common Criteria are designed to evaluate security functions in IT software and hardware products. Common Criteria evaluations often rely on FIPS 140-2 validations to provide assurance that basic cryptographic functionality is implemented properly. + +### How does FIPS 140 relate to Suite B? + +Suite B is a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. The Suite B cryptographic algorithms are a subset of the FIPS approved cryptographic algorithms allowed by the FIPS 140-2 standard. + +### Is SMB3 (Server Message Block) FIPS 140 compliant in Windows? + +SMB3 can be FIPS 140 compliant, if Windows is configured to operate in FIPS 140 mode on both client and server. In FIPS mode, SMB3 relies on the underlying Windows FIPS 140 validated cryptographic modules for cryptographic operations. + +## Microsoft FIPS 140-2 validated cryptographic modules + +The following tables identify the cryptographic modules used in an operating system, organized by release. + +## Modules used by Windows + +##### Windows 10 Fall 2018 Update (Version 1809) + +Validated Editions: Home, Pro, Enterprise, Education + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17763#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17763#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17763#3644See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17763#3615See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17763#3651See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17763#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17763#3089See Security Policy and Certificate page for algorithm information
    Virtual TPM10.0.17763#3690See Security Policy and Certificate page for algorithm information
    + +##### Windows 10 Spring 2018 Update (Version 1803) + +Validated Editions: Home, Pro, Enterprise, Education + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17134#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17134#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17134#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17134#3480See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17134#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17134#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17134#3089See Security Policy and Certificate page for algorithm information
    + +##### Windows 10 Fall Creators Update (Version 1709) + +Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.16299#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.16299#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.16299#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.16299#3194See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.16299#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.16299#3092See Security Policy and Certificate page for algorithm information
    Windows Resume10.0.16299#3091See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.16299#3089See Security Policy and Certificate page for algorithm information
    + +##### Windows 10 Creators Update (Version 1703) + +Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile + + ++ ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.15063#3095

    FIPS approved algorithms: AES (Cert. #4624); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2522); SHS (Cert. #3790); Triple-DES (Cert. #2459)
    +
    +Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #1281); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #1278)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.15063#3094

    #3094

    +

    FIPS approved algorithms: AES (Certs. #4624 and #4626); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2523); SHS (Cert. #3790); Triple-DES (Cert. #2459)
    +
    +Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert.#1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert.#2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert.#1281)

    Boot Manager10.0.15063#3089

    FIPS approved algorithms: AES (Certs. #4624 and #4625); CKG (vendor affirmed); HMAC (Cert. #3061); PBKDF (vendor affirmed); RSA (Cert. #2523); SHS (Cert. #3790)

    +

    Other algorithms: PBKDF (vendor affirmed); VMK KDF (vendor affirmed)

    Windows OS Loader10.0.15063#3090

    FIPS approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)

    +

    Other algorithms: NDRNG

    Windows Resume[1]10.0.15063#3091FIPS approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)
    BitLocker® Dump Filter[2]10.0.15063#3092FIPS approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2522); SHS (Cert. #3790)
    Code Integrity (ci.dll)10.0.15063#3093

    FIPS approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

    Secure Kernel Code Integrity (skci.dll)[3]10.0.15063#3096

    FIPS approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

    + + +\[1\] Applies only to Home, Pro, Enterprise, Education, and S. + +\[2\] Applies only to Pro, Enterprise, Education, S, Mobile, and Surface Hub + +\[3\] Applies only to Pro, Enterprise, Education, and S + +##### Windows 10 Anniversary Update (Version 1607) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.14393#2937

    FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    +
    +Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.14393#2936

    FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    +
    +Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887)

    Boot Manager10.0.14393#2931

    FIPS approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

    +

    Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

    BitLocker® Windows OS Loader (winload)10.0.14393#2932FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: NDRNG; MD5
    BitLocker® Windows Resume (winresume)[1]10.0.14393#2933FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[2]10.0.14393#2934FIPS approved algorithms: AES (Certs. #4061 and #4064)
    Code Integrity (ci.dll)10.0.14393#2935

    FIPS approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: AES (non-compliant); MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

    Secure Kernel Code Integrity (skci.dll)[3]10.0.14393#2938

    FIPS approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
    +
    +Other algorithms: MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

    + + +\[1\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB + +\[2\] Applies only to Pro, Enterprise, Enterprise LTSB, and Mobile + +\[3\] Applies only to Pro, Enterprise, and Enterprise LTSB + +##### Windows 10 November 2015 Update (Version 1511) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10586#2606

    FIPS approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888, and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
    +
    +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10586#2605

    FIPS approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs.  #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888, and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
    +
    +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663)

    Boot Manager[4]10.0.10586#2700FIPS approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
    +
    +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)[5]10.0.10586#2701FIPS approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
    +
    +Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[6]10.0.10586#2702FIPS approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[7]10.0.10586#2703FIPS approved algorithms: AES (Certs. #3653)
    Code Integrity (ci.dll)10.0.10586#2604

    FIPS approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
    +
    +Other algorithms: AES (non-compliant); MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

    Secure Kernel Code Integrity (skci.dll)[8]10.0.10586#2607

    FIPS approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
    +
    +Other algorithms: MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

    + + +\[4\] Applies only to Home, Pro, Enterprise, Mobile, and Surface Hub + +\[5\] Applies only to Home, Pro, Enterprise, Mobile, and Surface Hub + +\[6\] Applies only to Home, Pro, and Enterprise + +\[7\] Applies only to Pro, Enterprise, Mobile, and Surface Hub + +\[8\] Applies only to Enterprise and Enterprise LTSB + +##### Windows 10 (Version 1507) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Hub + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10240#2606

    FIPS approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
    +
    +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10240#2605

    FIPS approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
    +
    +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576)

    Boot Manager[9]10.0.10240#2600FIPS approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
    +
    +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)[10]10.0.10240#2601FIPS approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
    +
    +Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[11]10.0.10240#2602FIPS approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[12]10.0.10240#2603FIPS approved algorithms: AES (Certs. #3497 and #3498)
    Code Integrity (ci.dll)10.0.10240#2604

    FIPS approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
    +
    +Other algorithms: AES (non-compliant); MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

    Secure Kernel Code Integrity (skci.dll)[13]10.0.10240#2607

    FIPS approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
    +
    +Other algorithms: MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

    + + +\[9\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB + +\[10\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB + +\[11\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB + +\[12\] Applies only to Pro, Enterprise, and Enterprise LTSB + +\[13\] Applies only to Enterprise and Enterprise LTSB + +##### Windows 8.1 + +Validated Editions: RT, Pro, Enterprise, Phone, Embedded + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.17031#2357

    FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
    +
    +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323)

    Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.17042#2356

    FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
    +
    +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

    Boot Manager6.3.9600 6.3.9600.17031#2351FIPS approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    +
    +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.17031#2352FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
    +
    +Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[14]6.3.9600 6.3.9600.17031#2353FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)6.3.9600 6.3.9600.17031#2354FIPS approved algorithms: AES (Cert. #2832)
    +
    +Other algorithms: N/A
    Code Integrity (ci.dll)6.3.9600 6.3.9600.17031#2355#2355

    FIPS approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
    +
    +Other algorithms: MD5

    +

    Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

    + + +\[14\] Applies only to Pro, Enterprise, and Embedded 8. + +##### Windows 8 + +Validated Editions: RT, Home, Pro, Enterprise, Phone + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.9200#1892FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    +
    +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert.); ECDSA (Cert.); HMAC (Cert.); KAS (Cert); KBKDF (Cert.); PBKDF (vendor affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    +
    +
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.9200#1891FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    +
    +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and); ECDSA (Cert.); HMAC (Cert.); KAS (Cert.); KBKDF (Cert.); PBKDF (vendor affirmed); RNG (Cert.); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    +
    +Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.2.9200#1895FIPS approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    BitLocker® Windows OS Loader (WINLOAD)6.2.9200#1896FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
    BitLocker® Windows Resume (WINRESUME)[15]6.2.9200#1898FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (DUMPFVE.SYS)6.2.9200#1899FIPS approved algorithms: AES (Certs. #2196 and #2198)
    +
    +Other algorithms: N/A
    Code Integrity (CI.DLL)6.2.9200#1897FIPS approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.9200#1893FIPS approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert.); Triple-DES MAC (Triple-DES Certificate, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Certificate, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced Cryptographic Provider (RSAENH.DLL)6.2.9200#1894FIPS approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
    +
    +Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    + + +\[15\] Applies only to Home and Pro + +**Windows 7** + +Validated Editions: Windows 7, Windows 7 SP1 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)

    6.1.7600.16385

    +

    6.1.7601.17514

    		1329FIPS approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 bits to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
    +
    +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and); SHS (Cert.); Triple-DES (Cert.)
    +
    +Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Kernel Mode Cryptographic Primitives Library (cng.sys)

    6.1.7600.16385

    +

    6.1.7600.16915

    +

    6.1.7600.21092

    +

    6.1.7601.17514

    +

    6.1.7601.17725

    +

    6.1.7601.17919

    +

    6.1.7601.21861

    +

    6.1.7601.22076

    		1328FIPS approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 bits to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
    +
    +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Boot Manager

    6.1.7600.16385

    +

    6.1.7601.17514

    		1319FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
    +
    +Other algorithms: MD5#1168 and); HMAC (Cert.); RSA (Cert.); SHS (Cert.)
    +
    +Other algorithms: MD5
    Winload OS Loader (winload.exe)

    6.1.7600.16385

    +

    6.1.7600.16757

    +

    6.1.7600.20897

    +

    6.1.7600.20916

    +

    6.1.7601.17514

    +

    6.1.7601.17556

    +

    6.1.7601.21655

    +

    6.1.7601.21675

    		1326FIPS approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    BitLocker™ Drive Encryption

    6.1.7600.16385

    +

    6.1.7600.16429

    +

    6.1.7600.16757

    +

    6.1.7600.20536

    +

    6.1.7600.20873

    +

    6.1.7600.20897

    +

    6.1.7600.20916

    +

    6.1.7601.17514

    +

    6.1.7601.17556

    +

    6.1.7601.21634

    +

    6.1.7601.21655

    +

    6.1.7601.21675

    		1332FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
    +
    +Other algorithms: Elephant Diffuser
    Code Integrity (CI.DLL)

    6.1.7600.16385

    +

    6.1.7600.17122

    +

    6.1.7600.21320

    +

    6.1.7601.17514

    +

    6.1.7601.17950

    +

    6.1.7601.22108

    		1327FIPS approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.1.7600.16385
    +(no change in SP1)    		1331FIPS approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
    Enhanced Cryptographic Provider (RSAENH.DLL)6.1.7600.16385
    +(no change in SP1)    		1330FIPS approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
    +
    +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    + + +##### Windows Vista SP1 + +Validated Editions: Ultimate Edition + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.0.6001.18000 and 6.0.6002.18005978FIPS approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753)
    Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596979FIPS approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
    +
    +Other algorithms: MD5
    Code Integrity (ci.dll)6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005980FIPS approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
    +
    +Other algorithms: MD5
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228691000

    FIPS approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and); ECDSA (Cert.); HMAC (Cert.); RNG (Cert.  and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)

    +

    Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228721001

    FIPS approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)

    +

    Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)

    Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180051002

    FIPS approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)

    +

    Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180051003

    FIPS approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

    +

    Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4

    + + +##### Windows Vista + +Validated Editions: Ultimate Edition + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider (RSAENH)6.0.6000.16386893FIPS approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
    +
    +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6000.16386894FIPS approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
    BitLocker™ Drive Encryption6.0.6000.16386947FIPS approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
    +
    +Other algorithms: Elephant Diffuser
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067891FIPS approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
    +
    +Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 bits to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5
    + + +##### Windows XP SP3 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.1.2600.5512997

    FIPS approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)

    +

    Other algorithms: DES; MD5; HMAC MD5

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.1.2600.5507990

    FIPS approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)

    +

    Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4

    Enhanced Cryptographic Provider (RSAENH)5.1.2600.5507989

    FIPS approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)

    +

    Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits)

    + + +##### Windows XP SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    DSS/Diffie-Hellman Enhanced Cryptographic Provider5.1.2600.2133240

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)

    +

    Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement)

    Microsoft Enhanced Cryptographic Provider5.1.2600.2161238

    FIPS approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

    +

    Other algorithms: DES (Cert. #156); RC2; RC4; MD5

    + + +##### Windows XP SP1 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Microsoft Enhanced Cryptographic Provider5.1.2600.1029238

    FIPS approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

    +

    Other algorithms: DES (Cert. #156); RC2; RC4; MD5

    + + +##### Windows XP + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module5.1.2600.0241

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)

    +

    Other algorithms: DES (Cert. #89)

    + + +##### Windows 2000 SP3 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

    FIPS approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

    +

    Other algorithms: DES (Certs. #89)

    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS: 5.0.2195.3665 [SP3])

    +

    (Base: 5.0.2195.3839 [SP3])

    +

    (DSS/DH Enh: 5.0.2195.3665 [SP3])

    +

    (Enh: 5.0.2195.3839 [SP3]

    		103

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    + + +##### Windows 2000 SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

    FIPS approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

    +

    Other algorithms: DES (Certs. #89)

    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS:

    +

    5.0.2195.2228 [SP2])

    +

    (Base:

    +

    5.0.2195.2228 [SP2])

    +

    (DSS/DH Enh:

    +

    5.0.2195.2228 [SP2])

    +

    (Enh:

    +

    5.0.2195.2228 [SP2])

    		103

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    + + +##### Windows 2000 SP1 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS: 5.0.2150.1391 [SP1])

    +

    (Base: 5.0.2150.1391 [SP1])

    +

    (DSS/DH Enh: 5.0.2150.1391 [SP1])

    +

    (Enh: 5.0.2150.1391 [SP1])

    		103

    FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    + + +##### Windows 2000 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.2150.176

    FIPS approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

    + + +##### Windows 95 and Windows 98 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.1877.6 and 5.0.1877.775

    FIPS approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

    +

    Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

    + + +##### Windows NT 4.0 + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base Cryptographic Provider5.0.1877.6 and 5.0.1877.768FIPS approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
    +
    +Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)
    + +## Modules used by Windows Server + +##### Windows Server 2019 (Version 1809) + +Validated Editions: Standard, Datacenter + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17763#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17763#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17763#3644See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17763#3615See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17763#3651See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17763#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17763#3089See Security Policy and Certificate page for algorithm information
    Virtual TPM10.0.17763#3690See Security Policy and Certificate page for algorithm information
    + +##### Windows Server (Version 1803) + +Validated Editions: Standard, Datacenter + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17134#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17134#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17134#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17134#3480See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17134#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17134#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17134#3089See Security Policy and Certificate page for algorithm information
    + +##### Windows Server (Version 1709) + +Validated Editions: Standard, Datacenter + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.16299#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.16299#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.16299#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.16299#3194See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.16299#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.16299#3092See Security Policy and Certificate page for algorithm information
    Windows Resume10.0.16299#3091See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.16299#3089See Security Policy and Certificate page for algorithm information
    + +##### Windows Server 2016 + +Validated Editions: Standard, Datacenter, Storage Server + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.143932937FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    +
    +Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.143932936FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    +
    +Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager10.0.143932931

    FIPS approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

    +

    Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

    BitLocker® Windows OS Loader (winload)10.0.143932932FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: NDRNG; MD5
    BitLocker® Windows Resume (winresume)10.0.143932933FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)10.0.143932934FIPS approved algorithms: AES (Certs. #4061 and #4064)
    Code Integrity (ci.dll)10.0.143932935FIPS approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: AES (non-compliant); MD5
    Secure Kernel Code Integrity (skci.dll)10.0.143932938FIPS approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
    +
    +Other algorithms: MD5
    + + +##### Windows Server 2012 R2 + +Validated Editions: Server, Storage Server, + +**StorSimple 8000 Series, Azure StorSimple Virtual Array Windows Server 2012 R2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.170312357FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
    +
    +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.170422356FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
    +
    +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.3.9600 6.3.9600.170312351FIPS approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    +
    +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.170312352FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
    +
    +Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[16]6.3.9600 6.3.9600.170312353FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[17]6.3.9600 6.3.9600.170312354FIPS approved algorithms: AES (Cert. #2832)
    +
    +Other algorithms: N/A
    Code Integrity (ci.dll)6.3.9600 6.3.9600.170312355FIPS approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
    +
    +Other algorithms: MD5
    + + +\[16\] Doesn't apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** + +\[17\] Doesn't apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** + +**Windows Server 2012** + +Validated Editions: Server, Storage Server + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.92001892FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    +
    +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert.); HMAC (Cert. #); KAS (Cert.); KBKDF (Cert.); PBKDF (vendor affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    +
    +Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.92001891FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    +
    +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    +
    +Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.2.92001895FIPS approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    BitLocker® Windows OS Loader (WINLOAD)6.2.92001896FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
    BitLocker® Windows Resume (WINRESUME)6.2.92001898FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (DUMPFVE.SYS)6.2.92001899FIPS approved algorithms: AES (Certs. #2196 and #2198)
    +
    +Other algorithms: N/A
    Code Integrity (CI.DLL)6.2.92001897FIPS approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.92001893FIPS approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced Cryptographic Provider (RSAENH.DLL)6.2.92001894FIPS approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
    +
    +Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    + + +##### Windows Server 2008 R2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.1.7600.16385 or 6.1.7601.175141321FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    Winload OS Loader (winload.exe)6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216751333FIPS approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    Code Integrity (ci.dll)6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221081334FIPS approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220761335FIPS approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 bits and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
    +
    +-Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Cryptographic Primitives Library (bcryptprimitives.dll)66.1.7600.16385 or 6.1.7601.175141336FIPS approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 bits and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
    +
    +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4
    Enhanced Cryptographic Provider (RSAENH)6.1.7600.163851337FIPS approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
    +
    +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.1.7600.163851338FIPS approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
    BitLocker™ Drive Encryption6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216751339FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
    +
    +Other algorithms: Elephant Diffuser
    + + +##### Windows Server 2008 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224971004FIPS approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
    +
    +Other algorithms: N/A
    Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225961005FIPS approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
    +
    +Other algorithms: MD5
    Code Integrity (ci.dll)6.0.6001.18000 and 6.0.6002.180051006FIPS approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
    +
    +Other algorithms: MD5
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228691007FIPS approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
    +
    +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert.); RNG (Cert.  and SP800-90 AES-CTR, vendor affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)
    +
    +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228721008FIPS approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
    +
    +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180051009FIPS approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
    +
    +-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
    Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180051010FIPS approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
    +
    +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    + + +##### Windows Server 2003 SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.3959875

    FIPS approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)

    +

    Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4

    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.3959869

    FIPS approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)

    +

    Other algorithms: DES; HMAC-MD5

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.3959868

    FIPS approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)

    +

    Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 bits and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    + + +##### Windows Server 2003 SP1 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.1830 [SP1]405

    FIPS approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

    +

    Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.1830 [Service Pack 1])382

    FIPS approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

    +

    Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.1830 [Service Pack 1]381

    FIPS approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

    +

    Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    + + +##### Windows Server 2003 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.0405

    FIPS approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

    +

    Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.0382

    FIPS approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

    +

    Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.0381

    FIPS approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

    +

    Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    + + +#### Other Products + +##### Windows Embedded Compact 7 and Windows Embedded Compact 8 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider7.00.2872 [1] and 8.00.6246 [2]2957

    FIPS approved algorithms: AES (Certs.#4433and#4434); CKG (vendor affirmed); DRBG (Certs.#1432and#1433); HMAC (Certs.#2946and#2945); RSA (Certs.#2414and#2415); SHS (Certs.#3651and#3652); Triple-DES (Certs.#2383and#2384)

    +

    Allowed algorithms: HMAC-MD5, MD5, NDRNG

    Cryptographic Primitives Library (bcrypt.dll)7.00.2872 [1] and 8.00.6246 [2]2956

    FIPS approved algorithms: AES (Certs.#4430and#4431); CKG (vendor affirmed); CVL (Certs.#1139and#1140); DRBG (Certs.#1429and#1430); DSA (Certs.#1187and#1188); ECDSA (Certs.#1072and#1073); HMAC (Certs.#2942and#2943); KAS (Certs.#114and#115); RSA (Certs.#2411and#2412); SHS (Certs.#3648and#3649); Triple-DES (Certs.#2381and#2382)

    +

    Allowed algorithms: MD5, NDRNG, RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength

    + + + +##### Windows CE 6.0 and Windows Embedded Compact 7 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider6.00.1937 [1] and 7.00.1687 [2]825

    FIPS approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])

    +

    Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES

    + + +##### Outlook Cryptographic Provider + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Outlook Cryptographic Provider (EXCHCSP)SR-1A (3821)110

    FIPS approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5

    + + + +### Cryptographic Algorithms + +The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate. + +### Advanced Encryption Standard (AES) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-OFB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +

    Microsoft Surface Hub Virtual TPM Implementations #4904

    +

    Version 10.0.15063.674

      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-OFB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903

    +

    Version 10.0.16299

      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CCM:
      • +
      • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • +
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • +
      • Plain Text Length: 0-32
        • +
      • Additional authenticated data length: 0-65536
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CMAC:
      • +
      • +
      • Generation:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • Verification:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-GCM:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • +
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • +
      • Additional authenticated data lengths: 0, 8, 1016, 1024 (bits)
        • +
      • 96 bit IV supported
        • +
      • +
    • AES-XTS:
      • +
      • +
      • Key Size: 128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • Key Size: 256:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #4902

    +

    Version 10.0.15063.674

      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CCM:
      • +
      • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • +
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • +
      • Plain Text Length: 0-32
        • +
      • Additional authenticated data length: 0-65536
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CMAC:
      • +
      • +
      • Generation:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • Verification:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-GCM:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • +
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • +
      • Additional authenticated data lengths: 0, 8, 1016, 1024 (bits)
        • +
      • 96 bit IV supported
        • +
      • +
    • AES-XTS:
      • +
      • +
      • Key Size: 128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • Key Size: 256:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4901

    +

    Version 10.0.15254

      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CCM:
      • +
      • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • +
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • +
      • Plain Text Length: 0-32
        • +
      • Additional authenticated data length: 0-65536
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CMAC:
      • +
      • +
      • Generation:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • Verification:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-GCM:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • IV Generation: External
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • +
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • +
      • Additional authenticated data lengths: 0, 8, 1016, 1024 (bits)
        • +
      • 96 bit IV supported
        • +
      • +
    • AES-XTS:
      • +
      • +
      • Key Size: 128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • Key Size: 256:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897

    +

    Version 10.0.16299

    AES-KW:

    +
      +
    • Modes: Decrypt, Encrypt
      • +
    • CIPHK transformation direction: Forward
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • +
    +

    AES validation number 4902

    Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900

    +

    Version 10.0.15063.674

    AES-KW:

    +
      +
    • Modes: Decrypt, Encrypt
      • +
    • CIPHK transformation direction: Forward
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • +
    +

    AES validation number 4901

    Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899

    +

    Version 10.0.15254

    AES-KW:

    +
      +
    • Modes: Decrypt, Encrypt
      • +
    • CIPHK transformation direction: Forward
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • +
    +

    AES validation number 4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898

    +

    Version 10.0.16299

    AES-CCM:

    +
      +
    • Key Lengths: 256 (bits)
      • +
    • Tag Lengths: 128 (bits)
      • +
    • IV Lengths: 96 (bits)
      • +
    • Plain Text Length: 0-32
      • +
    • Additional authenticated data length: 0-65536
      • +
    +

    AES validation number 4902

    Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896

    +

    Version 10.0.15063.674

    AES-CCM:

    +
      +
    • Key Lengths: 256 (bits)
      • +
    • Tag Lengths: 128 (bits)
      • +
    • IV Lengths: 96 (bits)
      • +
    • Plain Text Length: 0-32
      • +
    • Additional authenticated data length: 0-65536
      • +
    +

    AES validation number 4901

    Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895

    +

    Version 10.0.15254

    AES-CCM:

    +
      +
    • Key Lengths: 256 (bits)
      • +
    • Tag Lengths: 128 (bits)
      • +
    • IV Lengths: 96 (bits)
      • +
    • Plain Text Length: 0-32
      • +
    • Additional authenticated data length: 0-65536
      • +
    +

    AES validation number 4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894

    +

    Version 10.0.16299

    CBC (e/d; 128, 192, 256);

    +

    CFB128 (e/d; 128, 192, 256);

    +

    OFB (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627

    +

    Version 10.0.15063

    KW (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 256, 192, 320, 2048)

    +

    AES validation number 4624

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626

    +

    Version 10.0.15063

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 4624

    +

     

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625

    +

    Version 10.0.15063

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

    CFB128 (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)

    +

    (KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)

    +

    IV Generated: (External); PT Lengths Tested: (0, 1024, 8, 1016); Additional authenticated data lengths tested: (0, 1024, 8, 1016); 96 bit IV supported

    +

    GMAC supported

    +

    XTS((KS: XTS_128((e/d)(f)) KS: XTS_256((e/d)(f))

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624

    +

    Version 10.0.15063

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434

    +

    Version 7.00.2872

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433

    +

    Version 8.00.6246

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431

    +

    Version 7.00.2872

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430

    +

    Version 8.00.6246

    CBC (e/d; 128, 192, 256);

    +

    CFB128 (e/d; 128, 192, 256);

    +

    OFB (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074

    +

    Version 10.0.14393

    ECB (e/d; 128, 192, 256); CBC (e/d; 128, 192, 256); CFB8 (e/d; 128, 192, 256); CFB128 (e/d; 128, 192, 256); CTR (int only; 128, 192, 256)

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    +(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    +IV Generated:  (Externally); PT Lengths Tested:  (0, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 1024, 8, 1016); IV Lengths Tested: (0, 0); 96 bit IV supported
    +GMAC supported

    +

    XTS((KS: XTS_128((e/d)(f)) KS: XTS_256((e/d)(f))

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064

    +

    Version 10.0.14393

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

     

    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
    +Version 10.0.14393

    KW  (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 192, 256, 320, 2048)

    +

    AES validation number 4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062

    +

    Version 10.0.14393

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061

    +

    Version 10.0.14393

    KW  (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 256, 192, 320, 2048)

    +

    AES validation number 3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652

    +

    Version 10.0.10586

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653

    +

    Version 10.0.10586

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

     

    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
    +Version 10.0.10586

    ECB (e/d; 128, 192, 256); CBC (e/d; 128, 192, 256); CFB8 (e/d; 128, 192, 256); CFB128 (e/d; 128, 192, 256); CTR (int only; 128, 192, 256)

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    +(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    +IV Generated:  (Externally); PT Lengths Tested:  (0, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 1024, 8, 1016); IV Lengths Tested: (0, 0); 96 bit IV supported
    +GMAC supported

    +

    XTS((KS: XTS_128((e/d) (f)) KS: XTS_256((e/d) (f))

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629
    +
    +

    +

    Version 10.0.10586

    KW  (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 256, 192, 320, 2048)

    +

    AES validation number 3497

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507

    +

    Version 10.0.10240

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 3497

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498

    +

    Version 10.0.10240

    ECB (e/d; 128, 192, 256); CBC (e/d; 128, 192, 256); CFB8 (e/d; 128, 192, 256); CFB128 (e/d; 128, 192, 256); CTR (int only; 128, 192, 256)

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC(Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    +(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    +IV Generated:  (Externally); PT Lengths Tested:  (0, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 1024, 8, 1016); IV Lengths Tested:  (0, 0); 96 bit IV supported
    +GMAC supported

    +

    XTS((KS: XTS_128((e/d)(f)) KS: XTS_256((e/d)(f))

    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
    +Version 10.0.10240

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

     

    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
    +Version 10.0.10240

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

     

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853

    +

    Version 6.3.9600

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 2832

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 BitLocker Cryptographic Implementations #2848

    +

    Version 6.3.9600

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 0 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)

    +

    (KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)

    +

    IV Generated:  (Externally); PT Lengths Tested:  (0, 128, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 128, 1024, 8, 1016); IV Lengths Tested:  (8, 1024); 96 bit IV supported;
    +OtherIVLen_Supported
    +GMAC supported

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832

    +

    Version 6.3.9600

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)
    +AES validation number 2197

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s); Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 192; Block Size(s); Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 256; Block Size(s); Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16)
    +AES validation number 2197

    +

    GCM(KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    +(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    +IV Generated: (Externally); PT Lengths Tested: (0, 128, 1024, 8, 1016); Additional authenticated data lengths tested: (0, 128, 1024, 8, 1016); IV Lengths Tested: (8, 1024); 96 bit IV supported
    +GMAC supported

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216

    CCM (KS: 256) (Assoc. Data Len Range: 0 - 0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 2196

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

    CFB128 (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

     

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196
    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0 – 0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)
    +AES validation number 1168

    Windows Server 2008 R2 and SP1 CNG algorithms #1187

    +

    Windows 7 Ultimate and SP1 CNG algorithms #1178

    CCM (KS: 128, 256) (Assoc. Data Len Range: 0 - 8) (Payload Length Range: 4 - 32 (Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16)
    +AES validation number 1168    		Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

     

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168

    GCM

    +

    GMAC

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168, vendor-affirmed
    CCM (KS: 128, 256) (Assoc. Data Len Range: 0 - 8) (Payload Length Range: 4 - 32 (Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16)Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760
    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0 - 0, 2^16) (Payload Length Range: 1 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    Windows Server 2008 CNG algorithms #757

    +

    Windows Vista Ultimate SP1 CNG algorithms #756

    CBC (e/d; 128, 256);

    +

    CCM (KS: 128, 256) (Assoc. Data Len Range: 0 - 8) (Payload Length Range: 4 - 32 (Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16)

    Windows Vista Ultimate BitLocker Drive Encryption #715

    +

    Windows Vista Ultimate BitLocker Drive Encryption #424

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739

    +

    Windows Vista Symmetric Algorithm Implementation #553

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818

    +

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781

    +

    Windows 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #548

    +

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #516

    +

    Windows CE and Windows Mobile 6, 6.1, and 6.5 Enhanced Cryptographic Provider (RSAENH) #507

    +

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #290

    +

    Windows CE 5.0 and 5.1 Enhanced Cryptographic Provider (RSAENH) #224

    +

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #80

    +

    Windows XP, SP1, and SP2 Enhanced Cryptographic Provider (RSAENH) #33

    + + +### Deterministic Random Bit Generator (DRBG) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function not used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4904

    Microsoft Surface Hub Virtual TPM Implementations #1734

    +

    Version 10.0.15063.674

      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function not used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4903

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733

    +

    Version 10.0.16299

      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4902

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1732

    +

    Version 10.0.15063.674

      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4901

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1731

    +

    Version 10.0.15254

      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730

    +

    Version 10.0.16299

    CTR_DRBG: [Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4627)]

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556

    +

    Version 10.0.15063

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 4624)]

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555

    +

    Version 10.0.15063

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4434)]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433

    +

    Version 7.00.2872

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4433)]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432

    +

    Version 8.00.6246

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4431)]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430

    +

    Version 7.00.2872

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4430)]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429

    +

    Version 8.00.6246

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4074)]

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222

    +

    Version 10.0.14393

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 4064)]

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217

    +

    Version 10.0.14393

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 3629)]

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955

    +

    Version 10.0.10586

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 3497)]

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868

    +

    Version 10.0.10240

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 2832)]

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489

    +

    Version 6.3.9600

    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 2197)]Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258
    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 2023)]Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193
    CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 1168)]Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23
    DRBG (SP 800–90)Windows Vista Ultimate SP1, vendor-affirmed
    + + +#### Digital Signature Algorithm (DSA) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • DSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • PQGGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • PQGVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • KeyPair:
          • +
          • +
          • L = 2048, N = 256
            • +
          • L = 3072, N = 256
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1303

    +

    Version 10.0.15063.674

      +
    • DSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • PQGGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • PQGVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • KeyPair:
          • +
          • +
          •  
            • +
          •  
            • +
          • L = 2048, N = 256
            • +
          • L = 3072, N = 256
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1302

    +

    Version 10.0.15254

      +
    • DSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • PQGGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • PQGVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • KeyPair:
          • +
          • +
          • L = 2048, N = 256
            • +
          • L = 3072, N = 256
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301

    +

    Version 10.0.16299

    FIPS186-4:

    +

    PQG(gen)PARMS TESTED:   [(2048,256)SHA(256); (3072,256) SHA(256)]

    +

    PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    KeyPairGen:   [(2048,256); (3072,256)]

    +

    SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 3790

    +

    DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223

    +

    Version 10.0.15063

    FIPS186-4:
    +PQG(ver)PARMS TESTED:       [(1024,160) SHA(1)]
    +SIG(ver)PARMS TESTED:   [(1024,160) SHA(1)]
    +SHS: validation number 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188

    +

    Version 7.00.2872

    FIPS186-4:
    +PQG(ver)PARMS TESTED:       [(1024,160) SHA(1)]
    +SIG(ver)PARMS TESTED:   [(1024,160) SHA(1)]
    +SHS: validation number 3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187

    +

    Version 8.00.6246

    FIPS186-4:
    +PQG(gen)    PARMS TESTED: [
    +(2048,256)SHA(256); (3072,256) SHA(256)]
    +PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +KeyPairGen:    [(2048,256); (3072,256)]
    +SIG(gen)PARMS TESTED:   [(2048,256)
    +SHA(256); (3072,256) SHA(256)]
    +SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 3347
    +DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098

    +

    Version 10.0.14393

    FIPS186-4:
    +PQG(gen)    PARMS TESTED:   [(2048,256)SHA(256); (3072,256) SHA(256)] PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +KeyPairGen:    [(2048,256); (3072,256)] SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 3047
    +DRBG: validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024

    +

    Version 10.0.10586

    FIPS186-4:
    +PQG(gen)    PARMS TESTED:   [(2048,256)SHA(256); (3072,256) SHA(256)]
    +PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +KeyPairGen:    [(2048,256); (3072,256)]
    +SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)] SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 2886
    +DRBG: validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983

    +

    Version 10.0.10240

    FIPS186-4:
    +PQG(gen)    PARMS TESTED:   [
    +(2048,256)SHA(256); (3072,256) SHA(256)]
    +PQG(ver)PARMS TESTED:   [(2048,256)
    +SHA(256); (3072,256) SHA(256)]
    +KeyPairGen:    [(2048,256); (3072,256)]
    +SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 2373
    +DRBG: validation number 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855

    +

    Version 6.3.9600

    FIPS186-2:
    +PQG(ver) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: #1903
    +DRBG: #258

    +

    FIPS186-4:
    +PQG(gen)PARMS TESTED    : [(2048,256)SHA(256); (3072,256) SHA(256)]
    +PQG(ver)PARMS TESTED: [(2048,256) SHA(256); (3072,256) SHA(256)]
    +SIG(gen)PARMS TESTED: [(2048,256) SHA(256); (3072,256) SHA(256)]
    +SIG(ver)PARMS TESTED: [(2048,256) SHA(256); (3072,256) SHA(256)]
    +SHS: #1903
    +DRBG: #258
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 687.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687
    FIPS186-2:
    +PQG(ver)     MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: #1902
    +DRBG: #258
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 686.    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686
    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: validation number 1773
    +DRBG: validation number 193
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 645.    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645
    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: validation number 1081
    +DRBG: validation number 23
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 391. See Historical DSA List validation number 386.

    Windows Server 2008 R2 and SP1 CNG algorithms #391

    +

    Windows 7 Ultimate and SP1 CNG algorithms #386

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: validation number 1081
    +RNG: validation number 649
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 390. See Historical DSA List validation number 385.

    Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390

    +

    Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: validation number 753
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 284. See Historical DSA List validation number 283.

    Windows Server 2008 CNG algorithms #284

    +

    Windows Vista Ultimate SP1 CNG algorithms #283

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: validation number 753
    +RNG: validation number 435
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 282. See Historical DSA List validation number 281.

    Windows Server 2008 Enhanced DSS (DSSENH) #282

    +

    Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: validation number 618
    +RNG: validation number 321
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 227. See Historical DSA List validation number 226.

    Windows Vista CNG algorithms #227

    +

    Windows Vista Enhanced DSS (DSSENH) #226

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: validation number 784
    +RNG: validation number 448
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 292.    		Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292
    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: validation number 783
    +RNG: validation number 447
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 291.    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291
    FIPS186-2:
    +PQG(gen)     MOD(1024);
    +PQG(ver) MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: validation number 611
    +RNG: validation number 314    		Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221
    FIPS186-2:
    +PQG(gen)     MOD(1024);
    +PQG(ver) MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: validation number 385    		Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146
    FIPS186-2:
    +PQG(ver)     MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: validation number 181
    +
    +    		Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95
    FIPS186-2:
    +PQG(gen)     MOD(1024);
    +PQG(ver) MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SHS: SHA-1 (BYTE)
    +SIG(ver) MOD(1024);
    +SHS: SHA-1 (BYTE)

    Windows 2000 DSSENH.DLL #29

    +

    Windows 2000 DSSBASE.DLL #28

    +

    Windows NT 4 SP6 DSSENH.DLL #26

    +

    Windows NT 4 SP6 DSSBASE.DLL #25

    FIPS186-2: PRIME;
    +FIPS186-2:

    +

    KEYGEN(Y):
    +SHS: SHA-1 (BYTE)

    +

    SIG(gen):
    +SIG(ver)     MOD(1024);
    +SHS: SHA-1 (BYTE)

    		Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17
    + + +#### Elliptic Curve Digital Signature Algorithm (ECDSA) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #2373, DRBG #489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263

    +

    Version 6.3.9600

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384
            • +
          • Generation Methods: Testing Candidates
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #1253

    +

    Version 10.0.15063.674

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384
            • +
          • Generation Methods: Testing Candidates
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252

    +

    Version 10.0.16299

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1251

    +

    Version 10.0.15063.674

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1250

    +

    Version 10.0.15063.674

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1249

    +

    Version 10.0.15254

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1248

    +

    Version 10.0.15254

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247

    +

    Version 10.0.16299

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246

    +

    Version 10.0.16299

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 TestingCandidates)
    +SHS: validation number 3790
    +DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136

    +

    Version 10.0.15063

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    +SHS: validation number 3790
    +DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135

    +

    Version 10.0.15063

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    +SHS: validation number 3790
    +DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133

    +

    Version 10.0.15063

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SigVer: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512))
    +SHS:validation number 3649
    +DRBG:validation number 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073

    +

    Version 7.00.2872

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SigVer: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512))
    +SHS:validation number 3648
    +DRBG:validation number 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072

    +

    Version 8.00.6246

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 TestingCandidates)
    +PKV: CURVES(P-256 P-384)
    +SigGen: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SigVer: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384))

    +

    SHS: validation number 3347
    +DRBG: validation number 1222

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920

    +

    Version 10.0.14393

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    +

    SHS: validation number 3347
    +DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911

    +

    Version 10.0.14393

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    +

    SHS: validation number 3047
    +DRBG: validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760

    +

    Version 10.0.10586

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    +

    SHS: validation number 2886
    +DRBG: validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706

    +

    Version 10.0.10240

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    +

    SHS: validation number 2373
    +DRBG: validation number 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505

    +

    Version 6.3.9600

    FIPS186-2:
    +PKG: CURVES    (P-256 P-384 P-521)
    +SHS: #1903
    +DRBG: #258
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: #1903
    +DRBG: #258

    +

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    +SHS: #1903
    +DRBG: #258
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 341.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341

    FIPS186-2:
    +PKG: CURVES    (P-256 P-384 P-521)
    +SHS: validation number 1773
    +DRBG: validation number 193
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: validation number 1773
    +DRBG: validation number 193

    +

    FIPS186-4:
    +PKG: CURVES    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    +SHS: validation number 1773
    +DRBG: validation number 193
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 295.

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295
    FIPS186-2:
    +PKG: CURVES    (P-256 P-384 P-521)
    +SHS: validation number 1081
    +DRBG: validation number 23
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: validation number 1081
    +DRBG: validation number 23
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 142. See Historical ECDSA List validation number 141.

    Windows Server 2008 R2 and SP1 CNG algorithms #142

    +

    Windows 7 Ultimate and SP1 CNG algorithms #141

    FIPS186-2:
    +PKG: CURVES    (P-256 P-384 P-521)
    +SHS: validation number 753
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: validation number 753
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 83. See Historical ECDSA List validation number 82.

    Windows Server 2008 CNG algorithms #83

    +

    Windows Vista Ultimate SP1 CNG algorithms #82

    FIPS186-2:
    +PKG: CURVES    (P-256 P-384 P-521)
    +SHS: validation number 618
    +RNG: validation number 321
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: validation number 618
    +RNG: validation number 321
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 60.    		Windows Vista CNG algorithms #60
    + + +#### Keyed-Hash Message Authentication Code (HMAC) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4011

    Microsoft Surface Hub Virtual TPM Implementations #3271

    +

    Version 10.0.15063.674

      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4009

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270

    +

    Version 10.0.16299

      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-512:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4011

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #3269

    +

    Version 10.0.15063.674

      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-512:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4010

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #3268

    +

    Version 10.0.15254

      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-512:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4009

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267

    +

    Version 10.0.16299

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062

    +

    Version 10.0.15063

    HMAC-SHA1(Key Sizes Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061

    +

    Version 10.0.15063

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3652

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3652

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3652

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946

    +

    Version 7.00.2872

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3651

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3651

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3651

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945

    +

    Version 8.00.6246

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3649

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3649

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3649

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943

    +

    Version 7.00.2872

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3648

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3648

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3648

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942

    +

    Version 8.00.6246

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    +SHS validation number 3347

    +

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3347

    +

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661

    +

    Version 10.0.14393

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3347

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3347

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3347

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS validation number 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651

    +

    Version 10.0.14393

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    +SHS validation number 3047

    +

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3047

    +

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3047

    +

    HMAC-SHA512 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381

    +

    Version 10.0.10586

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    +SHSvalidation number 2886

    +

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    +SHSvalidation number 2886

    +

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    + SHSvalidation number 2886

    +

    HMAC-SHA512 (Key Size Ranges Tested:  KSBS)
    +SHSvalidation number 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233

    +

    Version 10.0.10240

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    +SHS validation number 2373

    +

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 2373

    +

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 2373

    +

    HMAC-SHA512 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773

    +

    Version 6.3.9600

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 2764

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 2764

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 2764

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS validation number 2764

    Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122

    +

    Version 5.2.29344

    HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902

    +

    HMAC-SHA256 (Key Size Ranges Tested: KS#1902

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS#1902

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS#1902

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS#1902

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS#1902

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS)

    +

    SHS#1903

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS)

    +

    SHS#1903

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS)

    +

    SHS#1903

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS)

    +

    SHS#1903

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 1773

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 1773

    +

    Tinker HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 1773

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 1773

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 1774

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 1774

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 1774

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 1774

    		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 1081

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 1081

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 1081

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 1081

    Windows Server 2008 R2 and SP1 CNG algorithms #686

    +

    Windows 7 and SP1 CNG algorithms #677

    +

    Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687

    +

    Windows 7 Enhanced Cryptographic Provider (RSAENH) #673

    HMAC-SHA1(Key Sizes Ranges Tested: KSvalidation number 1081

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 1081

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 816

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 816

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 816

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 816

    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452

    HMAC-SHA1 (Key Sizes Ranges Tested: KSvalidation number 753

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 753

    		Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS)SHS validation number 753

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408

    +

    Windows Vista Enhanced Cryptographic Provider (RSAENH) #407

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS)SHSvalidation number 618

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    		Windows Vista Enhanced Cryptographic Provider (RSAENH) #297
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 785

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429

    +

    Windows XP, vendor-affirmed

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 783

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 783

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 783

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 783

    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 613

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 613

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 613

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 613

    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 610Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    Windows Server 2008 CNG algorithms #413

    +

    Windows Vista Ultimate SP1 CNG algorithms #412

    HMAC-SHA1 (Key Sizes Ranges Tested: KSvalidation number 737

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 737

    		Windows Vista Ultimate BitLocker Drive Encryption #386

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    		Windows Vista CNG algorithms #298

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 589

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS)SHSvalidation number 589

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 589

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 589

    		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 578

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 578

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 578

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 578

    		Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260

    HMAC-SHA1 (Key Sizes Ranges Tested: KSvalidation number 495

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 495

    		Windows Vista BitLocker Drive Encryption #199
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 364

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99

    +

    Windows XP, vendor-affirmed

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 305

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 305

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 305

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 305

    		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31
    + + +#### Key Agreement Scheme (KAS) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Full Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, ECDSA #1253, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #150

    +

    Version 10.0.15063.674

      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Full Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, ECDSA #1252, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149

    +

    Version 10.0.16299

      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Ephemeral Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • One-Pass DH:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • Static Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, ECDSA #1250, DRBG #1732

    +
      +
    • KAS FFC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • +
      • Schemes:
        • +
        • +
        • dhEphem:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhOneFlow:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhStatic:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DSA #1303, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #148

    +

    Version 10.0.15063.674

      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Ephemeral Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • One-Pass DH:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • Static Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, ECDSA #1249, DRBG #1731

    +
      +
    • KAS FFC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • +
      • Schemes:
        • +
        • +
        • dhEphem:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhOneFlow:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhStatic:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DSA #1302, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #147

    +

    Version 10.0.15254

      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Ephemeral Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • One-Pass DH:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • Static Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, ECDSA #1246, DRBG #1730

    +
      +
    • KAS FFC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • +
      • Schemes:
        • +
        • +
        • dhEphem:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhOneFlow:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhStatic:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DSA #1301, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146

    +

    Version 10.0.16299

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration) SCHEMES [FullUnified (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC)]

    +

    SHS validation number 3790
    +DSA validation number 1135
    +DRBG validation number 1556

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128

    +

    Version 10.0.15063

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (FB: SHA256) (FC: SHA256)] [dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB: SHA256 HMAC) (FC: SHA256   HMAC)]
    +SHS validation number 3790
    +DSA validation number 1223
    +DRBG validation number 1555

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [EphemeralUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    +
    +SHS validation number 3790
    +ECDSA validation number 1133
    +DRBG validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127

    +

    Version 10.0.15063

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB: SHA256) (FC: SHA256)] [dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB: SHA256 HMAC) (FC: SHA256   HMAC)]
    +SHS validation number 3649
    +DSA validation number 1188
    +DRBG validation number 1430

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES [EphemeralUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115

    +

    Version 7.00.2872

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhHybridOneFlow (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB:SHA256 HMAC) (FC: SHA256   HMAC)]
    +[dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB:SHA256 HMAC) (FC: SHA256   HMAC)]
    +SHS validation number 3648
    +DSA validation number 1187
    +DRBG validation number 1429

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES [EphemeralUnified (No_KC) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    +
    +SHS validation number 3648
    +ECDSA validation number 1072
    +DRBG validation number 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114

    +

    Version 8.00.6246

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration)
    +SCHEMES  [FullUnified  (No_KC  &lt; KARole(s): Initiator / Responder &gt; &lt; KDF: CONCAT &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC)]

    +

    SHS validation number 3347 ECDSA validation number 920 DRBG validation number 1222

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93

    +

    Version 10.0.14393

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation)
    +SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    +

    SHS validation number 3347 DSA validation number 1098 DRBG validation number 1217

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    +

    SHS validation number 3347 DSA validation number 1098 ECDSA validation number 911 DRBG validation number 1217 HMAC validation number 2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92

    +

    Version 10.0.14393

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    +

    SHS validation number 3047 DSA validation number 1024 DRBG validation number 955

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    +

    SHS validation number 3047 ECDSA validation number 760 DRBG validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72

    +

    Version 10.0.10586

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    +

    SHS validation number 2886 DSA validation number 983 DRBG validation number 868

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    +

    SHS validation number 2886 ECDSA validation number 706 DRBG validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64

    +

    Version 10.0.10240

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    +

    SHS validation number 2373 DSA validation number 855 DRBG validation number 489

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    +

    SHS validation number 2373 ECDSA validation number 505 DRBG validation number 489

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47

    +

    Version 6.3.9600

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    +(FA: SHA256) (FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FA: SHA256) (FB: SHA256) (FC: SHA256)]
    +[dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FA: SHA256 HMAC) (FB: SHA256 HMAC) (FC: SHA256 HMAC)]
    +SHS #1903 DSA validation number 687 DRBG #258

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration) SCHEMES [EphemeralUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256 SHA256 HMAC) (ED: P-384 SHA384 HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH(No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256 SHA256) (ED: P-384 SHA384) (EE: P-521 (SHA512, HMAC_SHA512)))]
    +[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256 SHA256 HMAC) (ED: P-384 SHA384 HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512))]
    +
    +SHS #1903 ECDSA validation number 341 DRBG #258

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36

    KAS (SP 800–56A)

    +

    key agreement

    +

    key establishment methodology provides 80 bits to 256 bits of encryption strength

    Windows 7 and SP1, vendor-affirmed

    +

    Windows Server 2008 R2 and SP1, vendor-affirmed

    + + +SP 800-108 Key-Based Key Derivation Functions (KBKDF) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • Counter:
      • +
      • +
      • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
        • +
      • +
    +

    MAC prerequisite: HMAC #3271

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    +
    +

    K prerequisite: DRBG #1734, KAS #150

    Microsoft Surface Hub Virtual TPM Implementations #161

    +

    Version 10.0.15063.674

      +
    • Counter:
      • +
      • +
      • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
        • +
      • +
    +

    MAC prerequisite: HMAC #3270

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    +
    +

    K prerequisite: DRBG #1733, KAS #149

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160

    +

    Version 10.0.16299

      +
    • Counter:
      • +
      • +
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • +
      • +
    +

    MAC prerequisite: AES #4902, HMAC #3269

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    • K prerequisite: KAS #148
      • +
    +

    Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #159

    +

    Version 10.0.15063.674

      +
    • Counter:
      • +
      • +
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • +
      • +
    +

    MAC prerequisite: AES #4901, HMAC #3268

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    +
    +

    K prerequisite: KAS #147

    Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #158

    +

    Version 10.0.15254

      +
    • Counter:
      • +
      • +
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • +
      • +
    +

    MAC prerequisite: AES #4897, HMAC #3267

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    +
    +

    K prerequisite: KAS #146

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157

    +

    Version 10.0.16299

    CTR_Mode: (Llength(Min0 Max0) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA384]) LocationCounter([BeforeFixedData]) rlength([32]))
    +
    +KAS validation number 128
    +DRBG validation number 1556
    +MAC validation number 3062

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141

    +

    Version 10.0.15063

    CTR_Mode: (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))
    +
    +KAS validation number 127
    +AES validation number 4624
    +DRBG validation number 1555
    +MAC validation number 3061

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140

    +

    Version 10.0.15063

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA384]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    KAS validation number 93 DRBG validation number 1222 MAC validation number 2661

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102

    +

    Version 10.0.14393

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    KAS validation number 92 AES validation number 4064 DRBG validation number 1217 MAC validation number 2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101

    +

    Version 10.0.14393

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    KAS validation number 72 AES validation number 3629 DRBG validation number 955 MAC validation number 2381

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72

    +

    Version 10.0.10586

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    KAS validation number 64 AES validation number 3497 RBG validation number 868 MAC validation number 2233

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66

    +

    Version 10.0.10240

    CTR_Mode:  (Llength(Min0 Max0) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    DRBG validation number 489 MAC validation number 1773

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30

    +

    Version 6.3.9600

    CTR_Mode: (Llength(Min0 Max4) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    DRBG #258 HMAC validation number 1345

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3
    + + +Random Number Generator (RNG) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #

    FIPS 186-2 General Purpose

    +

    [(x-Original); (SHA-1)]

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110
    FIPS 186-2
    +[(x-Original); (SHA-1)]

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060

    +

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292

    +

    Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286

    +

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66

    FIPS 186-2
    +[(x-Change Notice); (SHA-1)]

    +

    FIPS 186-2 General Purpose
    +[(x-Change Notice); (SHA-1)]

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649

    +

    Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435

    +

    Windows Vista RNG implementation #321

    FIPS 186-2 General Purpose
    +[(x-Change Notice); (SHA-1)]

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470

    +

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449

    +

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #316

    +

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313

    FIPS 186-2
    +[(x-Change Notice); (SHA-1)]

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448

    +

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314

    + + +#### RSA + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #2677

    +

    Version 10.0.15063.674

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 240 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676

    +

    Version 10.0.16299

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub RSA32 Algorithm Implementations #2675

    +

    Version 10.0.15063.674

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674

    +

    Version 10.0.16299

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) RSA32 Algorithm Implementations #2673

    +

    Version 10.0.15254

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Public Key Exponent: Fixed (10001)
          • +
        • Provable Primes with Conditions:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.3
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #2672

    +

    Version 10.0.15063.674

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Probable Random Primes:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.2
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #2671

    +

    Version 10.0.15063.674

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Probable Random Primes:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.2
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2670

    +

    Version 10.0.15254

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Public Key Exponent: Fixed (10001)
          • +
        • Provable Primes with Conditions:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.3
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #2669

    +

    Version 10.0.15254

      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Public Key Exponent: Fixed (10001)
          • +
        • Provable Primes with Conditions:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.3
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668

    +

    Version 10.0.16299

      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Probable Random Primes:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.2
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667

    +

    Version 10.0.16299

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(1, 256, 384)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA(1, 256, 384)) (2048 SHA(1, 256, 384))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48)))
    +SHA validation number 3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524

    +

    Version 10.0.15063

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523

    +

    Version 10.0.15063

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    +SHA validation number 3790
    +DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522

    +

    Version 10.0.15063

    FIPS186-4:
    +186-4KEY(gen):
    +PGM(ProbRandom:     (2048, 3072) PPTT:(C.2)
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    +SHA validation number 3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521

    +

    Version 10.0.15063

    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3652
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096, SHS: SHA-256validation number 3652, SHA-384validation number 3652, SHA-512validation number 3652
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3652, SHA-256validation number 3652, SHA-384validation number 3652, SHA-512validation number 3652

    +

    FIPS186-4:
    +ALG[ANSIX9.31]     Sig(Gen): (2048 SHA(1)) (3072 SHA(1))
    +SIG(gen) with SHA-1 affirmed for use with protocols only.     Sig(Ver): (1024 SHA(1)) (2048 SHA(1)) (3072 SHA(1))
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415

    +

    Version 7.00.2872

    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3651
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096, SHS: SHA-256validation number 3651, SHA-384validation number 3651, SHA-512validation number 3651
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3651, SHA-256validation number 3651, SHA-384validation number 3651, SHA-512validation number 3651

    +

    FIPS186-4:
    +ALG[ANSIX9.31]     Sig(Gen): (2048 SHA(1)) (3072 SHA(1))
    +SIG(gen) with SHA-1 affirmed for use with protocols only.     Sig(Ver): (1024 SHA(1)) (2048 SHA(1)) (3072 SHA(1))
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414

    +

    Version 8.00.6246

    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 4096, SHS: SHA-256validation number 3649, SHA-384validation number 3649, SHA-512validation number 3649
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3649, SHA-256validation number 3649, SHA-384validation number 3649, SHA-512validation number 3649

    +

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    +PGM(ProbRandom: (2048, 3072) PPTT:(C.2)
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3649
    +DRBG: validation number 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412

    +

    Version 7.00.2872

    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 4096, SHS: SHA-256validation number 3648, SHA-384validation number 3648, SHA-512validation number 3648
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3648, SHA-256validation number 3648, SHA-384validation number 3648, SHA-512validation number 3648

    +

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    +PGM(ProbRandom: (2048, 3072) PPTT:(C.2)
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3648
    +DRBG: validation number 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411

    +

    Version 8.00.6246

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(1, 256, 384)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SIG(Ver) (1024 SHA(1, 256, 384)) (2048 SHA(1, 256, 384))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48)))

    +

    SHA validation number 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206

    +

    Version 10.0.14393

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    +

    SHA validation number 3347 DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195

    +

    Version 10.0.14393

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 3346

    soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194

    +

    Version 10.0.14393

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    +SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 3347 DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193

    +

    Version 10.0.14393

    FIPS186-4:
    +[RSASSA-PSS]: Sig(Gen):     (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    SHA validation number 3347 DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192

    +

    Version 10.0.14393

    FIPS186-4:
    +186-4KEY(gen)    :  FIPS186-4_Fixed_e (10001);
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    +

    SHA validation number 3047 DRBG: validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889

    +

    Version 10.0.10586

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 3048

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871

    +

    Version 10.0.10586

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    +SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888

    +

    Version 10.0.10586

    FIPS186-4:
    +[RSASSA-PSS]: Sig(Gen)    : (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    +Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    SHA validation number 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887

    +

    Version 10.0.10586

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e (10001);
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    +

    SHA validation number 2886 DRBG: validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798

    +

    Version 10.0.10240

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784

    +

    Version 10.0.10240

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783

    +

    Version 10.0.10240

    FIPS186-4:
    +[RSASSA-PSS]:     Sig(Gen): (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    +Sig(Ver): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    SHA validation number 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802

    +

    Version 10.0.10240

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e;
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    +

    SHA validation number 2373 DRBG: validation number 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487

    +

    Version 6.3.9600

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494

    +

    Version 6.3.9600

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5    ] SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    +SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493

    +

    Version 6.3.9600

    FIPS186-4:
    +[RSASSA-PSS]:     Sig(Gen): (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    + Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    SHA validation number 2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519

    +

    Version 6.3.9600

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA(256, 384, 512-256)) (3072 SHA(256, 384, 512-256))
    +SIG(Ver) (1024 SHA(1, 256, 384, 512-256)) (2048 SHA(1, 256, 384, 512-256)) (3072 SHA(1, 256, 384, 512-256))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    +Sig(Ver): (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512, 512))
    +SHA #1903

    +

    Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1134.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134
    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e, FIPS186-4_Fixed_e_Value
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)
    +SHA #1903 DRBG: #258    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133
    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 DRBG: #258
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1132.    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1774
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1774, SHA-384validation number 1774, SHA-512validation number 1774,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1774, SHA-256validation number 1774, SHA-384validation number 1774, SHA-512validation number 1774,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1052.    		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052
    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 DRBG: validation number 193
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1773, SHA-384validation number 1773, SHA-512validation number 1773,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1773, SHA-256validation number 1773, SHA-384validation number 1773, SHA-512validation number 1773,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1051.    		Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 568.    		Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +ALG[RSASSA-PSS]: SIG(gen); 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 567. See Historical RSA List validation number 560.

    Windows Server 2008 R2 and SP1 CNG algorithms #567

    +

    Windows 7 and SP1 CNG algorithms #560

    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 DRBG: validation number 23
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 559.    		Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 557.    		Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 816, SHA-384validation number 816, SHA-512validation number 816,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 816, SHA-256validation number 816, SHA-384validation number 816, SHA-512validation number 816,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 395.    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 783
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 783, SHA-384validation number 783, SHA-512validation number 783,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 371.    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753, SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    +ALG[RSASSA-PSS]: SIG(gen); 2048, 3072, 4096, SHS: SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753, SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 358. See Historical RSA List validation number 357.

    Windows Server 2008 CNG algorithms #358

    +

    Windows Vista SP1 CNG algorithms #357

    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753, SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 355. See Historical RSA List validation number 354.

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355

    +

    Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354

    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 353.    		Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353
    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 RNG: validation number 321
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 258.    		Windows Vista RSA key generation implementation #258
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 618, SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    +ALG[RSASSA-PSS]: SIG(gen); 2048, 3072, 4096, SHS: SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 618, SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 257.    		Windows Vista CNG algorithms #257
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 618, SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 255.    		Windows Vista Enhanced Cryptographic Provider (RSAENH) #255
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 613
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 613, SHA-384validation number 613, SHA-512validation number 613,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 613, SHA-256validation number 613, SHA-384validation number 613, SHA-512validation number 613,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 245.    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 589
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 589, SHA-384validation number 589, SHA-512validation number 589,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 589, SHA-256validation number 589, SHA-384validation number 589, SHA-512validation number 589,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 230.    		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 578
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 578, SHA-384validation number 578, SHA-512validation number 578,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 578, SHA-256validation number 578, SHA-384validation number 578, SHA-512validation number 578,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 222.    		Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 364
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 81.    		Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 305
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 305, SHA-384validation number 305, SHA-512validation number 305,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 305, SHA-256validation number 305, SHA-384validation number 305, SHA-512validation number 305,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 52.    		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52

    FIPS186-2:

    +

    – PKCS#1 v1.5, signature generation, and verification

    +

    – Mod sizes: 1024, 1536, 2048, 3072, 4096

    +

    – SHS: SHA–1/256/384/512

    Windows XP, vendor-affirmed

    +

    Windows 2000, vendor-affirmed

    + + +#### Secure Hash Standard (SHS) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • SHA-1:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-256:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-384:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-512:
      • +
      • +
      • Supports Empty Message
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #4011

    +

    Version 10.0.15063.674

      +
    • SHA-1:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-256:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-384:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-512:
      • +
      • +
      • Supports Empty Message
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4010

    +

    Version 10.0.15254

      +
    • SHA-1:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-256:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-384:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-512:
      • +
      • +
      • Supports Empty Message
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009

    +

    Version 10.0.16299

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790

    +

    Version 10.0.15063

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652

    +

    Version 7.00.2872

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651

    +

    Version 8.00.6246

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649

    +

    Version 7.00.2872

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648

    +

    Version 8.00.6246

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
    +Version 10.0.14393
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
    +Version 10.0.14393
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
    +Version 10.0.10586
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
    +Version 10.0.10586
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
    +Version 10.0.10240
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
    +Version 10.0.10240
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
    +Version 6.3.9600
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
    +Version 6.3.9600

    SHA-1 (BYTE-only)

    +

    SHA-256 (BYTE-only)

    +

    SHA-384 (BYTE-only)

    +

    SHA-512 (BYTE-only)

    +

    Implementation does not support zero-length (null) messages.

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903

    +

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774

    +

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

    SHA-1 (BYTE-only)

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785

    +

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753

    +

    Windows Vista Symmetric Algorithm Implementation #618

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)

    Windows Vista BitLocker Drive Encryption #737

    +

    Windows Vista Beta 2 BitLocker Drive Encryption #495

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613

    +

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364

    SHA-1 (BYTE-only)

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611

    +

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610

    +

    Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385

    +

    Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #371

    +

    Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #181

    +

    Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #177

    +

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589

    +

    Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578

    +

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305

    SHA-1 (BYTE-only)

    Windows XP Microsoft Enhanced Cryptographic Provider #83

    +

    Crypto Driver for Windows 2000 (fips.sys) #35

    +

    Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32

    +

    Windows 2000 RSAENH.DLL #24

    +

    Windows 2000 RSABASE.DLL #23

    +

    Windows NT 4 SP6 RSAENH.DLL #21

    +

    Windows NT 4 SP6 RSABASE.DLL #20

    + + +#### Triple DES + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • TDES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB64:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #2558

    +

    Version 10.0.15063.674

      +
    • TDES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB64:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2557

    +

    Version 10.0.15254

      +
    • TDES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB64:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556

    +

    Version 10.0.16299

    TECB(KO 1 e/d); TCBC(KO 1 e/d); TCFB8(KO 1 e/d); TCFB64(KO 1 e/d)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459

    +

    Version 10.0.15063

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384

    +

    Version 8.00.6246

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383

    +

    Version 8.00.6246

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    CTR (int only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382

    +

    Version 7.00.2872

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381

    +

    Version 8.00.6246

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    TCFB8(KO 1 e/d);

    +

    TCFB64(KO 1 e/d)

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227
    +
    +

    +

    Version 10.0.14393

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    TCFB8(KO 1 e/d);

    +

    TCFB64(KO 1 e/d)

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024
    +
    +

    +

    Version 10.0.10586

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    TCFB8(KO 1 e/d);

    +

    TCFB64(KO 1 e/d)

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969
    +
    +

    +

    Version 10.0.10240

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    TCFB8(KO 1 e/d);

    +

    TCFB64(KO 1 e/d)

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692

    +

    Version 6.3.9600

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2);

    +

    TCFB64(e/d; KO 1, 2)

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2)

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2)

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2)

    		Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2)

    		Windows Vista Symmetric Algorithm Implementation #549
    Triple DES MAC

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed

    +

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2)

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308

    +

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691

    +

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #677

    +

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #676

    +

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #675

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #544

    +

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #543

    +

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #542

    +

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #526

    +

    Windows CE and Windows Mobile 6 and Windows Mobile 6.1 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #517

    +

    Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #381

    +

    Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #370

    +

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #365

    +

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #315

    +

    Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #201

    +

    Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #199

    +

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #192

    +

    Windows XP Microsoft Enhanced Cryptographic Provider #81

    +

    Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #18

    +

    Crypto Driver for Windows 2000 (fips.sys) #16

    + + +#### SP 800-132 Password-Based Key Derivation Function (PBKDF) + + + + + + + + + + + + + + +
    + Modes / States / Key Sizes + + Algorithm Implementation and Certificate # +
    + PBKDF (vendor affirmed) +

     Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
    (Software Version: 10.0.14393)

    +

    Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    +

    Code Integrity (ci.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2935
    (Software Version: 10.0.14393)

    +

    Boot Manager in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2931
    (Software Version: 10.0.14393)

    +
    + PBKDF (vendor affirmed) +

    Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    +

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed

    +
    + + +#### Component Validation List + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Publication / Component Validated / DescriptionImplementation and Certificate #
      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540

    +

    Version 6.3.9600

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Microsoft Surface Hub Virtual TPM Implementations #1519

    +

    Version 10.0.15063.674

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518

    +

    Version 10.0.16299

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1517

    +

    Version 10.0.15063.674

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1516

    +

    Version 10.0.15063.674

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

     Prerequisite: DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1515

    +

    Version 10.0.15063.674

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1514

    +

    Version 10.0.15063.674

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1513

    +

    Version 10.0.15063.674

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1512

    +

    Version 10.0.15063.674

      +
    • IKEv1:
      • +
      • +
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • +
      • Pre-shared Key Length: 64-2048
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, HMAC #3269

    +
      +
    • IKEv2:
      • +
      • +
      • Derived Keying Material length: 192-1792
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, HMAC #3269

    +
      +
    • TLS:
      • +
      • +
      • Supports TLS 1.0/1.1
        • +
      • Supports TLS 1.2:
        • +
        • +
        • SHA Functions: SHA-256, SHA-384
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, HMAC #3269

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1511

    +

    Version 10.0.15063.674

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1510

    +

    Version 10.0.15254

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1509

    +

    Version 10.0.15254

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1508

    +

    Version 10.0.15254

      +
    • IKEv1:
      • +
      • +
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • +
      • Pre-shared Key Length: 64-2048
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, HMAC #3268

    +
      +
    • IKEv2:
      • +
      • +
      • Derived Keying Material length: 192-1792
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, HMAC #3268

    +
      +
    • TLS:
      • +
      • +
      • Supports TLS 1.0/1.1
        • +
      • Supports TLS 1.2:
        • +
        • +
        • SHA Functions: SHA-256, SHA-384
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, HMAC #3268

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1507

    +

    Version 10.0.15254

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1506

    +

    Version 10.0.15254

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1505

    +

    Version 10.0.15254

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1504

    +

    Version 10.0.15254

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503

    +

    Version 10.0.16299

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502

    +

    Version 10.0.16299

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501

    +

    Version 10.0.16299

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499

    +

    Version 10.0.16299

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498

    +

    Version 10.0.16299

    +

     

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1497

    +

    Version 10.0.16299

      +
    • IKEv1:
      • +
      • +
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • +
      • Pre-shared Key Length: 64-2048
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, HMAC #3267

    +
      +
    • IKEv2:
      • +
      • +
      • Derived Keying Material length: 192-1792
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, HMAC #3267

    +
      +
    • TLS:
      • +
      • +
      • Supports TLS 1.0/1.1
        • +
      • Supports TLS 1.2:
        • +
        • +
        • SHA Functions: SHA-256, SHA-384
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, HMAC #3267

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    +

    Version 10.0.16299

    FIPS186-4 ECDSA

    +

    Signature Generation of hash sized messages

    +

    ECDSA SigGen Component: CURVES(P-256 P-384 P-521)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
    +Version 10.0. 15063

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
    +Version 10.0. 15063

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
    +Version 10.0.14393

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
    +Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
    +Version 10.0.10586

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
    +Version 6.3.9600

    FIPS186-4 RSA; PKCS#1 v2.1

    +

    RSASP1 Signature Primitive

    +

    RSASP1: (Mod2048: PKCS1.5 PKCSPSS)

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1285
    +Version 10.0.15063

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1282
    +Version 10.0.15063

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
    +Version 10.0.15063

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
    +Version 10.0.14393

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
    +Version 10.0.14393

    +

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
    +Version 10.0.10586

    +

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
    +Version  10.0.10240

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry MsBignum Cryptographic Implementations #289
    +Version 6.3.9600

    FIPS186-4 RSA; RSADP

    +

    RSADP Primitive

    +

    RSADP: (Mod2048)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1283
    +Version 10.0.15063

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
    +Version 10.0.15063

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
    +Version 10.0.14393

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
    +Version 10.0.14393

    +

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #663
    +Version 10.0.10586

    +

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #576
    +Version  10.0.10240

    SP800-135

    +

    Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    +

    Version 10.0.16299

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
    +Version 10.0.15063

    +

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1140
    +Version 7.00.2872

    +

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1139
    +Version 8.00.6246

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BcryptPrimitives and NCryptSSLp #886
    +Version 10.0.14393

    +

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BCryptPrimitives and NCryptSSLp #664
    +Version 10.0.10586

    +

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
    +Version  10.0.10240

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
    +Version 6.3.9600

    + +## Contact + +fips@microsoft.com + +## References + +* [FIPS 140-2, Security Requirements for Cryptographic Modules](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)) +* [Cryptographic Module Validation Program (CMVP) FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf) +* [SP 800-57 - Recommendation for Key Management – Part 1: General (Revised)](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) * [SP 800-131A - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf) \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/developer-faq.yml b/windows/security/threat-protection/intelligence/developer-faq.yml index 3a515be9fb..27ece7ec39 100644 --- a/windows/security/threat-protection/intelligence/developer-faq.yml +++ b/windows/security/threat-protection/intelligence/developer-faq.yml @@ -55,6 +55,6 @@ sections: Firewall blocks aren't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Windows Defender Firewall](../windows-firewall/windows-firewall-with-advanced-security.md). - question: | - Why does the Microsoft Defender Windows Defender SmartScreen say my program isn't commonly downloaded? + Why does the Microsoft Defender SmartScreen say my program isn't commonly downloaded? answer: | - This isn't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Microsoft Defender Windows Defender SmartScreen](../microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) + This isn't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Microsoft Defender SmartScreen](../microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) diff --git a/windows/security/threat-protection/intelligence/rootkits-malware.md b/windows/security/threat-protection/intelligence/rootkits-malware.md index 0fb53bc90f..250102afa9 100644 --- a/windows/security/threat-protection/intelligence/rootkits-malware.md +++ b/windows/security/threat-protection/intelligence/rootkits-malware.md @@ -56,7 +56,7 @@ For more general tips, see [prevent malware infection](prevent-malware-infection Microsoft security software includes a number of technologies designed specifically to remove rootkits. If you think you have a rootkit that your antimalware software isn’t detecting, you may need an extra tool that lets you boot to a known trusted environment. -[Microsoft Defender Offline](https://support.microsoft.com/help/17466/microsoft-defender-offline-help-protect-my-pc) can be launched from Windows Security Center and has the latest anti-malware updates from Microsoft. It’s designed to be used on devices that aren't working correctly because of a possible malware infection. +[Microsoft Defender Offline](https://support.microsoft.com/help/17466/microsoft-defender-offline-help-protect-my-pc) can be launched from the Windows Security app and has the latest antimalware updates from Microsoft. It’s designed to be used on devices that aren't working correctly because of a possible malware infection. [System Guard](https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard/) in Windows 10 protects against rootkits and threats that impact system integrity. diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md index a12edb4f83..406ee97c59 100644 --- a/windows/security/threat-protection/mbsa-removal-and-guidance.md +++ b/windows/security/threat-protection/mbsa-removal-and-guidance.md @@ -9,7 +9,7 @@ ms.author: dansimp author: dansimp ms.reviewer: manager: dansimp -ms.technology: other +ms.technology: windows-sec --- # What is Microsoft Baseline Security Analyzer and its uses? diff --git a/windows/security/threat-protection/microsoft-bug-bounty-program.md b/windows/security/threat-protection/microsoft-bug-bounty-program.md index 7dcc6cdd7f..70acd69970 100644 --- a/windows/security/threat-protection/microsoft-bug-bounty-program.md +++ b/windows/security/threat-protection/microsoft-bug-bounty-program.md @@ -10,7 +10,7 @@ ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.reviewer: -ms.technology: other +ms.technology: windows-sec --- # About the Microsoft Bug Bounty Program diff --git a/windows/security/threat-protection/msft-security-dev-lifecycle.md b/windows/security/threat-protection/msft-security-dev-lifecycle.md index c16994d574..df8eacefc1 100644 --- a/windows/security/threat-protection/msft-security-dev-lifecycle.md +++ b/windows/security/threat-protection/msft-security-dev-lifecycle.md @@ -10,7 +10,7 @@ ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.reviewer: -ms.technology: other +ms.technology: windows-sec --- # Microsoft Security Development Lifecycle diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md index 1ce02f4be2..6760e38f5a 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md @@ -40,8 +40,8 @@ This policy setting determines the behavior of all User Account Control (UAC) po Admin Approval Mode and all related UAC policies are disabled. > [!NOTE] - > If this security setting is configured to **Disabled**, the Security Center notifies the user that the overall security of the operating system has been reduced. - + > If this security setting is configured to **Disabled**, Windows Security app notifies the user that the overall security of the operating system has been reduced. + ### Best practices - Turn on this policy to allow all other UAC features and policies to function. @@ -52,7 +52,7 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec ### Default values -The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. +The following table lists the actual and effective default values for this policy. Default values are also listed on the policy's property page. | Server type or GPO | Default value | | - | - | diff --git a/windows/security/threat-protection/windows-10-mobile-security-guide.md b/windows/security/threat-protection/windows-10-mobile-security-guide.md index 4ee9598673..264a762b9c 100644 --- a/windows/security/threat-protection/windows-10-mobile-security-guide.md +++ b/windows/security/threat-protection/windows-10-mobile-security-guide.md @@ -120,7 +120,7 @@ In many cases, most apps don’t require enlightenment for them to use Windows I To configure Windows Information Protection in a Mobile Device Management (MDM) solution that supports it, simply add authorized apps to the allow list. When a device running Windows 10 Mobile enrolls in the MDM solution, unauthorized apps will not have access to enterprise data. -Windows Information Protection works seamlessly until users try to access enterprise data with or paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but Window Information Protection can block users from copying enterprise data from an authorized app to an unauthorized app. Likewise, it will block users from using an unauthorized app to open a file that contains enterprise data. +Windows Information Protection works seamlessly until users try to access enterprise data with or paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but Windows Information Protection can block users from copying enterprise data from an authorized app to an unauthorized app. Likewise, it will block users from using an unauthorized app to open a file that contains enterprise data. The extent to which users will be prevented from copying and pasting data from authorized apps to unauthorized apps or locations on the web depends on which protection level is set: - **Block.** Windows Information Protection blocks users from completing the operation. diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index fa6ef6f807..4112532232 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -66,7 +66,7 @@ A description of each policy rule, beginning with the left-most column, is provi | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | | **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is required to run HTA files, and is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | |**[Hypervisor-protected code integrity (HVCI)](../device-guard/enable-virtualization-based-protection-of-code-integrity.md)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| -| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | +| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by the Microsoft Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows–compatible driver must be WHQL certified. | | **Update Policy without Rebooting** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. | @@ -84,7 +84,7 @@ Selecting the **+ Advanced Options** label will show another column of policy ru |------------ | ----------- | | **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | | **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flight/preview-signed builds. | -| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | +| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that's only writable by an administrator) for any FileRule that allows a file based on FilePath. | | **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries (DLLs). | | **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later, or Windows 11 drivers will meet this requirement. | @@ -132,13 +132,12 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c ### File Hash Rules -Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. +Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause additional administrative overhead to maintain the current product version's hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. - -#### Deleting Signing Rules +#### Deleting Signing Rules The policy signing rules list table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. ## Up next -- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) \ No newline at end of file +- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md index 9f9932bc80..ab24b47475 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md @@ -25,7 +25,7 @@ ms.technology: windows-sec You can add information about your organization in a contact card to the Windows Security app. You can include a link to a support site, a phone number for a help desk, and an email address for email-based support. -![The security center custom fly-out.](images/security-center-custom-flyout.png) +![The Windows Security custom fly-out.](images/security-center-custom-flyout.png) This information will also be shown in some enterprise-specific notifications (including notifications for the [Block at first sight feature](/windows/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus), and [potentially unwanted applications](/windows/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus)). diff --git a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md index 7d0a3187b2..2f22a993dd 100644 --- a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md @@ -78,16 +78,16 @@ You can find more information about each section, including options for configur > [!IMPORTANT] > Microsoft Defender Antivirus and the Windows Security app use similarly named services for specific purposes. > -> The Windows Security app uses the Windows Security Service (*SecurityHealthService* or *Windows Security Health Servce*), which in turn utilizes the Security Center service ([*wscsvc*](/previous-versions/windows/it-pro/windows-xp/bb457154(v=technet.10)#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, third-party firewalls, and other security protection. +> The Windows Security app uses the Windows Security Service (*SecurityHealthService* or *Windows Security Health Service*), which in turn utilizes the Windows Security Center Service ([*wscsvc*](/previous-versions/windows/it-pro/windows-xp/bb457154(v=technet.10)#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, third-party firewalls, and other security protection. > >These services do not affect the state of Microsoft Defender Antivirus. Disabling or modifying these services will not disable Microsoft Defender Antivirus, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product. > >Microsoft Defender Antivirus will be [disabled automatically when a third-party antivirus product is installed and kept up to date](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility). > -> Disabling the Windows Security Center service will not disable Microsoft Defender Antivirus or [Windows Defender Firewall](/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). +> Disabling the Windows Security Center Service will not disable Microsoft Defender Antivirus or [Windows Defender Firewall](/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). > [!WARNING] -> If you disable the Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. +> If you disable the Windows Security Center Service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. > > It may also prevent Microsoft Defender Antivirus from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. > diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md index c234a83d1d..c73336b070 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md @@ -25,7 +25,7 @@ You can enable System Guard Secure Launch by using any of these options: - [Mobile Device Management (MDM)](#mobile-device-management) - [Group Policy](#group-policy) -- [Windows Security Center](#windows-security-center) +- [Windows Security app](#windows-security-app) - [Registry](#registry) ### Mobile Device Management @@ -34,17 +34,17 @@ System Guard Secure Launch can be configured for Mobile Device Management (MDM) ### Group Policy -1. Click **Start** > type and then click **Edit group policy**. +1. Click **Start** > type and then click **Edit group policy**. 2. Click **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn On Virtualization Based Security** > **Secure Launch Configuration**. ![Secure Launch Configuration.](images/secure-launch-group-policy.png) -### Windows Security Center +### Windows Security app Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation** > **Firmware protection**. - ![Windows Security Center.](images/secure-launch-security-app.png) + ![Windows Security app.](images/secure-launch-security-app.png) ### Registry @@ -54,7 +54,7 @@ Click **Start** > **Settings** > **Update & Security** > **Windows Security** > 3. Right-click **Scenarios** > **New** > **Key** and name the new key **SystemGuard**. -4. Right-click **SystemGuard** > **New** > **DWORD (32-bit) Value** and name the new DWORD **Enabled**. +4. Right-click **SystemGuard** > **New** > **DWORD (32-bit) Value** and name the new DWORD **Enabled**. 5. Double-click **Enabled**, change the value to **1**, and click **OK**. @@ -64,7 +64,7 @@ Click **Start** > **Settings** > **Update & Security** > **Windows Security** > To verify that Secure Launch is running, use System Information (MSInfo32). Click **Start**, search for **System Information**, and look under **Virtualization-based Security Services Running** and **Virtualization-based Security Services Configured**. -![Verifying Secure Launch is running in the Windows Security Center.](images/secure-launch-msinfo.png) +![Verifying Secure Launch is running in the Windows Security app.](images/secure-launch-msinfo.png) > [!NOTE] > To enable System Guard Secure launch, the platform must meet all the baseline requirements for [Device Guard](../device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md), [Credential Guard](../../identity-protection/credential-guard/credential-guard-requirements.md), and [Virtualization Based Security](/windows-hardware/design/device-experiences/oem-vbs). diff --git a/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md index fb40bad66f..84d2f5ce16 100644 --- a/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md +++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md @@ -1,6 +1,6 @@ --- title: GPO\_DOMISO\_IsolatedDomain\_Servers (Windows) -description: Author this GPO by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. +description: Author this GPO by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. ms.assetid: 33aed8f3-fdc3-4f96-985c-e9d2720015d3 ms.reviewer: ms.author: dansimp @@ -34,4 +34,3 @@ Because so many of the settings and rules for this GPO are common to those in th >**Important:**  Windows Vista and Windows Server 2008 support only one network location profile at a time. The profile for the least secure network type is applied to the device. If you attach a network adapter to a device that is not physically connected to a network, the public network location type is associated with the network adapter and applied to the device. **Next:** [Boundary Zone GPOs](boundary-zone-gpos.md) - diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 4568258c47..20366cd3bd 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -40,7 +40,7 @@ Microsoft Intune supports Windows 10 Enterprise LTSC 2019 and later. However, no ## Security -This version of Window 10 includes security improvements for threat protection, information protection, and identity protection. +This version of Windows 10 includes security improvements for threat protection, information protection, and identity protection. ### Threat protection diff --git a/windows/whats-new/whats-new-windows-10-version-1709.md b/windows/whats-new/whats-new-windows-10-version-1709.md index 80fd32b4a9..51abfb8e57 100644 --- a/windows/whats-new/whats-new-windows-10-version-1709.md +++ b/windows/whats-new/whats-new-windows-10-version-1709.md @@ -93,7 +93,7 @@ Microsoft Defender for Endpoint has been expanded with powerful analytics, secur Windows Defender Application Guard hardens a favorite attacker entry-point by isolating malware and other threats away from your data, apps, and infrastructure. For more information, see [Windows Defender Application Guard overview](/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview). -### Window Defender Exploit Guard +### Windows Defender Exploit Guard Window Defender Exploit Guard provides intrusion prevention capabilities to reduce the attack and exploit surface of applications. Exploit Guard has many of the threat mitigations that were available in Enhanced Mitigation Experience Toolkit (EMET) toolkit, a deprecated security download. These mitigations are now built into Windows and configurable with Exploit Guard. These mitigations include [Exploit protection](/microsoft-365/security/defender-endpoint/enable-exploit-protection), [Attack surface reduction protection](/microsoft-365/security/defender-endpoint/evaluate-attack-surface-reduction), [Controlled folder access](/microsoft-365/security/defender-endpoint/evaluate-controlled-folder-access), and [Network protection](/microsoft-365/security/defender-endpoint/enable-network-protection). diff --git a/windows/whats-new/whats-new-windows-10-version-21H2.md b/windows/whats-new/whats-new-windows-10-version-21H2.md index 2640bff4c6..af508674f5 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H2.md +++ b/windows/whats-new/whats-new-windows-10-version-21H2.md @@ -23,8 +23,8 @@ Windows 10, version 21H2 is the next feature update. This article lists the new Windows 10, version 21H2 is an [H2-targeted release](/lifecycle/faq/windows#what-is-the-servicing-timeline-for-a-version--feature-update--of-windows-10-), and has the following servicing schedule: -- **Windows 10 Professional**: Serviced for 24 months from the release date. -- **Windows 10 Enterprise**: Serviced for 36 months from the release date. +- **Windows 10 Professional**: Serviced for 18 months from the release date. +- **Windows 10 Enterprise**: Serviced for 30 months from the release date. Windows 10, version 21H2 is available through Windows Server Update Services (including Configuration Manager), Windows Update for Business, and the Volume Licensing Service Center (VLSC). For more information, see [How to get the Windows 10 November 2021 Update](https://blogs.windows.com/windowsexperience/2021/11/16/how-to-get-the-windows-10-november-2021-update/) and [IT tools to support Windows 10, version 21H2 blog](https://aka.ms/tools-for-21h2).