|
[!INCLUDE [intune-custom-settings-2](../../includes/configure/intune-custom-settings-2.md)]
-[!INCLUDE [intune-custom-settings-info](../../includes/configure/intune-custom-settings-info.md)]
> [!TIP]
> Use the following Graph call to automatically create the custom policy in your tenant without assignments nor scope tags. [1](#footnote1)
@@ -52,14 +51,13 @@ Content-Type: application/json
#### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
-To configure devices using a provisioning package, [create a provisioning package][WIN-1] using Windows Configuration Designer (WCD) with the following settings:
+[!INCLUDE [provisioning-package-1](../../includes/configure/provisioning-package-1.md)]
| Setting |
|--------|
|
Path: **`Education/AllowStickers`**
Value: **True**
|
-Follow the steps in [Apply a provisioning package][WIN-2] to apply the package that you created.
-
+[!INCLUDE [provisioning-package-2](../../includes/configure/provisioning-package-2.md)]
---
## How to use Stickers
@@ -76,8 +74,3 @@ Multiple stickers can be added from the picker by selecting them. The stickers c
:::image type="content" source="./images/win-11-se-stickers-animation.gif" alt-text="animation showing Windows 11 SE desktop with 4 pirate stickers being resized and moved" border="true":::
Select the *X button* at the top of the screen to save your progress and close the sticker editor.
-
-[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
-
-[WIN-1]: /windows/configuration/provisioning-packages/provisioning-create-package
-[WIN-2]: /windows/configuration/provisioning-packages/provisioning-apply-package
\ No newline at end of file
diff --git a/education/windows/edu-take-a-test-kiosk-mode.md b/education/windows/edu-take-a-test-kiosk-mode.md
index ba510327cf..21664c95bd 100644
--- a/education/windows/edu-take-a-test-kiosk-mode.md
+++ b/education/windows/edu-take-a-test-kiosk-mode.md
@@ -26,7 +26,7 @@ The other options allow you to configure Take a Test in kiosk mode using a local
Follow the instructions below to configure your devices, selecting the option that best suits your needs.
-#### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune)
+# [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune)
You can use Intune for Education or a custom profile in Microsoft Intune:
@@ -68,9 +68,8 @@ To configure devices using Intune for Education, follow these steps:
:::image type="content" source="./images/takeatest/intune-take-a-test-custom-profile.png" alt-text="Intune portal - creation of a custom policy to configure Take a Test." lightbox="./images/takeatest/intune-take-a-test-custom-profile.png" border="true":::
[!INCLUDE [intune-custom-settings-2](../../includes/configure/intune-custom-settings-2.md)]
-[!INCLUDE [intune-custom-settings-info](../../includes/configure/intune-custom-settings-info.md)]
-#### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
+# [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
To create a provisioning package, you can either use Set up School PCs or Windows Configuration Designer:
@@ -85,7 +84,7 @@ Create a provisioning package using the Set up School PCs app, configuring the s
### Create a provisioning package using Windows Configuration Designer
-[Create a provisioning package][WIN-1] using Windows Configuration Designer with the following settings:
+[!INCLUDE [provisioning-package-1](../../includes/configure/provisioning-package-1.md)]
| Setting |
|--------|
@@ -99,22 +98,11 @@ Create a provisioning package using the Set up School PCs app, configuring the s
:::image type="content" source="./images/takeatest/wcd-take-a-test.png" alt-text="Windows Configuration Designer - configuration of policies to enable Take a Test to run in kiosk mode" lightbox="./images/takeatest/wcd-take-a-test.png" border="true":::
-Follow the steps in [Apply a provisioning package][WIN-2] to apply the package that you created.
+[!INCLUDE [provisioning-package-2](../../includes/configure/provisioning-package-2.md)]
-#### [:::image type="icon" source="images/icons/powershell.svg"::: **PowerShell**](#tab/powershell)
+# [:::image type="icon" source="images/icons/powershell.svg"::: **PowerShell**](#tab/powershell)
-Configure your devices using PowerShell scripts via the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal). For more information, see [Using PowerShell scripting with the WMI Bridge Provider](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider).
-
-> [!TIP]
-> PowerShell scripts can be executed as scheduled tasks via Group Policy.
-
-> [!IMPORTANT]
-> For all device settings, the WMI Bridge client must be executed as SYSTEM (LocalSystem) account.
->
-> To test a PowerShell script, you can:
-> 1. [Download the psexec tool](/sysinternals/downloads/psexec)
-> 1. Open an elevated command prompt and run: `psexec.exe -i -s powershell.exe`
-> 1. Run the script in the PowerShell session
+[!INCLUDE [powershell-wmi-bridge-1](../../includes/configure/powershell-wmi-bridge-1.md)]
Edit the following sample PowerShell script to:
@@ -171,7 +159,9 @@ $cimObject.HideFastUserSwitching = 1
Set-CimInstance -CimInstance $cimObject
```
-#### [:::image type="icon" source="images/icons/settings.svg"::: **Settings app**](#tab/settings)
+[!INCLUDE [powershell-wmi-bridge-2](../../includes/configure/powershell-wmi-bridge-2.md)]
+
+# [:::image type="icon" source="images/icons/settings.svg"::: **Settings app**](#tab/settings)
To create a local account, and configure Take a Test in kiosk mode using the Settings app:
diff --git a/education/windows/take-tests-in-windows.md b/education/windows/take-tests-in-windows.md
index d9663d6d32..8c46ac4b93 100644
--- a/education/windows/take-tests-in-windows.md
+++ b/education/windows/take-tests-in-windows.md
@@ -1,7 +1,7 @@
---
title: Take tests and assessments in Windows
description: Learn about the built-in Take a Test app for Windows and how to use it.
-ms.date: 03/31/2023
+ms.date: 02/29/2024
ms.topic: how-to
---
@@ -48,7 +48,7 @@ This is an ideal option for teachers who want to create a link to a specific ass
For this option, you embed a URL with a specific prefix and specify parameters depending on what you want to allow during the test.
The URL must be in the following format:
-```
+```text
ms-edu-secureassessment:#enforceLockdown
```
diff --git a/includes/configure/intune-custom-settings-1.md b/includes/configure/intune-custom-settings-1.md
index 05f77b0843..d804757446 100644
--- a/includes/configure/intune-custom-settings-1.md
+++ b/includes/configure/intune-custom-settings-1.md
@@ -6,11 +6,4 @@ ms.topic: include
ms.service: windows-client
---
-To configure devices with Microsoft Intune, use a custom policy:
-
-1. Go to the Microsoft Intune admin center
-2. Select **Devices > Configuration profiles > Create profile**
-3. Select **Platform > Windows 10 and later** and **Profile type > Templates > Custom**
-4. Select **Create**
-5. Specify a **Name** and, optionally, a **Description > Next**
-6. Add the following settings:
\ No newline at end of file
+To configure devices with Microsoft Intune, [create a custom policy](/mem/intune/configuration/custom-settings-windows-10) and use the following settings:
\ No newline at end of file
diff --git a/includes/configure/intune-custom-settings-2.md b/includes/configure/intune-custom-settings-2.md
index 92dc4bf22d..66b5ceae1d 100644
--- a/includes/configure/intune-custom-settings-2.md
+++ b/includes/configure/intune-custom-settings-2.md
@@ -6,7 +6,4 @@ ms.topic: include
ms.service: windows-client
---
-7. Select **Next**
-8. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next**
-9. Under **Applicability Rules**, select **Next**
-10. Review the policy configuration and select **Create**
\ No newline at end of file
+Assign the policy to a group that contains as members the devices or users that you want to configure.
\ No newline at end of file
diff --git a/includes/configure/intune-custom-settings-info.md b/includes/configure/intune-custom-settings-info.md
deleted file mode 100644
index fc2277cecb..0000000000
--- a/includes/configure/intune-custom-settings-info.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-author: paolomatarazzo
-ms.author: paoloma
-ms.date: 08/15/2023
-ms.topic: include
-ms.service: windows-client
----
-
-For more information about how to create custom settings using Intune, see [Use custom settings for Windows devices in Intune](/mem/intune/configuration/custom-settings-windows-10).
\ No newline at end of file
diff --git a/includes/configure/powershell-wmi-bridge-1.md b/includes/configure/powershell-wmi-bridge-1.md
new file mode 100644
index 0000000000..84c8a0bb24
--- /dev/null
+++ b/includes/configure/powershell-wmi-bridge-1.md
@@ -0,0 +1,18 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 09/12/2023
+ms.topic: include
+ms.prod: windows-client
+---
+
+Configure your devices using PowerShell scripts via the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal).
+
+> [!IMPORTANT]
+> For all device settings, the WMI Bridge client must be executed as SYSTEM (LocalSystem) account.
+
+To test the PowerShell script, you can:
+
+1. [Download the psexec tool](/sysinternals/downloads/psexec)
+1. Open an elevated command prompt and run: `psexec.exe -i -s powershell.exe`
+1. Run the script in the PowerShell session
diff --git a/includes/configure/powershell-wmi-bridge-2.md b/includes/configure/powershell-wmi-bridge-2.md
new file mode 100644
index 0000000000..55db82674d
--- /dev/null
+++ b/includes/configure/powershell-wmi-bridge-2.md
@@ -0,0 +1,9 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 09/12/2023
+ms.topic: include
+ms.prod: windows-client
+---
+
+For more information, see [Use PowerShell scripting with the WMI Bridge Provider](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider).
diff --git a/includes/licensing/assigned-access-kiosk-mode.md b/includes/licensing/assigned-access.md
similarity index 84%
rename from includes/licensing/assigned-access-kiosk-mode.md
rename to includes/licensing/assigned-access.md
index f14704f482..fa2d4f7d31 100644
--- a/includes/licensing/assigned-access-kiosk-mode.md
+++ b/includes/licensing/assigned-access.md
@@ -7,13 +7,13 @@ ms.topic: include
## Windows edition and licensing requirements
-The following table lists the Windows editions that support Assigned Access (kiosk mode):
+The following table lists the Windows editions that support Assigned Access:
|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education|
|:---:|:---:|:---:|:---:|
|Yes|Yes|Yes|Yes|
-Assigned Access (kiosk mode) license entitlements are granted by the following licenses:
+Assigned Access license entitlements are granted by the following licenses:
|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5|
|:---:|:---:|:---:|:---:|:---:|
diff --git a/includes/licensing/shell-launcher.md b/includes/licensing/shell-launcher.md
new file mode 100644
index 0000000000..f53f3741e2
--- /dev/null
+++ b/includes/licensing/shell-launcher.md
@@ -0,0 +1,22 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 09/18/2023
+ms.topic: include
+---
+
+## Windows edition and licensing requirements
+
+The following table lists the Windows editions that support Shell Launcher:
+
+|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education|
+|:---:|:---:|:---:|:---:|
+|No|Yes|No|Yes|
+
+Shell Launcher license entitlements are granted by the following licenses:
+
+|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5|
+|:---:|:---:|:---:|:---:|:---:|
+|No|Yes|Yes|Yes|Yes|
+
+For more information about Windows licensing, see [Windows licensing overview](/windows/whats-new/windows-licensing).
diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md
deleted file mode 100644
index 534e26d426..0000000000
--- a/windows/application-management/add-apps-and-features.md
+++ /dev/null
@@ -1,98 +0,0 @@
----
-title: Add or hide Windows features
-description: Learn how to add Windows optional features using the Apps & features page in the Settings app. Also see the group policy objects (GPO) and MDM policies that show or hide Apps and Windows Features in the Settings app. Use Windows PowerShell to show or hide specific features in Windows Features.
-author: aczechowski
-ms.author: aaroncz
-manager: aaroncz
-ms.date: 08/18/2023
-ms.topic: how-to
-ms.service: windows-client
-ms.subservice: itpro-apps
-ms.localizationpriority: medium
-ms.collection: tier2
-appliesto:
- - ✅ Windows 11
- - ✅ Windows 10
----
-
-# Add or hide Windows features
-
-Windows includes optional features that aren't installed by default, but you can add later. These features are called [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities), and can be installed at any time. Some of these features are language resources like language packs or handwriting support. On organization-owned devices, you can control access to these other features. You can use group policy or mobile device management (MDM) policies to hide the UI from users, or use Windows PowerShell to enable or disable specific features.
-
-## Use the Windows Settings app to add or uninstall features
-
-### Windows 11
-
-1. Open the Start menu and search for **Settings**.
-
-1. In the Settings app, search for "optional" and select **Optional features**.
-
- > [!TIP]
- > You can also use the following shortcut to open it directly: [`ms-settings:optionalfeatures`](ms-settings:optionalfeatures).
-
-1. To add a feature:
-
- 1. Select **View features** next to "Add an optional feature."
-
- 1. Find the feature you want to add, like **XPS Viewer**. Select the box to add it. You can select multiple features.
-
- 1. Select **Next**. Review the list of features you selected, and then select **Install** to add the selected features.
-
-1. To uninstall a feature:
-
- 1. Search for it in the list of **Installed features**.
-
- 1. Expand the section, and select **Uninstall**.
-
-### Windows 10
-
-1. In the Search bar, search for "apps" and select **Apps and features**.
-
-1. Select **Optional features** > **Add a feature**.
-
-1. Select the feature you want to add, like **XPS Viewer**, and then select **Install.**
-
-When the installation completes, the feature is listed in **Apps & features**. In **Apps & features** > **Optional features** > **More Windows features**, there are more features that you and your users can install.
-
-To uninstall a feature, open the **Settings** app. Select the feature, and then select **Uninstall**.
-
-## Use group policy or MDM policies to hide Windows features
-
-By default, the OS might show Windows features and allow users to install and uninstall these optional apps and features. To hide Windows features on your user devices, you can use group policy or an MDM provider like Microsoft Intune.
-
-### Group policy
-
-If you use group policy, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Windows Features"` policy. By default, this policy may be set to **Not configured**, which means users can add or remove features. When this setting is **Enabled**, the settings page to add optional features is hidden on the device.
-
-You can't use group policy to disable specific Windows features, such as XPS Viewer. If you want to disable specific features, use [Windows PowerShell](#use-windows-powershell-to-disable-specific-features).
-
-If you want to hide the entire **Apps** feature in the Settings app, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Programs and Features" page` policy.
-
-### MDM
-
-Using Microsoft Intune, you can use [administrative templates](/mem/intune/configuration/administrative-templates-windows) or the [settings catalog](/mem/intune/configuration/settings-catalog) to hide Windows features.
-
-If you want to hide the entire **Apps** feature in the Settings app, you can use a configuration policy on Intune enrolled devices. For more information on the settings you can configure, see [Control Panel and Settings device restrictions in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings).
-
-## Use Windows PowerShell to disable specific features
-
-To disable specific features, use the Windows PowerShell [Disable-WindowsOptionalFeature](/powershell/module/dism/disable-windowsoptionalfeature) cmdlet.
-
-> [!NOTE]
-> There isn't a group policy that disables specific Windows features.
-
-To automate disabling specific features, create a scheduled task to run a PowerShell script. For more information about Windows task scheduler, see [Task Scheduler for developers](/windows/win32/taskschd/task-scheduler-start-page).
-
-Microsoft Intune can also run PowerShell scripts. For more information, see [Use PowerShell scripts on Windows client devices in Intune](/mem/intune/apps/intune-management-extension).
-
-To enable specific features, use the [Enable-WindowsOptionalFeature](/powershell/module/dism/enable-windowsoptionalfeature) cmdlet.
-
-Another useful PowerShell cmdlet is [Get-WindowsOptionalFeature](/powershell/module/dism/get-windowsoptionalfeature). Use this cmdlet to view information about optional features in the current OS or a mounted image. This cmdlet returns the current state of features, and whether a restart may be required when the state changes.
-
-## Related articles
-
-- [Features on Demand overview](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities)
-
-- [Available Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod)
-
-- [Language and region Features on Demand (FOD)](/windows-hardware/manufacture/desktop/features-on-demand-language-fod)
diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json
index 7b7f7eed47..128c0cfc00 100644
--- a/windows/application-management/docfx.json
+++ b/windows/application-management/docfx.json
@@ -39,6 +39,7 @@
"ms.collection": [
"tier2"
],
+ "zone_pivot_group_filename": "resources/zone-pivot-groups.json",
"uhfHeaderId": "MSDocsHeader-Windows",
"ms.service": "windows-client",
"ms.subservice": "itpro-apps",
@@ -53,9 +54,9 @@
"titleSuffix": "Windows Application Management",
"contributors_to_exclude": [
"dstrome2",
- "rjagiewich",
+ "rjagiewich",
"American-Dipper",
- "claydetels19",
+ "claydetels19",
"jborsecnik",
"v-stchambers",
"shdyas",
diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml
index 63f66e42cb..1308c9ba12 100644
--- a/windows/application-management/toc.yml
+++ b/windows/application-management/toc.yml
@@ -5,8 +5,6 @@ items:
items:
- name: Overview of apps in Windows
href: overview-windows-apps.md
- - name: Add or hide Windows features
- href: add-apps-and-features.md
- name: Sideload line of business (LOB) apps
href: sideload-apps-in-windows.md
- name: Private app repo on Windows 11
@@ -20,15 +18,15 @@ items:
- name: Keep removed apps from returning during an update
href: remove-provisioned-apps-during-update.md
- name: Application Virtualization (App-V)
- items:
+ items:
- name: App-V for Windows overview
href: app-v/appv-for-windows.md
- name: Getting Started
- items:
+ items:
- name: Getting Started with App-V
href: app-v/appv-getting-started.md
- name: What's new
- items:
+ items:
- name: What's new in App-V for Windows 10, version 1703 and earlier
href: app-v/appv-about-appv.md
- name: Release Notes for App-V for Windows 10, version 1607
@@ -40,11 +38,11 @@ items:
- name: High Level Architecture for App-V
href: app-v/appv-high-level-architecture.md
- name: Planning
- items:
+ items:
- name: Planning for App-V
href: app-v/appv-planning-for-appv.md
- name: Preparing your environment
- items:
+ items:
- name: Preparing your environment for App-V
href: app-v/appv-preparing-your-environment.md
- name: App-V Prerequisites
@@ -52,7 +50,7 @@ items:
- name: App-V security considerations
href: app-v/appv-security-considerations.md
- name: Planning to deploy
- items:
+ items:
- name: Planning to Deploy App-V
href: app-v/appv-planning-to-deploy-appv.md
- name: App-V Supported Configurations
@@ -74,11 +72,11 @@ items:
- name: App-V Planning Checklist
href: app-v/appv-planning-checklist.md
- name: Deploying
- items:
+ items:
- name: Deploying App-V
href: app-v/appv-deploying-appv.md
- name: App-V sequencer and client configuration
- items:
+ items:
- name: Deploying the App-V Sequencer and Configuring the Client
href: app-v/appv-deploying-the-appv-sequencer-and-client.md
- name: About Client Configuration Settings
@@ -88,7 +86,7 @@ items:
- name: How to Install the Sequencer
href: app-v/appv-install-the-sequencer.md
- name: App-V server deployment
- items:
+ items:
- name: Deploying the App-V Server
href: app-v/appv-deploying-the-appv-server.md
- name: How to Deploy the App-V Server
@@ -116,11 +114,11 @@ items:
- name: Deploying Microsoft Office 2010 by Using App-V
href: app-v/appv-deploying-microsoft-office-2010-wth-appv.md
- name: Operations
- items:
+ items:
- name: Operations for App-V
href: app-v/appv-operations.md
- name: Creating and managing virtualized applications
- items:
+ items:
- name: Creating and Managing App-V Virtualized Applications
href: app-v/appv-creating-and-managing-virtualized-applications.md
- name: Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)
@@ -140,7 +138,7 @@ items:
- name: How to Create a Virtual Application Package Using an App-V Package Accelerator
href: app-v/appv-create-a-virtual-application-package-package-accelerator.md
- name: Administering App-V
- items:
+ items:
- name: Administering App-V Virtual Applications by Using the Management Console
href: app-v/appv-administering-virtual-applications-with-the-management-console.md
- name: About App-V Dynamic Configuration
@@ -168,7 +166,7 @@ items:
- name: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console
href: app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md
- name: Connection groups
- items:
+ items:
- name: Managing Connection Groups
href: app-v/appv-managing-connection-groups.md
- name: About the Connection Group Virtual Environment
@@ -188,7 +186,7 @@ items:
- name: How to Allow Only Administrators to Enable Connection Groups
href: app-v/appv-allow-administrators-to-enable-connection-groups.md
- name: Deploying App-V packages with ESD
- items:
+ items:
- name: Deploying App-V Packages by Using Electronic Software Distribution (ESD)
href: app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md
- name: How to deploy App-V Packages Using Electronic Software Distribution
@@ -196,25 +194,25 @@ items:
- name: How to Enable Only Administrators to Publish Packages by Using an ESD
href: app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md
- name: Using the management console
- items:
+ items:
- name: Using the App-V client management console
href: app-v/appv-using-the-client-management-console.md
- name: Automatically clean up unpublished packages on the App-V client
href: app-v/appv-auto-clean-unpublished-packages.md
- name: Migrating
- items:
+ items:
- name: Migrating to App-V from a previous version
href: app-v/appv-migrating-to-appv-from-a-previous-version.md
- name: How to convert a package created in a previous version of App-V
href: app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md
- name: Maintenance
- items:
+ items:
- name: Maintaining App-V
href: app-v/appv-maintaining-appv.md
- name: How to Move the App-V Server to Another Computer
href: app-v/appv-move-the-appv-server-to-another-computer.md
- name: Administering App-V with Windows PowerShell
- items:
+ items:
- name: Administering App-V by using Windows PowerShell
href: app-v/appv-administering-appv-with-powershell.md
- name: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help
@@ -242,7 +240,7 @@ items:
- name: Troubleshooting App-V
href: app-v/appv-troubleshooting.md
- name: Technical Reference
- items:
+ items:
- name: Technical Reference for App-V
href: app-v/appv-technical-reference.md
- name: Available Mobile Device Management (MDM) settings for App-V
diff --git a/windows/client-management/client-tools/add-remove-hide-features.md b/windows/client-management/client-tools/add-remove-hide-features.md
new file mode 100644
index 0000000000..6bcc413598
--- /dev/null
+++ b/windows/client-management/client-tools/add-remove-hide-features.md
@@ -0,0 +1,170 @@
+---
+title: Add, remove, or hide Windows features
+description: Learn how to add or remove Windows optional features using the Optional features page in the Settings app. Also see the group policy objects (GPO) and MDM policies that show or hide Windows Features in the Settings app. Use Windows PowerShell to show or hide specific features in Windows Features.
+author: aczechowski
+ms.author: aaroncz
+manager: aaroncz
+ms.date: 03/13/2024
+ms.topic: how-to
+ms.service: windows-client
+ms.subservice: itpro-apps
+ms.localizationpriority: medium
+ms.collection: tier2
+zone_pivot_groups: windows-versions-11-10
+appliesto:
+ - ✅ Windows 11
+ - ✅ Windows 10
+---
+
+# Add, remove, or hide Windows features
+
+Windows has optional features that aren't included by default, but you can add later. These features are called [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities), and can be added at any time. Some of these features are language resources like language packs or handwriting support. On organization-owned devices, you can control access to these other features. You can use group policy or mobile device management (MDM) policies to hide the UI from users, or use Windows PowerShell to enable or disable specific features.
+
+## Use the Windows Settings app to add or remove features
+
+
+
+Open the **Optional features** pane in the **Settings** app by selecting the following link:
+
+> [!div class="nextstepaction"]
+> [Optional features](ms-settings:optionalfeatures)
+
+or
+
+1. Right-click on the **Start** menu and select **Run**.
+
+1. In the **Run** window, next to **Open:**, enter:
+
+ ```console
+ ms-settings:optionalfeatures
+ ```
+
+ and then select **OK**.
+
+or
+
+::: zone pivot="windows-11"
+
+1. Right-click on the **Start** menu and select **Settings**.
+
+1. In the left hand pane of the Settings app, select **System**.
+
+1. In the right hand **System** pane, select **Optional features**.
+
+> [!NOTE]
+>
+> The navigation steps, UI elements, and UI text in this section are based on the latest version of Windows 11 with the latest cumulative update installed. For other versions of Windows 11 that are currently supported or don't have the latest cumulative update, some of the navigation steps, UI elements, and UI text might be different. For example, the [**Optional features**](ms-settings:optionalfeatures) pane might be located under **Settings** > **Apps**.
+
+::: zone-end
+
+::: zone pivot="windows-10"
+
+1. Right-click on the **Start** menu and select **Settings**.
+
+1. In the Settings app, select **System**.
+
+1. In the left hand pane, select **Optional features**.
+
+> [!NOTE]
+>
+> The navigation steps, UI elements, and UI text in this section are based on Windows 10 22H2 with the latest cumulative update installed. For other versions of Windows 10 that are currently supported or don't have the latest cumulative update, some of the navigation steps, UI elements, and UI text might be different. For example, the [**Optional features**](ms-settings:optionalfeatures) pane might be located under **Settings** > **Apps** > **Apps & features**.
+
+::: zone-end
+
+### Add a feature
+
+::: zone pivot="windows-11"
+
+Once the **System > Optional features** pane is open, add a feature with the following steps:
+
+1. Select the **View features** button next to **Add an optional feature**.
+
+1. In the **Add an optional feature** window that opens:
+
+ 1. Find the desired feature to add and then select the box next to the feature to add it. Multiple features can be selected.
+
+ 1. Once all of the desired features are selected, select the **Next** button.
+
+ 1. Review the selected list of features and then select the **Install** button to add the selected features.
+
+::: zone-end
+
+::: zone pivot="windows-10"
+
+Once the **Optional features** pane is open, add a feature with the following steps:
+
+1. Select the **+** button next to **Add a feature**.
+
+1. In the **Add an optional feature** window that opens:
+
+ 1. Find the desired feature to add and then select the box next to the feature to add it. Multiple features can be selected.
+
+ 1. Once all of the desired features are selected, select the **Install** button.
+
+::: zone-end
+
+> [!IMPORTANT]
+>
+> Windows Update is used to add the optional features. The device needs to be online so Windows Update can download the content that it needs to add.
+
+### Remove a feature
+
+::: zone pivot="windows-11"
+
+Once the **System > Optional features** pane is open, remove a feature with the following steps:
+
+1. Under **Installed features**, search for the feature that needs to be removed in the **Search installed features** search box, or scroll through the list of added features until the feature that needs to be removed is found.
+
+1. Once the feature that needs to be removed is found, select the feature to expand it, and then select the **Uninstall** button.
+
+::: zone-end
+
+::: zone pivot="windows-10"
+
+Once the **Optional features** pane is open, remove a feature with the following steps:
+
+1. Under **Installed features**, search for the feature that needs to be removed in the **Find an installed optional feature** search box, or scroll through the list of added features until the feature that needs to be removed is found.
+
+1. Once the feature that needs to be removed is found, select the feature to expand it, and then select the **Uninstall** button.
+
+::: zone-end
+
+## Use group policy or MDM policies to hide Windows features
+
+By default, the OS might show Windows features and allow users to add and remove these optional apps and features. To hide Windows features on your user devices, you can use group policy or an MDM provider like Microsoft Intune.
+
+### Group policy
+
+If you use group policy, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Windows Features"` policy. By default, this policy might be set to **Not configured**, which means users can add or remove features. When this setting is **Enabled**, the settings page to add optional features is hidden on the device.
+
+You can't use group policy to disable specific Windows features. If you want to disable specific features, use [Windows PowerShell](#use-windows-powershell-to-disable-specific-features).
+
+If you want to hide the entire **Apps** feature in the Settings app, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Programs and Features" page` policy.
+
+### MDM
+
+Using Microsoft Intune, you can use [administrative templates](/mem/intune/configuration/administrative-templates-windows) or the [settings catalog](/mem/intune/configuration/settings-catalog) to hide Windows features.
+
+If you want to hide the entire **Apps** feature in the Settings app, you can use a configuration policy on Intune enrolled devices. For more information on the settings you can configure, see [Control Panel and Settings device restrictions in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings).
+
+## Use Windows PowerShell to disable specific features
+
+To disable specific features, use the Windows PowerShell [Disable-WindowsOptionalFeature](/powershell/module/dism/disable-windowsoptionalfeature) cmdlet.
+
+> [!NOTE]
+>
+> There isn't a group policy that disables specific Windows features.
+
+To automate disabling specific features, create a scheduled task to run a PowerShell script. For more information about Windows task scheduler, see [Task Scheduler for developers](/windows/win32/taskschd/task-scheduler-start-page).
+
+Microsoft Intune can also run PowerShell scripts. For more information, see [Use PowerShell scripts on Windows client devices in Intune](/mem/intune/apps/intune-management-extension).
+
+To enable specific features, use the [Enable-WindowsOptionalFeature](/powershell/module/dism/enable-windowsoptionalfeature) cmdlet.
+
+Another useful PowerShell cmdlet is [Get-WindowsOptionalFeature](/powershell/module/dism/get-windowsoptionalfeature). Use this cmdlet to view information about optional features in the current OS or a mounted image. This cmdlet returns the current state of features, and whether a restart might be required when the state changes.
+
+## Related content
+
+- [Features on Demand overview](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities).
+- [Available Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod).
+- [Language and region Features on Demand (FOD)](/windows-hardware/manufacture/desktop/features-on-demand-language-fod).
diff --git a/windows/client-management/client-tools/toc.yml b/windows/client-management/client-tools/toc.yml
index 115ff9afd8..17b21a7926 100644
--- a/windows/client-management/client-tools/toc.yml
+++ b/windows/client-management/client-tools/toc.yml
@@ -1,4 +1,6 @@
items:
+ - name: Add, remove, or hide Windows features
+ href: add-remove-hide-features.md
- name: Windows Tools/Administrative Tools
href: administrative-tools-in-windows.md
- name: Use Quick Assist to help users
diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md
index 85fa624e4a..df25725c5a 100644
--- a/windows/client-management/mdm/assignedaccess-csp.md
+++ b/windows/client-management/mdm/assignedaccess-csp.md
@@ -1,7 +1,7 @@
---
title: AssignedAccess CSP
description: Learn more about the AssignedAccess CSP.
-ms.date: 01/18/2024
+ms.date: 02/29/2024
---
@@ -11,19 +11,10 @@ ms.date: 01/18/2024
-The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration.
+The AssignedAccess configuration service provider (CSP) is used to configure a kiosk or restricted user experience. Once the CSP is executed, the next user login that is associated with the Assigned Access profile puts the device into the kiosk mode specified in the CSP configuration.
-- For a step-by-step guide for setting up devices to run in kiosk mode, see [Set up a single-app kiosk on Windows 10/11](/windows/configuration/kiosk-single-app).
-- For a step-by-step guide for configuring multi-app kiosks, see [Create a Windows 10 kiosk that runs multiple apps](/windows/configuration/lock-down-windows-10-to-specific-apps).
+To learn more about how to configure Assigned Access, see [Configure kiosks and restricted user experiences](/windows/configuration/assigned-access).
-> [!IMPORTANT]
-> The AssignedAccess CSP is supported in Windows 10 Enterprise and Windows 10 Education. Starting from Windows 10, version 1709, it is supported in Windows 10 Pro and Windows 10 S. Starting from Windows 10, version 1803, it is also supported in Windows Holographic for Business edition.
-
-> [!WARNING]
-> You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
-
-> [!NOTE]
-> If the application calls `KeyCredentialManager.IsSupportedAsync` when it is running in assigned access mode and it returns false on the first run, invoke the settings screen and select an appropriate PIN to use with Windows Hello. This is the settings screen that is hidden by the application running in assigned access mode. You can only use Windows Hello if you first leave assigned access mode, select your convenience pin, and then go back into assigned access mode again.
@@ -59,20 +50,8 @@ This node accepts an AssignedAccessConfiguration xml as input.
-The input XML specifies the settings that you can configure in the kiosk or device.
+To learn how to configure xml file, see [Create an Assigned Access configuration XML file](/windows/configuration/assigned-access/configuration-file)
-In **Windows 10, version 1803** the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk.
-
-In **Windows 10, version 1909**, Microsoft Edge kiosk mode support was added. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. The breakout sequence is defined with the format modifiers + keys. An example breakout sequence would look something like `shift+alt+a`, where `shift` and `alt` are the modifiers and `a` is the key.
-
-In **Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/5026446)**, AssignedAccessConfiguration schema was updated to add StartPins and TaskbarLayout nodes to support pinning apps to the Start Menu and Taskbar respectively.
-
-- For more information about setting up a multi-app kiosk, see [Create a Windows 10 kiosk that runs multiple apps](/windows/configuration/lock-down-windows-10-to-specific-apps).
-- For more information on the schema, see [AssignedAccessConfiguration XSD](#assignedaccessconfiguration-xsd).
-- For examples, see [AssignedAccessConfiguration examples](#assignedaccessconfiguration-examples).
-
-> [!NOTE]
-> Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it can't revert all the enforced policies (for example, Start Layout).
@@ -88,8 +67,6 @@ In **Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/
**Examples**:
-For more examples, see [AssignedAccessConfiguration examples](#assignedaccessconfiguration-examples).
-
- Get Configuration
```xml
@@ -165,8 +142,7 @@ This node supports Add, Delete, Replace and Get methods. When there's no configu
>
> This applies to both `domain\user`, `AzureAD\someone@contoso.onmicrosoft.com`, as long as a `\` is used in JSON string.
-- For more information about how to get the AUMID, see [Find the Application User Model ID of an installed app](/windows/configuration/find-the-application-user-model-id-of-an-installed-app).
-- For more information about single-app kiosk, see [Set up a single-app kiosk on Windows 10/11.](/windows/configuration/kiosk-single-app)
+For more information about how to get the AUMID, see [Find the Application User Model ID of an installed app](/windows/configuration/store/find-aumid).
> [!IMPORTANT]
>
@@ -293,9 +269,8 @@ This node accepts a ShellLauncherConfiguration xml as input.
-In **Windows 10, version 1903**, Shell Launcher V2 was introduced to support both UWP and Win32 apps as the custom shell.
-For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllauncher).
+To learn about Shell Launcher, see [What is Shell Launcher?](/windows/configuration/assigned-access/shell-launcher).
> [!IMPORTANT]
> You can't set both ShellLauncher and KioskModeApp at the same time on the device.
@@ -317,193 +292,8 @@ For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllau
-**ShellLauncherConfiguration XSD**:
-> [!NOTE]
-> Shell Launcher V2 uses a separate XSD and namespace for backward compatibility. The original V1 XSD has a reference to the V2 XSD.
-
-- Shell Launcher V1 XSD
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
-
-- Shell Launcher V2 XSD
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
+Here's the Shell Launcher XSD reference article: [Shell Launcher XML Schema Definition (XSD)](/windows/configuration/assigned-access/shell-launcher/xsd).
**Examples**:
@@ -523,160 +313,7 @@ For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllau
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
- ```
-
-- Add AutoLogon
-
- This function creates an auto-logon account on your behalf. It's a standard user with no password. The auto-logon account is managed by AssignedAccessCSP, so the account name isn't exposed.
-
- > [!NOTE]
- > The auto-logon function is designed to be used after OOBE with provisioning packages.
-
- ```xml
-
-
-
- 2
-
-
- ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher
-
-
- chr
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
- ```
-
-- V2 Add
-
- ```xml
-
-
-
- 2
-
-
- ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher
-
-
- chr
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
]]>
@@ -1026,594 +663,15 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat
## AssignedAccessConfiguration XSD
-- Schema for AssignedAccessConfiguration.
+Here's the Assigned Access XSD reference article: [Assigned Access XML Schema Definition (XSD)](/windows/configuration/assigned-access/xsd).
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- );
- ```
-
-- Schema for features introduced in Windows 10, version 1809 which added support for Microsoft Edge kiosk mode and breakout key sequence customization.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
-
-- Schema for new features introduced in Windows 10 1809 release.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
-
-- Schema for Windows 10 prerelease.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
-
-## AssignedAccessConfiguration examples
-
-> [!NOTE]
-> To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the auto-launch feature that was added in the 1809 release, use the below sample. Notice an alias `r1809` is given to the 201810 namespace for the 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline.
->
-> ```xml
-> xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
-> xmlns:r1809="http://schemas.microsoft.com/AssignedAccess/201810/config"
-> >
->
->
->
->
->
-> ...
->
-> ```
-
-- Example XML configuration for a multi-app kiosk for Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/5026446).
-
- > [!NOTE]
- > This example demonstrates the use of StartPins and TaskbarLayout elements. For more information, see [Set up a multi-app kiosk on Windows 11 devices](/windows/configuration/lock-down-windows-11-to-specific-apps).
- >
- > - StartPins element is used to pin apps to the Start menu and uses the [pinnedList JSON](/windows/configuration/customize-start-menu-layout-windows-11#get-the-pinnedlist-json) format.
- > - TaskbarLayout element is used to pin apps to the taskbar and uses the [TaskbarLayoutModification XML](/windows/configuration/customize-taskbar-windows-11#create-the-xml-file) format.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
- MultiAppKioskUser
-
-
-
-
- ```
-
-- Example XML configuration for a multi-app kiosk for Windows 10.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
- MultiAppKioskUser
-
-
-
-
- ```
-
-- Example XML configuration for a Microsoft Edge kiosk. This Microsoft Edge kiosk is configured to launch www.bing.com on startup in a public browsing mode.
-
- ```xml
-
-
-
-
-
-
-
-
-
- EdgeKioskUser
-
-
-
-
- ```
-
-- Example XML configuration for setting a breakout sequence to be Ctrl+A on a Microsoft Edge kiosk.
-
- > [!NOTE]
- > **BreakoutSequence** can be applied to any kiosk type, not just an Edge kiosk.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
- EdgeKioskUser
-
-
-
-
- ```
-
-
-
-## Windows Holographic for Business edition example
-
-This example configures the following apps: Skype, Learning, Feedback Hub, and Calibration, for first line workers. Use this XML in a provisioning package using Windows Configuration Designer. For instructions, see [Configure HoloLens using a provisioning package](/hololens/hololens-provisioning).
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
- AzureAD\multiusertest@analogfre.onmicrosoft.com
-
-
-
-
-```
+For practical examples of Assigned Access configuration files, see [Assigned Access examples](/windows/configuration/assigned-access/examples).
## Handling XML in Configuration
XML encoding (escaped) and CDATA of the XML in the Data node will both ensure that DM client can properly interpret the SyncML and send the configuration xml as string (in original format, unescaped) to AssignedAccess CSP to handle.
-Similarly, the StartLayout xml inside the configuration xml is using the same format, xml inside xml as string. In the sample Configuration xml provided above, CDATA is used to embed the StartLayout xml. If you use CDATA to embed configuration xml in SyncML as well, you'll have nested CDATA, so pay attention to how CDATA is used in the provided CDATA sample. With that being said, when the Configuration xml is being constructed, MDM server can either escape start layout xml or put startlayout xml inside CDATA, when MDM server puts configuration xml inside SyncML, MDM server can also either escape it or wrap with CDATA.
+Similarly, the StartLayout xml inside the configuration xml is using the same format, xml inside xml as string. In the sample Configuration xml provided above, CDATA is used to embed the StartLayout xml. If you use CDATA to embed configuration xml in SyncML as well, you have nested CDATA, so pay attention to how CDATA is used in the provided CDATA sample. With that being said, when the Configuration xml is being constructed, MDM server can either escape start layout xml or put startlayout xml inside CDATA, when MDM server puts configuration xml inside SyncML, MDM server can also either escape it or wrap with CDATA.
Escape and CDATA are mechanisms used when handling xml in xml. Consider that it's a transportation channel to send the configuration xml as payload from server to client. It's transparent to both, the end user who configures the CSP and to our CSP. Both the customer on the server side and our CSP must only see the original configuration XML.
@@ -1638,12 +696,6 @@ Escape and CDATA are mechanisms used when handling xml in xml. Consider that it'
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
<AllAppsList>
<AllowedApps>
- <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" />
- <App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" />
- <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
- <App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
- <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
- <App DesktopAppPath="%windir%\system32\mspaint.exe" />
<App DesktopAppPath="C:\Windows\System32\notepad.exe" />
</AllowedApps>
</AllAppsList>
@@ -1655,14 +707,6 @@ Escape and CDATA are mechanisms used when handling xml in xml. Consider that it'
<defaultlayout:StartLayout GroupCellWidth="6">
<start:Group Name="Group1">
<start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" />
- <start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" />
- <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
- <start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
- <start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
- </start:Group>
- <start:Group Name="Group2">
- <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\mspaint.exe" />
- <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\notepad.exe" />
</start:Group>
</defaultlayout:StartLayout>
</StartLayoutCollection>
@@ -1712,12 +756,6 @@ Escape and CDATA are mechanisms used when handling xml in xml. Consider that it'
-
-
-
-
-
-
@@ -1729,10 +767,6 @@ Escape and CDATA are mechanisms used when handling xml in xml. Consider that it'
-
-
-
-
diff --git a/windows/configuration/assigned-access/configuration-file.md b/windows/configuration/assigned-access/configuration-file.md
new file mode 100644
index 0000000000..5a96fcc4a4
--- /dev/null
+++ b/windows/configuration/assigned-access/configuration-file.md
@@ -0,0 +1,522 @@
+---
+title: Create an Assigned Access configuration file
+description: Learn how to create an XML file to configure Assigned Access.
+ms.topic: how-to
+zone_pivot_groups: windows-versions-11-10
+ms.date: 03/04/2024
+appliesto:
+---
+
+# Create an Assigned Access configuration XML file
+
+To configure Assigned Access, you must create and apply a configuration XML file to your devices. The configuration file must conform to a *schema*, as defined in [Assigned Access XML Schema Definition (XSD)](xsd.md).
+
+This article describes how to configure an Assigned Access configuration file, including practical examples.
+
+Let's start by looking at the basic structure of the XML file. An Assigned Access configuration file contains:
+
+- One or multiple `profiles`. Each `profile` defines a set of applications that are allowed to run
+- One or multiple `configs`. Each `config` associates a user account or a group to a `profile`
+
+Here's a basic example of an Assigned Access configuration file, with one profile and one config:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+## Versioning
+
+The Assigned Access configuration XML is versioned. The version is defined in the XML root element, and it's used to determine which schema to use to validate the XML file. The version is also used to determine which features are available for the configuration. Here's a table of the versions, aliases used in the documentation examples, and namespaces:
+
+| Version | Alias | Namespace |
+|-|-|-|
+|Windows 11, version 22H2|`v5`|`http://schemas.microsoft.com/AssignedAccess/2022/config`|
+|Windows 11, version 21H2|`v4`|`http://schemas.microsoft.com/AssignedAccess/2021/config`|
+|Windows 10|`v5`|`http://schemas.microsoft.com/AssignedAccess/202010/config`|
+|Windows 10|`v3`|`http://schemas.microsoft.com/AssignedAccess/2020/config`|
+|Windows 10|`rs5`|`http://schemas.microsoft.com/AssignedAccess/201810/config`|
+|Windows 10|default|`http://schemas.microsoft.com/AssignedAccess/2017/config`|
+
+To authorize a compatible configuration XML that includes version-specific elements and attributes, always include the namespace of the add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the `StartPins` feature that was added in Windows 11, version 22H2, use the below example. Note the alias `v5` associated to the `http://schemas.microsoft.com/AssignedAccess/2022/config` namespace for 22H2 release, and the alias is tagged on `StartPins` inline.
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+Here you can find the Assigned Access XML schema definitions: [Assigned Access XML Schema Definition (XSD)](xsd.md).
+
+## Profiles
+
+A configuration file can contain one or more profiles. Each profile is identified by a unique identifier `Profile Id` and, optionally, a `Name`. For example:
+
+```xml
+
+
+
+
+
+```
+
+> [!TIP]
+> The `Profile Id` must be unique within the XML file. You can generate a GUID with the PowerShell cmdlet `New-Guid`.
+
+A profile can be one of two types:
+
+- `KioskModeApp`: is used to configure a kiosk experience. Users assigned this profile don't access the desktop, but only the Universal Windows Platform (UWP) application or Microsoft Edge running in full-screen above the Lock screen
+- `AllAppList` is used to configure a restricted user experience. Users assigned this profile, access the desktop with the specific apps on the Start menu
+
+> [!IMPORTANT]
+>
+> - You can't set both `KioskModeApp` and `ShellLauncher` at the same time on the device
+> - A configuration file can contain only one `KioskModeApp` profile, but it can contain multiple `AllAppList` profiles.
+
+### KioskModeApp
+
+The properties of a `KioskModeApp` profile are:
+
+| Property| Description | Details |
+|-|-|-|
+|`AppUserModelId`|The Application User Model ID (AUMID) of the UWP app.|Learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md).|
+|`v4:ClassicAppPath`|The full path to a desktop app executable.|This is the path to the desktop app used in kiosk mode. The path can contain system environment variables in the form of `%variableName%`.|
+|`v4:ClassicAppArguments`|The arguments to be passed to the desktop app.|This property is optional.|
+
+By default, you can use the CTRL+ALT+DEL sequence to exit kiosk mode. You can define a `BreakoutSequence` element to change the default sequence. The `Key` attribute is a string that represents the key combination.
+
+Example of two profiles, a desktop app and a UWP app:
+
+```xml
+
+
+
+
+
+
+
+```
+
+> [!NOTE]
+> You can only assign a `KioskModeApp` profile to users, not to groups.
+
+### AllAppList
+
+Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules are generated to allow the apps that are listed in the configuration.
+
+> [!NOTE]
+> If an app has a dependency on another app, both must be included in the allowed apps list.
+
+Within the `AllAppList` node, define a list of applications that are allowed execute. Each `App` element has the following properties:
+
+| Property| Description | Details |
+|-|-|-|
+|`AppUserModelId`|The Application User Model ID (AUMID) of the UWP app.|Learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md).|
+|`DesktopAppPath`|The full path to a desktop app executable.|This is the path to the desktop app that used in kiosk mode. The path can contain system environment variables in the form of `%variableName%`.|
+|`rs5:AutoLaunch`|A Boolean attribute to indicate whether to launch the app (either desktop or UWP app) automatically when the user signs in.|This property is optional. Only one application can autolaunch.|
+|`rs5:AutoLaunchArguments`|The arguments to be passed to the app that is configured with `AutoLaunch`.|AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly. This property is optional.|
+
+Example:
+
+```xml
+
+
+
+
+
+
+
+
+
+```
+
+::: zone pivot="windows-10"
+
+### File Explorer restrictions
+
+In a restricted user experience (`AllAppList`), folder browsing is locked down by default. You can explicitly allow access to known folders by including the `FileExplorerNamespaceRestrictions` node.
+
+You can specify user access to Downloads folder, Removable drives, or no restrictions at all. Downloads and Removable Drives can be allowed at the same time.
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+Here are some practical examples.
+
+#### Block everything
+
+Either don't use the node or leave it empty.
+
+```xml
+
+
+```
+
+#### Only allow downloads
+
+```xml
+
+
+
+```
+
+#### Only allow removable drives
+
+```xml
+
+
+
+```
+
+#### Allow both Downloads, and removable drives
+
+```xml
+
+
+
+
+```
+
+#### No restrictions, all locations are allowed
+
+```xml
+
+
+
+```
+
+> [!TIP]
+> To grant access to File Explorer in a restricted user experience, add `Explorer.exe` to the list of allowed apps, and pin a shortcut to the Start menu.
+
+::: zone-end
+
+### Start menu customizations
+
+For a restricted user experience profile (`AllAppList`), you must define the Start layout. The Start layout contains a list of applications that are pinned to the Start menu. You can choose to pin all the allowed applications to the Start menu, or a subset. The easiest way to create a customized Start layout is to configure the Start menu on a test device and then export the layout.
+
+::: zone pivot="windows-10"
+
+To learn how to customize and export a Start menu configuration, see [Customize the Start menu](../start/customize-and-export-start-layout.md).
+
+With the exported Start menu configuration, use the `StartLayout` element and add the content of the XML file. For example:
+
+```xml
+
+
+ ]]>
+
+```
+
+Example with some apps pinned:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ]]>
+
+```
+
+::: zone-end
+
+::: zone pivot="windows-11"
+
+To learn how to customize and export a Start menu configuration, see [Customize the Start menu](../start/customize-and-export-start-layout.md).
+
+With the exported Start menu configuration, use the `v5:StartPins` element and add the content of the exported JSON file. For example:
+
+```xml
+
+
+ ]]>
+
+```
+
+Example with some apps pinned:
+
+
+
+
+
+::: zone-end
+
+> [!NOTE]
+> If an app isn't installed for the user, but is included in the Start layout XML, the app isn't shown on the Start screen.
+
+### Taskbar customizations
+
+::: zone pivot="windows-10"
+
+You can't pin apps on the taskbar in a restricted user experience. It's not supported to configure a Taskbar layout using the `` tag in a layout modification XML, as part of the Assigned Access configuration.
+
+The only Taskbar customization available is the option to show or hide it, using the `ShowTaskbar` boolean attribute.
+
+The following example exposes the taskbar:
+
+```xml
+
+```
+
+The following example hides the taskbar:
+
+```xml
+
+```
+
+> [!NOTE]
+> This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting `ShowTaskbar` as `false` hides the taskbar permanently.
+
+::: zone-end
+
+::: zone pivot="windows-11"
+
+You can customize the Taskbar by creating a custom layout and adding it to your XML file. To learn how to customize and export the Taskbar configuration, see [Customize the Taskbar](../taskbar/configure.md).
+
+> [!NOTE]
+> In Windows 11, the `ShowTaskbar` attribute is no-op. Configure it with a value of `true`.
+
+With the exported Taskbar configuration, use the `v5:TaskbarLayout` element and add the content of the XML file. For example:
+
+```xml
+
+
+ ]]>
+
+```
+
+Here's an example of a custom Taskbar with a few apps pinned:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ]]>
+
+```
+
+::: zone-end
+
+
+
+## Configs
+
+Under `Configs`, define one or more user accounts, or groups, and their association with a profile.
+
+When the user account signs in, the associated Assigned Access profile is enforced along with policy settings that are part of the restricted user experience.
+
+You can assign:
+
+- A standard user account, which can be local, domain, or Microsoft Entra ID
+- A group account, which can be local, Active Directory (domain), or Microsoft Entra ID
+
+Limitations:
+
+- Configs that specify group accounts can't use a kiosk profile, only a restricted user experience profile
+- Apply the restricted user experience to standard users only. It's not supported to associate an admin user with an Assigned Access profile
+- Don't apply the profile to users or groups that are targeted by conditional access policies that require user interaction. For example, multi-factor authentication (MFA), or Terms of Use (TOU). For more information, see [Users can't log on to Windows if a multi-app kiosk profile is assigned](/troubleshoot/mem/intune/device-configuration/users-cannot-logon-windows-multi-app-kiosk)
+
+>[!NOTE]
+> On Microsoft Entra joined and domain joined devices, local user accounts aren't displayed on the sign-in screen by default. To display the local accounts on the sign-in screen, enable the policy setting:
+>
+>- GPO: **Computer Configuration** > **Administrative Templates** > **System** > **Logon** > **Enumerate local users on domain-joined computers**
+>- CSP: `./Device/Vendor/MSFT/Policy/Config/WindowsLogon/`[EnumerateLocalUsersOnDomainJoinedComputers](/windows/client-management/mdm/policy-csp-windowslogon#enumeratelocalusersondomainjoinedcomputers)
+
+### AutoLogon account
+
+With ``, Assigned Access creates and manages a user account to automatically sign in after a device restarts. The account is a local standard user.
+
+The following example shows how to specify an account to sign in automatically, and the optional display name for the account on the sign-in screen:
+
+```xml
+
+
+
+
+
+
+```
+
+>[!IMPORTANT]
+>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature doesn't work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon).
+
+### Global profile
+
+With `GlobalProfile`, you can define an Assigned Access profile that is applied to every non-admin account that signs in. `GlobalProfile` is useful in scenarios like frontline workers or student devices, where you want to ensure that every user has a consistent experience.
+
+```xml
+
+
+
+```
+
+> [!NOTE]
+> You can combine a global profile with other profiles. If you assign a user a non-global profile, the global profile won't be applied to that user.
+
+### User accounts
+
+Individual accounts are specified using ``.
+
+> [!IMPORTANT]
+> Before applying the Assigned Access configuration, make sure the specified user account is available on the device, otherwise it fails.
+>
+> For both domain and Microsoft Entra accounts, as long as the device is Active Directory joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access.
+
+#### Local user
+
+Local account can be entered as `devicename\user`, `.\user`, or just `user`.
+
+```xml
+
+ user
+
+
+```
+
+#### Active Directory user
+
+Domain accounts must be entered using the format `domain\samAccountName`.
+
+```xml
+
+ contoso\user
+
+
+```
+
+#### Microsoft Entra user
+
+Microsoft Entra accounts must be specified with the format: `AzureAD\{UPN}`. `AzureAD` must be provided *as is*, then follow with the Microsoft Entra user principal name (UPN).
+
+```xml
+
+ AzureAD\user@contoso.onmicrosoft.com
+
+
+```
+
+### Group accounts
+
+Group accounts are specified using ``. Nested groups aren't supported. For example, if *User A* is member of *Group A*, *Group A* is member of *Group B*, and *Group B* is used in ``, *User A* doesn't have the kiosk experience.
+
+#### Local group
+
+Specify the group type as `LocalGroup` and add the group name in the `Name` attribute.
+
+```xml
+
+
+
+
+```
+
+#### Active Directory group
+
+Both security and distribution groups are supported. Specify the group type as `ActiveDirectoryGroup`. Use the domain name as the prefix in the name attribute.
+
+```xml
+
+
+
+
+```
+
+#### Microsoft Entra group
+
+Use the object ID of the Microsoft Entra group. You can find the object ID on the overview page for the group by signing in to the Microsoft Entra admin center and browsing to **Identity** > **Groups** > **All groups**. Specify the group type as `AzureActiveDirectoryGroup`. The kiosk device must have internet connectivity when users that belong to the group sign-in.
+
+```xml
+
+
+
+
+```
+
+## Next steps
+
+> [!div class="nextstepaction"]
+> Review some practical examples of Assigned Access XML configurations:
+>
+> [Assigned Access examples](examples.md)
diff --git a/windows/configuration/assigned-access/examples.md b/windows/configuration/assigned-access/examples.md
new file mode 100644
index 0000000000..3c0c865d64
--- /dev/null
+++ b/windows/configuration/assigned-access/examples.md
@@ -0,0 +1,49 @@
+---
+title: Assigned Access examples
+description: Practical examples of XML files to configure Assigned Access.
+ms.date: 03/04/2024
+ms.topic: reference
+zone_pivot_groups: windows-versions-11-10
+appliesto:
+---
+
+# Assigned Access examples
+
+This article contains examples of XML files to configure a device with Assigned Access. The files can be easily modified to fit your specific needs.
+
+To learn more:
+
+- [Create an Assigned Access configuration XML file](configuration-file.md).
+- [Assigned Access XML Schema Definition (XSD)](xsd.md).
+
+## Kiosk experience with Microsoft Edge
+
+[!INCLUDE [example-kiosk-edge](includes/example-kiosk-edge.md)]
+
+## Kiosk experience with Universal Windows Platform (UWP) app
+
+[!INCLUDE [example-kiosk-uwp](includes/example-kiosk-uwp.md)]
+
+::: zone pivot="windows-10"
+
+## File Explorer restrictions
+
+[!INCLUDE [example-file-explorer-restrictions](includes/example-file-explorer-restrictions.md)]
+
+::: zone-end
+
+## Global Profile
+
+The following configuration demonstrates that only a global profile is used, with no user configured.
+
+[!INCLUDE [example-global-profile](includes/example-global-profile.md)]
+
+## User Group
+
+The following configuration demonstrates how to assign profiles to different users and groups, including a user configured to automatically sign in.
+
+[!INCLUDE [example-usergroup](includes/example-usergroup.md)]
+
+## Restricted user experience
+
+[!INCLUDE [example-restricted-experience](includes/example-restricted-experience.md)]
diff --git a/windows/configuration/assigned-access/images/kiosk.png b/windows/configuration/assigned-access/images/kiosk.png
new file mode 100644
index 0000000000..bea0e381b6
Binary files /dev/null and b/windows/configuration/assigned-access/images/kiosk.png differ
diff --git a/windows/configuration/assigned-access/images/restricted-user-experience-windows-10.png b/windows/configuration/assigned-access/images/restricted-user-experience-windows-10.png
new file mode 100644
index 0000000000..81f6ded25e
Binary files /dev/null and b/windows/configuration/assigned-access/images/restricted-user-experience-windows-10.png differ
diff --git a/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png b/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png
new file mode 100644
index 0000000000..6105c7bdd7
Binary files /dev/null and b/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png differ
diff --git a/windows/configuration/assigned-access/images/restricted-user-experience.png b/windows/configuration/assigned-access/images/restricted-user-experience.png
new file mode 100644
index 0000000000..566b4bd902
Binary files /dev/null and b/windows/configuration/assigned-access/images/restricted-user-experience.png differ
diff --git a/windows/configuration/assigned-access/includes/example-file-explorer-restrictions.md b/windows/configuration/assigned-access/includes/example-file-explorer-restrictions.md
new file mode 100644
index 0000000000..ff855baa88
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/example-file-explorer-restrictions.md
@@ -0,0 +1,30 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 03/01/2024
+ms.topic: include
+---
+
+
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
diff --git a/windows/configuration/assigned-access/includes/example-global-profile.md b/windows/configuration/assigned-access/includes/example-global-profile.md
new file mode 100644
index 0000000000..a818640cbd
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/example-global-profile.md
@@ -0,0 +1,22 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+```
diff --git a/windows/configuration/assigned-access/includes/example-kiosk-edge.md b/windows/configuration/assigned-access/includes/example-kiosk-edge.md
new file mode 100644
index 0000000000..91059e7434
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/example-kiosk-edge.md
@@ -0,0 +1,26 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 03/01/2024
+ms.topic: include
+---
+
+
+
+```xml
+
+
+
+
+
+
+
+
+
+
+ Edge kiosk
+
+
+
+
+```
diff --git a/windows/configuration/assigned-access/includes/example-kiosk-uwp.md b/windows/configuration/assigned-access/includes/example-kiosk-uwp.md
new file mode 100644
index 0000000000..69e5a1ac70
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/example-kiosk-uwp.md
@@ -0,0 +1,25 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+
+
+```xml
+
+
+
+
+
+
+
+
+
+ Weather app
+
+
+
+
+```
diff --git a/windows/configuration/assigned-access/includes/example-restricted-experience.md b/windows/configuration/assigned-access/includes/example-restricted-experience.md
new file mode 100644
index 0000000000..7ee28b6761
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/example-restricted-experience.md
@@ -0,0 +1,115 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+
+
+::: zone pivot="windows-10"
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ]]>
+
+
+
+
+
+
+
+
+
+
+```
+
+::: zone-end
+
+::: zone pivot="windows-11"
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+::: zone-end
diff --git a/windows/configuration/assigned-access/includes/example-two-profiles.md b/windows/configuration/assigned-access/includes/example-two-profiles.md
new file mode 100644
index 0000000000..42bad92801
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/example-two-profiles.md
@@ -0,0 +1,37 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Weather app
+
+
+
+ Library Kiosk
+
+
+
+
+```
diff --git a/windows/configuration/assigned-access/includes/example-usergroup.md b/windows/configuration/assigned-access/includes/example-usergroup.md
new file mode 100644
index 0000000000..7d69b07f0b
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/example-usergroup.md
@@ -0,0 +1,47 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+
+
+```xml
+
+
+
+
+
+
+
+ contoso\user
+
+
+
+ AzureAD\user@contoso.onmicrosoft.com
+
+
+
+ user
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
diff --git a/windows/configuration/assigned-access/includes/quickstart-kiosk-intune.md b/windows/configuration/assigned-access/includes/quickstart-kiosk-intune.md
new file mode 100644
index 0000000000..8fb14f8ac6
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/quickstart-kiosk-intune.md
@@ -0,0 +1,13 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+```msgraph-interactive
+POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations
+Content-Type: application/json
+
+{ "id": "00000000-0000-0000-0000-000000000000", "displayName": "_MSLearn_Example_Kiosk - Assigned Access", "description": "This is a sample policy created from an article on learn.microsoft.com.", "roleScopeTagIds": [ "0" ], "@odata.type": "#microsoft.graph.windows10CustomConfiguration", "omaSettings": [ { "omaUri": "./Vendor/MSFT/AssignedAccess/Configuration", "displayName": "Configuration", "@odata.type": "#microsoft.graph.omaSettingString", "value": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n" } ] }
+```
\ No newline at end of file
diff --git a/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md b/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md
new file mode 100644
index 0000000000..4f5ce43c2e
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md
@@ -0,0 +1,32 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+```powershell
+$assignedAccessConfiguration = @"
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+"@
+
+$namespaceName="root\cimv2\mdm\dmmap"
+$className="MDM_AssignedAccess"
+$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
+$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration)
+Set-CimInstance -CimInstance $obj
+```
diff --git a/windows/configuration/assigned-access/includes/quickstart-kiosk-xml.md b/windows/configuration/assigned-access/includes/quickstart-kiosk-xml.md
new file mode 100644
index 0000000000..93a0607346
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/quickstart-kiosk-xml.md
@@ -0,0 +1,24 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
diff --git a/windows/configuration/assigned-access/includes/quickstart-restricted-experience-intune.md b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-intune.md
new file mode 100644
index 0000000000..7267d16e53
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-intune.md
@@ -0,0 +1,28 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+::: zone pivot="windows-10"
+
+```msgraph-interactive
+POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations
+Content-Type: application/json
+
+{ "id": "00-0000-0000-0000-000000000000", "displayName": "_MSLearn_Example_Restricted_User_Experience - Assigned Access - Windows 10", "description": "This is a sample policy created from an article on learn.microsoft.com.", "roleScopeTagIds": [ "0" ], "@odata.type": "#microsoft.graph.windows10CustomConfiguration", "omaSettings": [ { "@odata.type": "#microsoft.graph.omaSettingString", "displayName": "AssignedAccess_Configuration", "description": null, "omaUri": "./Vendor/MSFT/AssignedAccess/Configuration", "secretReferenceValueId": null, "isEncrypted": true, "value": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n ]]>\n \n \n \n \n \n \n \n \n \n \n" } ] }
+```
+
+::: zone-end
+
+::: zone pivot="windows-11"
+
+```msgraph-interactive
+POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations
+Content-Type: application/json
+
+{ "id": "00-0000-0000-0000-000000000000", "displayName": "_MSLearn_Example_Restricted_User_Experience - Assigned Access - Windows 11", "description": "This is a sample policy created from an article on learn.microsoft.com.", "roleScopeTagIds": [ "0" ], "@odata.type": "#microsoft.graph.windows10CustomConfiguration", "omaSettings": [ { "@odata.type": "#microsoft.graph.omaSettingString", "displayName": "AssignedAccess_Configuration", "description": null, "omaUri": "./Vendor/MSFT/AssignedAccess/Configuration", "secretReferenceValueId": null, "isEncrypted": true, "value": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" } ] }
+```
+
+::: zone-end
\ No newline at end of file
diff --git a/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md
new file mode 100644
index 0000000000..35a15c446f
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md
@@ -0,0 +1,129 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+::: zone pivot="windows-10"
+
+```powershell
+$assignedAccessConfiguration = @"
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ]]>
+
+
+
+
+
+
+
+
+
+
+"@
+
+$namespaceName="root\cimv2\mdm\dmmap"
+$className="MDM_AssignedAccess"
+$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
+$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration)
+Set-CimInstance -CimInstance $obj
+```
+
+::: zone-end
+
+::: zone pivot="windows-11"
+
+```powershell
+$assignedAccessConfiguration = @"
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+"@
+
+$namespaceName="root\cimv2\mdm\dmmap"
+$className="MDM_AssignedAccess"
+$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
+$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration)
+Set-CimInstance -CimInstance $obj
+```
+
+::: zone-end
diff --git a/windows/configuration/assigned-access/includes/quickstart-restricted-experience-xml.md b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-xml.md
new file mode 100644
index 0000000000..514c6ab44c
--- /dev/null
+++ b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-xml.md
@@ -0,0 +1,113 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+::: zone pivot="windows-10"
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ]]>
+
+
+
+
+
+
+
+
+
+
+```
+
+::: zone-end
+
+::: zone pivot="windows-11"
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+::: zone-end
diff --git a/windows/configuration/assigned-access/index.md b/windows/configuration/assigned-access/index.md
new file mode 100644
index 0000000000..e8f3ecf20b
--- /dev/null
+++ b/windows/configuration/assigned-access/index.md
@@ -0,0 +1,72 @@
+---
+title: Windows kiosks and restricted user experiences
+description: Learn about the options available in Windows to configure kiosks and restricted user experiences.
+ms.topic: overview
+ms.date: 03/04/2024
+---
+
+# Windows kiosks and restricted user experiences
+
+Organizations are constantly seeking ways to streamline operations, improve customer service, and enhance productivity. One effective solution is the deployment of kiosk devices. These specialized devices offer a range of benefits that can significantly impact an organization's efficiency and success. For example:
+
+- Cost-effective customer service: kiosks allow organizations to provide essential services without the need for dedicated staff. Whether it's checking in at a hotel, ordering food at a restaurant, or printing boarding passes at an airport, kiosks reduce labor costs while maintaining service quality. Customers appreciate the convenience of self-service options, leading to higher satisfaction levels
+- Reduced wait times: long queues and wait times frustrate customers and staff members. Kiosks expedite processes by allowing users to complete tasks independently. Whether it's paying bills, renewing memberships, or accessing information, kiosks empower users to get things done swiftly
+- Consistent brand experience: kiosks ensure a uniform brand experience across different locations. Whether in retail stores, schools, airports, or healthcare facilities, the interface remains consistent. Brand consistency builds trust and reinforces the organization's image
+- Customization and flexibility: kiosks can be tailored to specific needs. From touchscreens to barcode scanners, organizations choose features that align with their goals. Whether it's self-checkout, wayfinding, or interactive product catalogs, kiosks adapt to diverse requirements
+
+Windows offers two different options for public or specialized use:
+
+:::row:::
+ :::column span="1":::
+ :::image type="content" source="images/kiosk.png" alt-text="Icon representing a kiosk." border="false":::
+ :::column-end:::
+ :::column span="3":::
+ #### Kiosk experience
+ :::column-end:::
+:::row-end:::
+
+This option runs a single application in full screen, and people using the device can only use that app. When the designated kiosk account signs in, the kiosk app launches automatically. This option is sometimes referred to as *single-app kiosk*.
+
+Windows offers two different features to configure a kiosk experience:
+
+- **Assigned Access**: used to execute a single Universal Windows Platform (UWP) app or Microsoft Edge in full screen above the lock screen. When the kiosk account signs in, the kiosk app launches automatically. If the UWP app is closed, it automatically restarts
+- **Shell Launcher**: used to configure a device to execute a Windows desktop application as the user interface. The application that you specify replaces the default Windows shell (`Explorer.exe`) that usually runs when a user signs in. This type of single-app kiosk doesn't run above the lock screen
+
+:::row:::
+ :::column span="1":::
+ :::image type="content" source="images/restricted-user-experience.png" alt-text="Icon representing a restricted user experience." border="false":::
+ :::column-end:::
+ :::column span="3":::
+ #### Restricted user experience
+ :::column-end:::
+:::row-end:::
+
+This option loads the Windows desktop, but it only allows to run a defined set of applications. When the designated user signs in, the user can only run the apps that are allowed. The Start menu is customized to show only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types. This option is sometimes referred to as *multi-app kiosk*.
+
+To configure a restricted user experience, you use the **Assigned Access** feature.
+
+## Choose the right experience
+
+When you're considering a kiosk or restricted user experience, you need to choose the right experience for your needs. A good approach is to ask yourself the following set of questions:
+
+| | Question |
+|--|--|
+| **🔲** | *How many apps?* The number of apps determines the experience to build: **kiosk** or **restricted user experience**.|
+| **🔲** | *Desktop experience or custom?* If your users require access to the desktop with a custom Start menu, then you can build a **restricted user experience** with **Assigned Access**. If your users require access to multiple applications but with a custom user interface, then you should use **Shell Launcher**.|
+| **🔲** | *In single-app scenario, which type of app will your kiosk run?* If the kiosk requires a Universal Windows Platform (UWP) app or Microsoft Edge, you can build a **kiosk experience** with **Assigned Access**. If the kiosk requires a desktop app, you can build a **kiosk experience** with **Shell Launcher**.|
+| **🔲** | *Which edition of Windows client will the kiosk run?"* **Assigned Access** is supported on Windows Pro and Enterprise/Education. **Shell Launcher** is only supported on Windows Enterprise and Education editions.|
+
+## Next steps
+
+In the next sections, you can learn more about the options available to configure kiosks and restricted user experiences:
+
+- [Assigned Access](overview.md)
+- [Shell Launcher](shell-launcher/index.md)
+
+### :::image type="icon" source="../images/icons/rocket.svg" border="false"::: Quickstarts
+
+If you're ready to try out the options available to configure kiosks and restricted user experiences, check out the following quickstarts:
+
+- [Quickstart: configure a kiosk with Assigned Access](quickstart-kiosk.md)
+- [Quickstart: configure a kiosk experience with Shell Launcher](shell-launcher/quickstart-kiosk.md)
+- [Quickstart: configure a restricted user experience with Assigned Access](quickstart-restricted-user-experience.md)
\ No newline at end of file
diff --git a/windows/configuration/assigned-access/overview.md b/windows/configuration/assigned-access/overview.md
new file mode 100644
index 0000000000..aaac72ceeb
--- /dev/null
+++ b/windows/configuration/assigned-access/overview.md
@@ -0,0 +1,342 @@
+---
+title: What is Assigned Access?
+description: Learn about Assigned Access and how you can use it to configure a Windows device as a kiosk or restricted user experience.
+ms.date: 03/04/2024
+ms.topic: overview
+---
+
+# What is Assigned Access?
+
+Assigned Access is a Windows feature that you can use to configure a device as a kiosk or with a restricted user experience.
+
+When you configure a **kiosk experience**, a single Universal Windows Platform (UWP) application or Microsoft Edge is executed in full screen, above the lock screen. Users can only use that application. If the kiosk app is closed, it automatically restarts. Practical examples include:
+
+- Public browsing
+- Interactive digital signage
+
+When you configure a **restricted user experience**, users can only execute a defined list of applications, with a tailored Start menu and Taskbar. Different policy settings and AppLocker rules are enforced, creating a locked down experience. The users can access a familiar Windows desktop, while limiting their access, reducing distractions, and potential for inadvertent uses. Ideal for shared devices, you can create different configurations for different users. Practical examples include:
+
+- Frontline worker devices
+- Student devices
+- Lab devices
+
+> [!NOTE]
+> When you configure a restricted user experience, different policy settings are applied to the device. Some policy settings apply to standard users only, and some to administrator accounts too. For more information, see [Assigned Access policy settings](policy-settings.md).
+
+## Requirements
+
+Here are the requirements for Assigned Access:
+
+- To use a kiosk experience, [User account control (UAC)](/windows/security/identity-protection/user-account-control/user-account-control-overview) must be enabled
+- To use a kiosk experience, you must sign in from the console. The kiosk experience isn't supported over a remote desktop connection
+
+[!INCLUDE [assigned-access](../../../includes/licensing/assigned-access.md)]
+
+## Configure a kiosk experience
+
+There are several options to configure a kiosk experience. If you need to configure a single device with a local account, you can use:
+
+- PowerShell: you can use the `Set-AssignedAccess` PowerShell cmdlet to configure a kiosk experience using a local standard account
+- Settings: use this option when you need a simple method to configure a single device with a local standard user account
+
+For advanced customizations, you can use the [Assigned Access CSP](/windows/client-management/mdm/assignedaccess-csp) to configure the kiosk experience. The CSP allows you to configure the kiosk app, the user account, and the kiosk app's behavior. When you use the CSP, you must create an XML configuration file that specifies the kiosk app and the user account. The XML file is applied to the device using one of the following options:
+
+- A Mobile Device Management (MDM) solution, like Microsoft Intune
+- Provisioning packages
+- PowerShell, with the MDM Bridge WMI Provider
+
+To learn how to configure the Shell Launcher XML file, see [Create an Assigned Access configuration file](configuration-file.md).
+
+[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)]
+
+#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
+
+You can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3].
+
+- **Setting:** `./Vendor/MSFT/AssignedAccess/Configuration`
+- **Value:** content of the XML configuration file
+
+Assign the policy to a group that contains as members the devices that you want to configure.
+
+#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
+
+[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)]
+
+- **Path:** `AssignedAccess/AssignedAccessSettings`
+- **Value:** Enter the account and the application you want to use for Assigned access, using the AUMID of the app. Example:
+ - `{"Account":"domain\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}`
+
+[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)]
+
+#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps)
+
+To configure a device using Windows PowerShell:
+
+1. Sign in as administrator
+1. [Create the user account](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) for Assigned Access
+1. Sign in as the Assigned Access user account
+1. Install the required UWP app
+1. Sign out as the Assigned Access user account
+1. Sign in as administrator and from an elevated PowerShell prompt use one of the following commands:
+
+ ```PowerShell
+ #Configure Assigned Access by AppUserModelID and user name
+ Set-AssignedAccess -AppUserModelId -UserName
+
+ #Configure Assigned Access by AppUserModelID and user SID
+ Set-AssignedAccess -AppUserModelId -UserSID
+
+ #Configure Assigned Access by app name and user name
+ Set-AssignedAccess -AppName -UserName
+
+ #Configure Assigned Access by app name and user SID**:
+ Set-AssignedAccess -AppName -UserSID
+
+> [!NOTE]
+> To set up Assigned Access using `-AppName`, the user account that you enter for Assigned Access must have signed in at least once.
+
+For more information:
+
+- [Find the Application User Model ID of an installed app](../store/find-aumid.md)
+- [Set-AssignedAccess](/powershell/module/assignedaccess/set-assignedaccess)
+
+To remove assigned access, using PowerShell, run the following cmdlet:
+
+```powershell
+Clear-AssignedAccess
+```
+
+For advanced customizations that use the XML configuration file, you can use PowerShell scripts via the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal).
+
+> [!IMPORTANT]
+> For all device settings, the WMI Bridge client must be executed as SYSTEM (LocalSystem) account.
+
+To test the PowerShell script, you can:
+
+1. [Download the psexec tool](/sysinternals/downloads/psexec)
+1. Open an elevated command prompt and run: `psexec.exe -i -s powershell.exe`
+1. Run the script in the PowerShell session
+
+```PowerShell
+$shellLauncherConfiguration = @"
+
+# content of the XML configuration file
+
+"@
+
+$namespaceName="root\cimv2\mdm\dmmap"
+$className="MDM_AssignedAccess"
+$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
+$obj.ShellLauncher = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration)
+$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue
+if($cimSetError) {
+ Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n"
+ Write-Error -ErrorRecord $cimSetError[0]
+
+ $timeout = New-TimeSpan -Seconds 30
+ $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
+ do{
+ $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore
+ } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available
+
+ if($events.Count) {
+ $events | ForEach-Object {
+ Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")"
+ }
+ } else {
+ Write-Warning "Timed-out attempting to retrieve event logs..."
+ }
+
+ Exit 1
+}
+
+Write-Output "Successfully applied Shell Launcher configuration"
+```
+
+[!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)]
+
+#### [:::image type="icon" source="../images/icons/settings.svg"::: **Settings**](#tab/settings)
+
+Here are the steps to configure a kiosk using the Settings app:
+
+1. Open the Settings app to view and configure a device as a kiosk. Go to **Settings > Accounts > Other Users**, or use the following shortcut:
+
+ > [!div class="nextstepaction"]
+ >
+ > [Other Users](ms-settings:otherusers)
+
+1. Under **Set up a kiosk**, select **Get Started**
+1. In the **Create an account** dialog, enter the account name, and select **Next**
+ >[!NOTE]
+ >If there are any local standard user accounts already, the **Create an account** dialog offers the option to **Choose an existing account**
+
+1. Choose the application to run when the kiosk account signs in. Only apps that can run above the lock screen are available in the list of apps to choose from. If you select **Microsoft Edge** as the kiosk app, you configure the following options:
+
+ - Whether Microsoft Edge should display your website full-screen (digital sign) or with some browser controls available (public browser)
+ - Which URL should be open when the kiosk accounts signs in
+ - When Microsoft Edge should restart after a period of inactivity (if you select to run as a public browser)
+
+1. Select **Close**
+
+When the device isn't joined to an Active Directory domain or Microsoft Entra ID, automatic sign-in of the kiosk account is configured automatically:
+
+- If you want the kiosk account to sign in automatically, and the kiosk app launched when the device restarts, then you don't need to do anything
+- If you don't want the kiosk account to sign in automatically when the device restarts, then you must change the default setting before you configure the device as a kiosk. Sign in with the account that you want to use as the kiosk account. Open **Settings** > **Accounts** > **Sign-in options**. Set the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device
+
+---
+
+> [!TIP]
+> For practical examples, see the [Quickstart: Configure a kiosk with Assigned Access](quickstart-kiosk.md).
+
+## Configure a restricted user experience
+
+To configure a restricted user experience with Assigned Access, you must create an XML configuration file with the settings for the desired experience. The XML file is applied to the device via the [Assigned Access CSP](/windows/client-management/mdm/assignedaccess-csp#shelllauncher), using one of the following options:
+
+- A Mobile Device Management (MDM) solution, like Microsoft Intune
+- Provisioning packages
+- PowerShell, with the MDM Bridge WMI Provider
+
+To learn how to configure the Assigned Access XML file, see [Create an Assigned Access configuration file](configuration-file.md).
+
+[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)]
+
+#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
+
+You can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3].
+
+- **Setting:** `./Vendor/MSFT/AssignedAccess/ShellLauncher`
+- **Value:** content of the XML configuration file
+
+Assign the policy to a group that contains as members the devices that you want to configure.
+
+#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
+
+[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)]
+
+- **Path:** `AssignedAccess/MultiAppAssignedAccessSettings`
+- **Value:** content of the XML configuration file
+
+[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)]
+
+#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps)
+
+[!INCLUDE [powershell-wmi-bridge-1](../../../includes/configure/powershell-wmi-bridge-1.md)]
+
+```PowerShell
+$assignedAccessConfiguration = @"
+
+# content of the XML configuration file
+
+"@
+
+$namespaceName="root\cimv2\mdm\dmmap"
+$className="MDM_AssignedAccess"
+$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
+$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration)
+$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue
+if($cimSetError) {
+ Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n"
+ Write-Error -ErrorRecord $cimSetError[0]
+
+ $timeout = New-TimeSpan -Seconds 30
+ $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
+ do{
+ $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore
+ } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available
+
+ if($events.Count) {
+ $events | ForEach-Object {
+ Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")"
+ }
+ } else {
+ Write-Warning "Timed-out attempting to retrieve event logs..."
+ }
+
+ Exit 1
+}
+
+Write-Output "Successfully applied Assigned Access configuration"
+```
+
+[!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)]
+
+#### [:::image type="icon" source="../images/icons/settings.svg"::: **Settings**](#tab/settings)
+
+This option isn't available using Settings.
+
+---
+
+> [!TIP]
+> For practical examples, see the [Quickstart: Configure a restricted user experience with Assigned Access](quickstart-restricted-user-experience.md)
+
+## User experience
+
+To validate the kiosk or restricted user experience, sign in with the user account you specified in the configuration file.
+
+The Assigned Access configuration takes effect the next time the targeted user signs in. If that user account is signed in when you apply the configuration, sign out and sign back in to validate the experience.
+
+> [!NOTE]
+> Starting in Windows 11, a restricted user experience supports the use of multiple monitors.
+
+### Autotrigger touch keyboard
+
+The touch keyboard is automatically triggered when there's an input needed and no physical keyboard is attached on touch-enabled devices. You don't need to configure any other setting to enforce this behavior.
+
+> [!TIP]
+> The touch keyboard is triggered only when tapping a textbox. Mouse clicks don't trigger the touch keyboard. If you're testing this feature, use a physical device instead of a virtual machine (VM), as the touch keyboard is not triggered on VMs.
+
+### Sign out of assigned access
+
+By default, to exit the kiosk experience, press Ctrl + Alt + Del. The kiosk app exits automatically. If you sign in again as the Assigned Access account, or wait for the sign in screen timeout, the kiosk app relaunches. The default timeout is 30 seconds, but you can change the timeout with the registry key:
+
+`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI`
+
+To change the default time for Assigned Access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal.
+
+> [!NOTE]
+> `IdleTimeOut` doesn't apply to the Microsoft Edge kiosk mode.
+
+The Breakout Sequence of Ctrl + Alt + Del is the default, but this sequence can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence is CTRL + ALT + A, where CTRL + ALT are the modifiers, and A is the key value. To learn more, see [Create an Assigned Access configuration XML file](configuration-file.md).
+
+### Keyboard shortcuts
+
+The following keyboard shortcuts are blocked for the user accounts with Assigned Access:
+
+| Keyboard shortcut | Action |
+|------------------------------------------------------|-----------------------------------------------------------------------------------------------|
+| Ctrl + Shift + Esc | Open Task Manager |
+| WIN + , (comma) | Temporarily peek at the desktop |
+| WIN + A | Open Action center |
+| WIN + Alt + D | Display and hide the date and time on the desktop |
+| WIN + Ctrl + F | Find computer objects in Active Directory |
+| WIN + D | Display and hide the desktop |
+| WIN + E | Open File Explorer |
+| WIN + F | Open Feedback Hub |
+| WIN + G | Open Game bar when a game is open |
+| WIN + I | Open Settings |
+| WIN + J | Set focus to a Windows tip when one is available |
+| WIN + O | Lock device orientation |
+| WIN + Q | Open search |
+| WIN + R | Open the Run dialog box |
+| WIN + S | Open search |
+| WIN + Shift + C | Open Cortana in listening mode |
+| WIN + X | Open the Quick Link menu |
+| LaunchApp1 | Open the app that is assigned to this key |
+| LaunchApp2 | Open the app that is assigned to this key. On many Microsoft keyboards, the app is Calculator |
+| LaunchMail | Open the default mail client |
+
+## Remove Assigned Access
+
+Deleting the restricted user experience removes the policy settings associated with the users, but it can't revert all the configurations. For example, the Start menu configuration is maintained.
+
+## Next steps
+
+> [!div class="nextstepaction"]
+> Review the recommendations before you deploy Assigned Access:
+>
+> [Assigned Access recommendations](recommendations.md)
+
+
+
+[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
+[WIN-3]: /windows/client-management/mdm/assignedaccess-csp
diff --git a/windows/configuration/assigned-access/policy-settings.md b/windows/configuration/assigned-access/policy-settings.md
new file mode 100644
index 0000000000..0bf8a93e30
--- /dev/null
+++ b/windows/configuration/assigned-access/policy-settings.md
@@ -0,0 +1,114 @@
+---
+title: Assigned Access policy settings
+description: Learn about the policy settings enforced on a device configured with Assigned Access.
+ms.topic: reference
+ms.date: 03/04/2024
+---
+
+# Assigned Access policy settings
+
+When the Assigned Access configuration is applied on a device, certain policy settings and AppLocker rules are enforced, impacting the users accessing the device. The policy settings use a combination of configuration service provider (CSP) and group policy (GPO) settings.
+
+This reference article lists the policy settings and AppLocker rules applied by Assigned Access.
+
+>[!NOTE]
+>It's not recommended to configure policy settings enforced by Assigned Access to different values using other channels. Assigned Access is optimized to provide a locked-down experience.
+
+## Device policy settings
+
+The following policy settings are applied at the device level when you deploy a restricted user experience. Any user accessing the device is subject to the policy settings, including administrator accounts:
+
+| Type | Path | Name/Description |
+|---------|----------------------------------------------------------------------------|---------------------------------------------------------------------------|
+| **CSP** | `./Vendor/MSFT/Policy/Config/Experience/AllowCortana` | Disable Cortana |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderDocuments` | Disable Start documents icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderDownloads` | Disable Start downloads icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderFileExplorer` | Disable Start file explorer icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderHomeGroup` | Disable Start home group icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderMusic` | Disable Start music icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderNetwork` | Disable Start network icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderPersonalFolder` | Disable Start personal folder icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderPictures` | Disable Start pictures icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderSettings` | Disable Start settings icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderVideos` | Disable Start videos icon |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Start/HideChangeAccountSettings` | Hide *Change account settings* from appearing in the user tile |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Update/SetAutoRestartNotificationDisable` | Hides all update notifications |
+| **CSP** | `./Vendor/MSFT/Policy/Config/Update/UpdateNotificationLevel` | Disables auto restart notifications for updates |
+| **CSP** | `./Vendor/MSFT/Policy/Config/WindowsInkWorkspace/AllowWindowsInkWorkspace` | Access to ink workspace is disabled |
+| **CSP** | `./Vendor/MSFT/Policy/Config/WindowsLogon/DontDisplayNetworkSelectionUI` | Hide networks UI on the logon screen, as well as on "security options" UI |
+
+## User policy settings
+
+The following policy settings are applied to any nonadministrator account when you deploy a restricted user experience:
+
+| Type | Path | Name/Description |
+|---------|----------------------------------------------------------------------------------|-------------------------------------------------------------------|
+| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/DisableContextMenus` | Disable Context Menu for Start menu apps |
+| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HidePeopleBar` | Hide People Bar from appearing on taskbar |
+| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HideRecentlyAddedApps` | Hide recently added apps from appearing on the Start menu |
+| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HideRecentJumplists` | Hide recent jumplists from appearing on the Start menu/taskbar |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Clear history of recently opened documents on exit |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Disable showing balloon notifications as toast |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not allow pinning items in Jump Lists |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not allow pinning programs to the Taskbar |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not display or track items in Jump Lists from remote locations |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Hide and disable all items on the desktop |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Hide the Task View button |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Lock all taskbar settings |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Lock the Taskbar |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from adding or removing toolbars |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from customizing their Start Screen |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from moving taskbar to another screen dock location |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from rearranging toolbars |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from resizing the taskbar |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from uninstalling applications from Start |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove access to the context menus for the task bar |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove All Programs list from the Start menu |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Control Center |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove frequent programs list from the Start Menu |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Notification and Action Center |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Quick Settings |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Run menu from Start Menu |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove the Security and Maintenance icon |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Turn off all balloon notifications |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Turn off feature advertisement balloon notifications |
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Turn off toast notifications |
+| **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Change Password |
+| **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Logoff |
+| **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Task Manager |
+| **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove *Map network drive* and *Disconnect Network Drive* |
+| **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove File Explorer's default context menu |
+
+The following policy settings are applied to the kiosk account when you configure a kiosk experience with Microsoft Edge:
+
+| Type | Path | Name/Description |
+|---------|-----------------------------------------------------------------------------------|--------------------------------------------------------|
+| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Run only specified Windows applications > `msedge.exe` |
+| **GPO** | User Configuration\Administrative Templates\System | Turn off toast notifications |
+| **GPO** | User Configuration\Administrative Templates\Windows Components\Attachment Manager | Default risk level for file attachments > High risk |
+| **GPO** | User Configuration\Administrative Templates\Windows Components\Attachment Manager | Inclusion list for low file types > `.pdf;.epub` |
+| **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove File Explorer's default context menu |
+
+## AppLocker rules
+
+When you deploy an Assigned Access restricted user experience, AppLocker rules are generated to allow the apps that are listed in the configuration. Here are the predefined Assigned Access AppLocker rules:
+
+### Universal Windows Platform (UWP) app rules
+
+1. The default rule is to allow all users to launch the signed *packaged apps*
+1. The packaged app *deny list* is generated at runtime when the Assigned Access user signs in:
+ 1. Based on the installed apps available for the user account, Assigned Access generates the deny list. The list excludes the default allowed inbox packaged apps, which are critical for the system to function, and then exclude the allowed packages that are defined in the Assigned Access configuration
+ 1. If there are multiple apps within the same package, all the apps are excluded
+
+The deny list is used to prevent the user from accessing the apps, which are currently available for the user but not in the allowed list
+
+> [!NOTE]
+> You can't manage AppLocker rules that are generated by the restricted user experience in MMC snap-ins. Avoid creating AppLocker rules that conflict with AppLocker rules generated by Assigned Access.
+>
+> Assigned access doesn't prevent the organization or users from installing UWP apps. When a new UWP app is installed during an Assigned Access session, the app isn't in the deny list. When the user signs out and signs in again, the installed app is included in the deny list. For apps deployed centrally that you want to allow, like line-of-biness apps, update the Assigned Access configuration and include the apps in the *allow app list*.
+
+### Desktop app rules
+
+1. The default rule is to allow all users to launch the desktop programs signed with *Microsoft Certificate* for the system to boot and function. The rule also allows the admin user group to launch all desktop programs.
+1. There's a predefined inbox desktop app deny list for the Assigned Access user account, which is updated based on the *desktop app allow list* that you defined in the Assigned Access configuration
+1. Enterprise-defined allowed desktop apps are added in the AppLocker allow list
diff --git a/windows/configuration/assigned-access/quickstart-kiosk.md b/windows/configuration/assigned-access/quickstart-kiosk.md
new file mode 100644
index 0000000000..60839e646e
--- /dev/null
+++ b/windows/configuration/assigned-access/quickstart-kiosk.md
@@ -0,0 +1,104 @@
+---
+title: "Quickstart: configure a kiosk experience with Assigned Access"
+description: Learn how to configure a kiosk experience with Assigned Access using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO).
+ms.topic: quickstart
+ms.date: 03/04/2024
+---
+
+# Quickstart: configure a kiosk with Assigned Access
+
+This quickstart provides practical examples of how to configure a *kiosk experience* on Windows with Assigned Access. The examples describe the steps using the Settings app, a mobile device management solution (MDM) like Microsoft Intune, provisioning packages (PPKG), and PowerShell. While different solutions are used, the configuration settings and results are the same.
+
+The examples can be modified to fit your specific requirements. For example, you can change the app used, the URL specified when opening Microsoft Edge, or change the name of the user that automatically signs in to Windows.
+
+## Prerequisites
+
+>[!div class="checklist"]
+>Here's a list of requirements to complete this quickstart:
+>
+>- A Windows device
+>- Microsoft Intune, or a non-Microsoft MDM solution, if you want to configure the settings using MDM
+>- Windows Configuration Designer, if you want to configure the settings using a provisioning package
+>- Access to the [psexec tool](/sysinternals/downloads/psexec), if you want to test the configuration using Windows PowerShell
+
+## Configure a kiosk
+
+[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)]
+
+#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
+
+> [!TIP]
+> Use the following Graph call to automatically create a custom policy in your Microsoft Intune tenant without assignments nor scope tags.
+>
+> When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions.
+
+[!INCLUDE [quickstart-kiosk-intune](includes/quickstart-kiosk-intune.md)]
+
+Alternatively, you can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3].
+
+- **Setting:** `./Vendor/MSFT/AssignedAccess/Configuration`
+- **Value:**
+
+[!INCLUDE [quickstart-kiosk-xml](includes/quickstart-kiosk-xml.md)]
+
+Assign the policy to a group that contains as members the devices that you want to configure.
+
+#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
+
+[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)]
+
+- **Path:** `AssignedAccess/MultiAppAssignedAccessSettings`
+- **Value:**
+
+[!INCLUDE [quickstart-kiosk-xml](includes/quickstart-kiosk-xml.md)]
+
+[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)]
+
+#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps)
+
+[!INCLUDE [powershell-wmi-bridge-1](../../../includes/configure/powershell-wmi-bridge-1.md)]
+
+[!INCLUDE [quickstart-kiosk-ps](includes/quickstart-kiosk-ps.md)]
+
+[!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)]
+
+
+
+#### [:::image type="icon" source="../images/icons/settings.svg"::: **Settings**](#tab/settings)
+
+Here are the steps to configure a kiosk using the Settings app:
+
+1. Open the Settings app to view and configure a device as a kiosk. Go to **Settings > Accounts > Other Users**, or use the following shortcut:
+
+ > [!div class="nextstepaction"]
+ >
+ > [Other Users](ms-settings:otherusers)
+
+1. Under **Set up a kiosk**, select **Get Started**
+1. In the **Create an account** dialog, enter the account name, and select **Next**
+ >[!NOTE]
+ >If there are any local standard user accounts already, the **Create an account** dialog offers the option to **Choose an existing account**
+
+1. Choose the application to run when the kiosk account signs in. Only apps that can run above the lock screen are available in the list of apps to choose from. If you select **Microsoft Edge** as the kiosk app, you configure the following options:
+
+ - Whether Microsoft Edge should display your website full-screen (digital sign) or with some browser controls available (public browser)
+ - Which URL should be open when the kiosk accounts signs in
+ - When Microsoft Edge should restart after a period of inactivity (if you select to run as a public browser)
+
+1. Select **Close**
+
+---
+
+## User experience
+
+After the settings are applied, reboot the device. A local user account is automatically signed in, opening Microsoft Edge.
+
+## Next steps
+
+> [!div class="nextstepaction"]
+> Learn more about Assigned Access and how to configure it:
+>
+> [Assigned Access overview](overview.md)
+
+[WIN-3]: /windows/client-management/mdm/assignedaccess-csp
+[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
diff --git a/windows/configuration/assigned-access/quickstart-restricted-user-experience.md b/windows/configuration/assigned-access/quickstart-restricted-user-experience.md
new file mode 100644
index 0000000000..de5573c281
--- /dev/null
+++ b/windows/configuration/assigned-access/quickstart-restricted-user-experience.md
@@ -0,0 +1,93 @@
+---
+title: "Quickstart: configure a restricted user experience with Assigned Access"
+description: Learn how to configure a restricted user experience with Assigned Access using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO).
+ms.topic: quickstart
+ms.date: 03/04/2024
+appliesto:
+zone_pivot_groups: windows-versions-11-10
+---
+
+# Quickstart: configure a restricted user experience with Assigned Access
+
+This quickstart provides practical examples of how to configure a *restricted user experience* on Windows. The examples describe the steps using a mobile device management solution (MDM) like Microsoft Intune, provisioning packages (PPKG), and PowerShell. While different solutions are used, the configuration settings and results are the same.
+
+The examples can be modified to fit your specific requirements. For example, you can add or remove applications from the list of allowed apps, or change the name of the user that automatically signs in to Windows.
+
+## Prerequisites
+
+>[!div class="checklist"]
+>Here's a list of requirements to complete this quickstart:
+>
+>- A Windows device
+>- Microsoft Intune, or a non-Microsoft MDM solution, if you want to configure the settings using MDM
+>- Windows Configuration Designer, if you want to configure the settings using a provisioning package
+>- Access to the [psexec tool](/sysinternals/downloads/psexec), if you want to test the configuration using Windows PowerShell
+
+## Configure a restricted user experience
+
+[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)]
+
+#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
+
+> [!TIP]
+> Use the following Graph call to automatically create a custom policy in your Microsoft Intune tenant without assignments nor scope tags.
+>
+> When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions.
+
+[!INCLUDE [quickstart-restricted-experience-intune.md](includes/quickstart-restricted-experience-intune.md)]
+
+[!INCLUDE [intune-custom-settings-2](../../../includes/configure/intune-custom-settings-2.md)]
+
+Alternatively, you can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3].
+
+- **Setting:** `./Vendor/MSFT/AssignedAccess/Configuration`
+- **Value:**
+
+[!INCLUDE [quickstart-restricted-experience-xml.md](includes/quickstart-restricted-experience-xml.md)]
+
+#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
+
+[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)]
+
+- **Path:** `AssignedAccess/MultiAppAssignedAccessSettings`
+- **Value:**
+
+[!INCLUDE [quickstart-restricted-experience-xml.md](includes/quickstart-restricted-experience-xml.md)]
+
+[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)]
+
+#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps)
+
+[!INCLUDE [powershell-wmi-bridge-1](../../../includes/configure/powershell-wmi-bridge-1.md)]
+
+[!INCLUDE [quickstart-restricted-experience-ps.md](includes/quickstart-restricted-experience-ps.md)]
+
+[!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)]
+
+---
+
+## User experience
+
+After the settings are applied, reboot the device. A local user account is automatically signed in, with access to a limited set of applications, which are pinned to the Start menu.
+
+::: zone pivot="windows-11"
+:::image type="content" source="images/restricted-user-experience-windows-11.png" alt-text="Screenshot of the Windows 11 desktop used for the quickstart." border="false":::
+
+::: zone-end
+
+::: zone pivot="windows-10"
+:::image type="content" source="images/restricted-user-experience-windows-10.png" alt-text="Screenshot of the Windows 10 desktop used for the quickstart." border="false":::
+
+::: zone-end
+
+## Next steps
+
+> [!div class="nextstepaction"]
+> Learn more about Assigned Access and how to configure it:
+>
+> [Assigned Access overview](overview.md)
+
+
+
+[WIN-3]: /windows/client-management/mdm/assignedaccess-csp
+[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
diff --git a/windows/configuration/assigned-access/recommendations.md b/windows/configuration/assigned-access/recommendations.md
new file mode 100644
index 0000000000..a497237d15
--- /dev/null
+++ b/windows/configuration/assigned-access/recommendations.md
@@ -0,0 +1,169 @@
+---
+title: Assigned Access recommendations
+description: Learn about the recommended kiosk and restricted user experience configuration options.
+ms.topic: best-practice
+ms.date: 03/11/2024
+---
+
+# Assigned Access recommendations
+
+This article contains recommendations for devices configured with Assigned Access and Shell Launcher. Most of the recommendations include both group policy (GPO) and configuration service provider (CSP) settings to help you configure your kiosk devices.
+
+## Kiosk user account
+
+For kiosks devices located in public-facing environments, configure as a kiosk account a user account with the least privileges, such as a local, standard user account. Using an Active Directory user or Microsoft Entra user might allow an attacker to gain access to domain resources that are accessible to any domain accounts. When using domain accounts with assigned access, proceed with caution. Consider the domain resources potentially exposed by using a domain account.
+
+### Automatic sign-in
+
+Consider enabling *automatic sign-in* for your kiosk device. When the device restarts, from an update or power outage, you can configure the device to sign in with the Assigned Access account automatically. Ensure that policy settings applied to the device don't prevent automatic sign in from working as expected. For example, the policy settings [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#preferredaadtenantdomainname) prevents automatic sign-in from working.
+
+You can configure the Assigned Access and Shell Launcher XML files with an account to sign-in automatically. For more information, review the articles:
+
+- [Create an Assigned Access configuration XML file](configuration-file.md)
+- [Create a Shell Launcher configuration file](shell-launcher/configuration-file.md)
+
+Alternatively, you can edit the Registry to have an account sign in automatically:
+
+| Path | Name | Type | Value |
+|--|--|--|--|
+| `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` | `AutoAdminLogon` | REG_DWORD | 1 |
+| `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` | `DefaultUserName` | String | Set value as the account that you want signed in. |
+| `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` | `DefaultPassword` | String | Set value as the password for the account. |
+| `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` | `DefaultDomainName` | String | Set value for domain, only for domain accounts. For local accounts, don't add this key. |
+
+Once automatic sign-in is configured, reboot the device. The account will sign in automatically.
+
+> [!NOTE]
+> If you are using [Custom Logon](/windows-hardware/customize/enterprise/custom-logon) with `HideAutoLogonUI` enabled, you might experience a black screen when the user account password expires. Consider [setting the password to never expire](/windows-hardware/customize/enterprise/troubleshooting-custom-logon#the-device-displays-a-black-screen-when-a-password-expiration-screen-is-displayed).
+
+## Windows Update
+
+Configure your kiosk devices so that they're always up to date, without disrupting the user experience. Here are some policy settings to consider, to configure Windows Update for your kiosk devices:
+
+| Type | Path | Name/Description |
+|--|--|--|
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#activehoursend) | Integer value that represents the end of active hours. For example, `22` represents 10PM |
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#activehoursstart) | Integer value that represents the start of active hours. For example, `7` represents 7AM |
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#allowautoupdate) | Integer value. Set to `3` - Auto download and schedule the install |
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[ScheduledInstallTime](/windows/client-management/mdm/policy-csp-update#scheduledinstalltime) | Integer value. Specify the time for the device to install updates. For example, `23` represents 11PM |
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) | Integer value. Set to `2`: turn off all notifications, including restart warnings |
+| **GPO** | Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience | Display options for update notifications > Set the value to **2 - Turn off all notifications, including restart warnings** |
+| **GPO** | Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\Configure Automatic Updates | **4 - Auto download and schedule the install** > specify an install time that is outside the active hours |
+| **GPO** | Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\Turn off autorestart for updates during active hours | Configure the start and end active hours, during which the kiosk device can't restart due to Windows Update |
+
+## Power settings
+
+You might want to prevent the kiosk device from going to sleep, or prevent users to shut down or restart the kiosk. Here are some options to consider:
+
+| Type | Path | Name/Description |
+|--|--|--|
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/ADMX_StartMenu/`[HidePowerOptions](/windows/client-management/mdm/policy-csp-admx-startmenu#hidepoweroptions) | String. Set to `` |
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/` [Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#shutdown_allowsystemtobeshutdownwithouthavingtologon) | Integer value. Set to `0` |
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Power/`[DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | String. Set to `` |
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Power/`[SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Integer. Set to `0` |
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Power/`[SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#SelectSleepButtonActionPluggedIn) | Integer. Set to `0` |
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Power/`[StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | String. Set to `` |
+| **GPO** | Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands | **Enable** |
+| **GPO** | Computer Configuration\Administrative Templates\System\Power Management\Button Settings\Select the Power button action | Select the action: **Take no action** |
+| **GPO** | Computer Configuration\Administrative Templates\System\Power Management\Button Settings\Select the Sleep button action | Select the action: **Take no action** |
+| **GPO** | Computer Configuration\Administrative Templates\System\Power Management\Specify the system sleep timeout | Set the value to **0** seconds. |
+| **GPO** | Computer Configuration\Administrative Templates\System\Power Management\Video and Display Settings\Turn off the display | Set the value to **0** seconds. |
+| **GPO** | Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Shutdown: Allow system to be shut down without having to log on | **Disabled** |
+| **GPO** | Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Shut down the system | Remove the users or groups from this policy. To prevent this policy from affecting a member of the Administrators group, be sure to keep the Administrators group. |
+
+> [!NOTE]
+> You can also disable the power button from the security options screen using a feature called *Custom Logon*. For more information on removing the power button or disabling the physical power button, see [Custom Logon][WHW-1].
+
+## Keyboard shortcuts
+
+The following keyboard shortcuts aren't blocked for any user account that is configured with a restricted user experience:
+
+- Alt + F4
+- Alt + Tab
+- Alt + Shift + Tab
+- Ctrl + Alt + Delete
+
+You can use [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter) to block the key combinations. Keyboard Filter settings apply to other standard accounts.
+
+### Accessibility shortcuts
+
+Assigned access doesn't change accessibility settings. Use *Keyboard Filter* to block the following key combinations that open accessibility features:
+
+ | Key combination | Blocked behavior |
+ | --- | --- |
+ | Left Alt + Left Shift + Print Screen | Open High Contrast dialog box |
+ | Left Alt + Left Shift + Num Lock | Open Mouse Keys dialog box |
+ | WIN + U | Open the Settings app accessibility panel |
+
+> [!NOTE]
+> If Keyboard Filter is turned ON, then some key combinations are blocked automatically without you having to explicitly block them. For more information, see [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter).
+
+You can also disable the accessibility features and other options on the lock screen with [Custom Logon][WHW-1]. For example, to remove the Accessibility option, use the following registry key:
+
+| Path | Name | Type | Value |
+|--|--|--|--|
+| `HKLM\Software\Microsoft\Windows Embedded\EmbeddedLogon\BrandingNeutral` | `BrandingNeutral` | REG_DWORD | 8 |
+
+## Choose an app for a kiosk experience
+
+To create a kiosk experience with Assigned Access, you can choose UWP apps or Microsoft Edge. However, some applications might not provide a good user experience when used as a kiosk.
+
+The following guidelines help you choose an appropriate Windows app for a kiosk experience:
+
+- Windows apps must be provisioned or installed for the Assigned Access account before they can be selected as the Assigned Access app. [Learn how to provision and install apps](/windows/client-management/mdm/enterprise-app-management#install_your_apps)
+- UWP app updates can sometimes change the Application User Model ID (AUMID) of the app. In such scenario, you must update the Assigned Access settings to execute the updated app, because Assigned Access uses the AUMID to determine the app to launch
+- The app must be able to run above the lock screen. If the app can't run above the lock screen, it can't be used as a kiosk app
+- Some apps can launch other apps. Assigned Access in kiosk mode prevents Windows apps from launching other apps. Avoid selecting Windows apps that are designed to launch other apps as part of their core functionality
+- Microsoft Edge includes support for kiosk mode. To learn more, see [Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy)
+- Don't select Windows apps that might expose information you don't want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting these types of apps if they provide unnecessary data access
+- Some apps might require more configurations before they can be used appropriately in Assigned Access. For example, Microsoft OneNote requires you to set up a Microsoft account for the Assigned Access user account before OneNote opens
+- The kiosk profile is designed for public-facing kiosk devices. Use a local, nonadministrator account. If the device is connected to your organization network, using a domain or Microsoft Entra account could compromise confidential information
+
+When planning to deploy a kiosk or a restricted user experience, consider the following recommendations:
+
+- Evaluate all applications that users should use. If applications require user authentication, don't use a local or generic user account. Rather, target the group of users within the Assigned Access configuration file
+- A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, certain policy settings that affect all nonadministrator users on the device. For a list of these policies, see [Assigned Access policy settings](policy-settings.md)
+
+### Develop your kiosk app
+
+Assigned Access uses the *Lock framework*. When an Assigned Access user signs in, the selected kiosk app is launched above the lock screen. The kiosk app is running as an *above lock* screen app. To learn more, see [best practices guidance for developing a kiosk app for assigned access](/windows-hardware/drivers/partnerapps/create-a-kiosk-app-for-assigned-access).
+
+## Stop errors and recovery options
+
+When a stop error occurs, Windows displays a blue screen with a stop error code. You can replace the standard screen with a blank screen for OS errors. For more information, see [Configure system failure and recovery options](/troubleshoot/windows-client/performance/configure-system-failure-and-recovery-options).
+
+## Lock screen notifications
+
+Consider removing notifications from the lock screen to prevent users from seeing notifications when the device is locked. Here are some options to consider:
+
+| Type | Path | Name/Description |
+|--|--|--|
+| **CSP** | `./Device/Vendor/MSFT/Policy/Config/AboveLock/`[AllowToasts](/windows/client-management/mdm/policy-csp-abovelock#abovelock-allowtoasts)| Integer. Set to `0` |
+| **GPO** | Computer Configuration\Administrative Templates\System\Logon\Turn off app notifications on the lock screen | **Enabled**|
+
+## Troubleshooting and logs
+
+When testing Assigned Access, it can be useful to enable logging to help you troubleshoot issues. Logs can help you identify configuration and runtime issues. You can enable the following log: **Applications and Services Logs** > **Microsoft** > **Windows** > **AssignedAccess** > **Operational**.
+
+The following registry keys contain the Assigned Access configurations:
+
+- `HKLM\Software\Microsoft\Windows\AssignedAccessConfiguration`
+- `HKLM\Software\Microsoft\Windows\AssignedAccessCsp`
+
+The following registry key contains the configuration for each user with an Assigned Access policy:
+
+- `HKCU\SOFTWARE\Microsoft\Windows\AssignedAccessConfiguration`
+
+For more information about troubleshooting kiosk issues, see [Troubleshoot kiosk mode issues](/troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting).
+
+## Next steps
+
+> [!div class="nextstepaction"]
+> Learn how to create an XML file to configure Assigned Access:
+>
+> [Create an Assigned Access configuration file](configuration-file.md)
+
+
+
+[WHW-1]: /windows-hardware/customize/enterprise/custom-logon
+[WHW-2]: /windows-hardware/customize/enterprise/unified-write-filter
diff --git a/windows/configuration/assigned-access/shell-launcher/configuration-file.md b/windows/configuration/assigned-access/shell-launcher/configuration-file.md
new file mode 100644
index 0000000000..2dba54c2c4
--- /dev/null
+++ b/windows/configuration/assigned-access/shell-launcher/configuration-file.md
@@ -0,0 +1,291 @@
+---
+title: Create a Shell Launcher configuration file
+description: Learn how to create an XML file to configure a device with Shell Launcher.
+ms.date: 02/12/2024
+ms.topic: how-to
+---
+
+# Create a Shell Launcher configuration file
+
+To configure Shell Launcher, you must create and apply a configuration XML file to your devices. The configuration file must conform to a *schema*, as defined in [Shell Launcher XML Schema Definition (XSD)](xsd.md).
+
+This article describes how to configure a Shell Launcher configuration file, including practical examples.
+
+Let's start by looking at the basic structure of the XML file. A Shell Launcher configuration file contains:
+
+- One or multiple `profiles`. Each `profile` defines:
+ - the application that replaces the standard Windows shell (`Explorer.exe`), which is executed when a user signs in
+ - the default action to take when the application exits, and actions when the application exits with a specific return code
+- One or multiple `configs`. Each `config` associates a user account to a `profile`
+
+> [!NOTE]
+> A profile has no effect if it's not associated to a user account.
+
+Here's a basic example of a Shell Launcher configuration file, with one profile and one config:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+## Versioning
+
+The Shell Launcher configuration XML is versioned. The version is defined in the XML root element, and it's used to determine which schema to use to validate the XML file. The version is also used to determine which features are available for the configuration. Here's a table of the versions, aliases used in the documentation examples, and namespaces:
+
+| Version | Alias | Namespace |
+|-|-|-|
+|Windows 10|`V2`|http://schemas.microsoft.com/ShellLauncher/2019/Configuration|
+|Windows 10|default|http://schemas.microsoft.com/ShellLauncher/2018/Configuration|
+
+To authorize a compatible configuration XML that includes version-specific elements and attributes, always include the namespace of the add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the kiosk application to execute in full screen, use the below example. Note the alias `V2` associated to `http://schemas.microsoft.com/ShellLauncher/2019/Configuration` namespace, and the alias is tagged on the `AppType` and `AllAppsFullScreen` properties inline.
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+Here you can find the [Shell Launcher XML Schema Definitions (XSDs)](xsd.md).
+
+## Profiles
+
+A configuration file can contain one or more profiles. Each profile has a unique identifier `Profile Id` and, optionally, a `Name`. For example:
+
+```xml
+
+
+
+
+
+```
+
+> [!TIP]
+> The `Profile Id` must be unique within the XML file. You can generate a GUID with the PowerShell cmdlet `New-Guid`.
+
+You can define a `Defaultprofile` that is used when no other profile is associated to a user account. This ensures that every user using the device uses the same application. Example:
+
+```xml
+
+
+
+
+
+```
+
+### Shell
+
+Each profile defines a `Shell` element, which contains details about the application to execute. The `Shell` element has the following properties:
+
+| Property| Description | Details |
+|-|-|-|
+|`Shell`| Application that is used as a Windows shell. |- For Universal Windows Platform (UWP) apps, you must provide the App User Model ID (AUMID). Learn how to [Find the Application User Model ID of an installed app](../../store/find-aumid.md). - For desktop apps, specify the full path of the executable, which can contain system environment variables in the form of `%variableName%`. You can also specify any parameters that the app might require. |
+|`V2:AppType`| Defines the type of application. |Allowed values are `Desktop` and `UWP`.|
+|`V2:AllAppsFullScreen` | Boolean value that defines if all applications are executed in full screen. |- When set to `True`, Shell Launcher runs every app in full screen, or maximized for desktop apps. - When set to `False` or not set, only the custom shell app runs in full screen; other apps launched by the user run in windowed mode.|
+
+Example:
+
+```xml
+
+
+
+
+
+```
+
+In the next example, the Weather app is executed in full screen.
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+```
+
+In the next example, Microsoft Edge is executed in full screen, opening a website. The website is reloaded after 2 minutes of inactivity.
+
+```xml
+
+
+
+
+
+```
+
+#### ReturnCodeActions
+
+Shell Launcher defines four actions to handle app exits. You can customize Shell Launcher and use the actions based on different exit code. Here are the `ReturnCodeActions` enums:
+
+- `RestartShell`
+- `RestartDevice`
+- `ShutdownDevice`
+- `DoNothing`
+
+The actions can be used as default action, or mapped to a specific exit code. Refer to [Shell Launcher](/windows-hardware/customize/enterprise/wesl-usersettingsetcustomshell) to learn how to use exit codes with Shell Launcher WMI.
+
+You can specify at most four custom actions mapping to four exit codes, and one default action for all other exit codes. When an app exits, and if the exit code isn't found in the custom action mapping, or there's no default action defined, nothing happens. For this reason, you should at least define `DefaultAction`.
+
+Example:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+```
+
+## Configs
+
+Under `Configs`, define one or more user accounts and their association with a profile.
+
+Individual accounts are specified using ``.
+
+> [!IMPORTANT]
+> Before applying the Shell Launcher configuration, make sure the specified user account is available on the device, otherwise it fails.
+>
+> For both domain and Microsoft Entra accounts, as long as the device is Active Directory joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for Shell Launcher.
+
+### Local user
+
+Local account can be entered as `devicename\user`, `.\user`, or just `user`.
+
+```xml
+
+
+
+
+```
+
+### Active Directory user
+
+Domain accounts must be entered using the format `domain\samAccountName`.
+
+```xml
+
+
+
+
+```
+
+### Microsoft Entra user
+
+Microsoft Entra accounts must be specified with the format: `AzureAD\{UPN}`. `AzureAD` must be provided *as is*, then follow with the Microsoft Entra user principal name (UPN).
+
+```xml
+
+
+
+
+```
+
+When the user account signs in, the associated Shell Launcher profile is applied, loading the application specified in the profile.
+
+### Autologon account
+
+With ``, Shell Launcher creates and manages a user account to automatically sign in after a device restarts. The account is a local standard user named `Kiosk`.
+
+Example:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+## Example
+
+Here's a complete example of a Shell Launcher configuration file, with two profiles and three configs:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md
new file mode 100644
index 0000000000..eb3b1a1b04
--- /dev/null
+++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md
@@ -0,0 +1,13 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+```msgraph-interactive
+POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations
+Content-Type: application/json
+
+{ "id": "00-0000-0000-0000-000000000000", "displayName": "_MSLearn_Example_Kiosk - Shell Launcher", "description": "This is a sample policy created from an article on learn.microsoft.com.", "roleScopeTagIds": [ "0" ], "@odata.type": "#microsoft.graph.windows10CustomConfiguration", "omaSettings": [ { "@odata.type": "#microsoft.graph.omaSettingString", "displayName": "ShellLauncher", "description": null, "omaUri": "./Vendor/MSFT/AssignedAccess/ShellLauncher", "secretReferenceValueId": null, "isEncrypted": true, "value": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" } ], }
+```
diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md
new file mode 100644
index 0000000000..c783de00f6
--- /dev/null
+++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md
@@ -0,0 +1,43 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+```PowerShell
+$shellLauncherConfiguration = @"
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+"@
+
+$namespaceName="root\cimv2\mdm\dmmap"
+$className="MDM_AssignedAccess"
+$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
+$obj.ShellLauncher = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration)
+$obj = Set-CimInstance -CimInstance $obj
+```
diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md
new file mode 100644
index 0000000000..80e9dd0bb8
--- /dev/null
+++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md
@@ -0,0 +1,35 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 02/05/2024
+ms.topic: include
+---
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
\ No newline at end of file
diff --git a/windows/configuration/assigned-access/shell-launcher/index.md b/windows/configuration/assigned-access/shell-launcher/index.md
new file mode 100644
index 0000000000..d15947fe60
--- /dev/null
+++ b/windows/configuration/assigned-access/shell-launcher/index.md
@@ -0,0 +1,129 @@
+---
+title: What is Shell Launcher?
+description: Learn how to configure devices with Shell Launcher.
+ms.date: 02/29/2024
+ms.topic: overview
+---
+
+# What is Shell Launcher?
+
+Shell Launcher is a Windows feature that you can use to replace the default Windows Explorer shell (`Explorer.exe`) with a Windows desktop application or a Universal Windows Platform (UWP) app.
+
+Practical examples include:
+
+- Public browsing
+- Interactive digital signage
+- ATMs
+
+Shell Launcher controls which application the user sees as the shell after sign-in. It doesn't prevent the user from accessing other desktop applications and system components. From a custom shell, you can launch secondary views displayed on multiple monitors, or launch other apps in full screen on user's demand.
+
+With Shell Launcher, you can use features and methods to control access to other applications or system components. These methods include, but aren't limited to:
+
+- Configuration Service Provider (CSP): you can use a Mobile Device Management (MDM) solution like Microsoft Intune
+- Group policy (GPO)
+- [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview)
+
+Shell Launcher is part of the [Assigned Access](../overview.md) feature, which allows you to configure kiosks or restricted user experiences. To learn about the differences between Shell Launcher and the other options offered by Assigned Access, see [Windows kiosks and restricted user experiences](../index.md).
+
+[!INCLUDE [shell-launcher](../../../../includes/licensing/shell-launcher.md)]
+
+## Limitations
+
+Here are some limitations to consider when using Shell Launcher:
+
+- Windows doesn't support setting a custom shell before the out-of-box experience (OOBE). If you do, you can't deploy the resulting image
+- Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you can't specify `write.exe` in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. `Write.exe` creates a 32-bit `wordpad.exe` process and exits. Since Shell Launcher isn't aware of the newly created `wordpad.exe` process, Shell Launcher takes action based on the exit code of `Write.exe`, such as restarting the custom shell
+
+## Configure a device with Shell Launcher
+
+The configuration of Shell Launcher is done using an XML file. The XML file is applied to the device via the [Assigned Access CSP](/windows/client-management/mdm/assignedaccess-csp#shelllauncher), using one of the following options:
+
+- A Mobile Device Management (MDM) solution, like Microsoft Intune
+- Provisioning packages
+- The MDM Bridge WMI Provider
+
+To learn how to configure the Shell Launcher XML file, see [Create a Shell Launcher configuration file](configuration-file.md).
+
+[!INCLUDE [tab-intro](../../../../includes/configure/tab-intro.md)]
+
+#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
+
+You can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3].
+
+- **Setting:** `./Vendor/MSFT/AssignedAccess/ShellLauncher`
+- **Value:** content of the XML configuration file
+
+Assign the policy to a group that contains as members the devices that you want to configure.
+
+#### [:::image type="icon" source="../../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
+
+[!INCLUDE [provisioning-package-1](../../../../includes/configure/provisioning-package-1.md)]
+
+- **Path:** `SMISettings/ShellLauncher`
+- **Value:** depends on specific settings
+
+[!INCLUDE [provisioning-package-2](../../../../includes/configure/provisioning-package-2.md)]
+
+#### [:::image type="icon" source="../../images/icons/powershell.svg"::: **PowerShell**](#tab/ps)
+
+[!INCLUDE [powershell-wmi-bridge-1](../../../../includes/configure/powershell-wmi-bridge-1.md)]
+
+```PowerShell
+$shellLauncherConfiguration = @"
+
+# content of the XML configuration file
+
+"@
+
+$namespaceName="root\cimv2\mdm\dmmap"
+$className="MDM_AssignedAccess"
+$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
+$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration)
+$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue
+if($cimSetError) {
+ Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n"
+ Write-Error -ErrorRecord $cimSetError[0]
+
+ $timeout = New-TimeSpan -Seconds 30
+ $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
+ do{
+ $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore
+ } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available
+
+ if($events.Count) {
+ $events | ForEach-Object {
+ Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")"
+ }
+ } else {
+ Write-Warning "Timed-out attempting to retrieve event logs..."
+ }
+
+ Exit 1
+}
+
+Write-Output "Successfully applied Shell Launcher configuration"
+```
+
+[!INCLUDE [powershell-wmi-bridge-2](../../../../includes/configure/powershell-wmi-bridge-2.md)]
+
+---
+
+> [!TIP]
+> For practical examples, see the [Quickstart: configure a kiosk experience with Shell Launcher](quickstart-kiosk.md).
+
+## User experience
+
+After the settings are applied, the users that are configured to use Shell Launcher will execute the custom shell after sign-in.
+
+Depending on your configuration, you can have a user to automatically sign in to the device.
+
+## Next steps
+
+> [!div class="nextstepaction"]
+> Learn how to configure the Shell Launcher XML file:
+>
+> [Create a Shell Launcher configuration file](configuration-file.md)
+
+
+
+[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
\ No newline at end of file
diff --git a/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md b/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md
new file mode 100644
index 0000000000..f217d88363
--- /dev/null
+++ b/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md
@@ -0,0 +1,69 @@
+---
+title: "Quickstart: configure a kiosk experience with Shell Launcher"
+description: Learn how to configure a kiosk experience with Shell Launcher, using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO).
+ms.topic: quickstart
+ms.date: 02/05/2024
+---
+
+# Quickstart: configure a kiosk experience with Shell Launcher
+
+This quickstart provides practical examples of how to configure a *kiosk experience* on Windows with Shell Launcher. The examples describe the steps using a mobile device management solution (MDM) like Microsoft Intune, and PowerShell. While different solutions are used, the configuration settings and results are the same.
+
+The examples can be modified to fit your specific requirements. For example, you can change the app used, the URL specified when opening Microsoft Edge, or change the name of the user that automatically signs in to Windows.
+
+## Prerequisites
+
+>[!div class="checklist"]
+>Here's a list of requirements to complete this quickstart:
+>
+>- A Windows Enterprise or Education device
+>- Microsoft Intune, or a non-Microsoft MDM solution, if you want to configure the settings using MDM
+>- Access to the [psexec tool](/sysinternals/downloads/psexec), if you want to test the configuration using Windows PowerShell
+
+## Configure a kiosk device
+
+[!INCLUDE [tab-intro](../../../../includes/configure/tab-intro.md)]
+
+#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
+
+> [!TIP]
+> Use the following Graph call to automatically create a custom policy in your Microsoft Intune tenant without assignments nor scope tags.
+>
+> When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions.
+
+[!INCLUDE [quickstart-intune](includes/quickstart-intune.md)]
+
+Assign the policy to a group that contains as members the devices that you want to configure.
+
+Alternatively, you can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3].
+
+- **Setting:** `./Vendor/MSFT/AssignedAccess/ShellLauncher`
+- **Value:**
+
+[!INCLUDE [quickstart-xml](includes/quickstart-xml.md)]
+
+#### [:::image type="icon" source="../../images/icons/powershell.svg"::: **PowerShell**](#tab/ps)
+
+[!INCLUDE [powershell-wmi-bridge-1](../../../../includes/configure/powershell-wmi-bridge-1.md)]
+
+[!INCLUDE [quickstart-ps](includes/quickstart-ps.md)]
+
+[!INCLUDE [powershell-wmi-bridge-2](../../../../includes/configure/powershell-wmi-bridge-2.md)]
+
+---
+
+## User experience
+
+After the settings are applied, reboot the device. A local user account is automatically signed in, opening Microsoft Edge.
+
+## Next steps
+
+> [!div class="nextstepaction"]
+> Learn more how to create a Shell Launcher configuration file:
+>
+> [Create a Shell Launcher configuration file](configuration-file.md)
+
+
+
+[WIN-3]: /windows/client-management/mdm/assignedaccess-csp
+[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
diff --git a/windows/configuration/assigned-access/shell-launcher/toc.yml b/windows/configuration/assigned-access/shell-launcher/toc.yml
new file mode 100644
index 0000000000..047a8acdb9
--- /dev/null
+++ b/windows/configuration/assigned-access/shell-launcher/toc.yml
@@ -0,0 +1,9 @@
+items:
+- name: What is Shell Launcher?
+ href: index.md
+- name: "Quickstart: Configure a kiosk with Shell Launcher"
+ href: quickstart-kiosk.md
+- name: Create a Shell Launcher configuration file
+ href: configuration-file.md
+- name: Shell Launcher XSD
+ href: xsd.md
diff --git a/windows/configuration/assigned-access/shell-launcher/xsd.md b/windows/configuration/assigned-access/shell-launcher/xsd.md
new file mode 100644
index 0000000000..ef624ae434
--- /dev/null
+++ b/windows/configuration/assigned-access/shell-launcher/xsd.md
@@ -0,0 +1,193 @@
+---
+title: Shell Launcher XML Schema Definition (XSD)
+description: Shell Launcher XSD reference article.
+ms.topic: reference
+ms.date: 02/15/2024
+---
+
+# Shell Launcher XML Schema Definition (XSD)
+
+This reference article contains the latest Shell Launcher XML schema definition (XSD) and the XSD additions for each version of Windows.
+
+## Shell Launcher XSD
+
+Here's the latest Shell Launcher XSD, introduced in Windows 11:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+## Windows 10, version 1903 additions
+
+In Windows 10, version 1903, Shell Launcher introduced the support of both UWP and desktop apps as the custom shell.
+
+Here's the Shell Launcher XSD for the features added in Windows 10, version 1903:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
diff --git a/windows/configuration/assigned-access/toc.yml b/windows/configuration/assigned-access/toc.yml
new file mode 100644
index 0000000000..a80a14dd6a
--- /dev/null
+++ b/windows/configuration/assigned-access/toc.yml
@@ -0,0 +1,33 @@
+items:
+- name: Overview
+ href: index.md
+- name: Assigned Access
+ items:
+ - name: What is Assigned Access?
+ href: overview.md
+ - name: Quickstarts
+ items:
+ - name: Configure a kiosk with Assigned Access
+ href: quickstart-kiosk.md
+ - name: Configure a restricted user experience with Assigned Access
+ href: quickstart-restricted-user-experience.md
+ - name: Create an Assigned Access configuration file
+ href: configuration-file.md
+ - name: Reference
+ items:
+ - name: Assigned Access XSD
+ href: xsd.md
+ - name: Assigned Access XML examples
+ href: examples.md
+ - name: Assigned Access policy settings
+ href: policy-settings.md
+- name: Shell Launcher
+ href: shell-launcher/toc.yml
+- name: Recommendations
+ href: recommendations.md
+- name: Assigned Access CSP 🔗
+ href: /windows/client-management/mdm/assignedaccess-csp
+- name: Troubleshoot 🔗
+ href: /troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting
+- name: Configure Microsoft Edge kiosk mode 🔗
+ href: /deployedge/microsoft-edge-configure-kiosk-mode
\ No newline at end of file
diff --git a/windows/configuration/assigned-access/xsd.md b/windows/configuration/assigned-access/xsd.md
new file mode 100644
index 0000000000..89519a3862
--- /dev/null
+++ b/windows/configuration/assigned-access/xsd.md
@@ -0,0 +1,334 @@
+---
+title: Assigned Access XML Schema Definition (XSD)
+description: Assigned Access XSD reference article.
+ms.topic: reference
+ms.date: 02/15/2024
+---
+
+# Assigned Access XML Schema Definition (XSD)
+
+This reference article contains the latest Assigned Access XML schema definition (XSD) and the XSD additions for each version of Windows.
+
+## Assigned Access XSD
+
+Here's the latest Assigned Access XSD, introduced in Windows 11:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+## Windows 11, version 22H2 additions
+
+Here's the Assigned Access XSD for the features added in Windows 11:
+
+```xml
+
+
+
+
+
+```
+
+## Windows 11, version 21H2 additions
+
+Here's the Assigned Access XSD for the features added in Windows 10, version 21H2:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+## Windows 10, version 1909 additions
+
+Here's the Assigned Access XSD for the features added in Windows 10, version 1909:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+## Windows 10, version 1809 additions
+
+Here's the Assigned Access XSD for the features added in Windows 10, version 1809:
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
\ No newline at end of file
diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json
index 6bb76e2b5c..9cd7b554d8 100644
--- a/windows/configuration/docfx.json
+++ b/windows/configuration/docfx.json
@@ -43,8 +43,6 @@
"uhfHeaderId": "MSDocsHeader-Windows",
"ms.subservice": "itpro-configure",
"ms.service": "windows-client",
- "ms.author": "paoloma",
- "author": "paolomatarazzo",
"manager": "aaroncz",
"feedback_system": "Standard",
"feedback_product_url": "https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332",
@@ -77,17 +75,57 @@
"feedback_system": {
"ue-v/**/*.*": "None"
},
- "author": {
- "wcd//**/*.md": "aczechowski",
- "wcd//**/*.yml": "aczechowski",
+ "author":{
+ "accessibility//**/*.md": "paolomatarazzo",
+ "accessibility//**/*.yml": "paolomatarazzo",
+ "assigned-access//**/*.md": "paolomatarazzo",
+ "assigned-access//**/*.yml": "paolomatarazzo",
+ "cellular//**/*.md": "paolomatarazzo",
+ "cellular//**/*.yml": "paolomatarazzo",
+ "lock-screen//**/*.md": "paolomatarazzo",
+ "lock-screen//**/*.yml": "paolomatarazzo",
+ "provisioning-packages//**/*.md": "vinaypamnani-msft",
+ "provisioning-packages//**/*.yml": "vinaypamnani-msft",
+ "shared-pc//**/*.md": "paolomatarazzo",
+ "shared-pc//**/*.yml": "paolomatarazzo",
+ "start//**/*.md": "paolomatarazzo",
+ "start//**/*.yml": "paolomatarazzo",
+ "store//**/*.md": "paolomatarazzo",
+ "store//**/*.yml": "paolomatarazzo",
+ "taskbar//**/*.md": "paolomatarazzo",
+ "taskbar//**/*.yml": "paolomatarazzo",
+ "tips//**/*.md": "paolomatarazzo",
+ "tips//**/*.yml": "paolomatarazzo",
"ue-v//**/*.md": "aczechowski",
- "ue-v//**/*.yml": "aczechowski"
+ "ue-v//**/*.yml": "aczechowski",
+ "wcd//**/*.md": "vinaypamnani-msft",
+ "wcd//**/*.yml": "vinaypamnani-msft"
},
- "ms.author": {
- "wcd//**/*.md": "aaroncz",
- "wcd//**/*.yml": "aaroncz",
+ "ms.author":{
+ "accessibility//**/*.md": "paoloma",
+ "accessibility//**/*.yml": "paoloma",
+ "assigned-access//**/*.md": "paoloma",
+ "assigned-access//**/*.yml": "paoloma",
+ "cellular//**/*.md": "paoloma",
+ "cellular//**/*.yml": "paoloma",
+ "lock-screen//**/*.md": "paoloma",
+ "lock-screen//**/*.yml": "paoloma",
+ "provisioning-packages//**/*.md": "vinpa",
+ "provisioning-packages//**/*.yml": "vinpa",
+ "shared-pc//**/*.md": "paoloma",
+ "shared-pc//**/*.yml": "paoloma",
+ "start//**/*.md": "paoloma",
+ "start//**/*.yml": "paoloma",
+ "store//**/*.md": "paoloma",
+ "store//**/*.yml": "paoloma",
+ "taskbar//**/*.md": "paoloma",
+ "taskbar//**/*.yml": "paoloma",
+ "tips//**/*.md": "paoloma",
+ "tips//**/*.yml": "paoloma",
"ue-v//**/*.md": "aaroncz",
- "ue-v//**/*.yml": "aaroncz"
+ "ue-v//**/*.yml": "aaroncz",
+ "wcd//**/*.md": "vinpa",
+ "wcd//**/*.yml": "vinpa"
},
"ms.reviewer": {
"kiosk//**/*.md": "sybruckm",
diff --git a/windows/configuration/images/icons/explorer.svg b/windows/configuration/images/icons/explorer.svg
new file mode 100644
index 0000000000..070605d32b
--- /dev/null
+++ b/windows/configuration/images/icons/explorer.svg
@@ -0,0 +1,88 @@
+
diff --git a/windows/configuration/images/icons/group-policy.svg b/windows/configuration/images/icons/group-policy.svg
new file mode 100644
index 0000000000..c9cb511415
--- /dev/null
+++ b/windows/configuration/images/icons/group-policy.svg
@@ -0,0 +1,9 @@
+
diff --git a/windows/configuration/images/icons/registry.svg b/windows/configuration/images/icons/registry.svg
new file mode 100644
index 0000000000..bc4aa2f534
--- /dev/null
+++ b/windows/configuration/images/icons/registry.svg
@@ -0,0 +1,9 @@
+
diff --git a/windows/configuration/images/icons/rocket.svg b/windows/configuration/images/icons/rocket.svg
new file mode 100644
index 0000000000..133e0c7daf
--- /dev/null
+++ b/windows/configuration/images/icons/rocket.svg
@@ -0,0 +1,19 @@
+
diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml
index cf169d04cb..b6023eda4e 100644
--- a/windows/configuration/index.yml
+++ b/windows/configuration/index.yml
@@ -11,7 +11,7 @@ metadata:
author: paolomatarazzo
ms.author: paoloma
manager: aaroncz
- ms.date: 02/06/2024
+ ms.date: 03/04/2024
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new
@@ -22,9 +22,9 @@ landingContent:
- linkListType: how-to-guide
links:
- text: Customize the Windows Start menu layout
- url: start/customize-start-menu-layout-windows-11.md
+ url: start/customize-and-export-start-layout.md
- text: Customize the Windows taskbar
- url: taskbar/customize-taskbar-windows-11.md
+ url: taskbar/configure.md
- text: Configure Windows Spotlight on the lock screen
url: lock-screen/windows-spotlight.md
- text: Accessibility information for IT pros
@@ -32,29 +32,51 @@ landingContent:
- title: Configure a Windows kiosk
linkLists:
+ - linkListType: concept
+ links:
+ - text: What is Assigned Access?
+ url: assigned-access/overview.md
+ - text: What is Shell Launcher?
+ url: assigned-access/shell-launcher/index.md
- linkListType: how-to-guide
links:
- - text: Configure kiosks and digital signs
- url: kiosk/kiosk-methods.md
- - text: Set up a single-app kiosk
- url: kiosk/kiosk-single-app.md
- - text: Set up a multi-app kiosk for Windows 11
- url: kiosk/lock-down-windows-11-to-specific-apps.md
- - text: Manage multi-user and guest devices
- url: shared-devices-concepts.md
+ - text: Configure kiosks and restricted user experiences
+ url: assigned-access/index.md
+ - linkListType: quickstart
+ links:
+ - text: Configure a kiosk with Assigned Access
+ url: assigned-access/quickstart-kiosk.md
+ - text: Configure a kiosk with Shell Launcher
+ url: assigned-access/shell-launcher/quickstart-kiosk.md
+ - text: Configure a restricted user experience with Assigned Access
+ url: assigned-access/quickstart-restricted-user-experience.md
+ - linkListType: reference
+ links:
+ - text: Assigned Access XML Schema Definition (XSD)
+ url: assigned-access/xsd.md
+ - text: Shell Launcher XML Schema Definition (XSD)
+ url: assigned-access/shell-launcher/xsd.md
- title: Configure shared devices
linkLists:
+ - linkListType: concept
+ links:
+ - text: Shared devices concepts
+ url: /windows/configuration/shared-pc/shared-devices-concepts
- linkListType: how-to-guide
links:
- - text: Manage multi-user and guest devices
- url: shared-devices-concepts.md
+ - text: Configure a shared or guest Windows device
+ url: /windows/configuration/shared-pc/set-up-shared-or-guest-pc
+ - linkListType: reference
+ links:
+ - text: Shared PC technical reference
+ url: /windows/configuration/shared-pc/shared-pc-technical
- title: Use provisioning packages
linkLists:
- linkListType: how-to-guide
links:
- - text: Provisioning packages for Windows
+ - text: Provisioning packages overview
url: provisioning-packages/provisioning-packages.md
- text: Install Windows Configuration Designer
url: provisioning-packages/provisioning-install-icd.md
diff --git a/windows/configuration/kiosk/find-the-application-user-model-id-of-an-installed-app.md b/windows/configuration/kiosk/find-the-application-user-model-id-of-an-installed-app.md
deleted file mode 100644
index 862316c47b..0000000000
--- a/windows/configuration/kiosk/find-the-application-user-model-id-of-an-installed-app.md
+++ /dev/null
@@ -1,143 +0,0 @@
----
-title: Find the Application User Model ID of an installed app
-description: To configure assigned access (kiosk mode), you need the Application User Model ID (AUMID) of apps installed on a device.
-ms.topic: article
-ms.date: 12/31/2017
----
-
-# Find the Application User Model ID of an installed app
-
-To configure assigned access (kiosk mode), you need the Application User Model ID (AUMID) of apps installed on a device. You can find the AUMID by using Windows PowerShell, File Explorer, or the registry.
-
-## To find the AUMID by using Windows PowerShell
-
-To get the names and AUMIDs for all apps installed for the current user, open a Windows PowerShell command prompt and enter the following command:
-
-```powershell
-Get-StartApps
-```
-
-To get the names and AUMIDs for Windows Store apps installed for another user, open a Windows PowerShell command prompt and enter the following commands:
-
-```powershell
-$installedapps = Get-AppxPackage
-
-$aumidList = @()
-foreach ($app in $installedapps)
-{
- foreach ($id in (Get-AppxPackageManifest $app).package.applications.application.id)
- {
- $aumidList += $app.packagefamilyname + "!" + $id
- }
-}
-
-$aumidList
-```
-
-You can add the `-user ` or the `-allusers` parameters to the **Get-AppxPackage** cmdlet to list AUMIDs for other users. You must use an elevated Windows PowerShell prompt to use the `-user` or -`allusers` parameters.
-
-## To find the AUMID by using File Explorer
-
-To get the names and AUMIDs for all apps installed for the current user, perform the following steps:
-
-1. Open **Run**, enter **shell:Appsfolder**, and select **OK**.
-1. A File Explorer window opens. Press **Alt** > **View** > **Choose details**.
-1. In the **Choose Details** window, select **AppUserModelId**, and then select **OK**. (You might need to change the **View** setting from **Tiles** to **Details**.)
-
-
-
-## To find the AUMID of an installed app for the current user by using the registry
-
-Querying the registry can only return information about Microsoft Store apps that are installed for the current user, while the Windows PowerShell query can find information for any account on the device.
-
-At a command prompt, type the following command:
-
-```cmd
-reg query HKEY_CURRENT_USER\Software\Classes\ActivatableClasses\Package /s /f AppUserModelID | find "REG_SZ"
-```
-
-### Example to get AUMIDs of the installed apps for the specified user
-
-The following code sample creates a function in Windows PowerShell that returns an array of AUMIDs of the installed apps for the specified user.
-
-```powershell
-function listAumids( $userAccount ) {
-
- if ($userAccount -eq "allusers")
- {
- # Find installed packages for all accounts. Must be run as an administrator in order to use this option.
- $installedapps = Get-AppxPackage -allusers
- }
- elseif ($userAccount)
- {
- # Find installed packages for the specified account. Must be run as an administrator in order to use this option.
- $installedapps = Get-AppxPackage -user $userAccount
- }
- else
- {
- # Find installed packages for the current account.
- $installedapps = Get-AppxPackage
- }
-
- $aumidList = @()
- foreach ($app in $installedapps)
- {
- foreach ($id in (Get-AppxPackageManifest $app).package.applications.application.id)
- {
- $aumidList += $app.packagefamilyname + "!" + $id
- }
- }
-
- return $aumidList
-}
-```
-
-The following Windows PowerShell commands demonstrate how you can call the listAumids function after you've created it.
-
-```powershell
-# Get a list of AUMIDs for the current account:
-listAumids
-
-# Get a list of AUMIDs for an account named "CustomerAccount":
-listAumids("CustomerAccount")
-
-# Get a list of AUMIDs for all accounts on the device:
-listAumids("allusers")
-```
-
-### Example to get the AUMID of any application in the Start menu
-
-The following code sample creates a function in Windows PowerShell that returns the AUMID of any application currently listed in the Start menu.
-
-```powershell
-function Get-AppAUMID {
-param (
-[string]$AppName
-)
-$Apps = (New-Object -ComObject Shell.Application).NameSpace('shell:::{4234d49b-0245-4df3-b780-3893943456e1}').Items()
-if ($AppName){
- $Result = $Apps | Where-Object { $_.name -like "*$AppName*" } | Select-Object name,@{n="AUMID";e={$_.path}}
- if ($Result){
- Return $Result
- }
- else {"Unable to locate {0}" -f $AppName}
-}
-else {
- $Result = $Apps | Select-Object name,@{n="AUMID";e={$_.path}}
- Return $Result
-}
-}
-```
-
-The following Windows PowerShell commands demonstrate how you can call the Get-AppAUMID function after you've created it.
-
-```powershell
-# Get the AUMID for OneDrive
-Get-AppAUMID -AppName OneDrive
-
-# Get the AUMID for Microsoft Word
-Get-AppAUMID -AppName Word
-
-# List all apps and their AUMID in the Start menu
-Get-AppAUMID
-```
diff --git a/windows/configuration/kiosk/guidelines-for-assigned-access-app.md b/windows/configuration/kiosk/guidelines-for-assigned-access-app.md
deleted file mode 100644
index 4ed078e5e1..0000000000
--- a/windows/configuration/kiosk/guidelines-for-assigned-access-app.md
+++ /dev/null
@@ -1,146 +0,0 @@
----
-title: Guidelines for choosing an app for assigned access
-description: The following guidelines may help you choose an appropriate Windows app for your assigned access experience.
-ms.topic: article
-ms.date: 12/31/2017
----
-
-# Guidelines for choosing an app for assigned access (kiosk mode)
-
-Use assigned access to restrict users to use only one application, so that the device acts like a kiosk. Administrators can use assigned access to restrict a selected user account to access a single Windows app. You can choose almost any Windows app for assigned access; however, some apps may not provide a good user experience.
-
-The following guidelines may help you choose an appropriate Windows app for your assigned access experience.
-
-## General guidelines
-
-- Windows apps must be provisioned or installed for the assigned access account before they can be selected as the assigned access app. [Learn how to provision and install apps](/windows/client-management/mdm/enterprise-app-management#install_your_apps).
-- Updating a Windows app can sometimes change the Application User Model ID (AUMID) of the app. If this change happens, you must update the assigned access settings to launch the updated app, because assigned access uses the AUMID to determine which app to launch.
-- Apps that are generated using the [Desktop App Converter (Desktop Bridge)](/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) can't be used as kiosk apps.
-
-## Guidelines for Windows apps that launch other apps
-
-Some apps can launch other apps. Assigned access prevents Windows apps from launching other apps.
-
-Avoid selecting Windows apps that are designed to launch other apps as part of their core functionality.
-
-## Guidelines for web browsers
-
-Microsoft Edge includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy)
-
-In Windows client, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure more settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren't allowed to go to a competitor's website.
-
->[!NOTE]
->Kiosk Browser supports a single tab. If a website has links that open a new tab, those links will not work with Kiosk Browser. Kiosk Browser does not support .pdfs.
->
->Kiosk Browser can't access intranet websites.
-
-**Kiosk Browser** must be downloaded for offline licensing using Microsoft Store For Business. You can deploy **Kiosk Browser** to devices running Windows 10, version 1803 (Pro, Business, Enterprise, and Education) and Windows 11.
-
-1. [Get **Kiosk Browser** in Microsoft Store for Business with offline license type.](/microsoft-store/acquire-apps-microsoft-store-for-business#acquire-apps)
-1. [Deploy **Kiosk Browser** to kiosk devices.](/microsoft-store/distribute-offline-apps)
-1. Configure policies using settings from the Policy Configuration Service Provider (CSP) for [KioskBrowser](/windows/client-management/mdm/policy-csp-kioskbrowser). These settings can be configured using your MDM service provider, or [in a provisioning package](../provisioning-packages/provisioning-create-package.md). In Windows Configuration Designer, the settings are located in **Policies > KioskBrowser** when you select advanced provisioning for Windows desktop editions.
-
->[!NOTE]
->If you configure the kiosk using a provisioning package, you must apply the provisioning package after the device completes the out-of-box experience (OOBE).
-
-### Kiosk Browser settings
-
-| Kiosk Browser settings | Use this setting to |
-|--|--|
-| Blocked URL Exceptions | Specify URLs that people can navigate to, even though the URL is in your blocked URL list. You can use wildcards.
For example, if you want people to be limited to `http://contoso.com` only, you would add `.contoso.com` to blocked URL exception list and then block all other URLs. |
-| Blocked URLs | Specify URLs that people can't navigate to. You can use wildcards.
If you want to limit people to a specific site, add `https://*` to the blocked URL list, and then specify the site to be allowed in the blocked URL exceptions list. |
-| Default URL | Specify the URL that Kiosk Browser will open with. **Tip!** Make sure your blocked URLs don't include your default URL. |
-| Enable End Session Button | Show a button in Kiosk Browser that people can use to reset the browser. End Session will clear all browsing data and navigate back to the default URL. |
-| Enable Home Button | Show a Home button in Kiosk Browser. Home will return the browser to the default URL. |
-| Enable Navigation Buttons | Show forward and back buttons in Kiosk Browser. |
-| Restart on Idle Time | Specify when Kiosk Browser should restart in a fresh state after an amount of idle time since the last user interaction. |
-
-To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer:
-
-1. Create the provisioning package. When ready to export, close the project in Windows Configuration Designer
-1. Open the customizations.xml file in the project folder (e.g C:\Users\name\Documents\Windows Imaging and Configuration Designer (WICD)\Project_18)
-1. Insert the null character string in between each URL (e.g www.bing.com``www.contoso.com)
-1. Save the XML file
-1. Open the project again in Windows Configuration Designer
-1. Export the package. Ensure you do not revisit the created policies under Kiosk Browser or else the null character will be removed
-
-> [!TIP]
->
-> To enable the **End Session** button for Kiosk Browser in Intune, you must [create a custom OMA-URI policy](/intune/custom-settings-windows-10) with the following information:
->
-> - OMA-URI: ./Vendor/MSFT/Policy/Config/KioskBrowser/EnableEndSessionButton
-> - Data type: Integer
-> - Value: 1
-
-#### Rules for URLs in Kiosk Browser settings
-
-Kiosk Browser filtering rules are based on the [Chromium Project](https://www.chromium.org/Home).
-
-URLs can include:
-
-- A valid port value from 1 to 65,535.
-- The path to the resource.
-- Query parameters.
-
-More guidelines for URLs:
-
-- If a period precedes the host, the policy filters exact host matches only
-- You can't use user:pass fields
-- When both blocked URL and blocked URL exceptions apply with the same path length, the exception takes precedence
-- The policy searches wildcards (*) last
-- The optional query is a set of key-value and key-only tokens delimited by '&'
-- Key-value tokens are separated by '='
-- A query token can optionally end with a '*' to indicate prefix match. Token order is ignored during matching
-
-### Examples of blocked URLs and exceptions
-
-The following table describes the results for different combinations of blocked URLs and blocked URL exceptions.
-
-| Blocked URL rule | Block URL exception rule | Result |
-|--|--|--|
-| `*` | `contoso.com` `fabrikam.com` | All requests are blocked unless it's to contoso.com, fabrikam.com, or any of their subdomains. |
-| `contoso.com` | `mail.contoso.com` `.contoso.com` `.www.contoso.com` | Block all requests to contoso.com, except for the main page and its mail subdomain. |
-| `youtube.com` | `youtube.com/watch?v=v1` `youtube.com/watch?v=v2` | Blocks all access to youtube.com except for the specified videos (v1 and v2). |
-
-The following table gives examples for blocked URLs.
-
-| Entry | Result |
-|--|--|
-| `contoso.com` | Blocks all requests to contoso.com, www.contoso.com, and sub.www.contoso.com |
-| `https://*` | Blocks all HTTPS requests to any domain. |
-| `mail.contoso.com` | Blocks requests to mail.contoso.com but not to www.contoso.com or contoso.com |
-| `.contoso.com` | Blocks contoso.com but not its subdomains, like subdomain.contoso.com. |
-| `.www.contoso.com` | Blocks www.contoso.com but not its subdomains. |
-| `*` | Blocks all requests except for URLs in the Blocked URL Exceptions list. |
-| `*:8080` | Blocks all requests to port 8080. |
-| `contoso.com/stuff` | Blocks all requests to contoso.com/stuff and its subdomains. |
-| `192.168.1.2` | Blocks requests to 192.168.1.1. |
-| `youtube.com/watch?v=V1` | Blocks YouTube video with id V1. |
-
-### Other browsers
-
-You can create your own web browser Windows app by using the WebView class. Learn more about developing your own web browser app:
-
-- [Creating your own browser with HTML and JavaScript](https://blogs.windows.com/msedgedev/2015/08/27/creating-your-own-browser-with-html-and-javascript/)
-- [WebView class](/uwp/api/Windows.UI.Xaml.Controls.WebView)
-- [A web browser built with JavaScript as a Windows app](https://github.com/MicrosoftEdge/JSBrowser/tree/v1.0)
-
-## Secure your information
-
-Avoid selecting Windows apps that may expose the information you don't want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting like a shopping mall. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting these types of apps if they provide unnecessary data access.
-
-## App configuration
-
-Some apps may require more configurations before they can be used appropriately in assigned access. For example, Microsoft OneNote requires you to set up a Microsoft account for the assigned access user account before OneNote will open in assigned access.
-
-Check the guidelines published by your selected app and set up accordingly.
-
-## Develop your kiosk app
-
-Assigned access in Windows client uses the new lock framework. When an assigned access user signs in, the selected kiosk app is launched above the lock screen. The kiosk app is running as an above lock screen app.
-
-Follow the [best practices guidance for developing a kiosk app for assigned access](/windows-hardware/drivers/partnerapps/create-a-kiosk-app-for-assigned-access).
-
-## Test your assigned access experience
-
-The above guidelines may help you select or develop an appropriate Windows app for your assigned access experience. Once you've selected your app, we recommend that you thoroughly test the assigned access experience to ensure that your device provides a good customer experience.
diff --git a/windows/configuration/kiosk/images/account-management-details.PNG b/windows/configuration/kiosk/images/account-management-details.PNG
deleted file mode 100644
index e4307d8f7b..0000000000
Binary files a/windows/configuration/kiosk/images/account-management-details.PNG and /dev/null differ
diff --git a/windows/configuration/kiosk/images/add-applications-details.PNG b/windows/configuration/kiosk/images/add-applications-details.PNG
deleted file mode 100644
index 2efd3483ae..0000000000
Binary files a/windows/configuration/kiosk/images/add-applications-details.PNG and /dev/null differ
diff --git a/windows/configuration/kiosk/images/add-certificates-details.PNG b/windows/configuration/kiosk/images/add-certificates-details.PNG
deleted file mode 100644
index 78cd783282..0000000000
Binary files a/windows/configuration/kiosk/images/add-certificates-details.PNG and /dev/null differ
diff --git a/windows/configuration/kiosk/images/apprule.png b/windows/configuration/kiosk/images/apprule.png
deleted file mode 100644
index ec5417849a..0000000000
Binary files a/windows/configuration/kiosk/images/apprule.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/appwarning.png b/windows/configuration/kiosk/images/appwarning.png
deleted file mode 100644
index 877d8afebd..0000000000
Binary files a/windows/configuration/kiosk/images/appwarning.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/aumid-file-explorer.png b/windows/configuration/kiosk/images/aumid-file-explorer.png
deleted file mode 100644
index 87bc7166a3..0000000000
Binary files a/windows/configuration/kiosk/images/aumid-file-explorer.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/auto-signin.png b/windows/configuration/kiosk/images/auto-signin.png
deleted file mode 100644
index 260376199e..0000000000
Binary files a/windows/configuration/kiosk/images/auto-signin.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/enable-assigned-access-log.png b/windows/configuration/kiosk/images/enable-assigned-access-log.png
deleted file mode 100644
index d16f04c43a..0000000000
Binary files a/windows/configuration/kiosk/images/enable-assigned-access-log.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/finish-details.png b/windows/configuration/kiosk/images/finish-details.png
deleted file mode 100644
index 727efac696..0000000000
Binary files a/windows/configuration/kiosk/images/finish-details.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/genrule.png b/windows/configuration/kiosk/images/genrule.png
deleted file mode 100644
index 1d68f1ad0b..0000000000
Binary files a/windows/configuration/kiosk/images/genrule.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/kiosk-account-details.PNG b/windows/configuration/kiosk/images/kiosk-account-details.PNG
deleted file mode 100644
index 53c31880ea..0000000000
Binary files a/windows/configuration/kiosk/images/kiosk-account-details.PNG and /dev/null differ
diff --git a/windows/configuration/kiosk/images/kiosk-common-details.PNG b/windows/configuration/kiosk/images/kiosk-common-details.PNG
deleted file mode 100644
index 5eda9b293e..0000000000
Binary files a/windows/configuration/kiosk/images/kiosk-common-details.PNG and /dev/null differ
diff --git a/windows/configuration/kiosk/images/kiosk-fullscreen-sm.png b/windows/configuration/kiosk/images/kiosk-fullscreen-sm.png
deleted file mode 100644
index b096d6837d..0000000000
Binary files a/windows/configuration/kiosk/images/kiosk-fullscreen-sm.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/kiosk-settings.PNG b/windows/configuration/kiosk/images/kiosk-settings.PNG
deleted file mode 100644
index 51a4338371..0000000000
Binary files a/windows/configuration/kiosk/images/kiosk-settings.PNG and /dev/null differ
diff --git a/windows/configuration/kiosk/images/kiosk-wizard.png b/windows/configuration/kiosk/images/kiosk-wizard.png
deleted file mode 100644
index 160e170e5c..0000000000
Binary files a/windows/configuration/kiosk/images/kiosk-wizard.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/lockdownapps.png b/windows/configuration/kiosk/images/lockdownapps.png
deleted file mode 100644
index beb73e5370..0000000000
Binary files a/windows/configuration/kiosk/images/lockdownapps.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/multiappassignedaccesssettings.png b/windows/configuration/kiosk/images/multiappassignedaccesssettings.png
deleted file mode 100644
index 86e2e0a451..0000000000
Binary files a/windows/configuration/kiosk/images/multiappassignedaccesssettings.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/profile-config.png b/windows/configuration/kiosk/images/profile-config.png
deleted file mode 100644
index 24a4dad4ab..0000000000
Binary files a/windows/configuration/kiosk/images/profile-config.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/sample-start.png b/windows/configuration/kiosk/images/sample-start.png
deleted file mode 100644
index 8ef9cc928c..0000000000
Binary files a/windows/configuration/kiosk/images/sample-start.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/set-assignedaccess.png b/windows/configuration/kiosk/images/set-assignedaccess.png
deleted file mode 100644
index c2899361eb..0000000000
Binary files a/windows/configuration/kiosk/images/set-assignedaccess.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/set-up-device-details.PNG b/windows/configuration/kiosk/images/set-up-device-details.PNG
deleted file mode 100644
index 031dac6fe6..0000000000
Binary files a/windows/configuration/kiosk/images/set-up-device-details.PNG and /dev/null differ
diff --git a/windows/configuration/kiosk/images/set-up-network-details.PNG b/windows/configuration/kiosk/images/set-up-network-details.PNG
deleted file mode 100644
index 778b8497c4..0000000000
Binary files a/windows/configuration/kiosk/images/set-up-network-details.PNG and /dev/null differ
diff --git a/windows/configuration/kiosk/images/slv2-oma-uri.png b/windows/configuration/kiosk/images/slv2-oma-uri.png
deleted file mode 100644
index 98ee252b63..0000000000
Binary files a/windows/configuration/kiosk/images/slv2-oma-uri.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/vm-kiosk-connect.png b/windows/configuration/kiosk/images/vm-kiosk-connect.png
deleted file mode 100644
index 2febd9d573..0000000000
Binary files a/windows/configuration/kiosk/images/vm-kiosk-connect.png and /dev/null differ
diff --git a/windows/configuration/kiosk/images/vm-kiosk.png b/windows/configuration/kiosk/images/vm-kiosk.png
deleted file mode 100644
index 59f01c1348..0000000000
Binary files a/windows/configuration/kiosk/images/vm-kiosk.png and /dev/null differ
diff --git a/windows/configuration/kiosk/kiosk-additional-reference.md b/windows/configuration/kiosk/kiosk-additional-reference.md
deleted file mode 100644
index d652bf9874..0000000000
--- a/windows/configuration/kiosk/kiosk-additional-reference.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-title: More kiosk methods and reference information
-description: Find more information for configuring, validating, and troubleshooting kiosk configuration.
-ms.topic: reference
-ms.date: 12/31/2017
----
-
-# More kiosk methods and reference information
-
-## In this section
-
-| Topic | Description |
-|--|--|
-| [Find the Application User Model ID of an installed app](find-the-application-user-model-id-of-an-installed-app.md) | This topic explains how to get the AUMID for an app. |
-| [Validate your kiosk configuration](kiosk-validate.md) | This topic explains what to expect on a multi-app kiosk. |
-| [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) | These guidelines will help you choose an appropriate Windows app for your assigned access experience. |
-| [Policies enforced on kiosk devices](kiosk-policies.md) | Learn about the policies enforced on a device when you configure it as a kiosk. |
-| [Assigned access XML reference](kiosk-xml.md) | The XML and XSD for kiosk device configuration. |
-| [Use AppLocker to create a Windows client kiosk](lock-down-windows-10-applocker.md) | Learn how to use AppLocker to configure a Windows client kiosk device running Enterprise or Education so that users can only run a few specific apps. |
-| [Use Shell Launcher to create a Windows client kiosk](kiosk-shelllauncher.md) | Using Shell Launcher, you can configure a kiosk device that runs a Windows application as the user interface. |
-| [Use MDM Bridge WMI Provider to create a Windows client kiosk](kiosk-mdm-bridge.md) | Environments that use Windows Management Instrumentation (WMI) can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. |
-| [Troubleshoot kiosk mode issues](/troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting) | Tips for troubleshooting multi-app kiosk configuration. |
diff --git a/windows/configuration/kiosk/kiosk-mdm-bridge.md b/windows/configuration/kiosk/kiosk-mdm-bridge.md
deleted file mode 100644
index 7725923709..0000000000
--- a/windows/configuration/kiosk/kiosk-mdm-bridge.md
+++ /dev/null
@@ -1,143 +0,0 @@
----
-title: Use MDM Bridge WMI Provider to create a Windows kiosk
-description: Environments that use Windows Management Instrumentation (WMI) can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class.
-ms.topic: article
-ms.date: 1/26/2024
-zone_pivot_groups: windows-versions-11-10
-appliesto:
----
-
-# Use MDM Bridge WMI Provider to create a Windows client kiosk
-
-Environments that use [Windows Management Instrumentation (WMI)](/windows/win32/wmisdk/wmi-start-page) can use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to configure the MDM_AssignedAccess class. For more information about using a PowerShell script to configure AssignedAccess, see [PowerShell Scripting with WMI Bridge Provider](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider).
-
-Here's an example to set AssignedAccess configuration:
-
-1. [Download PsTools][PSTools]
-1. Open an elevated command prompt and run: `psexec.exe -i -s powershell.exe`
-1. In the PowerShell session launched by `psexec.exe`, execute the following script:
-
-::: zone pivot="windows-10"
-
-```PowerShell
-$nameSpaceName="root\cimv2\mdm\dmmap"
-$className="MDM_AssignedAccess"
-$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
-Add-Type -AssemblyName System.Web
-
-$obj.Configuration = [System.Web.HttpUtility]::HtmlEncode(@"
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
- MultiAppKioskUser
-
-
-
-
-"@)
-
-Set-CimInstance -CimInstance $obj
-```
-
-::: zone-end
-
-::: zone pivot="windows-11"
-
- ```PowerShell
-$nameSpaceName="root\cimv2\mdm\dmmap"
-$className="MDM_AssignedAccess"
-$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
-Add-Type -AssemblyName System.Web
-
-$obj.Configuration = [System.Web.HttpUtility]::HtmlEncode(@"
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- MultiAppKioskUser
-
-
-
-
-"@)
-
-Set-CimInstance -CimInstance $obj
-```
-
-::: zone-end
-
-For more information, see [Using PowerShell scripting with the WMI Bridge Provider][WIN-1].
-
-
-
-[WIN-1]: /windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider
-[PsTools]: https://download.sysinternals.com/files/PSTools.zip
diff --git a/windows/configuration/kiosk/kiosk-methods.md b/windows/configuration/kiosk/kiosk-methods.md
deleted file mode 100644
index 6db61a28ec..0000000000
--- a/windows/configuration/kiosk/kiosk-methods.md
+++ /dev/null
@@ -1,76 +0,0 @@
----
-title: Configure kiosks and digital signs on Windows 10/11 desktop editions
-description: In this article, learn about the methods for configuring kiosks and digital signs on Windows 10 or Windows 11 desktop editions.
-ms.topic: article
-ms.date: 12/31/2017
----
-
-# Configure kiosks and digital signs on Windows desktop editions
-
-Organization may want to set up special purpose devices, such as a device in the lobby that customers can use to view product catalogs, or a device displaying visual content as a digital sign. Windows client offers two different locked-down experiences for public or specialized use:
-
-- Single-app kiosk: runs a single Universal Windows Platform (UWP) application in full screen above the lock screen. People using the kiosk can see only that app. When the kiosk account (a local standard user account) signs in, the kiosk app launches automatically. If the kiosk app is closed, it will automatically restart
-- Multi-app kiosk: runs one or more applications from the desktop. People using the kiosk see a customized Start menu that shows only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types
-
-A single-app kiosk is ideal for public use. Using [Shell Launcher](kiosk-shelllauncher.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user signs in. This type of single-app kiosk doesn't run above the lock screen.
-
-A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that affects **all** non-administrator users on the device.
-
-Kiosk configurations are based on **Assigned Access**, a feature in Windows client that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user.
-
-There are several kiosk configuration methods that you can choose from, depending on your answers to the following questions.
-
-- **Which type of app will your kiosk run?**
- Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application. For [digital signage](setup-digital-signage.md), select a digital sign player as your kiosk app. [Check out the guidelines for kiosk apps.](guidelines-for-assigned-access-app.md)
-- **Which type of kiosk do you need?**
- If you want your kiosk to run a single app for anyone to see or use, consider a single-app kiosk that runs either a [Universal Windows Platform (UWP) app](#methods-for-a-single-app-kiosk-running-a-uwp-app) or a Windows desktop application. For a kiosk that people can sign in to with their accounts or that runs more than one app, choose a multi-app kiosk
-- **Which edition of Windows client will the kiosk run?**
- All of the configuration methods work for Windows client Enterprise and Education; some of the methods work for Windows Pro. Kiosk mode isn't available on Windows Home
-- **Which type of user account will be the kiosk account?**
- The kiosk account can be a local standard user account, a local administrator account, a domain account, or a Microsoft Entra account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method
-
->[!IMPORTANT]
->Single-app kiosk mode isn't supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk.
-
-[!INCLUDE [assigned-access-kiosk-mode](../../../includes/licensing/assigned-access-kiosk-mode.md)]
-
-## Methods for a single-app kiosk running a UWP app
-
-| You can use this method | For this edition | For this kiosk account type |
-|--|--|--|
-| [Assigned access in Settings](kiosk-single-app.md) | Pro, Ent, Edu | Local standard user |
-| [Assigned access cmdlets](kiosk-single-app.md) | Pro, Ent, Edu | Local standard user |
-| [The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md) | Pro (version 1709), Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID |
-| [Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md) | Pro (version 1709), Ent, Edu | Local standard user, Microsoft Entra ID |
-| [Shell Launcher](kiosk-shelllauncher.md) v2 | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID |
-
-## Methods for a single-app kiosk running a Windows desktop application
-
-| You can use this method | For this edition | For this kiosk account type |
-|--|--|--|
-| [The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md) | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID |
-| [Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md) | Pro (version 1709), Ent, Edu | Local standard user, Microsoft Entra ID |
-| [Shell Launcher](kiosk-shelllauncher.md) v1 and v2 | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID |
-
-## Methods for a multi-app kiosk
-
-| You can use this method | For this edition | For this kiosk account type |
-|--|--|--|
-| [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID |
-| [Microsoft Intune or other MDM](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Microsoft Entra ID |
-| [MDM WMI Bridge Provider](kiosk-mdm-bridge.md) | Pro, Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID |
-
-## Summary of kiosk configuration methods
-
-| Method | App type | Account type | Single-app kiosk | Multi-app kiosk |
-|--|--|--|:-:|:-:|
-| [Assigned access in Settings](kiosk-single-app.md) | UWP | Local account | ✅ |
-| [Assigned access cmdlets](kiosk-single-app.md) | UWP | Local account | ✅ |
-| [The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✅ |
-| [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✅ | ✅ |
-| Microsoft Intune or other MDM [for full-screen single-app kiosk](kiosk-single-app.md) or [for multi-app kiosk with desktop](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Microsoft Entra ID | ✅ | ✅ |
-| [Shell Launcher](kiosk-shelllauncher.md) | Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✅ |
-| [MDM Bridge WMI Provider](kiosk-mdm-bridge.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | | ✅ |
-
->[!NOTE]
->For devices running Windows client Enterprise and Education, you can also use [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) or [AppLocker](lock-down-windows-10-applocker.md) to lock down a device to specific apps.
diff --git a/windows/configuration/kiosk/kiosk-policies.md b/windows/configuration/kiosk/kiosk-policies.md
deleted file mode 100644
index 3ab125b892..0000000000
--- a/windows/configuration/kiosk/kiosk-policies.md
+++ /dev/null
@@ -1,98 +0,0 @@
----
-title: Policies enforced on kiosk devices
-description: Learn about the policies enforced on a device when you configure it as a kiosk.
-ms.topic: article
-ms.date: 12/31/2017
----
-
-# Policies enforced on kiosk devices
-
-It isn't recommended to set policies enforced in assigned access kiosk mode to different values using other channels, as the kiosk mode has been optimized to provide a locked-down experience.
-
-When the assigned access kiosk configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device.
-
-## Group Policy
-
-The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. These users include local users, domain users, and Microsoft Entra users.
-
-| Setting | Value |
-|--|--|
-| Remove access to the context menus for the task bar | Enabled |
-| Clear history of recently opened documents on exit | Enabled |
-| Prevent users from customizing their Start Screen | Enabled |
-| Prevent users from uninstalling applications from Start | Enabled |
-| Remove Run menu from Start Menu | Enabled |
-| Disable showing balloon notifications as toast | Enabled |
-| Do not allow pinning items in Jump Lists | Enabled |
-| Do not allow pinning programs to the Taskbar | Enabled |
-| Do not display or track items in Jump Lists from remote locations | Enabled |
-| Remove Notifications and Action Center | Enabled |
-| Lock all taskbar settings | Enabled |
-| Lock the Taskbar | Enabled |
-| Prevent users from adding or removing toolbars | Enabled |
-| Prevent users from resizing the taskbar | Enabled |
-| Remove frequent programs list from the Start Menu | Enabled |
-| Remove Pinned programs from the taskbar | Enabled |
-| Remove the Security and Maintenance icon | Enabled |
-| Turn off all balloon notifications | Enabled |
-| Turn off feature advertisement balloon notifications | Enabled |
-| Turn off toast notifications | Enabled |
-| Remove Task Manager | Enabled |
-| Remove Change Password option in Security Options UI | Enabled |
-| Remove Sign Out option in Security Options UI | Enabled |
-| Remove All Programs list from the Start Menu | Enabled - Remove and disable setting |
-| Prevent access to drives from My Computer | Enabled - Restrict all drives |
-
->[!NOTE]
->When **Prevent access to drives from My Computer** is enabled, users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears explaining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics.
-
-## MDM policy
-
-Some of the MDM policies based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system (that is, system-wide impact).
-
-| Setting | Value | System-wide |
-|--|--|--|
-| [Experience/AllowCortana](/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | 0 - Not allowed | Yes |
-| [Start/AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes |
-| Start/HidePeopleBar | 1 - True (hide) | No |
-| [Start/HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes |
-| [WindowsInkWorkspace/AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes |
-| [Start/StartLayout](/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No |
-| [WindowsLogon/DontDisplayNetworkSelectionUI](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes |
-
-
-
diff --git a/windows/configuration/kiosk/kiosk-prepare.md b/windows/configuration/kiosk/kiosk-prepare.md
deleted file mode 100644
index cf393573ad..0000000000
--- a/windows/configuration/kiosk/kiosk-prepare.md
+++ /dev/null
@@ -1,286 +0,0 @@
----
-title: Prepare a device for kiosk configuration on Windows 10/11 | Microsoft Docs
-description: Learn how to prepare a device for kiosk configuration. Also, learn about the recommended kiosk configuration changes.
-ms.topic: article
-ms.date: 12/31/2017
----
-
-# Prepare a device for kiosk configuration
-
-## Before you begin
-
-- [User account control (UAC)](/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode.
-- Kiosk mode isn't supported over a remote desktop connection. Your kiosk users must sign in on the physical device that's set up as a kiosk.
-- For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with the least privileges, such as a local standard user account.
-
- Assigned access can be configured using Windows Management Instrumentation (WMI) or configuration service provider (CSP). Assigned access runs an application using a domain user or service account, not a local account. Using a domain user or service accounts has risks, and might allow an attacker to gain access to domain resources that are accessible to any domain account. When using domain accounts with assigned access, proceed with caution. Consider the domain resources potentially exposed by using a domain account.
-
-- MDM providers, such as [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), use the configuration service providers (CSP) exposed by the Windows OS to manage settings on devices. In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started:
-
- - [Endpoint Management at Microsoft](/mem/endpoint-manager-getting-started)
- - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide)
- - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction)
-
-## Configuration recommendations
-
-For a more secure kiosk experience, we recommend that you make the following configuration changes to the device before you configure it as a kiosk:
-
-- **Hide update notifications**. Starting with Windows 10 version 1809, you can hide notifications from showing on the devices. To enable this feature, you have the following options:
-
- - **Use Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Display options for update notifications`
- - **Use an MDM provider**: This feature uses the [Update/UpdateNotificationLevel CSP](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel). In Intune, you can use the [Windows update settings](/mem/intune/protect/windows-update-settings) to manage this feature.
-
- - **Use the registry**:
-
- 1. Open Registry Editor (regedit).
- 1. Go to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate`.
- 1. Create a **New** > **DWORD (32-bit) Value**. Enter `SetUpdateNotificationLevel`, and set its value to `1`.
- 1. Create a **New** > **DWORD (32-bit) Value**. Enter `UpdateNotificationLevel`. For value, you can enter:
- - `1`: Hides all notifications except restart warnings.
- - `2`: Hides all notifications, including restart warnings.
-
-- **Enable and schedule automatic updates**. To enable this feature, you have the following options:
-
- - **Use Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates`. Select `4 - Auto download and schedule the install`.
- - **Use an MDM provider**: This feature uses the [Update/AllowAutoUpdate CSP](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate). Select `3 - Auto install and restart at a specified time`. In Intune, you can use the [Windows update settings](/mem/intune/protect/windows-update-settings) to manage this feature.
-
- You can also schedule automatic updates, including **Schedule Install Day**, **Schedule Install Time**, and **Schedule Install Week**. Installations can take between 30 minutes and 2 hours, depending on the device. Schedule updates to occur when a block of 3-4 hours is available.
-
-- **Enable automatic restart at the scheduled time**. To enable this feature, you have the following options:
-
- - **Use Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Always automatically restart at the scheduled time`. Select `4 - Auto download and schedule the install`.
-
- - **Use an MDM provider**: This feature uses the [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#update-activehoursstart) and [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#update-activehoursend) CSPs. In Intune, you can use the [Windows update settings](/mem/intune/protect/windows-update-settings) to manage this feature.
-
-- **Replace "blue screen" with blank screen for OS errors**. To enable this feature, use the Registry Editor:
-
- 1. Open Registry Editor (regedit).
- 1. Go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl`.
- 1. Create a **New** > **DWORD (32-bit) Value**. Enter `DisplayDisabled`, and set its value to `1`.
-
-- **Put device in "Tablet mode"**. If you want users to use the touch screen, without using a keyboard or mouse, then turn on tablet mode using the Settings app. If users won't interact with the kiosk, such as for a digital sign, then don't turn on this setting.
-
- Applies to Windows 10 only. Currently, Tablet mode isn't supported on Windows 11.
-
- Your options:
-
- - Use the **Settings** app:
- 1. Open the **Settings** app.
- 1. Go to **System** > **Tablet mode**.
- 1. Configure the settings you want.
-
- - Use the **Action Center**:
- 1. On your device, swipe in from the left.
- 1. Select **Tablet mode**.
-
-- **Hide "Ease of access" feature on the sign-in screen**: To enable this feature, you have the following options:
-
- - **Use an MDM provider**: In Intune, you can use the [Control Panel and Settings](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings) to manage this feature.
- - **Use the registry**: For more information, see [how to disable the Ease of Access button in the registry](/windows-hardware/customize/enterprise/complementary-features-to-custom-logon#welcome-screen).
-
-- **Disable the hardware power button**: To enable this feature, you have the following options:
-
- - **Use the Settings app**:
- 1. Open the **Settings** app.
- 1. Go to **System** > **Power & Sleep** > **Additional power settings** > **Choose what the power button does**.
- 1. Select **Do nothing**.
- 1. **Save changes**.
-
- - **Use Group Policy**: Your options:
-
- - `Computer Configuration\Administrative Templates\System\Power Management\Button Settings`: Set `Select Power Button Action on Battery` and `Select Power Button Action on Plugged In` to **Take no action**.
- - `User Configuration\Administrative Templates\Start Menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands`: This policy hides the buttons, but doesn't disable them.
- - `Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Shut down the system`: Remove the users or groups from this policy.
-
- To prevent this policy from affecting a member of the Administrators group, be sure to keep the Administrators group.
-
- - **Use an MDM provider**: In Intune, you have some options:
-
- - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following settings:
-
- - `Power\Select Power Button Action on Battery`: Set to **Take no action**.
- - `Power\Select Power Button Action on Plugged In`: Set to **Take no action**.
- - `Start\Hide Power Button`: Set to **Enabled**. This policy hides the button, but doesn't disable it.
-
- - [Administrative templates](/mem/intune/configuration/administrative-templates-windows): These templates are the administrative templates used in on-premises Group Policy. Configure the following setting:
-
- - `\Start menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands`: This policy hides the buttons, but doesn't disable them.
-
- When looking at settings, check the supported OS for each setting to make sure it applies.
-
- - [Start settings in a device configuration profile](/mem/intune/configuration/device-restrictions-windows-10#start): This option shows this setting, and all the Start menu settings you can manage.
-
-- **Remove the power button from the sign-in screen**. To enable this feature, you have the following options:
-
- - **Use Group Policy**: `Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Shutdown: Allow system to be shut down without having to log on`. Select **Disabled**.
-
- - **Use MDM**: In Intune, you have the following option:
-
- - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following setting:
-
- - `Local Policies Security Options\Shutdown Allow System To Be Shut Down Without Having To Log On`: Set to **Disabled**.
-
-- **Disable the camera**: To enable this feature, you have the following options:
-
- - **Use the Settings app**:
-
- 1. Open the **Settings** app.
- 1. Go to **Privacy** > **Camera**.
- 1. Select **Allow apps use my camera** > **Off**.
-
- - **Use Group Policy**: `Computer Configuration\Administrative Templates\Windows Components\Camera: Allow use of camera`: Select **Disabled**.
-
- - **Use an MDM provider**: This feature uses the [Policy CSP - Camera](/windows/client-management/mdm/policy-csp-camera). In Intune, you have the following options:
-
- - [General settings in a device configuration profile](/mem/intune/configuration/device-restrictions-windows-10#general): This option shows this setting, and more settings you can manage.
- - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following setting:
-
- - `Camera\Allow camera`: Set to **Not allowed**.
-
-- **Turn off app notifications on the lock screen**: To enable this feature, you have the following options:
-
- - **Use the Settings app**:
-
- 1. Open the **Settings** app.
- 1. Go to **System** > **Notifications & actions**.
- 1. In **Show notifications on the lock screen**, select **Off**.
-
- - **Use Group policy**:
- - `Computer Configuration\Administrative Templates\System\Logon\Turn off app notifications on the lock screen`: Select **Enabled**.
- - `User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen`: Select **Enabled**.
-
- - **Use an MDM provider**: This feature uses the [AboveLock/AllowToasts CSP](/windows/client-management/mdm/policy-csp-abovelock#abovelock-allowtoasts). In Intune, you have the following options:
-
- - [Locked screen experience device configuration profile](/mem/intune/configuration/device-restrictions-windows-10#locked-screen-experience): See this setting, and more settings you can manage.
-
- - [Administrative templates](/mem/intune/configuration/administrative-templates-windows): These templates are the administrative templates used in on-premises Group Policy. Configure the following settings:
-
- - `\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen`: Select **Enabled**.
- - `\System\Logon\Turn off app notifications on the lock screen`: Select **Enabled**.
-
- When looking at settings, check the supported OS for each setting to make sure it applies.
-
- - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following settings:
-
- - `\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen`: Select **Enabled**.
- - `\System\Logon\Turn off app notifications on the lock screen`: Select **Enabled**.
-
-- **Disable removable media**: To enable this feature, you have the following options:
- - **Use Group policy**: `Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions`. Review the available settings that apply to your situation.
- To prevent this policy from affecting a member of the Administrators group, select `Allow administrators to override Device Installation Restriction policies` > **Enabled**.
- - **Use an MDM provider**: In Intune, you have the following options:
- - [General settings in a device configuration profile](/mem/intune/configuration/device-restrictions-windows-10#general): See the **Removable storage** setting, and more settings you can manage.
- - [Administrative templates](/mem/intune/configuration/administrative-templates-windows): These templates are the administrative templates used in on-premises Group Policy. Configure the following settings:
- - `\System\Device Installation`: There are several policies you can manage, including restrictions in `\System\Device Installation\Device Installation Restrictions`.
- To prevent this policy from affecting a member of the Administrators group, select `Allow administrators to override Device Installation Restriction policies` > **Enabled**.
- When looking at settings, check the supported OS for each setting to make sure it applies.
- - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following settings:
- - `\Administrative Templates\System\Device Installation`: There are several policies you can manage, including restrictions in `\System\Device Installation\Device Installation Restrictions`.
- To prevent this policy from affecting a member of the Administrators group, select `Allow administrators to override Device Installation Restriction policies` > **Enabled**.
-
-## Enable logging
-
-Logs can help you [troubleshoot issues](/troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting) kiosk issues. Logs about configuration and runtime issues can be obtained by enabling the **Applications and Services Logs\Microsoft\Windows\AssignedAccess\Operational** channel, which is disabled by default.
-
-:::image type="content" source="images/enable-assigned-access-log.png" alt-text="On Windows client, open Event Viewer, right-click Operational, select enable log to turn on logging to help troubleshoot.":::
-
-## Automatic logon
-
-You may also want to set up **automatic logon** for your kiosk device. When your kiosk device restarts, from an update or power outage, you can sign in the assigned access account manually. Or, you can configure the device to sign in to the assigned access account automatically. Make sure that Group Policy settings applied to the device don't prevent automatic sign in.
-
-> [!NOTE]
-> If you are using a Windows client device restriction CSP to set "Preferred Microsoft Entra tenant domain", this will break the "User logon type" auto-login feature of the Kiosk profile.
-
-> [!TIP]
-> If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML.
-
-How to edit the registry to have an account sign in automatically:
-
-1. Open Registry Editor (regedit.exe).
-
- > [!NOTE]
- > If you are not familiar with Registry Editor, [learn how to modify the Windows registry](/troubleshoot/windows-server/performance/windows-registry-advanced-users).
-
-1. Go to
-
- **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon**
-
-1. Set the values for the following keys.
-
- - *AutoAdminLogon*: set value as **1**.
- - *DefaultUserName*: set value as the account that you want signed in.
- - *DefaultPassword*: set value as the password for the account.
-
- > [!NOTE]
- > If *DefaultUserName* and *DefaultPassword* aren't there, add them as **New** > **String Value**.
-
- - *DefaultDomainName*: set value for domain, only for domain accounts. For local accounts, don't add this key.
-
-1. Close Registry Editor. The next time the computer restarts, the account will sign in automatically.
-
-> [!TIP]
-> You can also configure automatic sign-in [using the Autologon tool from Sysinternals](/sysinternals/downloads/autologon).
-
-> [!NOTE]
-> If you are also using [Custom Logon](/windows-hardware/customize/enterprise/custom-logon) with **HideAutoLogonUI** enabled, you might experience a black screen after a password expires. We recommend that you consider [setting the password to never expire](/windows-hardware/customize/enterprise/troubleshooting-custom-logon#the-device-displays-a-black-screen-when-a-password-expiration-screen-is-displayed).
-
-## Interactions and interoperability
-
-The following table describes some features that have interoperability issues we recommend that you consider when running assigned access.
-
-- **Accessibility**: Assigned access doesn't change Ease of Access settings. We recommend that you use [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter) to block the following key combinations that bring up accessibility features:
-
- | Key combination | Blocked behavior |
- | --- | --- |
- | Left Alt + Left Shift + Print Screen | Open High Contrast dialog box. |
- | Left Alt + Left Shift + Num Lock | Open Mouse Keys dialog box. |
- | Windows logo key + U | Open Ease of Access Center. |
-
-- **Assigned access Windows PowerShell cmdlets**: In addition to using the Windows UI, you can use the Windows PowerShell cmdlets to set or clear assigned access. For more information, see [Assigned access Windows PowerShell reference](/powershell/module/assignedaccess/)
-
-- **Key sequences blocked by assigned access**: When in assigned access, some key combinations are blocked for assigned access users.
-
- Alt + F4, Alt + Shift + Tab, Alt + Tab aren't blocked by Assigned Access, it's recommended you use [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter) to block these key combinations.
-
- Ctrl + Alt + Delete is the key to break out of Assigned Access. If needed, you can use Keyboard Filter to configure a different key combination to break out of assigned access by setting BreakoutKeyScanCode as described in [WEKF_Settings](/windows-hardware/customize/enterprise/wekf-settings).
-
- | Key combination | Blocked behavior for assigned access users |
- | --- | --- |
- | Alt + Esc | Cycle through items in the reverse order from which they were opened. |
- | Ctrl + Alt + Esc | Cycle through items in the reverse order from which they were opened. |
- | Ctrl + Esc | Open the Start screen. |
- | Ctrl + F4 | Close the window. |
- | Ctrl + ShiftEsc | Open Task Manager. |
- | Ctrl + Tab | Switch windows within the application currently open. |
- | LaunchApp1 | Open the app that is assigned to this key. |
- | LaunchApp2 | Open the app that is assigned to this key. On many Microsoft keyboards, the app is Calculator. |
- | LaunchMail | Open the default mail client. |
- | Windows logo key | Open the Start screen. |
-
- Keyboard Filter settings apply to other standard accounts.
-
-- **Key sequences blocked by [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter)**: If Keyboard Filter is turned ON, then some key combinations are blocked automatically without you having to explicitly block them. For more information, see the [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter).
- [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter) is only available on Windows client Enterprise or Education.
-- **Power button**: Customizations for the Power button complement assigned access, letting you implement features such as removing the power button from the Welcome screen. Removing the power button ensures the user can't turn off the device when it's in assigned access.
- For more information on removing the power button or disabling the physical power button, see [Custom Logon](/windows-hardware/customize/enterprise/custom-logon).
-- **Unified Write Filter (UWF)**: UWFsettings apply to all users, including users with assigned access.
- For more information, see [Unified Write Filter](/windows-hardware/customize/enterprise/unified-write-filter).
-- **WEDL_AssignedAccess class**: You can use this class to configure and manage basic lockdown features for assigned access. It's recommended to you use the Windows PowerShell cmdlets instead.
- If you need to use assigned access API, see [WEDL_AssignedAccess](/windows-hardware/customize/enterprise/wedl-assignedaccess).
-- **Welcome Screen**: Customizations for the Welcome screen let you personalize not only how the Welcome screen looks, but for how it functions. You can disable the power or language button, or remove all user interface elements. There are many options to make the Welcome screen your own.
-
-For more information, see [Custom Logon](/windows-hardware/customize/enterprise/custom-logon).
-
-## Testing your kiosk in a virtual machine (VM)
-
-Customers sometimes use virtual machines (VMs) to test configurations before deploying those configurations to physical devices. If you use a VM to test your single-app kiosk configuration, you need to know how to connect to the VM properly.
-
-A single-app kiosk configuration runs an app above the lock screen. It doesn't work when it's accessed remotely, which includes *enhanced* sessions in Hyper-V.
-
-When you connect to a VM configured as a single-app kiosk, you need a *basic* session rather than an enhanced session. In the following image, notice that **Enhanced session** isn't selected in the **View** menu; that means it's a basic session.
-
-:::image type="content" source="images/vm-kiosk.png" alt-text="Use a basic session to connect a virtual machine. In the View menu, Extended session isn't selected, which means basic is used.":::
-
-To connect to a VM in a basic session, don't select **Connect** in the connection dialog, as shown in the following image, but instead, select the **X** button in the upper-right corner to cancel the dialog:
-
-:::image type="content" source="images/vm-kiosk-connect.png" alt-text="Don't select the connect button. Use the close X in the top corner to connect to a VM in basic session.":::
diff --git a/windows/configuration/kiosk/kiosk-shelllauncher.md b/windows/configuration/kiosk/kiosk-shelllauncher.md
deleted file mode 100644
index 0b6209673e..0000000000
--- a/windows/configuration/kiosk/kiosk-shelllauncher.md
+++ /dev/null
@@ -1,273 +0,0 @@
----
-title: Use Shell Launcher to create a kiosk experience
-description: Learn how to configure Shell Launcher to change the default Windows shell when a user signs in to a device.
-ms.topic: how-to
-ms.date: 12/31/2017
----
-
-# Use Shell Launcher to create a Windows client kiosk
-
-Shell Launcher is a Windows feature that executes an application as the user interface, replacing the default Windows Explorer (`explorer.exe`).
-
->[!NOTE]
->Shell Launcher controls which application the user sees as the shell after sign-in. It doesn't prevent the user from accessing other desktop applications and system components.
->
->Methods of controlling access to other desktop applications and system components can be used in addition to using the Shell Launcher. These methods include, but are not limited to:
->- [Group Policy](https://www.microsoft.com/download/details.aspx?id=25250) - example: Prevent access to registry editing tools
->- [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview) - Application control policies
->- [Mobile Device Management](/windows/client-management/mdm) - Enterprise management of device security policies
-
-You can apply a custom shell through Shell Launcher [by using PowerShell](#configure-a-custom-shell-using-powershell). Starting with Windows 10 version 1803+, you can also [use mobile device management (MDM)](#configure-a-custom-shell-in-mdm) to apply a custom shell through Shell Launcher.
-
-Shell Launcher replaces `explorer.exe` with `customshellhost.exe`. This executable file can launch a Windows desktop application or a UWP app.
-
-In addition to allowing you to use a UWP app for your replacement shell, Shell Launcher v2 offers additional enhancements:
-
-- You can use a custom Windows desktop application that can then launch UWP apps, such as **Settings** and **Touch Keyboard**.
-- From a custom UWP shell, you can launch secondary views and run on multiple monitors.
-- The custom shell app runs in full screen, and can run other apps in full screen on user's demand.
-
-For sample XML configurations for the different app combinations, see [Samples for Shell Launcher v2](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2).
-
-## Requirements
-
->[!WARNING]
->
->- Windows 10 doesn't support setting a custom shell prior to OOBE. If you do, you won't be able to deploy the resulting image.
->- Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you cannot specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher is not aware of the newly created wordpad.exe process, Shell Launcher will take action based on the exit code of **Write.exe**, such as restarting the custom shell.
-
-- A domain, Microsoft Entra ID, or local user account.
-- A Windows application that is installed for that account. The app can be your own company application or a common app like Internet Explorer.
-
-[See the technical reference for the shell launcher component.](/windows-hardware/customize/enterprise/shell-launcher)
-
-## Enable Shell Launcher feature
-
-To set a custom shell, you first turn on the Shell Launcher feature, and then you can set your custom shell as the default using PowerShell or MDM.
-
-**To turn on Shell Launcher in Windows features**
-
-1. Go to Control Panel > **Programs and features** > **Turn Windows features on or off**.
-1. Expand **Device Lockdown**.
-1. Select **Shell Launcher** and **OK**.
-
-Alternatively, you can turn on Shell Launcher using Windows Configuration Designer in a provisioning package, using `SMISettings > ShellLauncher`, or you can use the Deployment Image Servicing and Management (DISM.exe) tool.
-
-**To turn on Shell Launcher using DISM**
-
-1. Open a command prompt as an administrator.
-1. Enter the following command.
-
- ```
- Dism /online /Enable-Feature /all /FeatureName:Client-EmbeddedShellLauncher
- ```
-
-## Configure a custom shell in MDM
-
-You can use XML and a [custom OMA-URI setting](#custom-oma-uri-setting) to configure Shell Launcher in MDM.
-
-### XML for Shell Launcher configuration
-
-The following XML sample works for **Shell Launcher v1**:
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-
-For **Shell Launcher v2**, you can use UWP app type for `Shell` by specifying the v2 namespace, and use `v2:AppType` to specify the type, as shown in the following example. If `v2:AppType` isn't specified, it implies the shell is Win32 app.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-```
-
->[!TIP]
->In the XML for Shell Launcher v2, note the **AllAppsFullScreen** attribute. When set to **True**, Shell Launcher will run every app in full screen, or maximized for desktop apps. When this attribute is set to **False** or not set, only the custom shell app runs in full screen; other apps launched by the user will run in windowed mode.
-
-[Get XML examples for different Shell Launcher v2 configurations.](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2)
-
-### Custom OMA-URI setting
-
-In your MDM service, you can create a [custom OMA-URI setting](/intune/custom-settings-windows-10) to configure Shell Launcher v1 or v1. (The [XML](#xml-for-shell-launcher-configuration) that you use for your setting determines whether you apply Shell Launcher v1 or v2.)
-
-The OMA-URI path is `./Device/Vendor/MSFT/AssignedAccess/ShellLauncher`.
-
-For the value, you can select data type `String` and paste the desired configuration file content into the value box. If you wish to upload the xml instead of pasting the content, choose data type `String (XML file)`.
-
-
-
-After you configure the profile containing the custom Shell Launcher setting, select **All Devices** or selected groups of devices to apply the profile to. Don't assign the profile to users or user groups.
-
-## Configure a custom shell using PowerShell
-
-For scripts for Shell Launcher v2, see [Shell Launcher v2 Bridge WMI sample scripts](https://github.com/Microsoft/Windows-iotcore-samples/blob/develop/Samples/ShellLauncherV2/SampleBridgeWmiScripts/README.md).
-
-For Shell Launcher v1, modify the following PowerShell script as appropriate. The comments in the sample script explain the purpose of each section and tell you where you'll want to change the script for your purposes. Save your script with the extension.ps1, open Windows PowerShell as administrator, and run the script on the kiosk device.
-
-```powershell
-# Check if shell launcher license is enabled
-function Check-ShellLauncherLicenseEnabled
-{
- [string]$source = @"
-using System;
-using System.Runtime.InteropServices;
-
-static class CheckShellLauncherLicense
-{
- const int S_OK = 0;
- public static bool IsShellLauncherLicenseEnabled()
- {
- int enabled = 0;
- if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) {
- enabled = 0;
- }
- return (enabled != 0);
- }
- static class NativeMethods
- {
- [DllImport("Slc.dll")]
- internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value);
- }
-}
-"@
- $type = Add-Type -TypeDefinition $source -PassThru
- return $type[0]::IsShellLauncherLicenseEnabled()
-}
-
-[bool]$result = $false
-
-$result = Check-ShellLauncherLicenseEnabled
-"`nShell Launcher license enabled is set to " + $result
-if (-not($result))
-{
- "`nThis device doesn't have required license to use Shell Launcher"
- exit
-}
-
-$COMPUTER = "localhost"
-$NAMESPACE = "root\standardcimv2\embedded"
-
-# Create a handle to the class instance so we can call the static methods.
-try {
- $ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting"
- } catch [Exception] {
- write-host $_.Exception.Message;
-
- write-host "Make sure Shell Launcher feature is enabled"
- exit
- }
-
-# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group.
-
-$Admins_SID = "S-1-5-32-544"
-
-# Create a function to retrieve the SID for a user account on a machine.
-
-function Get-UsernameSID($AccountName) {
-
- $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName)
- $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier])
-
- return $NTUserSID.Value
-
-}
-
-# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script.
-
-$Cashier_SID = Get-UsernameSID("Cashier")
-
-# Define actions to take when the shell program exits.
-
-$restart_shell = 0
-$restart_device = 1
-$shutdown_device = 2
-
-# Examples. You can change these examples to use the program that you want to use as the shell.
-# This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed.
-
-$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device)
-
-# Display the default shell to verify that it was added correctly.
-
-$DefaultShellObject = $ShellLauncherClass.GetDefaultShell()
-
-"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction
-
-# Set Internet Explorer as the shell for "Cashier", and restart the machine if Internet Explorer is closed.
-
-$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell)
-
-# Set Explorer as the shell for administrators.
-
-$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe")
-
-# View all the custom shells defined.
-
-"`nCurrent settings for custom shells:"
-Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction
-
-# Enable Shell Launcher
-
-$ShellLauncherClass.SetEnabled($TRUE)
-$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
-"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
-
-# Remove the new custom shells.
-
-$ShellLauncherClass.RemoveCustomShell($Admins_SID)
-$ShellLauncherClass.RemoveCustomShell($Cashier_SID)
-
-# Disable Shell Launcher
-
-$ShellLauncherClass.SetEnabled($FALSE)
-$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
-"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
-```
-
-## default action, custom action, exit code
-
-Shell launcher defines four actions to handle app exits, you can customize shell launcher and use these actions based on different exit code.
-
-| Value | Description |
-|--|--|
-| 0 | Restart the shell |
-| 1 | Restart the device |
-| 2 | Shut down the device |
-| 3 | Do nothing |
-
-These actions can be used as default action, or can be mapped to a specific exit code. Refer to [Shell Launcher](/windows-hardware/customize/enterprise/wesl-usersettingsetcustomshell) to see how these codes with Shell Launcher WMI.
-
-To configure these actions with Shell Launcher CSP, use below syntax in the shell launcher configuration xml. You can specify at most four custom actions mapping to four exit codes, and one default action for all other exit codes. When app exits and if the exit code is not found in the custom action mapping, or there is no default action defined, it will be no-op, i.e. nothing happens. So it's recommended to at least define DefaultAction. [Get XML examples for different Shell Launcher v2 configurations.](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2)
-
-``` xml
-
-
-
-
-
-
-
-
-```
diff --git a/windows/configuration/kiosk/kiosk-single-app.md b/windows/configuration/kiosk/kiosk-single-app.md
deleted file mode 100644
index 688758b856..0000000000
--- a/windows/configuration/kiosk/kiosk-single-app.md
+++ /dev/null
@@ -1,330 +0,0 @@
----
-title: Set up a single-app kiosk on Windows
-description: A single-use device is easy to set up in Windows Pro, Enterprise, and Education editions.
-ms.topic: article
-ms.collection:
- - tier1
-ms.date: 07/12/2023
----
-
-
-# Set up a single-app kiosk
-
-A single-app kiosk uses the Assigned Access feature to run a single app above the lock screen. When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app.
-
-
-
->[!IMPORTANT]
->[User account control (UAC)](/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode.
->
->Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. Apps that run in kiosk mode cannot use copy and paste.
-
-You have several options for configuring your single-app kiosk.
-
-- Locally, in Settings: The **Set up a kiosk** (previously named **Set up assigned access**) option in **Settings** is a quick and easy method to set up a single device as a kiosk for a local standard user account.
-
- This option supports:
-
- - Windows 10 Pro, Enterprise, and Education
- - Windows 11
-
-- PowerShell: You can use Windows PowerShell cmdlets to set up a single-app kiosk. First, you need to [create the user account](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) on the device and install the kiosk app for that account.
-
- This option supports:
-
- - Windows 10 Pro, Enterprise, and Education
- - Windows 11
-
-- The kiosk wizard in Windows Configuration Designer: Windows Configuration Designer is a tool that produces a *provisioning package*. A provisioning package includes configuration settings that can be applied to one or more devices during the first-run experience (OOBE), or after OOBE is done (runtime). Using the kiosk wizard, you can also create the kiosk user account, install the kiosk app, and configure more useful settings.
-
- This option supports:
-
- - Windows 10 Pro version 1709+, Enterprise, and Education
- - Windows 11
-
-- Microsoft Intune or other mobile device management (MDM) provider: For devices managed by your organization, you can use MDM to set up a kiosk configuration.
-
- This option supports:
-
- - Windows 10 Pro version 1709+, Enterprise, and Education
- - Windows 11
-
-> [!TIP]
-> You can also configure a kiosk account and app for single-app kiosk within [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) by using a [kiosk profile](lock-down-windows-10-to-specific-apps.md#profile).
-
->
-> Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk.
-
-## Set up a kiosk in local Settings
-
-App type:
-
-- UWP
-
-OS:
-
-- Windows 10 Pro, Ent, Edu
-- Windows 11
-
-Account type:
-
-- Local standard user
-
-You can use **Settings** to quickly configure one or a few devices as a kiosk.
-
-When your kiosk is a local device that isn't managed by Active Directory or Microsoft Entra ID, there is a default setting that enables automatic sign-in after a restart. That means that when the device restarts, the last signed-in user will be signed in automatically. If the last signed-in user is the kiosk account, the kiosk app will be launched automatically after the device restarts.
-
-- If you want the kiosk account to sign in automatically, and the kiosk app launched when the device restarts, then you don't need to do anything.
-
-- If you don't want the kiosk account to sign in automatically when the device restarts, then you must change the default setting before you configure the device as a kiosk. Sign in with the account that you will assign as the kiosk account. Open the **Settings** app > **Accounts** > **Sign-in options**. Set the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device.
-
- 
-
-### Windows 10 version 1809+ / Windows 11
-
-When you set up a kiosk (also known as *assigned access*) in **Settings** for Windows client, you create the kiosk user account at the same time. To set up assigned access in PC settings:
-
-Open the **Settings** app > **Accounts**. Select **Other users** or **Family and other users**.
-
-1. Select **Set up a kiosk > Assigned access**, and then select **Get started**.
-
-1. Enter a name for the new account.
-
- >[!NOTE]
- >If there are any local standard user accounts on the device already, the **Create an account** page will offer the option to **Choose an existing account**.
-
-1. Choose the app that will run when the kiosk account signs in. Only apps that can run above the lock screen will be available in the list of apps to choose from. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). If you select **Microsoft Edge** as the kiosk app, you configure the following options:
-
- - Whether Microsoft Edge should display your website full-screen (digital sign) or with some browser controls available (public browser)
- - Which URL should be displayed when the kiosk accounts signs in
- - When Microsoft Edge should restart after a period of inactivity (if you select to run as a public browser)
-
-1. Select **Close**.
-
-To remove assigned access, select the account tile on the **Set up a kiosk** page, and then select **Remove kiosk**.
-
-### Windows 10 version 1803 and earlier
-
-When you set up a kiosk (also known as *assigned access*) in **Settings** for Windows 10 version 1803 and earlier, you must select an existing local standard user account. [Learn how to create a local standard user account.](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10)
-
-
-
-To set up assigned access in PC settings:
-
-1. Go to **Start** > **Settings** > **Accounts** > **Other people**.
-1. Select **Set up assigned access**.
-1. Choose an account.
-1. Choose an app. Only apps that can run above the lock screen will be available in the list of apps to choose from. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md).
-1. Close **Settings** - your choices are saved automatically, and will be applied the next time that user account signs in.
-To remove assigned access, choose **Turn off assigned access and sign out of the selected account**.
-
-## Set up a kiosk using Windows PowerShell
-
-App type:
-
-- UWP
-
-OS:
-
-- Windows 10 Pro, Ent, Edu
-- Windows 11
-
-Account type:
-
-- Local standard user
-
-
-
-You can use any of the following PowerShell cmdlets to set up assigned access on multiple devices.
-
-Before you run the cmdlet:
-
-1. Sign in as administrator.
-1. [Create the user account](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) for Assigned Access.
-1. Sign in as the Assigned Access user account.
-1. Install the Universal Windows app that follows the assigned access/above the lock guidelines.
-1. Sign out as the Assigned Access user account.
-1. Sign in as administrator.
-
-To open PowerShell on Windows client, search for PowerShell, and find **Windows PowerShell Desktop app** in the results. Run PowerShell as administrator.
-
-- **Configure assigned access by AppUserModelID and user name**: `Set-AssignedAccess -AppUserModelId -UserName `
-- **Configure assigned access by AppUserModelID and user SID**: `Set-AssignedAccess -AppUserModelId -UserSID `
-- **Configure assigned access by app name and user name**: `Set-AssignedAccess -AppName -UserName `
-- **Configure assigned access by app name and user SID**: `Set-AssignedAccess -AppName -UserSID `
-
-> [!NOTE]
-> To set up assigned access using `-AppName`, the user account that you enter for assigned access must have signed in at least once.
-
-[Learn how to get the AUMID](./find-the-application-user-model-id-of-an-installed-app.md).
-
-[Learn how to get the AppName](/powershell/module/assignedaccess/set-assignedaccess) (see **Parameters**).
-
-To remove assigned access, using PowerShell, run the following cmdlet:
-
-```powershell
-Clear-AssignedAccess
-```
-
-## Set up a kiosk using the kiosk wizard in Windows Configuration Designer
-
-App type:
-
-- UWP
-- Windows desktop application
-
-OS:
-
-- Windows 10 Pro version 1709+ for UWP only
-- Windows 10 Ent, Edu for UWP and Windows desktop applications
-- Windows 11
-
-Account type:
-
-- Local standard user
-- Active Directory
-
-
-
->[!IMPORTANT]
->When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon).
-
-When you use the **Provision kiosk devices** wizard in Windows Configuration Designer, you can configure the kiosk to run either a Universal Windows app or a Windows desktop application.
-
-[Install Windows Configuration Designer](../provisioning-packages/provisioning-install-icd.md), then open Windows Configuration Designer and select **Provision kiosk devices**. After you name your project, and select **Next**, configure the following settings:
-
-1. Enable device setup:
-
- :::image type="content" source="images/set-up-device-details.png" alt-text="In Windows Configuration Designer, enable device setup, enter the device name, the product key to upgrade, turn off shared use, and remove preinstalled software.":::
-
- If you want to enable device setup, select **Set up device**, and configure the following settings:
-
- - **Device name**: Required. Enter a unique 15-character name for the device. You can use variables to add unique characters to the name, such as `Contoso-%SERIAL%` and `Contoso-%RAND:5%`.
- - **Enter product key**: Optional. Select a license file to upgrade Windows client to a different edition. For more information, see [the permitted upgrades](/windows/deployment/upgrade/windows-10-edition-upgrades).
- - **Configure devices for shared use**: This setting optimizes Windows client for shared use scenarios, and isn't necessary for a kiosk scenario. Set this value to **No**, which may be the default.
- - **Remove pre-installed software**: Optional. Select **Yes** if you want to remove preinstalled software.
-
-1. Set up the network:
-
- :::image type="content" source="images/set-up-network-details.png" alt-text="In Windows Configuration Designer, turn on wireless connectivity, enter the network SSID, and network type.":::
-
- If you want to enable network setup, select **Set up network**, and configure the following settings:
-
- - **Set up network**: To enable wireless connectivity, select **On**.
- - **Network SSID**: Enter the Service Set Identifier (SSID) of the network.
- - **Network type**: Select **Open** or **WPA2-Personal**. If you select **WPA2-Personal**, enter the password for the wireless network.
-
-1. Enable account management:
-
- :::image type="content" source="images/account-management-details.png" alt-text="In Windows Configuration Designer, join Active Directory, Microsoft Entra ID, or create a local admin account.":::
-
- If you want to enable account management, select **Account Management**, and configure the following settings:
-
- - **Manage organization/school accounts**: Choose how devices are enrolled. Your options:
- - **Active Directory**: Enter the credentials for a least-privileged user account to join the device to the domain.
- - **Microsoft Entra ID**: Before you use a Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment, [set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Microsoft Entra tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used.
-
- If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions.
-
- You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards.
-
- - **Local administrator**: If you select this option, enter a user name and password. If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password isn't changed during that period, the account might be locked out, and unable to sign in.
-
-1. Add applications:
-
- :::image type="content" source="images/add-applications-details.png" alt-text="In Windows Configuration Designer, add an application that will run in kiosk mode.":::
-
- To add applications to the devices, select **Add applications**. You can install multiple applications in a provisioning package, including Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps. The settings in this step vary depending on the application you select. For help with the settings, see [Provision PCs with apps](../provisioning-packages/provision-pcs-with-apps.md).
-
- > [!WARNING]
- > If you select the plus button to add an application, you must enter an application for the provisioning package to validate. If you select the plus button by mistake, then:
- >
- > 1. In **Installer Path**, select any executable file.
- > 1. When the **Cancel** button shows, select it.
- >
- > These steps let you complete the provisioning package without adding an application.
-
-1. Add certificates:
-
- :::image type="content" source="images/add-certificates-details.png" alt-text="In Windows Configuration Designer, add a certificate.":::
-
- To add a certificate to the devices, select **Add certificates**, and configure the following settings:
-
- - **Certificate name**: Enter a name for the certificate.
- - **Certificate path**: Browse and select the certificate you want to add.
-
-1. Configure the kiosk account, and the kiosk mode app:
-
- :::image type="content" source="images/kiosk-account-details.png" alt-text="In Windows Configuration Designer, the Configure kiosk common settings button is shown when provisioning a kiosk device.":::
-
- To add the account that runs the app and choose the app type, select **Configure kiosk account and app**, and configure the following settings:
-
- - **Create a local standard user account to run the kiosk mode app**: Select **Yes** to create a local standard user account, and enter the **User name** and **Password**. This user account runs the app. If you select **No**, make sure you have an existing user account to run the kiosk app.
- - **Auto sign-in**: Select **Yes** to automatically sign in the account when the device starts. **No** doesn't automatically sign in the account. If there are issues with auto sign-in after you apply the provisioning package, then check the Event Viewer logs for auto logon issues (`Applications and Services Logs\Microsoft\Windows\Authentication User Interface\Operational`).
- - **Configure the kiosk mode app**: Enter the **User name** of the account that will run the kiosk mode app. In **App type**, select the type of app to run. Your options:
- - **Windows desktop application**: Enter the path or filename. If the file path is in the PATH environment variable, then you can use the filename. Otherwise, the full path is required.
- - **Universal Windows app**: Enter the AUMID.
-
-1. Configure kiosk common settings:
-
- :::image type="content" source="images/kiosk-common-details.png" alt-text="In Windows Configuration Designer, set tablet mode, configure the welcome and shutdown screens, and turn off the power timeout settings.":::
-
- To configure the tablet mode, configure welcome and shutdown screens, and set the power settings, select **Configure kiosk common settings**, and configure the following settings:
-
- - **Set tablet mode**
- - **Customize user experience**
- - **Configure power settings**
-
-1. Finish:
-
- :::image type="content" source="images/finish-details.png" alt-text="In Windows Configuration Designer, protect your package with a password.":::
-
- To complete the wizard, select **Finish**, and configure the following setting:
-
- - **Protect your package**: Select **Yes** to password protect your provisioning package. When you apply the provisioning package to a device, you must enter this password.
-
->[!NOTE]
->If you want to use [the advanced editor in Windows Configuration Designer](../provisioning-packages/provisioning-create-package.md#configure-settings), specify the user account and app (by AUMID) in **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings**
-
->[!IMPORTANT]
->When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
-
-[Learn how to apply a provisioning package.](../provisioning-packages/provisioning-apply-package.md)
-
-## Set up a kiosk or digital sign using Microsoft Intune or other MDM service
-
-App type:
-
-- UWP
-
-OS:
-
-- Windows 10 Pro version 1709+, Ent, Edu
-- Windows 11
-
-Account type:
-
-- Local standard user
-- Microsoft Entra ID
-
-Microsoft Intune and other MDM services enable kiosk configuration through the [AssignedAccess configuration service provider (CSP)](/windows/client-management/mdm/assignedaccess-csp). Assigned Access has a `KioskModeApp` setting. In the `KioskModeApp` setting, you enter the user account name and the [AUMID](/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the app to run in kiosk mode.
-
->[!TIP]
->A ShellLauncher node has been added to the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp).
-
-To configure a kiosk in Microsoft Intune, see [Windows client and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](/intune/kiosk-settings). For other MDM services, see the documentation for your provider.
-
-## Sign out of assigned access
-
-To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the sign in screen timeout, the kiosk app relaunches. The assigned access user will remain signed in until an admin account opens **Task Manager** > **Users** and signs out the user account.
-
-If you press **Ctrl + Alt + Del** and do not sign in to another account, after a set time, assigned access will resume. The default time is 30 seconds, but you can change that in the following registry key:
-
-`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI`
-
-To change the default time for assigned access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal.
-
-> [!NOTE]
-> **IdleTimeOut** doesn't apply to the new Microsoft Edge kiosk mode.
-
-The Breakout Sequence of **Ctrl + Alt + Del** is the default, but this sequence can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence would look something like **Shift + Alt + a**, where **Shift** and **Alt** are the modifiers and **a** is the key value. For more information, see [Microsoft Edge kiosk XML sample](/windows/configuration/kiosk-xml#microsoft-edge-kiosk-xml-sample).
diff --git a/windows/configuration/kiosk/kiosk-validate.md b/windows/configuration/kiosk/kiosk-validate.md
deleted file mode 100644
index eb3259d185..0000000000
--- a/windows/configuration/kiosk/kiosk-validate.md
+++ /dev/null
@@ -1,83 +0,0 @@
----
-title: Validate kiosk configuration
-description: In this article, learn what to expect on a multi-app kiosk in Windows 10/11 Pro, Enterprise, and Education.
-
-ms.topic: article
-ms.date: 12/31/2017
----
-
-# Validate kiosk configuration
-
-To identify the provisioning packages applied to a device, go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device.
-
-Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**.
-
-To test the kiosk, sign in with the assigned access user account you specified in the configuration to check out the multi-app experience.
-
->[!NOTE]
->The kiosk configuration setting will take effect the next time the assigned access user signs in. If that user account is signed in when you apply the configuration, make sure the user signs out and signs back in to validate the experience.
-
-The following sections explain what to expect on a multi-app kiosk.
-
-### App launching and switching experience
-
-In the multi-app mode, to maximize the user productivity and streamline the experience, an app will be always launched in full screen when the users click the tile on the Start. The users can minimize and close the app, but cannot resize the app window.
-
-The users can switch apps just as they do today in Windows. They can use the Task View button, Alt + Tab hotkey, and the swipe in from the left gesture to view all the open apps in task view. They can click the Windows button to show Start, from which they can open apps, and they can switch to an opened app by clicking it on the taskbar.
-
-### Start changes
-
-When the assigned access user signs in, you should see a restricted Start experience:
-- Start gets launched in full screen and prevents the end user from accessing the desktop.
-
-- Start shows the layout aligned with what you defined in the multi-app configuration XML.
-
-- Start prevents the end user from changing the tile layout.
- - The user cannot resize, reposition, and unpin the tiles.
- - The user cannot pin additional tiles on the start.
-- Start hides **All Apps** list.
-- Start hides all the folders on Start (including File Explorer, Settings, Documents, Downloads, Music, Pictures, Videos, HomeGroup, Network, and Personal folders).
-- Only **User** and **Power** buttons are available. (You can control whether to show the **User/Power** buttons using [existing policies](/windows/client-management/mdm/policy-csp-start).)
-- Start hides **Change account settings** option under **User** button.
-
-### Taskbar changes
-
-If the applied multi-app configuration enables taskbar, when the assigned access user signs in, you should see a restricted Taskbar experience:
-
-- Disables context menu of Start button (Quick Link)
-- Disables context menu of taskbar
-- Prevents the end user from changing the taskbar
-- Disables Cortana and Search Windows
-- Hides notification icons and system icons, e.g. Action Center, People, Windows Ink Workspace
-- Allows the end user to view the status of the network connection and power state, but disables the flyout of **Network/Power** to prevent end user from changing the settings
-
-### Blocked hotkeys
-
-The multi-app mode blocks the following hotkeys, which are not relevant for the lockdown experience.
-
-| Hotkey | Action |
-| --- | --- |
-| Windows logo key + A | Open Action center |
-| Windows logo key + Shift + C | Open Cortana in listening mode |
-| Windows logo key + D | Display and hide the desktop |
-| Windows logo key + Alt + D | Display and hide the date and time on the desktop |
-| Windows logo key + E | Open File Explorer |
-| Windows logo key + F | Open Feedback Hub |
-| Windows logo key + G | Open Game bar when a game is open |
-| Windows logo key + I | Open Settings |
-| Windows logo key + J | Set focus to a Windows tip when one is available. |
-| Windows logo key + O | Lock device orientation |
-| Windows logo key + Q | Open search |
-| Windows logo key + R | Open the Run dialog box |
-| Windows logo key + S | Open search |
-| Windows logo key + X | Open the Quick Link menu |
-| Windows logo key + comma (,) | Temporarily peek at the desktop |
-| Windows logo key + Ctrl + F | Search for PCs (if you're on a network) |
-
-### Locked-down Ctrl+Alt+Del screen
-
-The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience.
-
-### Auto-trigger touch keyboard
-
-In the multi-app mode, the touch keyboard will be automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don't need to configure any other setting to enforce this behavior.
diff --git a/windows/configuration/kiosk/kiosk-xml.md b/windows/configuration/kiosk/kiosk-xml.md
deleted file mode 100644
index dc2c2a62b2..0000000000
--- a/windows/configuration/kiosk/kiosk-xml.md
+++ /dev/null
@@ -1,952 +0,0 @@
----
-title: Assigned Access configuration kiosk XML reference
-description: Learn about the assigned access configuration (kiosk) for XML and XSD for kiosk device configuration in Windows 10/11.
-
-ms.topic: article
-ms.date: 12/31/2017
----
-
-# Assigned Access configuration (kiosk) XML reference
-
-## Full XML sample
-
->[!NOTE]
->Updated for Windows 10, version 1903, 1909, and 2004.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
- domain\account
-
-
-
- AzureAD\john@contoso.onmicrosoft.com
-
-
-
- localaccount
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-
-## Kiosk only sample XML
-
-```xml
-
-
-
-
-
-
-
-
-
- singleappuser
-
-
-
-
-```
-
-## Auto Launch Sample XML
-
-This sample demonstrates that both UWP and Win32 apps can be configured to automatically launch, when assigned access account logs in. One profile can have at most one app configured for auto launch. AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
- aauser1
-
-
-
- aauser2
-
-
-
-
-
-```
-
-## Microsoft Edge Kiosk XML Sample
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
- EdgeKioskUser
-
-
-
-
-```
-
-## Global Profile Sample XML
-
-Global Profile is supported on:
-
-- Windows 11
-- Windows 10, version 2004 and later
-
-Global Profile is designed for scenarios where a user doesn't have a designated profile, yet you still want the user to run in lockdown mode. It's also used as mitigation when a profile can't be determined for a user.
-
-This sample demonstrates that only a global profile is used, with no active user configured. Global Profile will be applied when every non-admin account signs in.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-```
-
-Below sample shows dedicated profile and global profile mixed usage, a user would use one profile, everyone else that's non-admin will use another profile.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
- aauser
-
-
-
-
-
-```
-
-## Folder Access sample xml
-
-Starting with Windows 10 version 1809 +, folder access is locked down so that when common file dialog is opened, IT Admin can specify if the user has access to the Downloads folder, or no access to any folder at all. This restriction has been redesigned for finer granularity and easier use, and is available in Windows 10 version 2009+.
-
-IT Admin now can specify user access to Downloads folder, Removable drives, or no restrictions at all. Downloads and Removable Drives can be allowed at the same time.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
- multi1
-
-
-
- multi2
-
-
-
- multi3
-
-
-
- multi4
-
-
-
- multi5
-
-
-
- multi6
-
-
-
-
-
-```
-
-## XSD for AssignedAccess configuration XML
-
-> [!NOTE]
-> Updated for Windows 10, version 1903 and later.
-
-The following XML schema is for AssignedAccess Configuration up to Windows 10, version 1803 release:
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-
-The following XML is the schema for new features introduced in Windows 10 1809 release:
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-
-The following XML is the schema for Windows 10 version 1909+:
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-
-To authorize a compatible configuration XML that includes elements and attributes from Windows 10 version 1809 or newer / Windows 11, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias.
-
-For example, to configure the autolaunch feature that was added in Windows 10 version 1809 / Windows 11, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10 version 1809 / Windows 11, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline.
-
-```xml
-
-
-
-
-
-
-```
diff --git a/windows/configuration/kiosk/lock-down-windows-10-applocker.md b/windows/configuration/kiosk/lock-down-windows-10-applocker.md
deleted file mode 100644
index 2781e1b640..0000000000
--- a/windows/configuration/kiosk/lock-down-windows-10-applocker.md
+++ /dev/null
@@ -1,97 +0,0 @@
----
-title: Use AppLocker to create a Windows 10 kiosk that runs multiple apps
-description: Learn how to use AppLocker to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps.
-appliesto:
-- ✅ Windows 10
-ms.date: 07/30/2018
-ms.topic: article
----
-
-# Use AppLocker to create a Windows 10 kiosk that runs multiple apps
-
-Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education, version 1703 and earlier, so that users can only run a few specific apps. The result is similar to [a kiosk device](./kiosk-methods.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings.
-
->[!NOTE]
->For devices running Windows 10, version 1709, we recommend the [multi-app kiosk method](lock-down-windows-10-to-specific-apps.md).
-
-You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device.
-
-AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref).
-
-This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy.
-
-
-
-## Install apps
-
-First, install the desired apps on the device for the target user account(s). This works for both Unified Windows Platform (UWP) apps and Windows desktop apps. For UWP apps, you must log on as that user for the app to install. For desktop apps, you can install an app for all users without logging on to the particular account.
-
-## Use AppLocker to set rules for apps
-
-After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else.
-
-1. Run Local Security Policy (secpol.msc) as an administrator.
-1. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**.
-
- 
-
-1. Check **Configured** under **Executable rules**, and then click **OK**.
-1. Right-click **Executable Rules** and then click **Automatically generate rules**.
-
- 
-
-1. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps.
-1. Type a name to identify this set of rules, and then click **Next**.
-1. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules.
-1. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps.
-1. Read the message and click **Yes**.
-
- 
-
-1. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users.
-1. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**.
-1. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run:
-
- ``` syntax
- sc config appidsvc start=auto
- ```
-
-1. Restart the device.
-
-## Other settings to lock down
-
-In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device:
-
-- Remove **All apps**.
-
- Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**.
-
-- Hide **Ease of access** feature on the logon screen.
-
- Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools.
-
-- Disable the hardware power button.
-
- Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**.
-
-- Disable the camera.
-
- Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**.
-
-- Turn off app notifications on the lock screen.
-
- Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**.
-
-- Disable removable media.
-
- Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation.
-
- **Note**
-
- To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**.
-
-To learn more about locking down features, see [Customizations for Windows 10 Enterprise](/windows-hardware/customize/enterprise/enterprise-custom-portal).
-
-## Customize Start screen layout for the device (recommended)
-
-Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](../start/windows-10-start-layout-options-and-policies.md).
diff --git a/windows/configuration/kiosk/lock-down-windows-10-to-specific-apps.md b/windows/configuration/kiosk/lock-down-windows-10-to-specific-apps.md
deleted file mode 100644
index 43646ca390..0000000000
--- a/windows/configuration/kiosk/lock-down-windows-10-to-specific-apps.md
+++ /dev/null
@@ -1,660 +0,0 @@
----
-title: Set up a multi-app kiosk on Windows 10
-description: Learn how to configure a kiosk device running Windows 10 so that users can only run a few specific apps.
-ms.topic: how-to
-ms.date: 11/08/2023
----
-
-# Set up a multi-app kiosk on Windows 10 devices
-
-> [!NOTE]
-> The use of multiple monitors isn't supported for multi-app kiosk mode in Windows 10.
-
-A [kiosk device](./kiosk-single-app.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. The benefit of a kiosk that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access.
-
-The following table lists changes to multi-app kiosk in recent updates.
-
-| New features and improvements | In update |
-| --- | ---|
-| - Configure [a single-app kiosk profile](#profile) in your XML file
- Assign [group accounts to a config profile](#config-for-group-accounts)
- Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 |
-| - Explicitly allow [some known folders when user opens file dialog box](#fileexplorernamespacerestrictions)
- [Automatically launch an app](#allowedapps) when the user signs in
- Configure a [display name for the autologon account](#config-for-autologon-account) | Windows 10, version 1809
**Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `https://schemas.microsoft.com/AssignedAccess/201810/config`. |
-
-> [!WARNING]
-> The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access.
-
-You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provisioning package](#provision).
-
-> [!TIP]
-> Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk.
-
-
-
-## Configure a kiosk in Microsoft Intune
-
-To configure a kiosk in Microsoft Intune, see:
-
-- [Windows client and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](/intune/kiosk-settings)
-- [Windows client device settings to run as a kiosk in Intune](/intune/kiosk-settings-windows)
-
-
-
-## Configure a kiosk using a provisioning package
-
-Process:
-
-1. [Create XML file](#create-xml-file)
-1. [Add XML file to provisioning package](#add-xml)
-1. [Apply provisioning package to device](#apply-ppkg)
-
-Watch how to use a provisioning package to configure a multi-app kiosk.
-
-> [!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false]
-
-If you don't want to use a provisioning package, you can deploy the configuration XML file using [mobile device management (MDM)](#use-mdm-to-deploy-the-multi-app-configuration), or you can configure assigned access using the [MDM Bridge WMI Provider](kiosk-mdm-bridge.md).
-
-### Prerequisites
-
-- Windows Configuration Designer (Windows 10, version 1709 or later)
-- The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 or later
-
-> [!NOTE]
-> For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk.
-
-### Create XML file
-
-Let's start by looking at the basic structure of the XML file.
-
-- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout.
-
-- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**.
-
-- Multiple config sections can be associated to the same profile.
-
-- A profile has no effect if it's not associated to a config section.
-
- 
-
-You can start your file by pasting the following XML into an XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this article. You can see a full sample version in the [Assigned access XML reference.](kiosk-xml.md)
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-
-#### Profile
-
-There are two types of profiles that you can specify in the XML:
-
-- **Lockdown profile**: Users assigned a lockdown profile will see the desktop in tablet mode with the specific apps on the Start screen.
-- **Kiosk profile**: Starting with Windows 10 version 1803, this profile replaces the KioskModeApp node of the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). Users assigned a kiosk profile won't see the desktop, but only the kiosk app running in full-screen mode.
-
-A lockdown profile section in the XML has the following entries:
-
-- [**Id**](#id)
-
-- [**AllowedApps**](#allowedapps)
-
-- [**FileExplorerNamespaceRestrictions**](#fileexplorernamespacerestrictions)
-
-- [**StartLayout**](#startlayout)
-
-- [**Taskbar**](#taskbar)
-
-A kiosk profile in the XML has the following entries:
-
-- [**Id**](#id)
-
-- [**KioskModeApp**](#kioskmodeapp)
-
-##### Id
-
-The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file.
-
-```xml
-
- …
-
-```
-
-##### AllowedApps
-
-**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. Starting with Windows 10 version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in.
-
-- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](./find-the-application-user-model-id-of-an-installed-app.md), or [get the AUMID from the Start Layout XML](#startlayout).
-- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of `%variableName%`. For example, `%systemroot%` or `%windir%`.
-- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both `"C:\Program Files\internet explorer\iexplore.exe"` and `"C:\Program Files (x86)\Internet Explorer\iexplore.exe"`.
-- To configure a single app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample).
-
-When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**:
-
-1. Default rule is to allow all users to launch the signed package apps.
-1. The package app blocklist is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the blocklist. This list will exclude the default allowed inbox package apps, which are critical for the system to function. It then excludes the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This blocklist will be used to prevent the user from accessing the apps that are currently available for the user but not in the allowed list.
-
- > [!NOTE]
- > You can't manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh994629(v=ws.11)#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration.
- >
- > Multi-app kiosk mode doesn't block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the blocklist. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list.
-
-Here are the predefined assigned access AppLocker rules for **desktop apps**:
-
-1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs.
-1. There's a predefined inbox desktop app blocklist for the assigned access user account, and this blocklist is adjusted based on the desktop app allowlist that you defined in the multi-app configuration.
-1. Enterprise-defined allowed desktop apps are added in the AppLocker allowlist.
-
-The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in.
-
-
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-```
-
-##### FileExplorerNamespaceRestrictions
-
-Starting in Windows 10 version 1809, you can explicitly allow some known folders to be accessed when the user tries to open the file dialog box in multi-app assigned access by including **FileExplorerNamespaceRestrictions** in your XML file. Currently, **Downloads** is the only folder supported. This behavior can also be set using Microsoft Intune.
-
-The following example shows how to allow user access to the Downloads folder in the common file dialog box.
-
-> [!TIP]
-> To grant access to the Downloads folder through File Explorer, add "Explorer.exe" to the list of allowed apps, and pin a file explorer shortcut to the kiosk start menu.
-
-```xml
-
-
-
-
-
- ...
-
-
-
-
-
-
- ...
-
-
-
-
-
-```
-
-`FileExplorerNamespaceRestriction` has been extended in current Windows 10 Prerelease for finer granularity and easier use. For more information and full samples, see [Assigned access XML reference](kiosk-xml.md). By using new elements, you can configure whether a user can access the Downloads folder or removable drives, or have no restrictions at all.
-
-> [!NOTE]
-> - `FileExplorerNamespaceRestrictions` and `AllowedNamespace:Downloads` are available in namespace `https://schemas.microsoft.com/AssignedAccess/201810/config`.
-> - `AllowRemovableDrives` and `NoRestriction` are defined in a new namespace `https://schemas.microsoft.com/AssignedAccess/2020/config`.
-
-- When `FileExplorerNamespaceRestrictions` node isn't used, or used but left empty, the user won't be able to access any folder in a common dialog. For example, **Save As** in the Microsoft Edge browser.
-- When Downloads is mentioned in allowed namespace, user will be able to access Downloads folder.
-- When `AllowRemovableDrives` is used, user will be to access removable drives.
-- When `NoRestriction` is used, no restriction will be applied to the dialog.
-- `AllowRemovableDrives` and `AllowedNamespace:Downloads` can be used at the same time.
-
-##### StartLayout
-
-After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen.
-
-The easiest way to create a customized Start layout to apply to other Windows client devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](../start/customize-and-export-start-layout.md).
-
-A few things to note here:
-
-- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration.
-- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout.
-- There are no apps pinned on the taskbar in the multi-app mode, and it's not supported to configure Taskbar layout using the `` tag in a layout modification XML as part of the assigned access configuration.
-- The following example uses `DesktopApplicationLinkPath` to pin the desktop app to start. When the desktop app doesn't have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files).
-
-The following example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start:
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-```
-
-> [!NOTE]
-> If an app isn't installed for the user, but is included in the Start layout XML, the app isn't shown on the Start screen.
-
-
-
-##### Taskbar
-
-Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don't attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want.
-
-The following example exposes the taskbar to the end user:
-
-```xml
-
-```
-
-The following example hides the taskbar:
-
-```xml
-
-```
-
-> [!NOTE]
-> This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden.
-
-##### KioskModeApp
-
-**KioskModeApp** is used for a [kiosk profile](#profile) only. Enter the AUMID for a single app. You can only specify one kiosk profile in the XML.
-
-```xml
-
-```
-
-> [!IMPORTANT]
-> The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Microsoft Entra account could potentially compromise confidential information.
-
-#### Configs
-
-Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced. This behavior includes the allowed apps, Start layout, taskbar configuration, and other local group policies or mobile device management (MDM) policies set as part of the multi-app experience.
-
-The full multi-app assigned access experience can only work for non-admin users. It's not supported to associate an admin user with the assigned access profile. Making this configuration in the XML file will result in unexpected or unsupported experiences when this admin user signs in.
-
-You can assign:
-
-- [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only)
-- [An individual account, which can be local, domain, or Microsoft Entra ID](#config-for-individual-accounts)
-- [A group account, which can be local, Active Directory (domain), or Microsoft Entra ID](#config-for-group-accounts) (Applies to Windows 10, version 1803 only).
-
-> [!NOTE]
-> Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request.
-
-##### Config for AutoLogon Account
-
-When you use `` and the configuration is applied to a device, the specified account (managed by Assigned Access) is created on the device as a local standard user account. The specified account is signed in automatically after restart.
-
-The following example shows how to specify an account to sign in automatically.
-
-```xml
-
-
-
-
-
-
-```
-
-Starting with Windows 10 version 1809, you can configure the display name that will be shown when the user signs in. The following example shows how to create an AutoLogon Account that shows the name "Hello World".
-
-```xml
-
-
-
-
-
-
-```
-
-On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).)
-
-> [!IMPORTANT]
-> When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon).
-
-##### Config for individual accounts
-
-Individual accounts are specified using ``.
-
-- Local account can be entered as `machinename\account` or `.\account` or just `account`.
-- Domain account should be entered as `domain\account`.
-- Microsoft Entra account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided _as is_, and consider it's a fixed domain name. Then follow with the Microsoft Entra ID email address. For example, `AzureAD\someone@contoso.onmicrosoft.com`
-
-> [!WARNING]
-> Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so.
-
-Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail.
-
-> [!NOTE]
-> For both domain and Microsoft Entra accounts, it's not required that target account is explicitly added to the device. As long as the device is AD-joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access.
-
-```xml
-
-
- MultiAppKioskUser
-
-
-
-```
-
-##### Config for group accounts
-
-Group accounts are specified using ``. Nested groups aren't supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in ``, user A won't have the kiosk experience.
-
-- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Microsoft Entra accounts that are added to the local group won't have the kiosk settings applied.
-
- ```xml
-
-
-
-
- ```
-
-- Domain group: Both security and distribution groups are supported. Specify the group type as ActiveDirectoryGroup. Use the domain name as the prefix in the name attribute.
-
- ```xml
-
-
-
-
- ```
-
-- Microsoft Entra group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in.
-
- ```xml
-
-
-
-
- ```
-
- > [!NOTE]
- > If a Microsoft Entra group is configured with a lockdown profile on a device, a user in the Microsoft Entra group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out.
-
-
-
-#### [Preview] Global profile
-
-Global profile is available in Windows 1. If you want everyone who signs into a specific device to be assigned as an access user, even if there's no dedicated profile for that user. Alternatively, perhaps Assigned Access couldn't identify a profile for the user and you want to have a fallback profile. Global profile is designed for these scenarios.
-
-Usage is demonstrated below, by using the new XML namespace and specifying `GlobalProfile` from that namespace. When you configure `GlobalProfile`, a non-admin account logs in, if this user doesn't have a designated profile in Assigned Access, or Assigned Access fails to determine a profile for current user, a global profile is applied for the user.
-
-> [!NOTE]
-> 1. `GlobalProfile` can only be a multi-app profile.
-> 1. Only one `GlobalProfile` can be used in one `AssignedAccess` configuration XML.
-> 1. `GlobalProfile` can be used as the only config, or it can be used along with regular user or group config.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-```
-
-### Add XML file to provisioning package
-
-Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](kiosk-xml.md#xsd-for-assignedaccess-configuration-xml).
-
-Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](../provisioning-packages/provisioning-install-icd.md).
-
-> [!IMPORTANT]
-> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
-
-1. Open Windows Configuration Designer. By default: `%systemdrive%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe`.
-
-1. Choose **Advanced provisioning**.
-
-1. Name your project, and select **Next**.
-
-1. Choose **All Windows desktop editions** and select **Next**.
-
-1. On **New project**, select **Finish**. The workspace for your package opens.
-
-1. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**.
-
-1. In the center pane, select **Browse**. Locate and select the assigned access configuration XML file that you created.
-
- 
-
-1. _Optional: If you want to apply the provisioning package after device initial setup and there's an admin user already available on the kiosk device, skip this step._ Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed.
-
-1. _Optional: If you already have a non-admin account on the kiosk device, skip this step._ Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**.
-
-1. On the **File** menu, select **Save.**
-
-1. On the **Export** menu, select **Provisioning package**.
-
-1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
-
-1. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
-
- - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
-
- - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package.
-
-1. Select **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location.
-
- Optionally, you can select **Browse** to change the default output location.
-
-1. Select **Next**.
-
-1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
-
- If you need to cancel the build, select **Cancel**. This action cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
-
-1. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
-
- If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
-
- - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this action, select **Back** to change the output package name and path, and then select **Next** to start another build.
- - If you're done, select **Finish** to close the wizard and go back to the **Customizations Page**.
-
-1. Copy the provisioning package to the root directory of a USB drive.
-
-
-
-### Apply provisioning package to device
-
-Provisioning packages can be applied to a device during initial setup (out-of-box experience or "OOBE") and after ("runtime"). For more information, see [Apply a provisioning package](../provisioning-packages/provisioning-apply-package.md).
-
-> [!NOTE]
-> If your provisioning package doesn't include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device.
-
-### Use MDM to deploy the multi-app configuration
-
-Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML.
-
-If your device is enrolled with an MDM service that supports applying the assigned access configuration, you can use it to apply the setting remotely.
-
-The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`.
-
-## Considerations for Windows Mixed Reality immersive headsets
-
-With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps.
-
-To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps):
-
-```xml
-
-
-
-
-```
-
-These apps are in addition to any mixed reality apps that you allow.
-
-**Before your kiosk user signs in:** An admin user must sign in to the PC, connect a mixed reality device, and complete the guided setup for the Mixed Reality Portal. The first time that the Mixed Reality Portal is set up, some files and content are downloaded. A kiosk user wouldn't have permissions to download and so their setup of the Mixed Reality Portal would fail.
-
-After the admin has completed setup, the kiosk account can sign in and repeat the setup. The admin user may want to complete the kiosk user setup before providing the PC to employees or customers.
-
-There's a difference between the mixed reality experiences for a kiosk user and other users. Typically, when a user connects a mixed reality device, they begin in the [Mixed Reality home](/windows/mixed-reality/discover/navigating-the-windows-mixed-reality-home). The Mixed Reality home is a shell that runs in "silent" mode when the PC is configured as a kiosk. When a kiosk user connects a mixed reality device, they'll see only a blank display in the device, and won't have access to the features and functionality available in the home. To run a mixed reality app, the kiosk user must launch the app from the PC Start screen.
-
-## Policies set by multi-app kiosk configuration
-
-It's not recommended to set policies enforced in assigned access multi-app mode to different values using other channels, as the multi-app mode has been optimized to provide a locked-down experience.
-
-When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will affect other users on the device.
-
-### Group policy
-
-The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This list includes local users, domain users, and Microsoft Entra users.
-
-| Setting | Value |
-| --- | --- |
-Remove access to the context menus for the task bar | Enabled
-Clear history of recently opened documents on exit | Enabled
-Prevent users from customizing their Start Screen | Enabled
-Prevent users from uninstalling applications from Start | Enabled
-Remove All Programs list from the Start menu | Enabled
-Remove Run menu from Start Menu | Enabled
-Disable showing balloon notifications as toast | Enabled
-Do not allow pinning items in Jump Lists | Enabled
-Do not allow pinning programs to the Taskbar | Enabled
-Do not display or track items in Jump Lists from remote locations | Enabled
-Remove Notifications and Action Center | Enabled
-Lock all taskbar settings | Enabled
-Lock the Taskbar | Enabled
-Prevent users from adding or removing toolbars | Enabled
-Prevent users from resizing the taskbar | Enabled
-Remove frequent programs list from the Start Menu | Enabled
-Remove 'Map Network Drive' and 'Disconnect Network Drive' | Enabled
-Remove the Security and Maintenance icon | Enabled
-Turn off all balloon notifications | Enabled
-Turn off feature advertisement balloon notifications | Enabled
-Turn off toast notifications | Enabled
-Remove Task Manager | Enabled
-Remove Change Password option in Security Options UI | Enabled
-Remove Sign Out option in Security Options UI | Enabled
-Remove All Programs list from the Start Menu | Enabled - Remove and disable setting
-Prevent access to drives from My Computer | Enabled - Restrict all drivers
-
-> [!NOTE]
-> When **Prevent access to drives from My Computer** is enabled, users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears explaining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics.
-
-### MDM policy
-
-Some of the MDM policies based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system.
-
-Setting | Value | System-wide
- --- | --- | ---
-[Experience/AllowCortana](/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | 0 - Not allowed | Yes
-[Start/AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-[Start/AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-[Start/AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-[Start/AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-[Start/AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-[Start/AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-[Start/AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-[Start/AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-[Start/AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-[Start/AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes
-Start/DisableContextMenus | 1 - Context menus are hidden for Start apps | No
-[Start/HidePeopleBar](/windows/client-management/mdm/policy-csp-start#start-hidepeoplebar) | 1 - True (hide) | No
-[Start/HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes
-[WindowsInkWorkspace/AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes
-[Start/StartLayout](/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No
-[WindowsLogon/DontDisplayNetworkSelectionUI](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes
-
-
-
-## Provision .lnk files using Windows Configuration Designer
-
-First, create your desktop app's shortcut file by installing the app on a test device, using the default installation location. Right-click the installed application, and choose **Send to** > **Desktop (create shortcut)**. Rename the shortcut to `.lnk`
-
-Next, create a batch file with two commands. If the desktop app is already installed on the target device, skip the first command for MSI install.
-
-```PowerShell
-msiexec /I ".msi" /qn /norestart
-copy .lnk "%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\.lnk"
-```
-
-In Windows Configuration Designer, under **ProvisioningCommands** > **DeviceContext**:
-
-- Under **CommandFiles**, upload your batch file, your .lnk file, and your desktop app installation file.
-
- > [!IMPORTANT]
- > Paste the full file path to the .lnk file in the **CommandFiles** field. If you browse to and select the .lnk file, the file path will be changed to the path of the target of the .lnk.
-
-- Under **CommandLine**, enter `cmd /c *FileName*.bat`.
-
-## Other methods
-
-Environments that use WMI can use the [MDM Bridge WMI Provider to configure a kiosk](kiosk-mdm-bridge.md).
diff --git a/windows/configuration/kiosk/lock-down-windows-11-to-specific-apps.md b/windows/configuration/kiosk/lock-down-windows-11-to-specific-apps.md
deleted file mode 100644
index 705b8f1517..0000000000
--- a/windows/configuration/kiosk/lock-down-windows-11-to-specific-apps.md
+++ /dev/null
@@ -1,404 +0,0 @@
----
-title: Set up a multi-app kiosk on Windows 11
-description: Learn how to configure a kiosk device running Windows 11 so that users can only run a few specific apps.
-ms.date: 05/12/2023
-
-ms.topic: how-to
----
-# Set up a multi-app kiosk on Windows 11 devices
-
-> [!NOTE]
-> The use of multiple monitors is supported for multi-app kiosk mode in Windows 11.
-
-An assigned access multi-app kiosk runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the apps that are allowed. With this approach, you can configure a locked-down experience for different account types. A multi-app kiosk is appropriate for devices that are shared by multiple people. Here's a guide on how to set up a multi-app kiosk.
-
-> [!WARNING]
-> The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access.
-
-> [!TIP]
-> Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk.
-
-## Configure a Multi-App Kiosk
-
-See the table below for the different methods to configure a multi-app kiosk in Windows 11.
-
-|Configuration Method|Availability|
-|--------------------|------------|
-|[MDM WMI Bridge Provider](#configure-a-kiosk-using-wmi-bridge) | Available May 2023|
-
-
-
-> [!NOTE]
-> For WMI Bridge/PowerShell and Provisioning package methods, you will need to create your own multi-app kiosk XML file as specified below.
-
-## Create the XML file
-
-Let's start by looking at the basic structure of the XML file.
-
-- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout.
-
-- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**.
-
-- Multiple config sections can be associated to the same profile.
-
-- A profile has no effect if it's not associated to a config section.
-
-You can start your file by pasting the following XML into an XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this article.
-
-> [!NOTE]
-> If you want to write a configuration file to be applied to both Windows 10 and Windows 11 devices, follow the [Windows 10 instructions](lock-down-windows-10-to-specific-apps.md) to add the StartLayout tag to your XML file, just above the StartPins tag. Windows will automatically ignore the sections that don't apply to the version running.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-#### Profile
-
-There are two types of profiles that you can specify in the XML:
-
-- **Lockdown profile**: Users assigned a lockdown profile will see the desktop in tablet mode with the specific apps on the Start screen.
-- **Kiosk profile**: Starting with Windows 10 version 1803, this profile replaces the KioskModeApp node of the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). Users assigned a kiosk profile won't see the desktop, but only the kiosk app running in full-screen mode.
-
-A lockdown profile section in the XML has the following entries:
-
-- [**Id**](#id)
-- [**AllowedApps**](#allowedapps)
-- [**StartPins**](#startpins)
-- [**Taskbar**](#taskbar)
-
-A kiosk profile in the XML has the following entries:
-
-- [**Id**](#id)
-- [**KioskModeApp**](#kioskmodeapp)
-
-##### Id
-
-The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file.
-
-```xml
-
- …
-
-```
-
-##### AllowedApps
-
-**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. Starting with Windows 10 version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in.
-
-- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](./find-the-application-user-model-id-of-an-installed-app.md), or [get the AUMID from the Start Layout XML](#create-the-xml-file).
-- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of `%variableName%`. For example, `%systemroot%` or `%windir%`.
-- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both `"C:\Program Files\internet explorer\iexplore.exe"` and `"C:\Program Files (x86)\Internet Explorer\iexplore.exe"`.
-- To configure a single app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample).
-
-When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**:
-
-1. Default rule is to allow all users to launch the signed package apps.
-1. The package app blocklist is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the blocklist. This list will exclude the default allowed inbox package apps, which are critical for the system to function. It then excludes the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This blocklist will be used to prevent the user from accessing the apps that are currently available for the user but not in the allowed list.
-
- > [!NOTE]
- > You can't manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh994629(v=ws.11)#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration.
- > Multi-app kiosk mode doesn't block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the blocklist. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list.
-
-Here are the predefined assigned access AppLocker rules for **desktop apps**:
-
-1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs.
-1. There's a predefined inbox desktop app blocklist for the assigned access user account, and this blocklist is adjusted based on the desktop app allowlist that you defined in the multi-app configuration.
-1. Enterprise-defined allowed desktop apps are added in the AppLocker allowlist.
-
-The following example allows Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in.
-
-
-
-```xml
-
-
-
-
-
-
-
-
-
-```
-
-##### StartPins
-
-After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. The easiest way to create a customized Start layout to apply to other Windows client devices is to set up the Start screen on a test device and then export the layout. Once you've decided, you can get the JSON needed for your kiosk configuration by following the steps to [Get the pinnedList JSON](../start/customize-and-export-start-layout.md). If you opt to do this using the PowerShell command, make sure that the system you run the command on has the same file structure as the device on which you will apply the kiosk (the path to the allowed apps must be the same). At the end of this step, you should have a JSON pinnedList that looks something like the below.
-
-Add your pinnedList JSON into the StartPins tag in your XML file.
-
-```xml
-
-
-
-```
-
-> [!NOTE]
-> If an app isn't installed for the user, but is included in the Start layout XML, the app isn't shown on the Start screen.
-
-##### Taskbar
-
-Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don't attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want.
-
-The following example exposes the taskbar to the end user:
-
-```xml
-
-```
-
-The following example hides the taskbar:
-
-```xml
-
-```
-
-> [!NOTE]
-> This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden.
-
-##### KioskModeApp
-
-**KioskModeApp** is used for a [kiosk profile](#profile) only. Enter the AUMID for a single app. You can only specify one kiosk profile in the XML.
-
-```xml
-
-```
-
-> [!IMPORTANT]
-> The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Microsoft Entra account could potentially compromise confidential information.
-
-#### Configs
-
-Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced. This behavior includes the allowed apps, Start layout, taskbar configuration, and other local group policies or mobile device management (MDM) policies set as part of the multi-app experience.
-
-The full multi-app assigned access experience can only work for non-admin users. It's not supported to associate an admin user with the assigned access profile. Making this configuration in the XML file will result in unexpected or unsupported experiences when this admin user signs in.
-
-You can assign:
-
-- [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only)
-- [An individual account, which can be local, domain, or Microsoft Entra ID](#config-for-individual-accounts)
-- [A group account, which can be local, Active Directory (domain), or Microsoft Entra ID](#config-for-group-accounts) (Applies to Windows 10, version 1803 only).
-
-> [!NOTE]
-> Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request.
-
-##### Config for AutoLogon Account
-
-When you use `` and the configuration is applied to a device, the specified account (managed by Assigned Access) is created on the device as a local standard user account. The specified account is signed in automatically after restart.
-
-The following example shows how to specify an account to sign in automatically.
-
-```xml
-
-
-
-
-
-
-```
-
-Starting with Windows 10 version 1809, you can configure the display name that will be shown when the user signs in. The following example shows how to create an AutoLogon Account that shows the name "Hello World".
-
-```xml
-
-
-
-
-
-
-```
-
-On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).)
-
->[!IMPORTANT]
->When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon).
-
-##### Config for individual accounts
-
-Individual accounts are specified using ``.
-
-- Local account can be entered as `machinename\account` or `.\account` or just `account`.
-- Domain account should be entered as `domain\account`.
-- Microsoft Entra account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided *as is*, and consider it's a fixed domain name. Then follow with the Microsoft Entra ID email address. For example, `AzureAD\someone@contoso.onmicrosoft.com`
-
-> [!WARNING]
-> Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so.
-
-Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail.
-
-> [!NOTE]
-> For both domain and Microsoft Entra accounts, it's not required that target account is explicitly added to the device. As long as the device is AD-joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access.
-
-```xml
-
-
- MultiAppKioskUser
-
-
-
-```
-
-##### Config for group accounts
-
-Group accounts are specified using ``. Nested groups aren't supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in ``, user A won't have the kiosk experience.
-
-- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Microsoft Entra accounts that are added to the local group won't have the kiosk settings applied.
-
- ```xml
-
-
-
-
- ```
-
-- Domain group: Both security and distribution groups are supported. Specify the group type as ActiveDirectoryGroup. Use the domain name as the prefix in the name attribute.
-
- ```xml
-
-
-
-
- ```
-
-- Microsoft Entra group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in.
-
- ```xml
-
-
-
-
- ```
-
- > [!NOTE]
- > If a Microsoft Entra group is configured with a lockdown profile on a device, a user in the Microsoft Entra group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out.
-
-## Configure a kiosk using WMI Bridge
-
-Environments that use [Windows Management Instrumentation (WMI)](/windows/win32/wmisdk/wmi-start-page) can use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to configure the MDM_AssignedAccess class.
-
-Here's an example of how to set AssignedAccess configuration:
-
-1. Download the [psexec tool](/sysinternals/downloads/psexec).
-
-1. Using an elevated command prompt, run `psexec.exe -i -s cmd.exe`.
-1. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell.
-1. Save the following Powershell excerpt as a PowerShell script (.ps1), replacing the placeholder "your XML here" with the [Sample Assigned Access XML](#sample-assigned-access-xml) then run the script at the Powershell prompt from the previous step.
-
-```powershell
-$eventLogFilterHashTable = @{
- ProviderName = "Microsoft-Windows-AssignedAccess";
- StartTime = Get-Date -Millisecond 0
-}
-
-$namespaceName="root\cimv2\mdm\dmmap"
-$className="MDM_AssignedAccess"
-$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
-$obj.Configuration = [System.Net.WebUtility]::HtmlEncode(@"
-
-
-
-"@)
-
-$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue
-if($cimSetError) {
- Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n"
- Write-Error -ErrorRecord $cimSetError[0]
-
- $timeout = New-TimeSpan -Seconds 30
- $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
- do{
- $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore
- } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available
-
- if($events.Count) {
- $events | ForEach-Object {
-
- Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")"
-
- }
- } else {
- Write-Warning "Timed-out attempting to retrieve event logs..."
- }
-
- Exit 1
-}
-
-Write-Output "Successfully applied Assigned Access configuration"
-```
-
-## Sample Assigned Access XML
-
-This section contains a predefined XML file which can be used as a quickstart to get familiar with the Assigned Access multi-app kiosk feature on Windows 11.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- MultiAppKioskUser
-
-
-
-
-```
diff --git a/windows/configuration/kiosk/lockdown-features-windows-10.md b/windows/configuration/kiosk/lockdown-features-windows-10.md
deleted file mode 100644
index 592bf95d71..0000000000
--- a/windows/configuration/kiosk/lockdown-features-windows-10.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Lockdown features from Windows Embedded 8.1 Industry
-description: Many of the lockdown feature available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10.
-ms.topic: article
-appliesto:
-- ✅ Windows 10
-ms.date: 12/31/2017
----
-
-# Lockdown features from Windows Embedded 8.1 Industry
-
-Many of the lockdown feature available in Windows Embedded 8.1 Industry have been modified in some form for Windows 1. This table maps Windows Embedded Industry 8.1 features to Windows 10 Enterprise features, along with links to documentation.
-
-|Windows Embedded 8.1 Industry lockdown feature|Windows 10 feature|Changes|
-|--- |--- |--- |
-|[Hibernate Once/Resume Many (HORM)](/previous-versions/windows/embedded/dn449302(v=winembedded.82)): Quick boot to device|[HORM](/windows-hardware/customize/enterprise/hibernate-once-resume-many-horm-)|HORM is supported in Windows 10, version 1607 and later.|
-|[Unified Write Filter](/previous-versions/windows/embedded/dn449332(v=winembedded.82)): protect a device's physical storage media|[Unified Write Filter](/windows-hardware/customize/enterprise/unified-write-filter)|The Unified Write Filter is continued in Windows 10.|
-|[Keyboard Filter](/previous-versions/windows/embedded/dn449298(v=winembedded.82)): block hotkeys and other key combinations|[Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter)|Keyboard filter is added in Windows 10, version 151. As in Windows Embedded Industry 8.1, Keyboard Filter is an optional component that can be turned on via **Turn Windows Features On/Off**. Keyboard Filter (in addition to the WMI configuration previously available) will be configurable through Windows Imaging and Configuration Designer (ICD) in the SMISettings path.|
-|[Shell Launcher](/previous-versions/windows/embedded/dn449423(v=winembedded.82)): launch a Windows desktop application on sign-on|[Shell Launcher](/windows-hardware/customize/enterprise/shell-launcher)|Shell Launcher continues in Windows 1. It's now configurable in Windows ICD under the **SMISettings** category. Learn [how to use Shell Launcher to create a kiosk device](/windows/configuration/kiosk-single-app) that runs a Windows desktop application.|
-|[Application Launcher](/previous-versions/windows/embedded/dn449251(v=winembedded.82)): launch a Universal Windows Platform (UWP) app on sign-on|[Assigned Access](/windows/client-management/mdm/assignedaccess-csp)|The Windows 8 Application Launcher has been consolidated into Assigned Access. Application Launcher enabled launching a Windows 8 app and holding focus on that app. Assigned Access offers a more robust solution for ensuring that apps retain focus.|
-|[Dialog Filter](/previous-versions/windows/embedded/dn449395(v=winembedded.82)): suppress system dialogs and control which processes can run|[AppLocker](/windows/device-security/applocker/applocker-overview)|Dialog Filter has been deprecated for Windows 1. Dialog Filter provided two capabilities; the ability to control which processes were able to run, and the ability to prevent dialogs (in practice, system dialogs) from appearing.
Control over which processes are able to run will now be provided by AppLocker.
System dialogs in Windows 10 have been replaced with system toasts. To see more on blocking system toasts, see Toast Notification Filter below.|
-|[Toast Notification Filter](/previous-versions/windows/embedded/dn449360(v=winembedded.82)): suppress toast notifications|Mobile device management (MDM) and Group Policy|Toast Notification Filter has been replaced by MDM and Group Policy settings for blocking the individual components of noncritical system toasts that may appear. For example, to prevent a toast from appearing when a USB drive is connected, ensure that USB connections have been blocked using the USB-related policies, and turn off notifications from apps. Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** MDM policy name may vary depending on your MDM service. In Microsoft Intune, use **Allow action center notifications** and a [custom OMA-URI setting](/mem/intune/configuration/custom-settings-windows-10) for **AboveLock/AllowActionCenterNotifications**.|
-|[Embedded Lockdown Manager](/previous-versions/windows/embedded/dn449279(v=winembedded.82)): configure lockdown features|[Windows Imaging and Configuration Designer (ICD)](/windows/configuration/provisioning-packages/provisioning-install-icd)|The Embedded Lockdown Manager has been deprecated for Windows 10 and replaced by the Windows ICD. Windows ICD is the consolidated tool for Windows imaging and provisioning scenarios and enables configuration of all Windows settings, including the lockdown features previously configurable through Embedded Lockdown Manager.|
-|[USB Filter](/previous-versions/windows/embedded/dn449350(v=winembedded.82)): restrict USB devices and peripherals on system|MDM and Group Policy|The USB Filter driver has been replaced by MDM and Group Policy settings for blocking the connection of USB devices.
Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Device Installation Restrictions** MDM policy name may vary depending on your MDM service. In Microsoft Intune, use **Removable storage**.|
-|[Assigned Access](/previous-versions/windows/embedded/dn449303(v=winembedded.82)): launch a UWP app on sign-in and lock access to system|[Assigned Access](/windows/client-management/mdm/assignedaccess-csp)|Assigned Access has undergone significant improvement for Windows 1. In Windows 8.1, Assigned Access blocked system hotkeys and edge gestures, and noncritical system notifications, but it also applied some of these limitations to other accounts on the device. In Windows 10, Assigned Access no longer affects accounts other than the one being locked down. Assigned Access now restricts access to other apps or system components by locking the device when the selected user account logs in and launching the designated app above the lock screen, ensuring that no unintended functionality can be accessed.
Learn [how to use Assigned Access to create a kiosk device](/windows/configuration/kiosk-single-app) that runs a Universal Windows app.|
-|[Gesture Filter](/previous-versions/windows/embedded/dn449374(v=winembedded.82)): block swipes from top, left, and right edges of screen|MDM and Group Policy|In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. In Windows 10, Charms have been removed. In Windows 10, version 1607, you can block swipes using the [Allow edge swipe](/windows/client-management/mdm/policy-configuration-service-provider#LockDown_AllowEdgeSwipe) policy.|
-|[Custom sign in](/previous-versions/windows/embedded/dn449309(v=winembedded.82)): suppress Windows UI elements during Windows sign-on, sign out, and shut down|[Embedded sign in](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-embeddedlogon)|No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.|
-|[Unbranded Boot](/previous-versions/windows/embedded/dn449249(v=winembedded.82)): custom brand a device by removing or replacing Windows boot UI elements|[Unbranded Boot](/windows-hardware/customize/enterprise/unbranded-boot)|No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.|
diff --git a/windows/configuration/kiosk/setup-digital-signage.md b/windows/configuration/kiosk/setup-digital-signage.md
deleted file mode 100644
index f159299653..0000000000
--- a/windows/configuration/kiosk/setup-digital-signage.md
+++ /dev/null
@@ -1,65 +0,0 @@
----
-title: Set up digital signs on Windows
-description: A single-use device such as a digital sign is easy to set up in Windows 10 and Windows 11 (Pro, Enterprise, and Education).
-ms.date: 09/20/2021
-ms.topic: article
----
-
-# Set up digital signs
-
-Digital signage can be a useful and exciting business tool. Use digital signs to showcase your products and services, to display testimonials, or to advertise promotions and campaigns. A digital sign can be a static display, such as a building directory or menu, or it can be dynamic, such as repeating videos or a social media feed.
-
-For digital signage, simply select a digital sign player as your kiosk app. You can also use [Microsoft Edge in kiosk mode](/DeployEdge/microsoft-edge-configure-kiosk-mode) or the Kiosk Browser app, and configure it to show your online content.
-
->[!TIP]
->Kiosk Browser can also be used in [single-app kiosks](kiosk-single-app.md) and [multi-app kiosk](lock-down-windows-10-to-specific-apps.md) as a web browser. For more information, see [Guidelines for web browsers](guidelines-for-assigned-access-app.md#guidelines-for-web-browsers).
-
-Kiosk Browser must be downloaded for offline licensing using Microsoft Store for Business. You can deploy Kiosk Browser to devices running Windows 11, and Windows 10 version 1803+.
-
->[!NOTE]
->If you haven't set up your Microsoft Store for Business yet, check out [the prerequisites](/microsoft-store/prerequisites-microsoft-store-for-business) and then [sign up](/microsoft-store/sign-up-microsoft-store-for-business).
-
-This procedure explains how to configure digital signage using Kiosk Browser on a device running Windows client that has already been set up (completed the first-run experience).
-
-1. [Get **Kiosk Browser** in Microsoft Store for Business with offline, unencoded license type.](/microsoft-store/acquire-apps-microsoft-store-for-business#acquire-apps)
-1. [Download the **Kiosk Browser** package, license file, and all required frameworks.](/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app)
-1. [Install Windows Configuration Designer.](~/provisioning-packages/provisioning-install-icd.md)
-1. Open Windows Configuration Designer and select **Provision kiosk devices**.
-1. Enter a friendly name for the project, and select **Finish**.
-1. On **Set up device**, select **Disabled**, and select **Next**.
-1. On **Set up network**, enable network setup:
- - Toggle **On** wireless network connectivity.
- - Enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network.
-1. On **Account management**, select **Disabled**, and select **Next**.
-1. On **Add applications**, select **Add an application**:
- - For **Application name**, enter `Kiosk Browser`.
- - For **Installer path**, browse to and select the AppxBundle that you downloaded from Microsoft Store for Business. After you select the package, additional fields are displayed.
- - For **License file path**, browse to and select the XML license file that you downloaded from Microsoft Store for Business.
- - The **Package family name** is populated automatically.
- - Select **Next**.
-1. On **Add certificates**, select **Next**.
-1. On **Configure kiosk account and app**, toggle **Yes** to create a local user account for your digital signage:
- - Enter a user name and password, and toggle **Auto sign-in** to **Yes**.
- - Under **Configure the kiosk mode app**, enter the user name for the account that you're creating.
- - For **App type**, select **Universal Windows App**.
- - In **Enter the AUMID for the app**, enter `Microsoft.KioskBrowser_8wekyb3d8bbwe!App`.
-1. In the bottom left corner of Windows Configuration Designer, select **Switch to advanced editor**.
-1. Go to **Runtime settings** > **Policies** > **KioskBrowser**. Let's assume that the URL for your digital signage content is contoso.com/menu:
- - In **BlockedUrlExceptions**, enter `https://www.contoso.com/menu`.
- - In **BlockedUrl**, enter `*`.
- - In **DefaultUrl**, enter `https://www.contoso.com/menu`.
- - Set **EnableEndSessionButton**, **EnableHomeButton**, and **EnableNavigationButtons** to **No**.
-
- >[!TIP]
- >For more information on kiosk browser settings, see [Guidelines for web browsers](guidelines-for-assigned-access-app.md#guidelines-for-web-browsers).
-
-1. On the **File** menu, select **Save**, and select **OK** in the **Keep your info secure** dialog box.
-1. On the **Export** menu, select **Provisioning package**.
-1. Change the **Owner** to **IT Admin**, and select **Next**.
-1. On **Select security details for the provisioning package**, select **Next**.
-1. On **Select where to save the provisioning package**, select **Next**.
-1. On **Build the provisioning package**, select **Build**.
-1. On the **All done!** screen, click the **Output location**.
-1. Copy the .ppkg file to a USB drive.
-1. Attach the USB drive to the device that you want to use for your digital sign.
-1. Go to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package on the USB drive.
diff --git a/windows/configuration/kiosk/toc.yml b/windows/configuration/kiosk/toc.yml
deleted file mode 100644
index 3362daaabd..0000000000
--- a/windows/configuration/kiosk/toc.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-items:
-- name: Overview
- href: kiosk-methods.md
-- name: Prepare a device for kiosk configuration
- href: kiosk-prepare.md
-- name: Set up digital signs
- href: setup-digital-signage.md
-- name: Set up a single-app kiosk
- href: kiosk-single-app.md
-- name: Set up a multi-app kiosk for Windows 10
- href: lock-down-windows-10-to-specific-apps.md
-- name: Set up a multi-app kiosk for Windows 11
- href: lock-down-windows-11-to-specific-apps.md
-- name: Kiosk reference information
- items:
- - name: More kiosk methods and reference information
- href: kiosk-additional-reference.md
- - name: Find the Application User Model ID of an installed app
- href: find-the-application-user-model-id-of-an-installed-app.md
- - name: Validate your kiosk configuration
- href: kiosk-validate.md
- - name: Guidelines for choosing an app for assigned access (kiosk mode)
- href: guidelines-for-assigned-access-app.md
- - name: Policies enforced on kiosk devices
- href: kiosk-policies.md
- - name: Assigned access XML reference
- href: kiosk-xml.md
- - name: Use AppLocker to create a Windows 10 kiosk
- href: lock-down-windows-10-applocker.md
- - name: Use Shell Launcher to create a Windows client kiosk
- href: kiosk-shelllauncher.md
- - name: Use MDM Bridge WMI Provider to create a Windows client kiosk
- href: kiosk-mdm-bridge.md
- - name: Troubleshoot kiosk mode issues
- href: /troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting
-- name: Lockdown features from Windows Embedded 8.1 Industry
- href: lockdown-features-windows-10.md
\ No newline at end of file
diff --git a/windows/configuration/provisioning-packages/toc.yml b/windows/configuration/provisioning-packages/toc.yml
index 818ccc679e..afd0f1f158 100644
--- a/windows/configuration/provisioning-packages/toc.yml
+++ b/windows/configuration/provisioning-packages/toc.yml
@@ -1,5 +1,5 @@
items:
- - name: Provisioning packages for Windows client
+ - name: Overview
href: provisioning-packages.md
- name: How provisioning works in Windows client
href: provisioning-how-it-works.md
diff --git a/windows/configuration/start/customize-and-export-start-layout.md b/windows/configuration/start/customize-and-export-start-layout.md
index 725c7c8756..4a22ee3b6f 100644
--- a/windows/configuration/start/customize-and-export-start-layout.md
+++ b/windows/configuration/start/customize-and-export-start-layout.md
@@ -1,17 +1,180 @@
---
-title: Customize and export Start layout
-description: The easiest method for creating a customized Start layout is to set up the Start screen and export the layout.
+title: Customize and export the Start layout
+description: Learn how to customize the Windows Start layout and export the configuration to apply to other devices.
ms.topic: how-to
+ms.date: 03/04/2024
+zone_pivot_groups: windows-versions-11-10
appliesto:
-- ✅ Windows 10
-ms.date: 08/18/2023
ms.collection:
- tier1
---
-# Customize and export Start layout
+# Customize and export the Start layout
->**Looking for consumer information?** See [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630)
+> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu).
+
+::: zone pivot="windows-11"
+
+Your organization can deploy a customized Start layout to your Windows 11 devices. Customizing the Start layout is common when you have similar devices used by many users, or you want to pin specific apps.
+
+For example, you can override the default set of apps with your own a set of pinned apps, and in the order you choose. As an administrator, use this feature to pin apps, remove default pinned apps, order the apps, and more.
+
+To add apps you want pinned to the Start menu, you use a JSON file. In previous Windows versions, IT administrators used an XML file to customize the Start menu. The XML file isn't available on Windows 11 and later ***unless*** [you're an OEM](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu).
+
+This article shows you how to export an existing Start menu layout, and use the JSON in a Microsoft Intune policy.
+
+## Before you begin
+
+- When you customize the Start layout, you overwrite the entire full layout. A partial Start layout isn't available. Users can pin and unpin apps, and uninstall apps from Start. When a user signs in or Explorer restarts, Windows reapplies the MDM policy. This action restores the specified layout and doesn't retain any user changes.
+
+ To prevent users from making any changes to the Start menu layout, see the [NoChangeStartMenu](/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-nochangestartmenu) policy.
+
+- It's recommended to use a mobile device management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use Microsoft Intune. Intune is a family of products that include Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises.
+
+ In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started:
+
+ - [Endpoint Management at Microsoft](/mem/endpoint-manager-overview)
+ - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide)
+ - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction)
+
+## Start menu features and areas
+
+In Windows 11, the Start menu is redesigned with a simplified set of apps that are arranged in a grid of pages. There aren't folders, groups, or different-sized app icons:
+
+:::image type="content" source="./images/start-windows-11.png" alt-text="Sample start menu layout on Windows 11 that shows pinned apps, access to all apps, and recommended files.":::
+
+Start has the following areas:
+
+- **Pinned**: Shows pinned apps, or a subset of all of the apps installed on the device. You can create a list of pinned apps you want on the devices using the **ConfigureStartPins** policy. **ConfigureStartPins** overrides the entire layout, which also removes apps that are pinned by default.
+
+ This article shows you [how to use the **ConfigureStartPins** policy](#get-the-pinnedlist-json).
+
+- **All apps**: Users select this option to see an alphabetical list of all the apps on the device. This section can't be customized using the JSON file.
+
+ The [Start/HideFrequentlyUsedApps CSP](/windows/client-management/mdm/policy-csp-start#start-hidefrequentlyusedapps) exposes settings that configure the "Most used" section, which is at the top of the all apps list.
+
+ In **Intune**, you can configure this Start menu layout feature, and more. For more information on the Start menu settings you can configure in an Intune policy, see [Windows 10/11 device settings to allow or restrict features](/mem/intune/configuration/device-restrictions-windows-10#start).
+
+ In **Group Policy**, there are policies that include settings that control the Start menu layout. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices:
+
+ - `Computer Configuration\Administrative Templates\Start Menu and Taskbar`
+ - `User Configuration\Administrative Templates\Start Menu and Taskbar`
+
+- **Recommended**: Shows recently opened files and recently installed apps. This section can only be customized in Windows 11 SE using the following policy.
+
+ - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove Recommended section from Start Menu`
+
+## Create the JSON file
+
+On an existing Windows 11 device, set up your own Start layout with the pinned apps you want users to see. Then, use the [Windows PowerShell Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet to export the existing layout to a `LayoutModification.json` file.
+
+The JSON file controls the Start menu layout, and lists all the apps that are pinned. You can update the JSON file to:
+
+- Change the order of existing apps. The apps in the JSON file are shown on Start in the same order.
+- Add more apps by entering the app ID. For more information, see [Get the pinnedList JSON](#get-the-pinnedlist-json) (in this article).
+
+If you're familiar with creating JSON files, you can create your own `LayoutModification.json` file. But, it's easier and faster to export the layout from an existing device.
+
+### Export an existing Start layout
+
+1. Create a folder to save the `.json` file. For example, create the `C:\Layouts` folder.
+1. On a Windows 11 device, open the Windows PowerShell app.
+1. Run the following cmdlet. Name the file `LayoutModification.json`.
+
+ ```powershell
+ Export-StartLayout -Path "C:\Layouts\LayoutModification.json"
+
+ ```
+
+### Get the pinnedList JSON
+
+1. Open the `LayoutModification.json` file in a JSON editor, such as Visual Studio Code or Notepad. For more information, see [edit JSON with Visual Studio Code](https://code.visualstudio.com/docs/languages/json).
+1. In the file, you see the `pinnedList` section. This section includes all of the pinned apps. Copy the `pinnedList` content in the JSON file. You'll use it in the next section.
+
+ In the following example, you see that Microsoft Edge, Microsoft Word, the Microsoft Store app, and Notepad are pinned:
+
+ ```json
+ {
+ "pinnedList": [
+ { "desktopAppId": "MSEdge" },
+ { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" },
+ { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" },
+ { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" }
+ ]
+ }
+ ```
+
+1. Starting with Windows 11, the **ConfigureStartPins** policy is available. This policy uses the `LayoutModification.json` file to add apps to the Pinned section. In your JSON file, you can add more apps to this section using the following keys:
+
+| Key | Description |
+|--|--|
+| packagedAppID | Use this option for Universal Windows Platform apps. To pin a UWP app, use the app's AUMID. |
+| desktopAppID | Use this option for unpackaged Win32 apps. To pin a Win32 app, use the app's AUMID. If the app doesn't have an AUMID, then enter the `desktopAppLink` instead. |
+| desktopAppLink | Use this option for unpackaged Win32 apps that don't have an associated AUMID. To pin this type of app, use the path to the `.lnk` shortcut that points to the app. |
+
+## Use MDM to create and deploy a pinned list policy
+
+Now that you have the JSON syntax, you're ready to deploy your customized Start layout to devices in your organization.
+
+MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list.
+
+This section shows you how to create a pinned list policy in Intune. There isn't a Group Policy to create a pinned list.
+
+### Create a pinned list using an Intune policy
+
+To deploy this policy, the devices must be enrolled, and managed by your organization. For more information, see [What is device enrollment?](/mem/intune/enrollment/device-enrollment).
+
+1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Devices** > **Configuration profiles** > **Create profile**.
+1. Enter the following properties:
+
+ - **Platform**: Select **Windows 10 and later**.
+ - **Profile**: Select **Templates** > **Custom**.
+
+1. Select **Create**.
+1. In **Basics**, enter the following properties:
+
+ - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify them later. For example, a good profile name is **Win11: Custom Start layout**.
+ - **Description**: Enter a description for the profile. This setting is optional, and recommended.
+
+1. Select **Next**.
+1. In **Configuration settings** > **OMA-URI**, select **Add**. Add the following properties:
+
+ - **Name**: Enter something like **Configure Start pins**.
+ - **Description**: Enter a description for the row. This setting is optional, and recommended.
+ - **OMA-URI**: Enter `./Vendor/MSFT/Policy/Config/Start/ConfigureStartPins`.
+ - **Data type**: Select **String**.
+ - **Value**: Paste the JSON you created or updated in the previous section. For example, enter the following text:
+
+ ```json
+ {
+ "pinnedList": [
+ { "desktopAppId": "MSEdge" },
+ { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" },
+ { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" },
+ { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" }
+ ]
+ }
+ ```
+
+ Your settings look similar to the following settings:
+
+ :::image type="content" source="./images/endpoint-manager-admin-center-custom-oma-uri-start-layout.png" alt-text="Custom OMA-URI settings to customize Start menu layout using pinnedList":::
+
+1. Select **Save** > **Next** to save your changes.
+1. Configure the rest of the policy settings. For more specific information, see [Create a profile with custom settings](/mem/intune/configuration/custom-settings-configure).
+
+The Windows OS exposes many CSPs that apply to the Start menu. For a list, see [Supported CSP policies for Windows 11 Start menu](supported-csp-start-menu-layout-windows.md).
+
+### Deploy the policy using Intune
+
+When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized Start layout, the policy can be deployed anytime, including before users sign in the first time.
+
+For more information and guidance on assigning policies to devices in your organization, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
+
+::: zone-end
+
+::: zone pivot="windows-10"
The easiest method for creating a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test computer and then export the layout.
@@ -21,15 +184,6 @@ When a full Start layout is applied, the users can't pin, unpin, or uninstall ap
When [a partial Start layout](#configure-a-partial-start-layout) is applied, the contents of the specified tile groups can't be changed, but users can move those groups, and can also create and customize their own groups.
-> [!NOTE]
-> Partial Start layout is only supported on Windows 10, version 1511 and later.
-
-You can deploy the resulting .xml file to devices using one of the following methods:
-
-- [Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
-- [Windows Configuration Designer provisioning package](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
-- [Mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
-
## Customize the Start screen on your test computer
To prepare a Start layout for export, you simply customize the Start layout on a test computer.
@@ -52,9 +206,7 @@ To customize Start:
- **Create your own app groups**. Drag the apps to an empty area. To name a group, select above the group of tiles and then type the name in the **Name group** field that appears above the group.
> [!IMPORTANT]
-> In Windows 10, version 1703, if the Start layout includes tiles for apps that are not installed on the device that the layout is later applied to, the tiles for those apps will be blank. The blank tiles will persist until the next time the user signs in, at which time the blank tiles are removed. Some system events may cause the blank tiles to be removed before the next sign-in.
->
-> In earlier versions of Windows 10, no tile would be pinned.
+> If the Start layout includes tiles for apps that are not installed on the device that the layout is later applied to, the tiles for those apps will be blank. The blank tiles will persist until the next time the user signs in, at which time the blank tiles are removed. Some system events may cause the blank tiles to be removed before the next sign-in.
### Export the Start layout
@@ -66,17 +218,13 @@ When you have the Start layout that you want your users to see, use the [Export-
To export the Start layout to an .xml file:
1. While signed in with the same account that you used to customize Start, right-click Start, and select **Windows PowerShell**.
-1. On a device running Windows 10, version 1607, 1703, or 1803, at the Windows PowerShell command prompt, enter the following command:
-
- `Export-StartLayout -path .xml`
-
- On a device running Windows 10, version 1809 or higher, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example:
+1. Run `Export-StartLayout` with the switch `-UseDesktopApplicationID`. For example:
```PowerShell
Export-StartLayout -UseDesktopApplicationID -Path layout.xml
```
- In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml).
+ In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, `\\FileServer01\StartLayouts\StartLayoutMarketing.xml`).
Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet doesn't append the file name extension, and the policy settings require the extension.
@@ -99,7 +247,7 @@ To export the Start layout to an .xml file:
```
-1. (Optional) Edit the .xml file to add [a taskbar configuration](../taskbar/configure-windows-10-taskbar.md) or to [modify the exported layout](start-layout-xml-desktop.md). When you make changes to the exported layout, be aware that [the order of the elements in the .xml file is critical.](start-layout-xml-desktop.md#required-order)
+1. (Optional) Edit the .xml file to add [a taskbar configuration](../taskbar/configure.md) or to [modify the exported layout](start-layout-xml-desktop.md). When you make changes to the exported layout, be aware that [the order of the elements in the .xml file is critical.](start-layout-xml-desktop.md#required-order)
> [!IMPORTANT]
> If the Start layout that you export contains tiles for desktop (Win32) apps or .url links, **Export-StartLayout** will use **DesktopApplicationLinkPath** in the resulting file. Use a text or XML editor to change **DesktopApplicationLinkPath** to **DesktopApplicationID**. See [Specify Start tiles](start-layout-xml-desktop.md#specify-start-tiles) for details on using the app ID in place of the link path.
@@ -141,3 +289,236 @@ To configure a partial Start screen layout:
> [!NOTE]
> Office 2019 tiles might be removed from the Start menu when you upgrade Office 201. This only occurs if Office 2019 app tiles are in a custom group in the Start menu and only contains the Office 2019 app tiles. To avoid this problem, place another app tile in the Office 2019 group prior to the upgrade. For example, add Notepad.exe or calc.exe to the group. This issue occurs because Office 2019 removes and reinstalls the apps when they are upgraded. Start removes empty groups when it detects that all apps for that group have been removed.
+
+You can deploy the resulting .xml file to devices using one of the following methods:
+
+- Configuration Service Provider (CSP)
+- Group Policy
+- Provisioning package
+
+[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)]
+
+#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
+
+You can use a mobile device management (MDM) policy to deploy a customized Start and taskbar layout to users. No reimaging is required. The layout can be updated simply by overwriting the `.xml` file that contains the layout. This feature enables you to customize Start layouts for different departments or organizations, with minimal management overhead.
+
+**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md).
+
+>[!WARNING]
+>When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups.
+
+Two features enable Start layout control:
+
+- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
+
+ >[!NOTE]
+ >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet.
+
+- In Microsoft Intune, you select the Start layout XML file and add it to a device configuration profile.
+
+ >[!NOTE]
+ >Please do not include XML Prologs like \ in the Start layout XML file. The settings may not be reflected correctly.
+
+## Create a policy for your customized Start layout
+
+The following example uses Microsoft Intune to configure an MDM policy that applies a customized Start layout:
+
+1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+
+1. Select **Devices** > **Configuration profiles** > **Create profile**.
+
+1. Enter the following properties:
+
+ - **Platform**: Select **Windows 10 and later**.
+ - **Profile type**: Select **Templates** > **Device restrictions** > **Create**.
+
+1. In **Basics**, enter the following properties:
+
+ - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify it later. For example, a good profile name is **Customize Start menu and taskbar**.
+ - **Description**: Enter a description for the profile. This setting is optional, but recommended.
+
+1. Select **Next**.
+
+1. In **Configuration settings**, select **Start**:
+
+ - If you're using an XML file, select **Start menu layout**. Browse to and select your Start layout XML file.
+ - If you don't have an XML file, configure the others settings. For more information on these settings, see [Start settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#start).
+
+1. Select **Next**.
+1. In **Scope tags**, select **Next**. For more information about scope tags, see [Use RBAC and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags).
+1. In **Assignments**, select the user or groups that will receive your profile. Select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
+1. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list.
+
+> [!NOTE]
+> For third party partner MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`.
+
+#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
+
+You can use a provisioning package that you create with Windows Configuration Designer to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead.
+
+> [!IMPORTANT]
+> If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy.
+
+**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions.
+
+Three features enable Start and taskbar layout control:
+
+- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
+
+ > [!NOTE]
+ > To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet.
+
+- [You can modify the Start .xml file](../taskbar/configure.md) to include `` or create an .xml file just for the taskbar configuration.
+
+- In Windows Configuration Designer, you use the **Policies/Start/StartLayout** setting to provide the contents of the .xml file that defines the Start and taskbar layout.
+
+
+
+## Prepare the Start layout XML file
+
+The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout section to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout section to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters.
+
+1. Copy the contents of layout.xml into an online tool that escapes characters.
+
+1. During the procedure to create a provisioning package, you will copy the text with the escape characters and paste it in the customizations.xml file for your project.
+
+## Create a provisioning package that contains a customized Start layout
+
+Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](../provisioning-packages/provisioning-install-icd.md)
+
+> [!IMPORTANT]
+> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
+
+1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe).
+
+1. Choose **Advanced provisioning**.
+
+1. Name your project, and click **Next**.
+
+1. Choose **All Windows desktop editions** and click **Next**.
+
+1. On **New project**, click **Finish**. The workspace for your package opens.
+
+1. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**.
+
+ > [!TIP]
+ > If **Start** is not listed, check the type of settings you selected in step 1. You must create the project using settings for **All Windows desktop editions**.
+
+1. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step.
+
+1. Save your project and close Windows Configuration Designer.
+
+1. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*)
+
+1. Open the customizations.xml file in a text editor.
+
+1. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape).
+
+1. Save and close the customizations.xml file.
+
+1. Open Windows Configuration Designer and open your project.
+
+1. On the **File** menu, select **Save.**
+
+1. On the **Export** menu, select **Provisioning package**.
+
+1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
+
+1. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
+
+ - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
+
+ - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package.
+
+1. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location.
+
+ Optionally, you can click **Browse** to change the default output location.
+
+1. Click **Next**.
+
+1. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
+
+ If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
+
+1. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
+
+ If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
+
+ - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
+ - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
+
+1. Copy the provisioning package to the target device.
+1. Double-click the ppkg file and allow it to install.
+
+#### [:::image type="icon" source="../images/icons/group-policy.svg"::: **GPO**](#tab/gpo)
+
+You can use a Group Policy Object (GPO) to deploy a customized Start and taskbar layout to users in a domain. No reimaging is required, and the layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead.
+
+This topic describes how to update Group Policy settings to display a customized Start and taskbar layout when the users sign in. By creating a domain-based GPO with these settings, you can deploy a customized Start and taskbar layout to users in a domain.
+
+>[!WARNING]
+>When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. When you apply a taskbar layout, users will still be able to pin and unpin apps, and change the order of pinned apps.
+
+**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md)
+
+## Operating system requirements
+
+The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. In Group Policy, ADMX files are used to define Registry-based policy settings in the Administrative Templates category. To find out how to create a central store for Administrative Templates files, see [article 929841, written for Windows Vista and still applicable](/troubleshoot/windows-server/group-policy/create-central-store-domain-controller) in the Microsoft Knowledge Base.
+
+Three features enable Start and taskbar layout control:
+
+- The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
+ >[!NOTE]
+ >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet.
+- [You can modify the Start .xml file](../taskbar/configure.md) to include `` or create an .xml file just for the taskbar configuration.
+- In Group Policy, you use the **Start Layout** settings for the **Start Menu and Taskbar** administrative template to set a Start and taskbar layout from an .xml file when the policy is applied. The Group Policy object doesn't support an empty tile layout, so the default tile layout for Windows is loaded in that case.
+
+>[!NOTE]
+>To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( https://go.microsoft.com/fwlink/p/?LinkId=620863).
+
+## Use Group Policy to apply a customized Start layout in a domain
+
+To apply the Start and taskbar layout to users in a domain, use the Group Policy Management Console (GPMC) to configure a domain-based Group Policy Object (GPO) that sets **Start Layout** policy settings in the **Start Menu and Taskbar** administrative template for users in a domain.
+
+The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied.
+
+The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed.
+
+The .xml file with the Start and taskbar layout must be located on shared network storage that is available to the users' computers when they sign in and the users must have Read-only access to the file. If the file is not available when the first user signs in, Start and the taskbar are not customized during the session, but the user will be prevented from making changes to Start. On subsequent sign-ins, if the file is available at sign-in, the layout it contains will be applied to the user's Start and taskbar.
+
+For information about deploying GPOs in a domain, see [Working with Group Policy Objects](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).
+
+## Use Group Policy to apply a customized Start layout on the local computer
+
+You can use the Local Group Policy Editor to provide a customized Start and taskbar layout for any user who signs in on the local computer. To display the customized Start and taskbar layout for any user who signs in, configure **Start Layout** policy settings for the **Start Menu and Taskbar** administrative template. You can use the **Start Menu and Taskbar** administrative template in **User Configuration** or **Computer Configuration**.
+
+>[!NOTE]
+>This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment).
+>
+>This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](/previous-versions/windows/it-pro/windows-vista/cc766291(v=ws.10)). The guide was written for Windows Vista and the procedures still apply to Windows 10.
+
+This procedure adds the customized Start and taskbar layout to the user configuration, which overrides any Start layout settings in the local computer configuration when a user signs in on the computer.
+
+To configure Start Layout policy settings in Local Group Policy Editor:
+
+1. On the test computer, press the Windows key, type **gpedit**, and then select **Edit group policy (Control panel)**.
+1. Go to **User Configuration** or **Computer Configuration** > **Administrative Templates** >**Start Menu and Taskbar**.
+ 
+1. Right-click **Start Layout** in the right pane, and click **Edit**.
+ This opens the **Start Layout** policy settings.
+ 
+1. Enter the following settings, and then click **OK**:
+ 1. Select **Enabled**.
+ 1. Under **Options**, specify the path to the .xml file that contains the Start and taskbar layout. For example, type **C:\\Users\\Test01\\StartScreenMarketing.xml**.
+ 1. Optionally, enter a comment to identify the Start and taskbar layout.
+
+ > [!IMPORTANT]
+ > If you disable Start Layout policy settings that have been in effect and then re-enable the policy, users will not be able to make changes to Start, however the layout in the .xml file will not be reapplied unless the file has been updated. In Windows PowerShell, you can update the timestamp on a file by running the following command:
+ >
+ > `(ls ).LastWriteTime = Get-Date`
+
+## Update a customized Start layout
+
+After you use Group Policy to apply a customized Start and taskbar layout on a computer or in a domain, you can update the layout simply by replacing the .xml file that is specified in the Start Layout policy settings with a file with a newer timestamp.
+
+::: zone-end
diff --git a/windows/configuration/start/customize-start-menu-layout-windows-11.md b/windows/configuration/start/customize-start-menu-layout-windows-11.md
deleted file mode 100644
index e8995d4ee4..0000000000
--- a/windows/configuration/start/customize-start-menu-layout-windows-11.md
+++ /dev/null
@@ -1,169 +0,0 @@
----
-title: Add or remove pinned apps on the Start menu in Windows 11
-description: Export Start layout to LayoutModification.json with pinned apps, and add or remove pinned apps. Use the JSON text in an MDM policy to deploy a custom Start menu layout to Windows 11 devices.
-ms.date: 01/10/2023
-ms.topic: article
-appliesto:
-- ✅ Windows 11
----
-
-# Customize the Start menu layout on Windows 11
-
-> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu).
-
-Your organization can deploy a customized Start layout to your Windows 11 devices. Customizing the Start layout is common when you have similar devices used by many users, or you want to pin specific apps.
-
-For example, you can override the default set of apps with your own a set of pinned apps, and in the order you choose. As an administrator, use this feature to pin apps, remove default pinned apps, order the apps, and more.
-
-To add apps you want pinned to the Start menu, you use a JSON file. In previous Windows versions, IT administrators used an XML file to customize the Start menu. The XML file isn't available on Windows 11 and later ***unless*** [you're an OEM](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu).
-
-This article shows you how to export an existing Start menu layout, and use the JSON in a Microsoft Intune policy.
-
-## Before you begin
-
-- When you customize the Start layout, you overwrite the entire full layout. A partial Start layout isn't available. Users can pin and unpin apps, and uninstall apps from Start. When a user signs in or Explorer restarts, Windows reapplies the MDM policy. This action restores the specified layout and doesn't retain any user changes.
-
- To prevent users from making any changes to the Start menu layout, see the [NoChangeStartMenu](/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-nochangestartmenu) policy.
-
-- It's recommended to use a mobile device management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use Microsoft Intune. Intune is a family of products that include Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises.
-
- In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started:
-
- - [Endpoint Management at Microsoft](/mem/endpoint-manager-overview)
- - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide)
- - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction)
-
-## Start menu features and areas
-
-In Windows 11, the Start menu is redesigned with a simplified set of apps that are arranged in a grid of pages. There aren't folders, groups, or different-sized app icons:
-
-:::image type="content" source="./images/start-windows-11.png" alt-text="Sample start menu layout on Windows 11 that shows pinned apps, access to all apps, and recommended files.":::
-
-Start has the following areas:
-
-- **Pinned**: Shows pinned apps, or a subset of all of the apps installed on the device. You can create a list of pinned apps you want on the devices using the **ConfigureStartPins** policy. **ConfigureStartPins** overrides the entire layout, which also removes apps that are pinned by default.
-
- This article shows you [how to use the **ConfigureStartPins** policy](#get-the-pinnedlist-json).
-
-- **All apps**: Users select this option to see an alphabetical list of all the apps on the device. This section can't be customized using the JSON file.
-
- The [Start/HideFrequentlyUsedApps CSP](/windows/client-management/mdm/policy-csp-start#start-hidefrequentlyusedapps) exposes settings that configure the "Most used" section, which is at the top of the all apps list.
-
- In **Intune**, you can configure this Start menu layout feature, and more. For more information on the Start menu settings you can configure in an Intune policy, see [Windows 10/11 device settings to allow or restrict features](/mem/intune/configuration/device-restrictions-windows-10#start).
-
- In **Group Policy**, there are policies that include settings that control the Start menu layout. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices:
-
- - `Computer Configuration\Administrative Templates\Start Menu and Taskbar`
- - `User Configuration\Administrative Templates\Start Menu and Taskbar`
-
-- **Recommended**: Shows recently opened files and recently installed apps. This section can only be customized in Windows 11 SE using the following policy.
-
- - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove Recommended section from Start Menu`
-
-## Create the JSON file
-
-On an existing Windows 11 device, set up your own Start layout with the pinned apps you want users to see. Then, use the [Windows PowerShell Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet to export the existing layout to a `LayoutModification.json` file.
-
-The JSON file controls the Start menu layout, and lists all the apps that are pinned. You can update the JSON file to:
-
-- Change the order of existing apps. The apps in the JSON file are shown on Start in the same order.
-- Add more apps by entering the app ID. For more information, see [Get the pinnedList JSON](#get-the-pinnedlist-json) (in this article).
-
-If you're familiar with creating JSON files, you can create your own `LayoutModification.json` file. But, it's easier and faster to export the layout from an existing device.
-
-### Export an existing Start layout
-
-1. Create a folder to save the `.json` file. For example, create the `C:\Layouts` folder.
-1. On a Windows 11 device, open the Windows PowerShell app.
-1. Run the following cmdlet. Name the file `LayoutModification.json`.
-
- ```powershell
- Export-StartLayout -Path "C:\Layouts\LayoutModification.json"
-
- ```
-
-### Get the pinnedList JSON
-
-1. Open the `LayoutModification.json` file in a JSON editor, such as Visual Studio Code or Notepad. For more information, see [edit JSON with Visual Studio Code](https://code.visualstudio.com/docs/languages/json).
-1. In the file, you see the `pinnedList` section. This section includes all of the pinned apps. Copy the `pinnedList` content in the JSON file. You'll use it in the next section.
-
- In the following example, you see that Microsoft Edge, Microsoft Word, the Microsoft Store app, and Notepad are pinned:
-
- ```json
- {
- "pinnedList": [
- { "desktopAppId": "MSEdge" },
- { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" },
- { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" },
- { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" }
- ]
- }
- ```
-
-1. Starting with Windows 11, the **ConfigureStartPins** policy is available. This policy uses the `LayoutModification.json` file to add apps to the Pinned section. In your JSON file, you can add more apps to this section using the following keys:
-
-| Key | Description |
-|--|--|
-| packagedAppID | Use this option for Universal Windows Platform apps. To pin a UWP app, use the app's AUMID. |
-| desktopAppID | Use this option for unpackaged Win32 apps. To pin a Win32 app, use the app's AUMID. If the app doesn't have an AUMID, then enter the `desktopAppLink` instead. |
-| desktopAppLink | Use this option for unpackaged Win32 apps that don't have an associated AUMID. To pin this type of app, use the path to the `.lnk` shortcut that points to the app. |
-
-## Use MDM to create and deploy a pinned list policy
-
-Now that you have the JSON syntax, you're ready to deploy your customized Start layout to devices in your organization.
-
-MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list.
-
-This section shows you how to create a pinned list policy in Intune. There isn't a Group Policy to create a pinned list.
-
-### Create a pinned list using an Intune policy
-
-To deploy this policy, the devices must be enrolled, and managed by your organization. For more information, see [What is device enrollment?](/mem/intune/enrollment/device-enrollment).
-
-1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
-1. Select **Devices** > **Configuration profiles** > **Create profile**.
-1. Enter the following properties:
-
- - **Platform**: Select **Windows 10 and later**.
- - **Profile**: Select **Templates** > **Custom**.
-
-1. Select **Create**.
-1. In **Basics**, enter the following properties:
-
- - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify them later. For example, a good profile name is **Win11: Custom Start layout**.
- - **Description**: Enter a description for the profile. This setting is optional, and recommended.
-
-1. Select **Next**.
-1. In **Configuration settings** > **OMA-URI**, select **Add**. Add the following properties:
-
- - **Name**: Enter something like **Configure Start pins**.
- - **Description**: Enter a description for the row. This setting is optional, and recommended.
- - **OMA-URI**: Enter `./Vendor/MSFT/Policy/Config/Start/ConfigureStartPins`.
- - **Data type**: Select **String**.
- - **Value**: Paste the JSON you created or updated in the previous section. For example, enter the following text:
-
- ```json
- {
- "pinnedList": [
- { "desktopAppId": "MSEdge" },
- { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" },
- { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" },
- { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" }
- ]
- }
- ```
-
- Your settings look similar to the following settings:
-
- :::image type="content" source="./images/endpoint-manager-admin-center-custom-oma-uri-start-layout.png" alt-text="Custom OMA-URI settings to customize Start menu layout using pinnedList":::
-
-1. Select **Save** > **Next** to save your changes.
-1. Configure the rest of the policy settings. For more specific information, see [Create a profile with custom settings](/mem/intune/configuration/custom-settings-configure).
-
-The Windows OS exposes many CSPs that apply to the Start menu. For a list, see [Supported CSP policies for Windows 11 Start menu](supported-csp-start-menu-layout-windows.md).
-
-### Deploy the policy using Intune
-
-When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized Start layout, the policy can be deployed anytime, including before users sign in the first time.
-
-For more information and guidance on assigning policies to devices in your organization, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
diff --git a/windows/configuration/start/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/start/customize-windows-10-start-screens-by-using-group-policy.md
deleted file mode 100644
index 6702f5d255..0000000000
--- a/windows/configuration/start/customize-windows-10-start-screens-by-using-group-policy.md
+++ /dev/null
@@ -1,85 +0,0 @@
----
-title: Customize Windows 10 Start and taskbar with group policy
-description: In Windows 10, you can use a Group Policy Object (GPO) to deploy a customized Start layout to users in a domain.
-ms.date: 12/31/2017
-ms.topic: how-to
-appliesto:
-- ✅ Windows 10
----
-
-# Customize Windows 10 Start and taskbar with Group Policy
-
->**Looking for consumer information?** See [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630)
-
-In Windows 10 Pro, Enterprise, and Education, you can use a Group Policy Object (GPO) to deploy a customized Start and taskbar layout to users in a domain. No reimaging is required, and the layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead.
-
-This topic describes how to update Group Policy settings to display a customized Start and taskbar layout when the users sign in. By creating a domain-based GPO with these settings, you can deploy a customized Start and taskbar layout to users in a domain.
-
->[!WARNING]
->When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. When you apply a taskbar layout, users will still be able to pin and unpin apps, and change the order of pinned apps.
-
-**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md)
-
-## Operating system requirements
-
-In Windows 10, version 1607, Start and taskbar layout control using Group Policy is supported in Windows 10 Enterprise and Windows 10 Education. In Windows 10, version 1703, Start and taskbar layout control using Group Policy is also supported in Windows 10 Pro.
-
-The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. In Group Policy, ADMX files are used to define Registry-based policy settings in the Administrative Templates category. To find out how to create a central store for Administrative Templates files, see [article 929841, written for Windows Vista and still applicable](/troubleshoot/windows-server/group-policy/create-central-store-domain-controller) in the Microsoft Knowledge Base.
-
-## How Start layout control works
-
-Three features enable Start and taskbar layout control:
-
-- The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
- >[!NOTE]
- >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet.
-- [You can modify the Start .xml file](../taskbar/configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration.
-- In Group Policy, you use the **Start Layout** settings for the **Start Menu and Taskbar** administrative template to set a Start and taskbar layout from an .xml file when the policy is applied. The Group Policy object doesn't support an empty tile layout, so the default tile layout for Windows is loaded in that case.
-
->[!NOTE]
->To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( https://go.microsoft.com/fwlink/p/?LinkId=620863).
-
-## Use Group Policy to apply a customized Start layout in a domain
-
-To apply the Start and taskbar layout to users in a domain, use the Group Policy Management Console (GPMC) to configure a domain-based Group Policy Object (GPO) that sets **Start Layout** policy settings in the **Start Menu and Taskbar** administrative template for users in a domain.
-
-The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied.
-
-The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed.
-
-The .xml file with the Start and taskbar layout must be located on shared network storage that is available to the users' computers when they sign in and the users must have Read-only access to the file. If the file is not available when the first user signs in, Start and the taskbar are not customized during the session, but the user will be prevented from making changes to Start. On subsequent sign-ins, if the file is available at sign-in, the layout it contains will be applied to the user's Start and taskbar.
-
-For information about deploying GPOs in a domain, see [Working with Group Policy Objects](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).
-
-## Use Group Policy to apply a customized Start layout on the local computer
-
-You can use the Local Group Policy Editor to provide a customized Start and taskbar layout for any user who signs in on the local computer. To display the customized Start and taskbar layout for any user who signs in, configure **Start Layout** policy settings for the **Start Menu and Taskbar** administrative template. You can use the **Start Menu and Taskbar** administrative template in **User Configuration** or **Computer Configuration**.
-
->[!NOTE]
->This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment).
->
->This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](/previous-versions/windows/it-pro/windows-vista/cc766291(v=ws.10)). The guide was written for Windows Vista and the procedures still apply to Windows 10.
-
-This procedure adds the customized Start and taskbar layout to the user configuration, which overrides any Start layout settings in the local computer configuration when a user signs in on the computer.
-
-**To configure Start Layout policy settings in Local Group Policy Editor**
-
-1. On the test computer, press the Windows key, type **gpedit**, and then select **Edit group policy (Control panel)**.
-1. Go to **User Configuration** or **Computer Configuration** > **Administrative Templates** >**Start Menu and Taskbar**.
- 
-1. Right-click **Start Layout** in the right pane, and click **Edit**.
- This opens the **Start Layout** policy settings.
- 
-1. Enter the following settings, and then click **OK**:
- 1. Select **Enabled**.
- 1. Under **Options**, specify the path to the .xml file that contains the Start and taskbar layout. For example, type **C:\\Users\\Test01\\StartScreenMarketing.xml**.
- 1. Optionally, enter a comment to identify the Start and taskbar layout.
-
- > [!IMPORTANT]
- > If you disable Start Layout policy settings that have been in effect and then re-enable the policy, users will not be able to make changes to Start, however the layout in the .xml file will not be reapplied unless the file has been updated. In Windows PowerShell, you can update the timestamp on a file by running the following command:
- >
- > `(ls ).LastWriteTime = Get-Date`
-
-## Update a customized Start layout
-
-After you use Group Policy to apply a customized Start and taskbar layout on a computer or in a domain, you can update the layout simply by replacing the .xml file that is specified in the Start Layout policy settings with a file with a newer timestamp.
diff --git a/windows/configuration/start/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/configuration/start/customize-windows-10-start-screens-by-using-mobile-device-management.md
deleted file mode 100644
index 1b378a93ca..0000000000
--- a/windows/configuration/start/customize-windows-10-start-screens-by-using-mobile-device-management.md
+++ /dev/null
@@ -1,69 +0,0 @@
----
-title: Change the Windows 10 Start and taskbar using mobile device management | Microsoft Docs
-description: In Windows 10, you can use a mobile device management (MDM) policy to deploy a customized Start and taskbar layout to users. For example, use Microsoft Intune to configure the start menu layout and taskbar, and deploy the policy to your devices.
-ms.topic: article
-appliesto:
-- ✅ Windows 10
-ms.date: 08/05/2021
----
-
-# Customize Windows 10 Start and taskbar with mobile device management (MDM)
-
->**Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630)
-
-In Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, you can use a mobile device management (MDM) policy to deploy a customized Start and taskbar layout to users. No reimaging is required. The layout can be updated simply by overwriting the `.xml` file that contains the layout. This feature enables you to customize Start layouts for different departments or organizations, with minimal management overhead.
-
->[!NOTE]
->Support for applying a customized taskbar using MDM is added in Windows 10, version 1703.
-
-**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions (also works for taskbar customization).
-
->[!WARNING]
->When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups.
-
-## How Start layout control works
-
-Two features enable Start layout control:
-
-- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
-
- >[!NOTE]
- >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet.
-
-- In Microsoft Intune, you select the Start layout XML file and add it to a device configuration profile.
-
- >[!NOTE]
- >Please do not include XML Prologs like \ in the Start layout XML file. The settings may not be reflected correctly.
-
-## Create a policy for your customized Start layout
-
-The following example uses Microsoft Intune to configure an MDM policy that applies a customized Start layout:
-
-1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
-
-1. Select **Devices** > **Configuration profiles** > **Create profile**.
-
-1. Enter the following properties:
-
- - **Platform**: Select **Windows 10 and later**.
- - **Profile type**: Select **Templates** > **Device restrictions** > **Create**.
-
-1. In **Basics**, enter the following properties:
-
- - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify it later. For example, a good profile name is **Customize Start menu and taskbar**.
- - **Description**: Enter a description for the profile. This setting is optional, but recommended.
-
-1. Select **Next**.
-
-1. In **Configuration settings**, select **Start**:
-
- - If you're using an XML file, select **Start menu layout**. Browse to and select your Start layout XML file.
- - If you don't have an XML file, configure the others settings. For more information on these settings, see [Start settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#start).
-
-1. Select **Next**.
-1. In **Scope tags**, select **Next**. For more information about scope tags, see [Use RBAC and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags).
-1. In **Assignments**, select the user or groups that will receive your profile. Select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
-1. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list.
-
-> [!NOTE]
-> For third party partner MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`.
diff --git a/windows/configuration/start/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/start/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md
deleted file mode 100644
index b8653f7973..0000000000
--- a/windows/configuration/start/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md
+++ /dev/null
@@ -1,115 +0,0 @@
----
-title: Customize Windows 10 Start and taskbar with provisioning packages
-description: In Windows 10, you can use a provisioning package to deploy a customized Start layout to users.
-ms.topic: article
-appliesto:
-- ✅ Windows 11
-ms.date: 12/31/2017
----
-
-# Customize Windows 10 Start and taskbar with provisioning packages
-
-> **Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630)
-
-> [!NOTE]
-> Currently, using provisioning packages to customize the Start menu layout is supported on Windows 1. It's not supported on Windows 11.
-
-In Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, version 1703, you can use a provisioning package that you create with Windows Configuration Designer to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead.
-
-> [!IMPORTANT]
-> If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy.
-
-**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions.
-
-## How Start layout control works
-
-Three features enable Start and taskbar layout control:
-
-- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
-
- > [!NOTE]
- > To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet.
-
-- [You can modify the Start .xml file](../taskbar/configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration.
-
-- In Windows Configuration Designer, you use the **Policies/Start/StartLayout** setting to provide the contents of the .xml file that defines the Start and taskbar layout.
-
-
-
-## Prepare the Start layout XML file
-
-The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout section to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout section to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters.
-
-1. Copy the contents of layout.xml into an online tool that escapes characters.
-
-1. During the procedure to create a provisioning package, you will copy the text with the escape characters and paste it in the customizations.xml file for your project.
-
-## Create a provisioning package that contains a customized Start layout
-
-Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](../provisioning-packages/provisioning-install-icd.md)
-
-> [!IMPORTANT]
-> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
-
-1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe).
-
-1. Choose **Advanced provisioning**.
-
-1. Name your project, and click **Next**.
-
-1. Choose **All Windows desktop editions** and click **Next**.
-
-1. On **New project**, click **Finish**. The workspace for your package opens.
-
-1. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**.
-
- > [!TIP]
- > If **Start** is not listed, check the type of settings you selected in step 1. You must create the project using settings for **All Windows desktop editions**.
-
-1. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step.
-
-1. Save your project and close Windows Configuration Designer.
-
-1. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*)
-
-1. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this:
-
- 
-
-1. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape).
-
-1. Save and close the customizations.xml file.
-
-1. Open Windows Configuration Designer and open your project.
-
-1. On the **File** menu, select **Save.**
-
-1. On the **Export** menu, select **Provisioning package**.
-
-1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
-
-1. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
-
- - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
-
- - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package.
-
-1. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location.
-
- Optionally, you can click **Browse** to change the default output location.
-
-1. Click **Next**.
-
-1. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
-
- If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
-
-1. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
-
- If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
-
- - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
- - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
-
-1. Copy the provisioning package to the target device.
-1. Double-click the ppkg file and allow it to install.
diff --git a/windows/configuration/start/start-layout-xml-desktop.md b/windows/configuration/start/start-layout-xml-desktop.md
index 4e97904532..a0c742fc52 100644
--- a/windows/configuration/start/start-layout-xml-desktop.md
+++ b/windows/configuration/start/start-layout-xml-desktop.md
@@ -1,7 +1,7 @@
---
title: Start layout XML for desktop editions of Windows 10
description: This article describes the options for customizing Start layout in LayoutModification.xml for Windows 10 desktop editions.
-ms.topic: article
+ms.topic: reference
ms.date: 10/02/2018
appliesto:
- ✅ Windows 10
@@ -192,7 +192,6 @@ You can use the **start:DesktopApplicationTile** tag to pin a Windows desktop ap
Column="4"/>
```
-
You must set the **DesktopApplicationLinkPath** attribute to the .lnk file that points to the Windows desktop application. The path also supports environment variables.
If you are pointing to a third-party Windows desktop application and the layout is being applied before the first boot, you must put the .lnk file in a legacy Start Menu directory before first boot; for example, "%APPDATA%\Microsoft\Windows\Start Menu\Programs\" or the all users profile "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\".
diff --git a/windows/configuration/start/start-secondary-tiles.md b/windows/configuration/start/start-secondary-tiles.md
index 60449adfba..17a578d2dd 100644
--- a/windows/configuration/start/start-secondary-tiles.md
+++ b/windows/configuration/start/start-secondary-tiles.md
@@ -1,7 +1,7 @@
---
title: Add image for secondary Microsoft Edge tiles
description: Add app tiles on Windows 10 that's a secondary tile.
-ms.topic: article
+ms.topic: how-to
ms.date: 12/31/2017
---
@@ -14,48 +14,30 @@ App tiles are the Start screen tiles that represent and launch an app. A tile th
- Status and updates from an important contact in a social app
- A website in Microsoft Edge
-In a Start layout for Windows 10, version 1703, you can include secondary tiles for Microsoft Edge that display a custom image, rather than a tile with the standard Microsoft Edge logo.
-
Suppose that the [Start layout that you export](customize-and-export-start-layout.md) had two secondary tiles, such as in the following image:
-In prior versions of Windows 10, when you applied the Start layout to a device, the tiles would display as shown in the following image:
-
-
-
-In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutEdgeAssets` and the policy setting `ImportEdgeAssets`, the tiles will now display the same as they did on the device from which you exported the Start layout.
+By using the PowerShell cmdlet `export-StartLayoutEdgeAssets` and the policy setting `ImportEdgeAssets`, the tiles display the same as they did on the device from which you exported the Start layout.
-**Example of secondary tiles in XML generated by Export-StartLayout**
+Example of secondary tiles in XML generated by Export-StartLayout:
```xml
+ AppUserModelID="Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe!App"
+ TileID="-9513911450"
+ DisplayName="Bing"
+ Size="2x2"
+ Column="0"
+ Row="0"
+ Arguments="-contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x36a8c2e4 -pinnedTimeHigh 0x01d0919b -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000014 http://www.bing.com/" Square150x150LogoUri="ms-appdata:///local/PinnedTiles/-9513911450/lowres.png"
+ Wide310x150LogoUri="ms-appx:///"
+ ShowNameOnSquare150x150Logo="true"
+ ShowNameOnWide310x150Logo="true"
+ BackgroundColor="#7fffffff"
+/>
```
## Export Start layout and assets
@@ -78,14 +60,13 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE
1. In Windows PowerShell, enter the following command:
-
```powershell
Export-StartLayoutEdgeAssets assets.xml
```
## Configure policy settings
-You can apply the customized Start layout with images for secondary tiles by using [mobile device management](customize-windows-10-start-screens-by-using-mobile-device-management.md) or [a provisioning package](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md). However, because you're including the images for secondary tiles, you must configure another setting to import the Edge assets.
+You can apply the customized Start layout with images for secondary tiles by using mobile device management (MDM) or a provisioning package. However, because you're including the images for secondary tiles, you must configure another setting to import the Edge assets.
### Using MDM
@@ -138,8 +119,6 @@ The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce
#### Create a provisioning package that contains a customized Start layout
-
-
Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](../provisioning-packages/provisioning-install-icd.md)
>[!IMPORTANT]
@@ -155,7 +134,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
1. On **New project**, select **Finish**. The workspace for your package opens.
-1. Expand **Runtime settings** > **Policies** > **Start**, and select **StartLayout**.
+1. Expand **Runtime settings** > **Policies** > **Start**, and select **StartLayout**.
>[!TIP]
>If **Start** is not listed, check the type of settings you selected in step 1. You must create the project using settings for **All Windows desktop editions**.
@@ -170,9 +149,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
1. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*)
-1. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this:
-
- 
+1. Open the customizations.xml file in a text editor.
1. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape).
diff --git a/windows/configuration/start/supported-csp-start-menu-layout-windows.md b/windows/configuration/start/supported-csp-start-menu-layout-windows.md
index fcc05cbe55..995c92acfa 100644
--- a/windows/configuration/start/supported-csp-start-menu-layout-windows.md
+++ b/windows/configuration/start/supported-csp-start-menu-layout-windows.md
@@ -2,7 +2,7 @@
title: Supported CSP policies to customize Start menu on Windows 11 | Microsoft Docs
description: See a list of the Policy CSP - Start items that are supported on Windows 11 to customize the Start menu.
ms.date: 12/31/2017
-ms.topic: article
+ms.topic: reference
appliesto:
- ✅ Windows 11
---
@@ -13,7 +13,7 @@ The Windows OS exposes CSPs that are used by MDM providers, like [Microsoft Intu
This article lists the CSPs that are available to customize the Start menu for Windows 11 devices. Windows 11 uses the [Policy CSP - Start](/windows/client-management/mdm/policy-csp-start). For more general information, see [Configuration service provider (CSP) reference](/windows/client-management/mdm/configuration-service-provider-reference).
-For information on customizing the Start menu layout using policy, see [Customize the Start menu layout on Windows 11](customize-start-menu-layout-windows-11.md).
+For information on customizing the Start menu layout using policy, see [Customize the Start menu layout](customize-and-export-start-layout.md).
## Existing Windows CSP policies that Windows 11 supports
@@ -47,14 +47,14 @@ For information on customizing the Start menu layout using policy, see [Customiz
- [Start/HideAppList](/windows/client-management/mdm/policy-csp-start#start-hideapplist)
- [Start/DisableContextMenus](/windows/client-management/mdm/policy-csp-start#start-disablecontextmenus)
+
## Existing CSP policies that Windows 11 doesn't support
- [Start/StartLayout](/windows/client-management/mdm/policy-csp-start#start-startlayout)
- Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout`
- [Start/HideRecentlyAddedApps](/windows/client-management/mdm/policy-csp-start#start-hiderecentlyaddedapps)
- - Group policy: `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove "Recently added" list from Start Menu`
-
+- Group policy: `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove "Recently added" list from Start Menu`
> [!NOTE]
> The following two policies are supported starting in Windows 11, version 22H2
diff --git a/windows/configuration/start/toc.yml b/windows/configuration/start/toc.yml
index 649a679653..77492cb6fe 100644
--- a/windows/configuration/start/toc.yml
+++ b/windows/configuration/start/toc.yml
@@ -1,23 +1,15 @@
items:
-- name: Customizethe Start menu in Windows 11
- href: customize-start-menu-layout-windows-11.md
+- name: Customize and export the Start layout
+ href: customize-and-export-start-layout.md
- name: Supported Start menu CSPs
href: supported-csp-start-menu-layout-windows.md
- name: Start layout and taskbar
href: windows-10-start-layout-options-and-policies.md
- name: Use XML
items:
- - name: Customize and export Start layout
- href: customize-and-export-start-layout.md
- name: Add image for secondary Microsoft Edge tiles
href: start-secondary-tiles.md
- name: Start layout XML for Windows 10 desktop editions (reference)
href: start-layout-xml-desktop.md
-- name: Use group policy
- href: customize-windows-10-start-screens-by-using-group-policy.md
-- name: Use provisioning packages
- href: customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md
-- name: Use mobile device management (MDM)
- href: customize-windows-10-start-screens-by-using-mobile-device-management.md
-- name: Troubleshoot Start menu errors
+- name: Troubleshoot Start menu errors 🔗
href: /troubleshoot/windows-client/shell-experience/troubleshoot-start-menu-errors
diff --git a/windows/configuration/start/windows-10-start-layout-options-and-policies.md b/windows/configuration/start/windows-10-start-layout-options-and-policies.md
index 6bc1b415c5..aa22d3e5da 100644
--- a/windows/configuration/start/windows-10-start-layout-options-and-policies.md
+++ b/windows/configuration/start/windows-10-start-layout-options-and-policies.md
@@ -1,8 +1,10 @@
---
title: Customize and manage the Windows 10 Start and taskbar layout
description: On Windows devices, customize the start menu layout and taskbar using XML, group policy, provisioning package, or MDM policy. You can add pinned folders, add a start menu size, pin apps to the taskbar, and more.
-ms.topic: article
+ms.topic: how-to
ms.date: 08/05/2021
+appliesto:
+- ✅ Windows 10
---
# Customize the Start menu and taskbar layout on Windows 10 and later devices
@@ -31,19 +33,17 @@ For more information, see [Customize and export Start layout](customize-and-expo
For the **taskbar**, you can use the same XML file as the start screen. Or, you can create a new XML file. When you have the XML file, add this file to a group policy or a provisioning package. Using these methods, you can deploy the XML file to your devices. When the devices receive your policy, they'll use the taskbar settings you configured in the XML file.
-For more information, see [Configure Windows 10 taskbar](../taskbar/configure-windows-10-taskbar.md).
+For more information, see [Configure Windows 10 taskbar](../taskbar/configure.md).
## Use group policy
Using group policy objects (GPO), you can manage different parts of the Start menu and taskbar. You don't need to reimage the devices. Using administrative templates, you configure settings in a policy, and then deploy this policy to your devices. [Start menu policy settings](#start-menu-policy-settings) (in this article) lists the policies you can configure.
-For more information, see [Use group policy to customize Windows 10 Start and taskbar](customize-windows-10-start-screens-by-using-group-policy.md).
-
## Use provisioning packages
Provisioning packages are containers that include a set of configuration settings. They're designed to configure a device quickly, without installing a new image. For more information on what provisioning packages are, and what they do, see [Provisioning packages](../provisioning-packages/provisioning-packages.md).
-Using a provisioning package, you can customize the Start and taskbar. For more information, see [Use provisioning packages to customize Windows 10 Start and taskbar](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md).
+Using a provisioning package, you can customize the Start and taskbar.
## Use a mobile device management (MDM) solution
@@ -51,8 +51,6 @@ Using an MDM solution, you add an XML file to a policy, and then deploy this pol
If you use Microsoft Intune for your MDM solution, then you can use settings to configure Start and the taskbar. For more information on the settings you can configure, see [Start settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#start).
-For more information, see [Use MDM to customize Windows 10 Start and taskbar](customize-windows-10-start-screens-by-using-mobile-device-management.md).
-
## Start menu policy settings
@@ -156,7 +154,7 @@ There are three app categories that could be pinned to a taskbar:
- Default Windows apps pinned during the OS installation, such as Microsoft Edge, File Explorer, and Store
- Apps pinned by your organization, such as in an unattended Windows setup
- In an unattended Windows setup file, it's recommended to use the [layoutmodification.xml method](../taskbar/configure-windows-10-taskbar.md) to configure the taskbar options. It's not recommended to use [TaskbarLinks](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-taskbarlinks).
+ In an unattended Windows setup file, it's recommended to use the [layoutmodification.xml method](../taskbar/configure.md) to configure the taskbar options. It's not recommended to use [TaskbarLinks](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-taskbarlinks).
The following example shows how apps are pinned. In OS configured to use a right-to-left language, the taskbar order is reversed:
@@ -184,19 +182,6 @@ In a clean install, if you apply a taskbar layout, only the following apps are p
After the layout is applied, users can pin more apps to the taskbar.
-### Taskbar configuration applied to Windows 10 upgrades
-
-When a device is upgraded to Windows 10, apps are already pinned to the taskbar. Some apps may have been pinned to the taskbar by a user, by a customized base image, or by using Windows unattended setup.
-
-On Windows 10 version 1607 and later, the new taskbar layout for upgrades apply the following behavior:
-
-- If users pinned apps to the taskbar, then those pinned apps remain. New apps are added to the right.
-- If users didn't pin any apps (they're pinned during installation or by policy), and the apps aren't in an updated layout file, then the apps are unpinned.
-- If a user didn't pin the app, and the app is in the updated layout file, then the app is pinned to the right.
-- New apps specified in updated layout file are pinned to right of user's pinned apps.
-
-[Learn how to configure Windows 10 taskbar](../taskbar/configure-windows-10-taskbar.md).
-
## Start layout configuration errors
If your Start layout customization isn't applied as you expect, open the **Event Viewer**. Go to **Applications and Services Log** > **Microsoft** > **Windows** > **ShellCommon-StartLayoutPopulation** > **Operational**. Look for the following events:
diff --git a/windows/configuration/store/find-aumid.md b/windows/configuration/store/find-aumid.md
new file mode 100644
index 0000000000..2e19c3355e
--- /dev/null
+++ b/windows/configuration/store/find-aumid.md
@@ -0,0 +1,114 @@
+---
+title: Find the Application User Model ID of an installed app
+description: Learn how to find the Application User Model ID (AUMID) of the applications installed on a Windows device.
+ms.topic: how-to
+ms.date: 02/06/2024
+---
+
+# Find the Application User Model ID of an installed app
+
+Windows uses Application User Model Id (AUMID, also known as AppId) values to identify and differentiate applications for switching, launching, telemetry, and other functions.\
+AUMID are unique to each installed application, and independent of the installation path or the application's display name.
+
+To configure Assigned Access, which is the Configuration Service Provider (CSP) used to create a kiosk or dedicated device, you must use the AUMID of the apps installed on a device. This article describes how to find the AUMID of an installed application.
+
+## How to find the AUMID
+
+You can find an application's AUMID by using Windows PowerShell, File Explorer, or the registry.
+
+Follow the instructions to retrieve AUMIDs, selecting the tool of your choice.
+
+# [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps)
+
+To get the names and AUMIDs for all apps that appear in the Start menu, open a Windows PowerShell command prompt and enter the following command:
+
+```powershell
+Get-StartApps
+```
+
+>[!NOTE]
+>Applications that are not listed in the Start menu will not appear in the output of the **Get-StartApps** cmdlet.
+
+To get the names and AUMIDs for Microsoft Store apps installed for the current user, open a Windows PowerShell command prompt and enter the following commands:
+
+```powershell
+$installedapps = Get-AppxPackage
+
+$aumidList = @()
+foreach ($app in $installedapps)
+{
+ foreach ($id in (Get-AppxPackageManifest $app).package.applications.application.id)
+ {
+ $aumidList += $app.packagefamilyname + "!" + $id
+ }
+}
+
+$aumidList
+```
+
+> [!NOTE]
+> You can add the `-user ` or the `-allusers` parameters to the `Get-AppxPackage` cmdlet to list AUMIDs for other users. You must use an elevated Windows PowerShell prompt to use the `-user` or -`allusers` parameters.
+
+### Example to get AUMIDs of the installed apps for the specified user
+
+The following code sample creates a function in Windows PowerShell that returns an array of AUMIDs of the installed apps for the specified user.
+
+### Example to get the AUMID of any application in the Start menu
+
+The following code sample creates a function in Windows PowerShell that returns the AUMID of any application currently listed in the Start menu.
+
+```powershell
+function Get-AppAUMID {
+param (
+[string]$AppName
+)
+$Apps = (New-Object -ComObject Shell.Application).NameSpace('shell:::{4234d49b-0245-4df3-b780-3893943456e1}').Items()
+if ($AppName){
+ $Result = $Apps | Where-Object { $_.name -like "*$AppName*" } | Select-Object name,@{n="AUMID";e={$_.path}}
+ if ($Result){
+ Return $Result
+ }
+ else {"Unable to locate {0}" -f $AppName}
+}
+else {
+ $Result = $Apps | Select-Object name,@{n="AUMID";e={$_.path}}
+ Return $Result
+}
+}
+```
+
+The following Windows PowerShell commands demonstrate how you can call the Get-AppAUMID function after you've created it.
+
+```powershell
+# Get the AUMID for OneDrive
+Get-AppAUMID -AppName OneDrive
+
+# Get the AUMID for Microsoft Word
+Get-AppAUMID -AppName Word
+
+# List all apps and their AUMID in the Start menu
+Get-AppAUMID
+```
+
+# [:::image type="icon" source="../images/icons/explorer.svg"::: **Explorer**](#tab/explorer)
+
+To get the names and AUMIDs for all apps installed for the current user, perform the following steps:
+
+1. Select **Start** > **Run**, enter `shell:Appsfolder`, and select **OK**
+1. A File Explorer window opens. Press Alt+V > **Choose details**
+1. In the **Choose Details** window, select **AppUserModelId**, and then select **OK**. (You might need to c
+1. Change the **View** setting from **Tiles** to **Details**
+
+:::image type="content" source="images/aumid-file-explorer.png" alt-text="Screenshot of the File Explorer showing the AUMID details." border="false":::
+
+# [:::image type="icon" source="../images/icons/registry.svg"::: **Registry**](#tab/registry)
+
+Querying the registry can only return information about Microsoft Store apps that are installed for the current user, while the Windows PowerShell query can find information for any account on the device.
+
+At a command prompt, type the following command:
+
+```cmd
+reg query HKEY_CURRENT_USER\Software\Classes\ActivatableClasses\Package /s /f AppUserModelID | find "REG_SZ"
+```
+
+---
diff --git a/windows/configuration/store/images/aumid-file-explorer.png b/windows/configuration/store/images/aumid-file-explorer.png
new file mode 100644
index 0000000000..0361cd9bfe
Binary files /dev/null and b/windows/configuration/store/images/aumid-file-explorer.png differ
diff --git a/windows/configuration/store/images/store-blocked.png b/windows/configuration/store/images/store-blocked.png
new file mode 100644
index 0000000000..c45c074f34
Binary files /dev/null and b/windows/configuration/store/images/store-blocked.png differ
diff --git a/windows/configuration/store/index.md b/windows/configuration/store/index.md
new file mode 100644
index 0000000000..09c92aea0f
--- /dev/null
+++ b/windows/configuration/store/index.md
@@ -0,0 +1,66 @@
+---
+title: Configure access to the Microsoft Store app
+description: Learn how to configure access to the Microsoft Store app.
+ms.topic: how-to
+ms.date: 03/13/2024
+---
+
+# Configure access to the Microsoft Store app
+
+Microsoft Store is a digital distribution platform that provides a way for users to install applications on Windows devices. For some organizations, business policies require blocking access to Microsoft Store.
+
+This article describes how to configure access to the Microsoft Store app in your organization.
+
+## Prevent access to the Microsoft Store app
+
+You can use configuration service provider (CSP) or group policy (GPO) settings to configure access to the Microsoft Store app. The CSP configuration is available to Windows Enterprise and Education editions only.
+
+[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)]
+
+#### [:::image type="icon" source="../images/icons/intune.svg" border="false"::: **Intune/CSP**](#tab/intune)
+
+[!INCLUDE [intune-settings-catalog-1](../../../includes/configure/intune-settings-catalog-1.md)]
+
+| Category | Setting name | Value |
+|--|--|--|
+| **Administrative Templates > Windows Components > Store** | Turn off the Store application| **Enabled**|
+
+[!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)]
+
+Alternatively, you can configure devices using a [custom policy][INT-1] with the [Policy CSP][CSP-1].
+
+| Setting |
+|--|
+|- **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/ADMX_WindowsStore/RemoveWindowsStore_2` - **Data type:** string - **Value:** ``|
+
+#### [:::image type="icon" source="../images/icons/group-policy.svg" border="false"::: **GPO**](#tab/gpo)
+
+[!INCLUDE [gpo-settings-1](../../../includes/configure/gpo-settings-1.md)]
+
+| Group policy path | Group policy setting | Value |
+| - | - | - |
+| **Computer Configuration\Administrative Templates\Windows Components\Store** | Turn off the Store application| **Enabled**|
+
+[!INCLUDE [gpo-settings-2](../../../includes/configure/gpo-settings-2.md)]
+
+---
+
+## User experience
+
+When you turn off the Microsoft Store application, users get the following message when they open it:
+
+:::image type="content" source="images/store-blocked.png" alt-text="Screenshot of the Microsoft Store app blocked access." border="false":::
+
+## Considerations
+
+Here are some considerations when you prevent access to the Microsoft Store app:
+
+- Microsoft Store applications keep updating automatically, by default
+- Users might still be able to install applications using Windows Package Manager (winget), or other methods, if they don't need to acquire the package from Microsoft Store
+- Devices managed by Microsoft Intune can still install applications sourced from Microsoft Store, even if you block access to the Microsoft Store app. To learn more, see [Add Microsoft Store apps to Microsoft Intune][INT-2]
+
+
+
+[CSP-1]: /windows/client-management/mdm/policy-csp-admx-windowsstore
+[INT-1]: /mem/intune/configuration/settings-catalog
+[INT-2]: /mem/intune/apps/store-apps-microsoft
diff --git a/windows/configuration/store/stop-employees-from-using-microsoft-store.md b/windows/configuration/store/stop-employees-from-using-microsoft-store.md
deleted file mode 100644
index a70a6b5922..0000000000
--- a/windows/configuration/store/stop-employees-from-using-microsoft-store.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: Configure access to Microsoft Store
-description: Learn how to configure access to Microsoft Store for client computers and mobile devices in your organization.
-ms.topic: conceptual
-ms.date: 11/29/2022
----
-
-# Configure access to Microsoft Store
-
-IT pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store.
-
-> [!IMPORTANT]
-> All executable code including Microsoft Store applications should have an update and maintenance plan. Organizations that use Microsoft Store applications should ensure that the applications can be updated through the Microsoft Store over the internet, through the [Private Store](/microsoft-store/distribute-apps-from-your-private-store), or [distributed offline](/microsoft-store/distribute-offline-apps) to keep the applications up to date.
-
-## Options to configure access to Microsoft Store
-
-You can use either AppLocker or Group Policy to configure access to Microsoft Store. For Windows 10, configuring access to Microsoft Store is only supported on Windows 10 Enterprise edition.
-
-## Block Microsoft Store using AppLocker
-
-Applies to: Windows 10 Enterprise, Windows 10 Education
-
-AppLocker provides policy-based access control management for applications. You can block access to Microsoft Store app with AppLocker by creating a rule for packaged apps. You'll give the name of the Microsoft Store app as the packaged app that you want to block from client computers.
-
-For more information on AppLocker, see [What is AppLocker?](/windows/device-security/applocker/what-is-applocker) For more information on creating an AppLocker rule for app packages, see [Create a rule for packaged apps](/windows/device-security/applocker/create-a-rule-for-packaged-apps).
-
-**To block Microsoft Store using AppLocker:**
-
-1. Enter **`secpol`** in the search bar to find and start AppLocker.
-
-1. In the console tree of the snap-in, select **Application Control Policies**, select **AppLocker**, and then select **Packaged app Rules**.
-
-1. On the **Action** menu, or by right-clicking on **Packaged app Rules**, select **Create New Rule**.
-
-1. On **Before You Begin**, select **Next**.
-
-1. On **Permissions**, select the action (allow or deny) and the user or group that the rule should apply to, and then select **Next**.
-
-1. On **Publisher**, you can select **Use an installed app package as a reference**, and then select **Select**.
-
-1. On **Select applications**, find and select **Store** under **Applications** column, and then select **OK**. Select **Next**.
-
- [Create a rule for packaged apps](/windows/device-security/applocker/create-a-rule-for-packaged-apps) has more information on reference options and setting the scope on packaged app rules.
-
-1. Optional: On **Exceptions**, specify conditions by which to exclude files from being affected by the rule. Conditions allow you to add exceptions based on the same rule reference and rule scope as you set before. Select **Next**.
-
-## Block Microsoft Store using configuration service provider
-
-Applies to: Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education
-
-If you have Windows 10 devices in your organization that are managed using a mobile device management (MDM) system, such as Microsoft Intune, you can block access to Microsoft Store app using the following configuration service providers (CSPs):
-
-- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider)
-- [AppLocker CSP](/windows/client-management/mdm/applocker-csp)
-
-For more information, see [Configure an MDM provider](/microsoft-store/configure-mdm-provider-microsoft-store-for-business).
-
-For more information on the rules available via AppLocker on the different supported operating systems, see [Operating system requirements](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker#operating-system-requirements).
-
-> [!IMPORTANT]
-> If you block access to the Store using CSP, you need to also configure [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store.
-
-## Block Microsoft Store using Group Policy
-
-Applies to: Windows 10 Enterprise, Windows 10 Education
-
-> [!NOTE]
-> Not supported on Windows 10 Pro, starting with version 151. For more info, see [Knowledge Base article #3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store).
-
-You can also use Group Policy to manage access to Microsoft Store.
-
-**To block Microsoft Store using Group Policy:**
-
-1. Enter **`gpedit`** in the search bar to find and start Group Policy Editor.
-
-1. In the console tree of the snap-in, select **Computer Configuration**, select **Administrative Templates**, select **Windows Components**, and then select **Store**.
-
-1. In the Setting pane, select **Turn off the Store application**, and then select **Edit policy setting**.
-
-1. On the **Turn off the Store application** setting page, select **Enabled**, and then select **OK**.
-
-> [!IMPORTANT]
-> When you enable the policy to **Turn off the Store application**, it turns off app updates from the Microsoft Store. To allow store apps to update, disable the policy to **Turn off automatic download and install of Updates**. This policy is found under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store**. This configuration allows in-box store apps to update while still blocking access to the store.
-
-## Show private store only using Group Policy
-
-Applies to Windows 10 Enterprise, Windows 10 Education
-
-If you're using Microsoft Store for Business and you want employees to only see apps you're managing in your private store, you can use Group Policy to show only the private store. Microsoft Store app will still be available, but employees can't view or purchase apps. Employees can view and install apps that the admin has added to your organization's private store.
-
-**To show private store only in Microsoft Store app:**
-
-1. Enter **`gpedit`** in the search bar, and then select **Edit group policy (Control panel)** to find and start Group Policy Editor.
-
-1. In the console tree of the snap-in, go to **User Configuration** or **Computer Configuration** > **Administrative Templates** > **Windows Components**, and then select **Store**.
-
-1. Right-click **Only display the private store within the Microsoft Store app** in the right pane, and select **Edit**.
-
- The **Only display the private store within the Microsoft Store app** policy settings will open.
-
-1. On the **Only display the private store within the Microsoft Store app** setting page, select **Enabled**, and then select **OK**.
-
-## Related articles
-
-[Distribute apps using your private store](/microsoft-store/distribute-apps-from-your-private-store)
-
-[Manage access to private store](/microsoft-store/manage-access-to-private-store)
diff --git a/windows/configuration/taskbar/configure-windows-10-taskbar.md b/windows/configuration/taskbar/configure.md
similarity index 50%
rename from windows/configuration/taskbar/configure-windows-10-taskbar.md
rename to windows/configuration/taskbar/configure.md
index b9ac41035d..8061acd2b6 100644
--- a/windows/configuration/taskbar/configure-windows-10-taskbar.md
+++ b/windows/configuration/taskbar/configure.md
@@ -4,10 +4,12 @@ description: Administrators can pin more apps to the taskbar and remove default
ms.topic: how-to
ms.date: 08/18/2023
appliesto:
-- ✅ Windows 10
+zone_pivot_groups: windows-versions-11-10
---
-# Configure Windows 10 taskbar
+# Configure Windows Taskbar
+
+::: zone pivot="windows-10"
Starting in Windows 10, version 1607, administrators can pin more apps to the taskbar and remove default pinned apps from the taskbar by adding a `` section to a layout modification XML file. This method never removes user-pinned apps from the taskbar.
@@ -38,7 +40,7 @@ To configure the taskbar:
- Add `xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"` to the first line of the file, before the closing \>.
- Use `` and [AUMID](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) to pin Universal Windows Platform apps
- Use `` and Desktop Application Link Path to pin desktop applications
-1. Apply the layout modification XML file to devices using [Group Policy](../start/customize-windows-10-start-screens-by-using-group-policy.md) or a [provisioning package created in Windows Imaging and Configuration Designer (Windows ICD)](../start/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md).
+1. Apply the layout modification XML file to devices using Group Policy or a provisioning package.
>[!IMPORTANT]
>If you use a provisioning package or import-startlayout to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using Group Policy.
@@ -308,3 +310,231 @@ The resulting taskbar for computers in any other country region:
```
+
+::: zone-end
+
+::: zone pivot="windows-11"
+
+> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu).
+
+Your organization can deploy a customized taskbar to your Windows devices. Customizing the taskbar is common when your organization uses a common set of apps, or wants to bring attention to specific apps. You can also remove the default pinned apps.
+
+For example, you can override the default set of apps with your own a set of pinned apps, and in the order you choose. As an administrator, use this feature to pin apps, remove default pinned apps, order the apps, and more on the taskbar.
+
+To add apps you want pinned to the taskbar, you use an XML file. You can use an existing XML file, or create a new file. If you have an XML file that's used on Windows 10 devices, you can also use it on Windows 11 devices. You may have to update the App IDs.
+
+This article shows you how to create the XML file, add apps to the XML, and deploy the XML file. To learn how to customize the taskbar buttons, see [CSP policies to customize Windows 11 taskbar buttons](supported-csp-taskbar-windows.md#csp-policies-to-customize-windows-11-taskbar-buttons).
+
+## Before you begin
+
+- There isn't a limit on the number of apps that you can pin. In the XML file, add apps using the [Application User Model ID (AUMID)](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) or Desktop Application Link Path (the local path to the app).
+- There are some situations that an app pinned in your XML file won't be pinned in the taskbar. For example, if an app isn't approved or installed for a user, then the pinned icon won't show on the taskbar.
+- The order of apps in the XML file dictates the order of pinned apps on the taskbar, from left to right, and to the right of any existing apps pinned by the user. If the OS is configured to use a right-to-left language, then the taskbar order is reversed.
+- Some classic Windows applications are packaged differently than they were in previous versions of Windows, including Notepad and File Explorer. Be sure to enter the correct AppID. For more information, see [Application User Model ID (AUMID)](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) and [Get the AUMID and Desktop app link path](#get-the-aumid-and-desktop-app-link-path) (in this article).
+- It's recommended to use a Mobile Device Management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use Microsoft Intune. Intune is a family of products that include Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises.
+
+ In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started:
+
+ - [Endpoint Management at Microsoft](/mem/endpoint-manager-overview)
+ - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide)
+ - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction)
+
+## Create the XML file
+
+1. In a text editor, such as Visual Studio Code, create a new XML file. To help you get started, you can copy and paste the following XML sample. The sample pins 2 apps to the taskbar - File Explorer and the Command Prompt:
+
+ ```xml
+
+
+
+
+
+
+
+
+
+
+
+ ```
+
+1. In the `` node, add (or remove) the apps you want pinned. You can pin Universal Windows Platform (UWP) apps and desktop apps:
+
+ - ``: Select this option for UWP apps. Add the [AUMID](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) of the UWP app.
+ - ``: Select this option for desktop apps. Add the Desktop Application Link Path of the desktop app.
+
+ You can pin as many apps as you want. Just keep adding them to the list. Remember, the app order in the list is the same order the apps are shown on the taskbar.
+
+ For more information, see [Get the AUMID and Desktop app link path](#get-the-aumid-and-desktop-app-link-path) (in this article).
+
+1. In the `` node, the apps you add are pinned after the default apps. If you want to remove the default apps, and only show the apps you add in the XML file, then add `PinListPlacement="Replace"`:
+
+ - ``: Keeps the default pinned apps. After the default apps, the apps you add are pinned.
+ - ``: Unpins the default apps. Only the apps you add are pinned.
+
+ If you want to remove some of the default pinned apps, then add `PinListPlacement="Replace"`. When you add your apps to ``, include the default apps you still want pinned.
+
+1. In the `` node, use `region=" | "` to use different taskbar configurations based on the device locale and region.
+
+ In the following XML example, two regions are added: `US|UK` and `DE|FR`:
+
+ ```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ```
+
+ The taskbar applies when:
+
+ - If the `` node has a country or region, then the apps are pinned on devices configured for that country or region.
+ - If the `` node doesn't have a region tag for the current region, then the first `` node with no region is applied.
+
+1. Save the file, and name the file so you know what it is. For example, name the file something like `TaskbarLayoutModification.xml`. Once you have the file, it's ready to be deployed to your Windows devices.
+
+## Use Group Policy or MDM to create and deploy a taskbar policy
+
+Now that you have the XML file with your customized taskbar, you're ready to deploy it to devices in your organization. You can deploy your taskbar XML file using Group Policy, or using an MDM provider, like Microsoft Intune.
+
+This section shows you how to deploy the XML both ways.
+
+### Use Group Policy to deploy your XML file
+
+Use the following steps to add your XML file to a group policy, and apply the policy:
+
+1. Open your policy editor. For example, open Group Policy Management Console (GPMC) for domain-based group policies, or open `gpedit` for local policies.
+1. Go to one of the following policies:
+
+ - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout`
+ - `User Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout`
+
+1. Double-select `Start Layout` > **Enable**. Enter the fully qualified path to your XML file, including the XML file name. You can enter a local path, like `C:\StartLayouts\TaskbarLayoutModification.xml`, or a network path, like `\\Server\Share\TaskbarLayoutModification.xml`. Be sure you enter the correct file path. If using a network share, be sure to give users read access to the XML file. If the file isn't available when the user signs in, then the taskbar isn't changed. Users can't customize the taskbar when this setting is enabled.
+
+ Your policy looks like the following policy:
+
+ :::image type="content" source="images/start-layout-group-policy.png" alt-text="Add your taskbar layout XML file to the Start Layout policy on Windows devices.":::
+
+ The `User Configuration\Administrative Templates\Start Menu and Taskbar` policy includes other settings that control the taskbar. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices.
+
+1. When you apply the policy, the taskbar includes your changes. The next time users sign in, they'll see the changes.
+
+ For more information on using group policies, see [Implement Group Policy Objects](/training/modules/implement-group-policy-objects/).
+
+### Create a Microsoft Intune policy to deploy your XML file
+
+MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list.
+
+Use the following steps to create an Intune policy that deploys your taskbar XML file:
+
+1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+
+1. Select **Devices** > **Configuration profiles** > **Create profile**.
+
+1. Enter the following properties:
+
+ - **Platform**: Select **Windows 10 and later**.
+ - **Profile type**: Select **Templates** > **Device restrictions** > **Create**.
+
+1. In **Basics**, enter the following properties:
+
+ - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify it later. For example, a good profile name is **Win11: Custom taskbar**.
+ - **Description**: Enter a description for the profile. This setting is optional, and recommended.
+
+1. Select **Next**.
+
+1. In **Configuration settings**, select **Start** > **Start menu layout**. Browse to, and select your taskbar XML file.
+
+1. Select **Next**, and configure the rest of the policy settings. For more specific information, see [Configure device restriction settings](/mem/intune/configuration/device-restrictions-configure).
+
+1. When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized taskbar, the policy can also be deployed before users sign in the first time.
+
+ For more information and guidance on assigning policies using Microsoft Intune, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
+
+> [!NOTE]
+> For third party partner MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`.
+
+## Get the AUMID and Desktop app link path
+
+In the layout modification XML file, you add apps in the XML markup. To pin an app, you enter the AUMID or Desktop Application Link Path. The easiest way to find this app information is to use the [Export-StartLayout](/powershell/module/startlayout/export-startlayout) Windows PowerShell cmdlet:
+
+1. On an existing Windows 11 device, pin the app to the Start menu.
+1. Create a folder to save an output file. For example, create the `C:\Layouts` folder.
+1. Open the Windows PowerShell app, and run the following cmdlet:
+
+ ```powershell
+ Export-StartLayout -Path "C:\Layouts\GetIDorPath.xml"
+ ```
+
+1. Open the generated GetIDorPath.xml file, and look for the app you pinned. When you find the app, get the AppID or Path. Add these properties to your XML file.
+
+## Pin order for all apps
+
+On a taskbar, the following apps are typically pinned:
+
+- Apps pinned by the user
+- Default Windows apps pinned during the OS installation, such as Microsoft Edge, File Explorer, and Microsoft Store.
+- Apps pinned by your organization, such as in an unattended Windows setup.
+
+ In an unattended Windows setup file, use the XML file you created in this article. It's not recommended to use [TaskbarLinks](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-taskbarlinks).
+
+Apps are pinned in the following order:
+
+1. Windows default apps are pinned first.
+1. User-pinned apps are pinned after the Windows default apps.
+1. XML-pinned apps are pinned after the user-pinned apps.
+
+If the OS is configured to use a right-to-left language, then the taskbar order is reversed.
+
+## OS install and upgrade
+
+- On a clean install of the Windows client, if you apply a taskbar layout, the following apps are pinned to the taskbar:
+
+ - Apps you specifically add
+ - Any default apps you don't remove
+
+ After the taskbar layout is applied, users can pin more apps, change the order, and unpin apps.
+
+- On a Windows client upgrade, apps are already pinned to the taskbar. These apps may have been pinned by a user, by an image, or by using Windows unattended setup. For upgrades, the taskbar layout applies the following behavior:
+
+ - If users pinned apps to the taskbar, then those pinned apps remain. New apps are pinned after the existing user-pinned apps.
+ - If the apps are pinned during the install or by a policy (not by a user), and the apps aren't pinned in an updated layout file, then the apps are unpinned.
+ - If a user didn't pin an app, and the same app is pinned in the updated layout file, then the app is pinned after any existing pinned apps.
+ - New apps in updated layout file are pinned after the user's pinned apps.
+
+ After the layout is applied, users can pin more apps, change the order, and unpin apps.
+
+::: zone-end
diff --git a/windows/configuration/taskbar/customize-taskbar-windows-11.md b/windows/configuration/taskbar/customize-taskbar-windows-11.md
deleted file mode 100644
index 6af8ef100f..0000000000
--- a/windows/configuration/taskbar/customize-taskbar-windows-11.md
+++ /dev/null
@@ -1,234 +0,0 @@
----
-title: Configure and customize Windows 11 taskbar
-description: On Windows 11 devices, pin and unpin default apps and organization apps on the taskbar using an XML file. Deploy the taskbar XML file using Group Policy or MDM and Microsoft Intune. See what happens to the taskbar when the Windows OS client is installed or upgraded.
-ms.date: 08/17/2023
-ms.topic: article
-ms.collection:
- - tier1
-appliesto:
-- ✅ Windows 11
----
-
-# Customize the Taskbar on Windows 11
-
-> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu).
-
-Your organization can deploy a customized taskbar to your Windows devices. Customizing the taskbar is common when your organization uses a common set of apps, or wants to bring attention to specific apps. You can also remove the default pinned apps.
-
-For example, you can override the default set of apps with your own a set of pinned apps, and in the order you choose. As an administrator, use this feature to pin apps, remove default pinned apps, order the apps, and more on the taskbar.
-
-To add apps you want pinned to the taskbar, you use an XML file. You can use an existing XML file, or create a new file. If you have an XML file that's used on Windows 10 devices, you can also use it on Windows 11 devices. You may have to update the App IDs.
-
-This article shows you how to create the XML file, add apps to the XML, and deploy the XML file. To learn how to customize the taskbar buttons, see [CSP policies to customize Windows 11 taskbar buttons](supported-csp-taskbar-windows.md#csp-policies-to-customize-windows-11-taskbar-buttons).
-
-## Before you begin
-
-- There isn't a limit on the number of apps that you can pin. In the XML file, add apps using the [Application User Model ID (AUMID)](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) or Desktop Application Link Path (the local path to the app).
-- There are some situations that an app pinned in your XML file won't be pinned in the taskbar. For example, if an app isn't approved or installed for a user, then the pinned icon won't show on the taskbar.
-- The order of apps in the XML file dictates the order of pinned apps on the taskbar, from left to right, and to the right of any existing apps pinned by the user. If the OS is configured to use a right-to-left language, then the taskbar order is reversed.
-- Some classic Windows applications are packaged differently than they were in previous versions of Windows, including Notepad and File Explorer. Be sure to enter the correct AppID. For more information, see [Application User Model ID (AUMID)](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) and [Get the AUMID and Desktop app link path](#get-the-aumid-and-desktop-app-link-path) (in this article).
-- It's recommended to use a Mobile Device Management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use Microsoft Intune. Intune is a family of products that include Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises.
-
- In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started:
-
- - [Endpoint Management at Microsoft](/mem/endpoint-manager-overview)
- - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide)
- - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction)
-
-## Create the XML file
-
-1. In a text editor, such as Visual Studio Code, create a new XML file. To help you get started, you can copy and paste the following XML sample. The sample pins 2 apps to the taskbar - File Explorer and the Command Prompt:
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
- ```
-
-1. In the `` node, add (or remove) the apps you want pinned. You can pin Universal Windows Platform (UWP) apps and desktop apps:
-
- - ``: Select this option for UWP apps. Add the [AUMID](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) of the UWP app.
- - ``: Select this option for desktop apps. Add the Desktop Application Link Path of the desktop app.
-
- You can pin as many apps as you want. Just keep adding them to the list. Remember, the app order in the list is the same order the apps are shown on the taskbar.
-
- For more information, see [Get the AUMID and Desktop app link path](#get-the-aumid-and-desktop-app-link-path) (in this article).
-
-1. In the `` node, the apps you add are pinned after the default apps. If you want to remove the default apps, and only show the apps you add in the XML file, then add `PinListPlacement="Replace"`:
-
- - ``: Keeps the default pinned apps. After the default apps, the apps you add are pinned.
- - ``: Unpins the default apps. Only the apps you add are pinned.
-
- If you want to remove some of the default pinned apps, then add `PinListPlacement="Replace"`. When you add your apps to ``, include the default apps you still want pinned.
-
-1. In the `` node, use `region=" | "` to use different taskbar configurations based on the device locale and region.
-
- In the following XML example, two regions are added: `US|UK` and `DE|FR`:
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
-
- The taskbar applies when:
-
- - If the `` node has a country or region, then the apps are pinned on devices configured for that country or region.
- - If the `` node doesn't have a region tag for the current region, then the first `` node with no region is applied.
-
-1. Save the file, and name the file so you know what it is. For example, name the file something like `TaskbarLayoutModification.xml`. Once you have the file, it's ready to be deployed to your Windows devices.
-
-## Use Group Policy or MDM to create and deploy a taskbar policy
-
-Now that you have the XML file with your customized taskbar, you're ready to deploy it to devices in your organization. You can deploy your taskbar XML file using Group Policy, or using an MDM provider, like Microsoft Intune.
-
-This section shows you how to deploy the XML both ways.
-
-### Use Group Policy to deploy your XML file
-
-Use the following steps to add your XML file to a group policy, and apply the policy:
-
-1. Open your policy editor. For example, open Group Policy Management Console (GPMC) for domain-based group policies, or open `gpedit` for local policies.
-1. Go to one of the following policies:
-
- - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout`
- - `User Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout`
-
-1. Double-select `Start Layout` > **Enable**. Enter the fully qualified path to your XML file, including the XML file name. You can enter a local path, like `C:\StartLayouts\TaskbarLayoutModification.xml`, or a network path, like `\\Server\Share\TaskbarLayoutModification.xml`. Be sure you enter the correct file path. If using a network share, be sure to give users read access to the XML file. If the file isn't available when the user signs in, then the taskbar isn't changed. Users can't customize the taskbar when this setting is enabled.
-
- Your policy looks like the following policy:
-
- :::image type="content" source="images/start-layout-group-policy.png" alt-text="Add your taskbar layout XML file to the Start Layout policy on Windows devices.":::
-
- The `User Configuration\Administrative Templates\Start Menu and Taskbar` policy includes other settings that control the taskbar. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices.
-
-1. When you apply the policy, the taskbar includes your changes. The next time users sign in, they'll see the changes.
-
- For more information on using group policies, see [Implement Group Policy Objects](/training/modules/implement-group-policy-objects/).
-
-### Create a Microsoft Intune policy to deploy your XML file
-
-MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list.
-
-Use the following steps to create an Intune policy that deploys your taskbar XML file:
-
-1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
-
-1. Select **Devices** > **Configuration profiles** > **Create profile**.
-
-1. Enter the following properties:
-
- - **Platform**: Select **Windows 10 and later**.
- - **Profile type**: Select **Templates** > **Device restrictions** > **Create**.
-
-1. In **Basics**, enter the following properties:
-
- - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify it later. For example, a good profile name is **Win11: Custom taskbar**.
- - **Description**: Enter a description for the profile. This setting is optional, and recommended.
-
-1. Select **Next**.
-
-1. In **Configuration settings**, select **Start** > **Start menu layout**. Browse to, and select your taskbar XML file.
-
-1. Select **Next**, and configure the rest of the policy settings. For more specific information, see [Configure device restriction settings](/mem/intune/configuration/device-restrictions-configure).
-
-1. When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized taskbar, the policy can also be deployed before users sign in the first time.
-
- For more information and guidance on assigning policies using Microsoft Intune, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
-
-> [!NOTE]
-> For third party partner MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`.
-
-## Get the AUMID and Desktop app link path
-
-In the layout modification XML file, you add apps in the XML markup. To pin an app, you enter the AUMID or Desktop Application Link Path. The easiest way to find this app information is to use the [Export-StartLayout](/powershell/module/startlayout/export-startlayout) Windows PowerShell cmdlet:
-
-1. On an existing Windows 11 device, pin the app to the Start menu.
-1. Create a folder to save an output file. For example, create the `C:\Layouts` folder.
-1. Open the Windows PowerShell app, and run the following cmdlet:
-
- ```powershell
- Export-StartLayout -Path "C:\Layouts\GetIDorPath.xml"
- ```
-
-1. Open the generated GetIDorPath.xml file, and look for the app you pinned. When you find the app, get the AppID or Path. Add these properties to your XML file.
-
-## Pin order for all apps
-
-On a taskbar, the following apps are typically pinned:
-
-- Apps pinned by the user
-- Default Windows apps pinned during the OS installation, such as Microsoft Edge, File Explorer, and Microsoft Store.
-- Apps pinned by your organization, such as in an unattended Windows setup.
-
- In an unattended Windows setup file, use the XML file you created in this article. It's not recommended to use [TaskbarLinks](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-taskbarlinks).
-
-Apps are pinned in the following order:
-
-1. Windows default apps are pinned first.
-1. User-pinned apps are pinned after the Windows default apps.
-1. XML-pinned apps are pinned after the user-pinned apps.
-
-If the OS is configured to use a right-to-left language, then the taskbar order is reversed.
-
-## OS install and upgrade
-
-- On a clean install of the Windows client, if you apply a taskbar layout, the following apps are pinned to the taskbar:
-
- - Apps you specifically add
- - Any default apps you don't remove
-
- After the taskbar layout is applied, users can pin more apps, change the order, and unpin apps.
-
-- On a Windows client upgrade, apps are already pinned to the taskbar. These apps may have been pinned by a user, by an image, or by using Windows unattended setup. For upgrades, the taskbar layout applies the following behavior:
-
- - If users pinned apps to the taskbar, then those pinned apps remain. New apps are pinned after the existing user-pinned apps.
- - If the apps are pinned during the install or by a policy (not by a user), and the apps aren't pinned in an updated layout file, then the apps are unpinned.
- - If a user didn't pin an app, and the same app is pinned in the updated layout file, then the app is pinned after any existing pinned apps.
- - New apps in updated layout file are pinned after the user's pinned apps.
-
- After the layout is applied, users can pin more apps, change the order, and unpin apps.
diff --git a/windows/configuration/taskbar/toc.yml b/windows/configuration/taskbar/toc.yml
index cbe3e66b83..906f16ce7c 100644
--- a/windows/configuration/taskbar/toc.yml
+++ b/windows/configuration/taskbar/toc.yml
@@ -1,7 +1,5 @@
items:
-- name: Customize the Taskbar in Windows 11
- href: customize-taskbar-windows-11.md
+- name: Customize the Taskbar
+ href: configure.md
- name: Supported Taskbar CSPs
- href: supported-csp-taskbar-windows.md
-- name: Customize the Taskbar in Windows 10
- href: configure-windows-10-taskbar.md
\ No newline at end of file
+ href: supported-csp-taskbar-windows.md
\ No newline at end of file
diff --git a/windows/configuration/tips/manage-tips-and-suggestions.md b/windows/configuration/tips/manage-tips-and-suggestions.md
deleted file mode 100644
index 02b2484664..0000000000
--- a/windows/configuration/tips/manage-tips-and-suggestions.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Manage Windows 10 and Microsoft Store tips, fun facts, and suggestions
-description: Windows 10 provides organizations with various options to manage user experiences to provide a consistent and predictable experience for employees.
-ms.topic: article
-ms.date: 09/20/2017
----
-
-# Manage Windows 10 and Microsoft Store tips, "fun facts", and suggestions
-
-Since its inception, Windows 10 has included a number of user experience features that provide useful tips, "fun facts", and suggestions as you use Windows, as well as app suggestions from the Microsoft Store. These features are designed to help people get the most out of their Windows 10 experience by, for example, sharing new features, providing more details on the features they use, or sharing content available in the Microsoft Store. Examples of such user experiences include:
-
-* **Windows Spotlight on the lock screen**. Daily updated images on the lock screen that can include additional facts and tips in "hotspots" that are revealed on hover.
-* **Start menu app suggestions**. App suggestions in Start that recommend productivity tool or utilities from the Microsoft Store.
-* **Additional apps on Start**. Additional apps pre-installed on the Start screen which can enhance the user's experience.
-* **Windows tips**. Contextual tips that appear based on specific user actions to reveal related Windows features or help users complete a scenario.
-* **Microsoft account notifications**. For users who have a connected Microsoft account, toast notifications about their account like parental control notifications or subscription expiration.
-
->[!TIP]
-> On all Windows desktop editions, users can directly enable and disable Windows 10 tips, "fun facts", and suggestions and Microsoft Store suggestions. For example, users are able to select personal photos for the lock screen as opposed to the images provided by Microsoft, or turn off tips, "fun facts", or suggestions as they use Windows.
-
-Windows 10 provides organizations the ability to centrally manage the type of content provided by these features through Group Policy or mobile device management (MDM). The following table describes how administrators can manage suggestions and tips in Windows 10 commercial and education editions.
-
-## Options available to manage Windows 10 tips and "fun facts" and Microsoft Store suggestions
-
-| Windows 10 edition | Disable | Show Microsoft apps only | Show Microsoft and popular third-party apps |
-|--|--|--|--|
-| Windows 10 Pro | No | Yes | Yes (default) |
-| Windows 10 Enterprise | Yes | Yes | Yes (default) |
-| Windows 10 Pro Education | Yes (default) | Yes | No (setting cannot be changed) |
-| Windows 10 Education | Yes (default) | Yes | No (setting cannot be changed) |
-
-[Learn more about policy settings for Windows Spotlight.](../lock-screen/windows-spotlight.md)
diff --git a/windows/configuration/toc.yml b/windows/configuration/toc.yml
index ca93c8e7db..25256515be 100644
--- a/windows/configuration/toc.yml
+++ b/windows/configuration/toc.yml
@@ -9,23 +9,23 @@ items:
href: start/toc.yml
- name: Taskbar
href: taskbar/toc.yml
+ - name: Windows Spotlight
+ href: lock-screen/windows-spotlight.md
- name: Microsoft Store
items:
- - name: Configure access to the Microsoft Store
- href: store/stop-employees-from-using-microsoft-store.md
- - name: Manage Microsoft Store tips, "fun facts", and suggestions
- href: tips/manage-tips-and-suggestions.md
-- name: Windows Spotlight
- href: lock-screen/windows-spotlight.md
+ - name: Configure access to Microsoft Store
+ href: store/index.md
+ - name: Find the AUMID of an installed app
+ href: store/find-aumid.md
- name: Cellular settings
href: cellular/provisioning-apn.md
-- name: Kiosks and restricted user experience
- href: kiosk/toc.yml
+- name: Kiosks and restricted user experiences
+ href: assigned-access/toc.yml
- name: Multi-user and guest devices
href: shared-pc/toc.yml
-- name: Use provisioning packages
+- name: Provisioning packages
href: provisioning-packages/toc.yml
-- name: Windows Configuration Designer reference
+- name: Windows Configuration Designer
href: wcd/toc.yml
- name: User Experience Virtualization (UE-V)
href: ue-v/toc.yml
\ No newline at end of file
diff --git a/windows/configuration/wcd/wcd-policies.md b/windows/configuration/wcd/wcd-policies.md
index 6ef6203e11..68c83b8121 100644
--- a/windows/configuration/wcd/wcd-policies.md
+++ b/windows/configuration/wcd/wcd-policies.md
@@ -295,7 +295,7 @@ This section describes the **Policies** settings that you can configure in [prov
## KioskBrowser
-These settings apply to the **Kiosk Browser** app available in Microsoft Store. For more information, see [Guidelines for web browsers](../kiosk/guidelines-for-assigned-access-app.md#guidelines-for-web-browsers).
+These settings apply to the **Kiosk Browser** app available in Microsoft Store.
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
| --- | --- | :---: | :---: | :---: | :---: |
diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml
index 47091d44c1..9920192616 100644
--- a/windows/deployment/TOC.yml
+++ b/windows/deployment/TOC.yml
@@ -387,7 +387,7 @@
- name: Additional Windows Update settings
href: update/waas-wu-settings.md
- name: Update other Microsoft products
- href: update/update-other-microsoft-products.md
+ href: update/update-other-microsoft-products.md
- name: Delivery Optimization reference
href: do/waas-delivery-optimization-reference.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json
- name: Windows client in S mode
@@ -573,7 +573,7 @@
href: planning/testing-your-application-mitigation-packages.md
- name: Use the Sdbinst.exe Command-Line Tool
href: planning/using-the-sdbinstexe-command-line-tool.md
- - name: Install fonts in Windows client
- href: windows-10-missing-fonts.md
+ - name: Add fonts in Windows
+ href: windows-missing-fonts.md
- name: Customize Windows PE boot images
href: customize-boot-image.md
\ No newline at end of file
diff --git a/windows/deployment/update/update-other-microsoft-products.md b/windows/deployment/update/update-other-microsoft-products.md
index 01f1505029..1479c86008 100644
--- a/windows/deployment/update/update-other-microsoft-products.md
+++ b/windows/deployment/update/update-other-microsoft-products.md
@@ -11,7 +11,7 @@ manager: aaroncz
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 02/27/2024
+ms.date: 03/11/2024
---
# Update other Microsoft products
@@ -23,7 +23,7 @@ This article contains a list of other Microsoft products that might be updated w
- **MDM**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowMUUpdateService](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowmuupdateservice)
> [!Note]
-> This policy includes drivers. If you need to exclude drivers, use [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update&bc=/windows/deployment/breadcrumb/toc.json#excludewudriversinqualityupdate).
+> This policy includes drivers. If you need to exclude drivers, use [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#excludewudriversinqualityupdate).
## List of other Microsoft products
diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md
index 52cda69c7b..d76f5a49c9 100644
--- a/windows/deployment/update/waas-overview.md
+++ b/windows/deployment/update/waas-overview.md
@@ -14,20 +14,20 @@ ms.collection:
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 12/31/2017
+ms.date: 03/13/2024
---
# Overview of Windows as a service
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2).
-Windows as a service is a way to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time.
+Windows as a service is a way to simplify the lives of IT pros and maintain a consistent Windows experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time.
## Building
Prior to Windows 10, Microsoft released new versions of Windows every few years. This traditional deployment schedule imposed a training burden on users because the feature revisions were often significant. That schedule also meant waiting long periods without new features. That scenario doesn't always work in today's rapidly changing world, a world in which new security, management, and deployment capabilities are necessary to address challenges.
-In the past, when Microsoft developed new versions of Windows, it typically released technical previews near the end of the process, when Windows was nearly ready to ship. With Windows 10, new features are delivered to the [Windows Insider Program](/windows-insider/) as soon as possible, during the development cycle, through a process called *flighting*. Organizations can see exactly what Microsoft is developing and start their testing as soon as possible.
+In the past, when Microsoft developed new versions of Windows, it typically released technical previews near the end of the process, when Windows was nearly ready to ship. Now, new features are delivered to the [Windows Insider Program](/windows-insider/) as soon as possible, during the development cycle, through a process called *flighting*. Organizations can see exactly what Microsoft is developing and start their testing as soon as possible.
Microsoft also depends on receiving feedback from organizations throughout the development process so that it can make adjustments as quickly as possible rather than waiting until after release. For more information about the Windows Insider Program and how to sign up, see the section [Windows Insider](#windows-insider).
@@ -35,7 +35,7 @@ Microsoft also runs extensive internal testing, with engineering teams installin
## Deploying
-Deploying Windows 10 and Windows 11 is simpler than with previous versions of Windows. When migrating from earlier versions of Windows, you can use an easy in-place upgrade process to automatically preserve all apps, settings, and data. Afterwards, deployment of feature updates is equally simple.
+Deploying a modern version of Windows is simpler than with previous versions of Windows. When migrating from earlier versions of Windows, you can use an easy in-place upgrade process to automatically preserve all apps, settings, and data. Afterwards, deployment of feature updates is equally simple.
### Application compatibility
@@ -43,7 +43,9 @@ Application compatibility testing has historically been a burden when approachin
## Servicing
-Traditional Windows servicing has included several release types: major revisions (for example, the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10 and Windows 11, there are two release types: feature updates that add new functionality and quality updates that provide security and reliability fixes.
+Traditional Windows servicing has included several release types: major revisions (for example, the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10 and Windows 11, there are two release types:
+- **Quality updates**: Updates that provide security and reliability fixes and can also add new functionality or features periodically.
+- **Feature updates**: Updates that are released once a year on which the [servicing timeline](/lifecycle/faq/windows#windows-11) for the operating system is based. These updates can contain new features and functionality and previously released quality updates.
Servicing channels are the first way to separate users into deployment groups for feature and quality updates. For more information about developing a deployment strategy that uses servicing channels, see [Plan servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md).
@@ -54,50 +56,42 @@ There are three servicing channels, each of which provides different levels of f
There are currently three release channels for Windows clients:
- The **General Availability Channel** receives feature updates as soon as they're available.
-- The **Long-Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
-- The **Windows Insider Program** provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update.
+- The **Long-Term Servicing Channel** (LTSC) is designed to be used only for specialized devices such as those that control medical equipment or ATM machines. LTSC receives new feature releases every two to three years.
+- The **Windows Insider Program** provides organizations with the opportunity to test and provide feedback on features that will be shipped in upcoming updates.
->[!NOTE]
->With each General Availability release, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible.
+With each General Availability release, you would typically begin deploying right away to devices selected for early adoption (targeted validation) and then ramp up to full deployment at your discretion. This enables you to gain access to new features, experiences, and integrated security as soon as possible.
>[!IMPORTANT]
->Devices on the General Availability Channel must have their diagnostic data set to **1 (Basic)** or higher in order to ensure that the service is performing at the expected quality. For instructions to set the diagnostic data level, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization).
+> Devices on the General Availability Channel must have their diagnostic data set to **1 (Basic)** or higher in order to ensure that the service is performing at the expected quality. For instructions to set the diagnostic data level, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization).
### Feature updates
-New features are packaged into feature updates that you can deploy using existing management tools. These changes come in bite-sized chunks rather than all at once, decreasing user readiness time.
+You can deploy feature updates using existing management tools. These changes come in bite-sized chunks rather than all at once like in previous versions of Windows, decreasing user readiness time.
### Quality updates
Monthly updates in previous Windows versions were often overwhelming because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn't, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of nonsecurity fixes.
-Rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators see one cumulative monthly update that supersedes the previous month's update, containing both security and non-security fixes. This approach makes updating simpler and ensures that devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from updates.
+Rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators see one cumulative monthly update that supersedes the previous month's update, containing both security and nonsecurity payloads. This approach makes updating simpler and ensures that devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from updates.
## Servicing channels
There are three servicing channels. The [Windows Insider Program](#windows-insider) provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. The [General Availability Channel](#general-availability-channel) provides new functionality with feature update releases. Organizations can choose when to deploy updates from the General Availability Channel. The [Long-Term Servicing Channel](#long-term-servicing-channel), which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. For more information about the versions in each servicing channel, see [Windows release information](/windows/release-health/).
-> [!NOTE]
-> Servicing channels aren't the only way to separate groups of devices when consuming updates. Each channel can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing channels, see [Plan servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md).
+Servicing channels aren't the only way to separate groups of devices when consuming updates. Each channel can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing channels, see [Plan servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md).
### General Availability Channel
In the General Availability Channel, feature updates are available annually. This servicing model is ideal for pilot deployments and testing of feature updates and for users such as developers who need to work with the latest features. Once the latest release has gone through pilot deployment and testing, you'll be able to choose the timing at which it goes into broad deployment.
-When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the General Availability Channel is available but not necessarily immediately mandatory, depending on the policy of the management system. For more information about servicing tools, see [Servicing tools](#servicing-tools).
+When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the General Availability Channel is available but not necessarily immediately mandatory, depending on the policy of the management system. Organizations can electively delay feature updates into as many phases as they wish by using servicing tools. For more information about servicing tools, see [Servicing tools](#servicing-tools).
-> [!NOTE]
-> All releases of Windows 10 have **18 months of servicing for all editions**--these updates provide security and feature updates for the release. However, fall releases of the **Enterprise and Education editions** will have an **additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release**. This extended servicing window applies to Enterprise and Education editions starting with Windows 10, version 1607.
->
-> Organizations can electively delay feature updates into as many phases as they wish by using one of the servicing tools mentioned in the section Servicing tools.
### Long-term Servicing Channel
Specialized systems—such as devices that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don't need feature updates as frequently as other devices in the organization. It's more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Enterprise LTSC devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSC clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools.
-> [!NOTE]
->
-> The Long-term Servicing channel is not intended for deployment on most or all the devices in an organization; it should be used only for special-purpose devices. As a general guideline, a device with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the General Availability channel.
+The Long-term Servicing channel isn't intended for deployment on most or all the devices in an organization. It should be used only for special-purpose devices. As a general guideline, a device with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it's better suited for the General Availability channel.
Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSC. Instead, it typically offers new LTSC releases every 2-3 years, and organizations can choose to install them as in-place upgrades or even skip releases over the product's lifecycle. Always check your individual LTSC release to verify its servicing lifecycle. For more information, see [release information](/windows/release-health/), or perform a search on the [product's lifecycle information](/lifecycle/products/) page.
@@ -114,7 +108,7 @@ Microsoft recommends that all organizations have at least a few devices enrolled
## Servicing tools
-There are many tools you can use to service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates:
+There are many tools you can use to service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows updates:
- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the General Availability Channel. Organizations can target which devices defer updates by selecting the **Defer upgrades** check box in **Start\Settings\Update & Security\Advanced Options** on a Windows client device.
- **Windows Update for Business** includes control over update deferment and provides centralized management using Group Policy or MDM. Windows Update for Business can be used to defer updates by up to 365 days, depending on the version. These deployment options are available to clients in the General Availability Channel. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Microsoft Intune.
diff --git a/windows/deployment/update/wufb-reports-schema-ucclient.md b/windows/deployment/update/wufb-reports-schema-ucclient.md
index b4c113ef71..993c45e682 100644
--- a/windows/deployment/update/wufb-reports-schema-ucclient.md
+++ b/windows/deployment/update/wufb-reports-schema-ucclient.md
@@ -11,7 +11,7 @@ manager: aaroncz
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 12/06/2023
+ms.date: 03/12/2024
---
# UCClient
@@ -35,7 +35,6 @@ UCClient acts as an individual device's record. It contains data such as the cur
| **IsVirtual** | [bool](/azure/data-explorer/kusto/query/scalar-data-types/bool) | No | `Yes, No` | Whether device is a virtual device. |
| **LastCensusScanTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | The last time this device performed a successful census scan, if any. |
| **LastWUScanTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | The last time this device performed a successful Windows Update scan, if any. |
-| **NewTest_CF [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. |
| **OSArchitecture** | [string](/azure/data-explorer/kusto/query/scalar-data-types/string) | Yes | `x86` | The architecture of the operating system (not the device) this device is currently on. |
| **OSBuild** | [string](/azure/data-explorer/kusto/query/scalar-data-types/string) | No | `10.0.22621.1702` | The full operating system build installed on this device, such as Major.Minor.Build.Revision |
| **OSBuildNumber** | [int](/azure/kusto/query/scalar-data-types/int) | No | `22621` | The major build number, in int format, the device is using. |
@@ -62,18 +61,18 @@ UCClient acts as an individual device's record. It contains data such as the cur
| **WUAutomaticUpdates** | | No | | Currently, data isn't gathered to populate this field. Manage automatic update behavior to scan, download, and install updates. |
| **WUDeadlineNoAutoRestart** | | No | | Currently, data isn't gathered to populate this field. Devices won't automatically restart outside of active hours until the deadline is reached - It's 1 by default and indicates enabled, 0 indicates disabled |
| **WUDODownloadMode** | | No | | Currently, data isn't gathered to populate this field. The Windows Update DO DownloadMode configuration. |
-| **WUFeatureDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | CSP: ConfigureDeadlineForFeatureUpdates. The Windows Update feature update deadline configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values > 0 indicate the deadline in days. |
-| **WUFeatureDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | CSP: DeferFeatureUpdates. The Windows Update feature update deferral configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values > 0 indicate the policy setting. |
-| **WUFeatureGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `7` | The Windows Update grace period for feature update in days. -1 indicates not configured, 0 indicates configured and set to 0. Values greater than 0 indicate the grace period in days. |
-| **WUFeaturePauseEndTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update feature update pause will end, if activated, else null. |
+| **WUFeatureDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | CSP: ConfigureDeadlineForFeatureUpdates. The feature update deadline configuration in days. -1 indicates not configured. 0 indicates configured but set to 0. Values > 0 indicate the deadline in days. |
+| **WUFeatureDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | CSP: DeferFeatureUpdates. The feature update deferral configuration in days. -1 indicates not configured. 0 indicates configured but set to 0. Values > 0 indicate the policy setting. |
+| **WUFeatureGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `7` | The Windows Update grace period for feature update in days. -1 indicates not configured. 0 indicates configured and set to 0. Values greater than 0 indicate the grace period in days. |
+| **WUFeaturePauseEndTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update feature update pause ends, if activated, else null. |
| **WUFeaturePauseStartTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update feature update pause was activated, if activated, else null. Feature updates are paused for 35 days from the specified start date. |
| **WUFeaturePauseState** | [string](/azure/data-explorer/kusto/query/scalar-data-types/string) | No | `NotConfigured` | Indicates pause status of device for feature updates. Possible values are Paused, NotPaused, NotConfigured. |
-| **WUNotificationLevel** | | No | | Currently, data isn't gathered to populate this field. This policy allows you to define what Windows Update notifications users see. 0 (default) - Use the default Windows Update notifications. 1 - Turn off all notifications, excluding restart warnings. 2 - Turn off all notifications, including restart warnings |
+| **WUNotificationLevel** | | No | | Currently, data isn't gathered to populate this field. This policy allows you to define what Windows Update notifications users see. 0 (default) - Use the default Windows Update notifications. 1 - Turn off all notifications, excluding restart warnings. 2 - Turn off all notifications, including restart warnings |
| **WUPauseUXDisabled** | | No | | Currently, data isn't gathered to populate this field. This policy allows the IT admin to disable the Pause Updates feature. When this policy is enabled, the user can't access the Pause updates' feature. Supported values 0, 1. |
-| **WUQualityDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `7` | CSP: ConfigureDeadlineForQualityUpdates. The Windows update quality update deadline configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values > 0 indicate the deadline in days. |
-| **WUQualityDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `-1` | CSP: DeferQualityUpdates. The Windows Update quality update deferral configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values greater than 0 indicate the policy setting. |
-| **WUQualityGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | The Windows Update grace period for quality update in days. -1 indicates not configured, 0 indicates configured and set to 0. Values greater than 0 indicate the grace period in days. |
-| **WUQualityPauseEndTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update quality update pause- will end, if activated, else null. |
+| **WUQualityDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `7` | CSP: ConfigureDeadlineForQualityUpdates. The Windows update quality update deadline configuration in days. -1 indicates not configured. 0 indicates configured but set to 0. Values > 0 indicate the deadline in days. |
+| **WUQualityDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `-1` | CSP: DeferQualityUpdates. The Windows Update quality update deferral configuration in days. -1 indicates not configured. 0 indicates configured but set to 0. Values greater than 0 indicate the policy setting. |
+| **WUQualityGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | The Windows Update grace period for quality update in days. -1 indicates not configured. 0 indicates configured and set to 0. Values greater than 0 indicate the grace period in days. |
+| **WUQualityPauseEndTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time the quality update pause ends, if activated, else null. |
| **WUQualityPauseStartTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update quality update pause- was activated; if activated; else null. |
| **WUQualityPauseState** | [string](/azure/data-explorer/kusto/query/scalar-data-types/string) | No | `NotConfigured` | Indicates pause status of device for quality updates. Possible values are Paused, NotPaused, NotConfigured. |
| **WURestartNotification** | | No | | Currently, data isn't gathered to populate this field. Allows the IT Admin to specify the method by which the auto restart required notification is dismissed. The following list shows the supported values: 1 (default) = Auto Dismissal. 2 - User Dismissal. |
diff --git a/windows/deployment/windows-10-missing-fonts.md b/windows/deployment/windows-10-missing-fonts.md
deleted file mode 100644
index 3ba1d1b034..0000000000
--- a/windows/deployment/windows-10-missing-fonts.md
+++ /dev/null
@@ -1,112 +0,0 @@
----
-title: How to install fonts missing after upgrading to Windows client
-description: Some of the fonts are missing from the system after you upgrade to Windows client.
-ms.service: windows-client
-ms.localizationpriority: medium
-author: frankroj
-ms.author: frankroj
-manager: aaroncz
-ms.topic: article
-ms.date: 11/23/2022
-ms.subservice: itpro-deploy
----
-# How to install fonts that are missing after upgrading to Windows client
-
-*Applies to:*
-
-- Windows 10
-- Windows 11
-
-When you upgrade from the Windows 7, Windows 8, or Windows 8.1 operating system to Windows 10 or Windows 11, certain fonts are no longer available by default post-upgrade. To reduce the operating system footprint, improve performance, and optimize disk space usage, we moved many of the fonts that were previously shipped with prior versions of Windows to the optional features of Windows client. If you install a fresh instance of Windows client, or upgrade an older version of Windows to Windows client, these optional features aren't enabled by default. As a result, these fonts appear to be missing from the system.
-
-If you have documents created using the missing fonts, these documents might display differently on Windows client.
-
-For example, if you've an English, French, German, or Spanish version of Windows 10 installed, you might notice that fonts such as the following are appear to be missing:
-
-- `Gautami`
-- `Meiryo`
-- `Narkism/Batang`
-- `BatangChe`
-- `Dotum`
-- `DotumChe`
-- `Gulim`
-- `GulimChe`
-- `Gungsuh`
-- `GungsuhChe`
-
-If you want to use these fonts, you can enable the optional feature to add them back to your system. The removal of these fonts is a permanent change in behavior for Windows client, and it will remain this way in future releases.
-
-## Installing language-associated features via language settings
-
-If you want to use the fonts from the optional feature and you know that you'll want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. Use the Settings app.
-
-For example, here are the steps to install the fonts associated with the Hebrew language:
-
-1. Select **Start > Settings**.
-
-2. For Windows 10, in **Settings**, select **Time & language**, and then select **Region & language**.
-
- For Windows 11, in **Settings**, select **Time & language**, and then select **Language & Region**.
-
-3. If Hebrew isn't included in the list of languages, select the plus sign (**+**) to add a language.
-
-4. Find **Hebrew**, and then select it to add it to your language list.
-
-Once you've added Hebrew to your language list, then the optional Hebrew font feature and other optional features for Hebrew language support are installed. This process should only take a few minutes.
-
-> [!NOTE]
-> The optional features are installed by Windows Update. You need to be online for the Windows Update service to work.
-
-## Install optional fonts manually without changing language settings
-
-If you want to use fonts in an optional feature but don't need to search web pages, edit documents, or use apps in the associated language, you can install the optional font features manually without changing your language settings.
-
-For example, here are the steps to install the fonts associated with the Hebrew language without adding the Hebrew language itself to your language preferences:
-
-1. Select **Start > Settings**.
-
-2. In **Settings**, select **Apps**, select **Apps & features**, and then select **Manage optional features**.
-
-3. If you don't see **Hebrew Supplemental Fonts** in the list of installed features, select the plus sign (**+**) to add a feature.
-
-4. Select **Hebrew Supplemental Fonts** in the list, and then select **Install**.
-
-> [!NOTE]
-> The optional features are installed by Windows Update. You need to be online for the Windows Update service to work.
-
-## Fonts included in optional font features
-
-Here's a comprehensive list of the font families in each of the optional features. Some font families might include multiple fonts for different weights and styles.
-
-- Arabic Script Supplemental Fonts: `Aldhabi, Andalus, Arabic Typesetting, Microsoft Uighur, Sakkal Majalla, Simplified Arabic, Traditional Arabic, Urdu Typesetting`
-- Bangla Script Supplemental Fonts: `Shonar Bangla, Vrinda`
-- Canadian Aboriginal Syllabics Supplemental Fonts: `Euphemia`
-- Cherokee Supplemental Fonts: `Plantagenet Cherokee`
-- Chinese (Simplified) Supplemental Fonts: `DengXian, FangSong, KaiTi, SimHei`
-- Chinese (Traditional) Supplemental Fonts: `DFKai-SB, MingLiU, MingLiU_HKSCS, PMingLiU`
-- Devanagari Supplemental Fonts: `Aparajita, Kokila, Mangal, Sanskrit Text, Utsaah`
-- Ethiopic Supplemental Fonts: `Nyala`
-- Gujarati Supplemental Fonts: `Shruti`
-- Gurmukhi Supplemental Fonts: `Raavi`
-- Hebrew Supplemental Fonts: `Aharoni Bold, David, FrankRuehl, Gisha, Levanim MT, Miriam, Miriam Fixed, Narkism, Rod`
-- Japanese Supplemental Fonts: `Meiryo, Meiryo UI, MS Gothic, MS PGothic, MS UI Gothic, MS Mincho, MS PMincho, Yu Mincho`
-- Kannada Supplemental Fonts: `Tunga`
-- Khmer Supplemental Fonts: `DaunPenh, Khmer UI, MoolBoran`
-- Korean Supplemental Fonts: `Batang, BatangChe, Dotum, DotumChe, Gulim, GulimChe, Gungsuh, GungsuhChe`
-- Lao Supplemental Fonts: `DokChampa, Lao UI`
-- Malayalam Supplemental Fonts: `Karthika`
-- Odia Supplemental Fonts: `Kalinga`
-- Pan-European Supplemental Fonts: `Arial Nova, Georgia Pro, Gill Sans Nova, Neue Haas Grotesk, Rockwell Nova, Verdana Pro`
-- Sinhala Supplemental Fonts: `Iskoola Pota`
-- Syriac Supplemental Fonts: `Estrangelo Edessa`
-- Tamil Supplemental Fonts: `Latha, Vijaya`
-- Telugu Supplemental Fonts: `Gautami, Vani`
-- Thai Supplemental Fonts: `Angsana New, AngsanaUPC, Browallia New, BrowalliaUPC, Cordia New, CordiaUPC, DilleniaUPC, EucrosiaUPC, FreesiaUPC, IrisUPC, JasmineUPC, KodchiangUPC, Leelawadee, LilyUPC`
-
-## Related articles
-
-[Download the list of all available language FODs](https://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx)
-
-[Features On Demand V2 (Capabilities)](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities#span-idrelatedtopicsspanrelated-topics)
-
-[Add Language Packs to Windows](/windows-hardware/manufacture/desktop/add-language-packs-to-windows)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md
index eb73ee5af6..38af149ad8 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md
@@ -1,7 +1,7 @@
---
title: Windows feature update summary dashboard
description: Provides a broader view of the current Windows OS upgrade status for all devices registered with Windows Autopatch.
-ms.date: 10/11/2023
+ms.date: 01/22/2024
ms.service: windows-client
ms.subservice: itpro-updates
ms.topic: how-to
@@ -41,6 +41,7 @@ The following information is available in the Summary dashboard:
| In progress | Total device counts reporting the In progress status. For more information, see [In progress](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-sub-statuses). |
| Paused | Total device count reporting the status of the pause whether it's Service or Customer initiated. For more information, see [Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices). |
| Not ready | Total device count reporting the Not ready status. For more information, see [Not ready](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#not-up-to-date-devices). |
+| % with the target feature update | Percent of [Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices) devices on the targeted feature update. |
## Report options
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md
index fdacc1576c..36e2fe54de 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md
@@ -1,7 +1,7 @@
---
title: Windows quality and feature update reports overview
-description: This article details the types of reports available and info about update device eligibility, device update health, device update trends in Windows Autopatch groups
-ms.date: 07/25/2023
+description: This article details the types of reports available and info about update device eligibility, device update health, device update trends in Windows Autopatch groups.
+ms.date: 01/22/2024
ms.service: windows-client
ms.subservice: itpro-updates
ms.topic: conceptual
@@ -82,7 +82,7 @@ Up to date devices are devices that meet all of the following prerequisites:
- Have applied the current monthly cumulative updates
> [!NOTE]
-> [Up to Date devices](#up-to-date-devices) will remain with the **In Progress** status for the 21-day service level objective period until the device either applies the current monthly cumulative update or receives an [alert](../operate/windows-autopatch-device-alerts.md). If the device receives an alert, the device's status will change to [Not up to Date](#not-up-to-date-devices).
+> Device that are [Up to Date](#up-to-date-devices) will remain with the **In Progress** status until either the current monthly cumulative update is applied, or an [alert](../operate/windows-autopatch-device-alerts.md) is received. If the device receives an alert, the device's status will change to [Not up to Date](#not-up-to-date-devices).
#### Up to Date sub statuses
@@ -96,7 +96,7 @@ Up to date devices are devices that meet all of the following prerequisites:
Not Up to Date means a device isn't up to date when the:
- Quality or feature update is out of date, or the device is on the previous update.
-- Device is more than 21 days overdue from the last release.
+- The assigned update schedule has elapsed and the device still has not applied the current release.
- Device has an [alert](../operate/windows-autopatch-device-alerts.md) resulting in an error and action must be taken.
### Not Ready devices
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md
index 9f3cb93c97..64ed6a7a91 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md
@@ -1,7 +1,7 @@
---
title: Windows quality update summary dashboard
description: Provides a summary view of the current update status for all devices enrolled into Windows Autopatch with Autopatch groups
-ms.date: 10/04/2023
+ms.date: 01/22/2024
ms.service: windows-client
ms.subservice: itpro-updates
ms.topic: how-to
@@ -40,6 +40,7 @@ The following information is available in the Summary dashboard:
| In progress | Total device counts reporting the In progress status. For more information, see [In progress](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-sub-statuses). |
| Paused | Total device count reporting the status of the pause whether it's Service or Customer initiated. For more information, see [Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices). |
| Not ready | Total device count reporting the Not ready status. For more information, see [Not ready](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#not-up-to-date-devices). |
+| % with the latest quality update | Percent of [Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices) devices on the most current Windows release and its build number |
## Report options
diff --git a/windows/deployment/windows-missing-fonts.md b/windows/deployment/windows-missing-fonts.md
new file mode 100644
index 0000000000..d98de67b71
--- /dev/null
+++ b/windows/deployment/windows-missing-fonts.md
@@ -0,0 +1,271 @@
+---
+title: How to add fonts missing after upgrading Windows
+description: Some of the fonts are missing from the system after upgrading Windows.
+ms.service: windows-client
+ms.localizationpriority: medium
+author: frankroj
+ms.author: frankroj
+manager: aaroncz
+ms.topic: article
+ms.date: 03/13/2024
+ms.subservice: itpro-deploy
+zone_pivot_groups: windows-versions-11-10
+appliesto:
+ - ✅ Windows 11
+ - ✅ Windows 10
+---
+
+# How to add fonts that are missing after upgrading Windows
+
+
+
+When Windows is upgraded from older versions of Windows to currently supported versions of Windows, previously available fonts might no longer be available post-upgrade. Many of the fonts that were previously shipped with Windows were moved to the optional features of Windows to:
+
+- Reduce the operating system footprint.
+- Improve performance.
+- Optimize disk space usage.
+
+ In the following instances:
+
+- A fresh instance of Windows is installed
+- Windows is upgraded from an older version of Windows
+
+optional fonts aren't enabled by default. As a result, these fonts are missing from the system. If documents were created using the missing fonts, these documents might display differently in the updated version of Windows.
+
+For example, if an English, French, German, or Spanish version of Windows is installed, fonts such as the following are missing:
+
+- `Gautami`
+- `Meiryo`
+- `Narkism/Batang`
+- `BatangChe`
+- `Dotum`
+- `DotumChe`
+- `Gulim`
+- `GulimChe`
+- `Gungsuh`
+- `GungsuhChe`
+
+If these fonts are needed, you can add them back to your system via optional features. The removal of these fonts is a permanent change in behavior for Windows, and it will remain this way in future releases.
+
+## Adding language-associated features via language settings
+
+If fonts associated with a language are needed across the system, then that language should be added to the user profile followed by switching to that language. For example, the fonts are needed to:
+
+- View web pages.
+- Edit documents.
+- Use apps in that language.
+
+Adding a language and then switching to it can be done via the **Settings** app.
+
+::: zone pivot="windows-11"
+
+To add the fonts associated with a language and then switch to that language, first open the **Language & region** pane in the **Settings** app by selecting the following link:
+
+> [!div class="nextstepaction"]
+> [Language & region](ms-settings:regionlanguage)
+
+::: zone-end
+
+::: zone pivot="windows-10"
+
+To add the fonts associated with a language and then switch to that language, first open the **Language** pane in the **Settings** app by selecting the following link:
+
+> [!div class="nextstepaction"]
+> [Language](ms-settings:regionlanguage)
+
+::: zone-end
+
+or
+
+1. Right-click on the **Start** menu and select **Run**.
+
+1. In the **Run** window, next to **Open:**, enter:
+
+ ```console
+ ms-settings:regionlanguage
+ ```
+
+ and then select **OK**.
+
+or
+
+::: zone pivot="windows-11"
+
+1. Right-click on the **Start** menu and select **Settings**.
+
+1. In the left hand pane of the Settings app, select **Time & language**.
+
+1. In the right hand **Time & language** pane, select **Language & region**.
+
+Once the **Time & language > Language & region** pane is open, add the fonts associated with a language and then switch to that language with the following steps:
+
+1. Under the **Language** section:
+
+ 1. Drop down the menu next to **Windows display language** to show all of the languages currently added to the device.
+
+ 1. If the desired language isn't listed, add the fonts for the desired language by selecting the **Add a language** button next to **Preferred languages**.
+
+ 1. In the **Choose a language to install** window that opens:
+
+ 1. Find the desired language by scrolling through the list of languages. Alternatively, search for the desired language in the **Type a language name...** search box.
+
+ 1. Once the desired language is found, select the language, and then select the **Next** button.
+
+ 1. In the **Install language features** window, select the desired options for the language, and then select the **Install** button.
+
+ 1. The desired language should now be available in the drop-down menu next to **Windows display language**. Drop down the **Windows display language** menu and select the desired language.
+
+ 1. Below **Windows display language** the message **Windows needs to sign you out in order to apply your new display language.** is displayed. Select the **Sign out** button to finish applying the language including the additional language fonts.
+
+::: zone-end
+
+::: zone pivot="windows-10"
+
+1. Right-click on the **Start** menu and select **Settings**.
+
+1. In the Settings app, select **Time & Language**.
+
+1. In the left hand pane, select **Language**.
+
+Once the **Language** pane is open, add the fonts associated with a language and then switch to that language with the following steps:
+
+1. Drop down the menu below **Windows display language** to show all of the languages currently added to the device.
+
+1. If the desired language isn't listed, add the fonts for the desired language by selecting the **+** button next to **Add a language**.
+
+1. In the **Choose a language to install** window that opens:
+
+ 1. Find the desired language by scrolling through the list of languages. Alternatively, search for the desired language in the **Type a language name...** search box.
+
+ 1. Once the desired language is found, select the language, and then select the **Next** button.
+
+ 1. In the **Install language features** window, select the desired features for the language, and then select the **Install** button.
+
+1. The desired language should now be available in the drop-down menu below **Windows display language**. Drop down the **Windows display language** menu and select the desired language.
+
+1. The following message is displayed:
+
+ > **Setting Windows display language**
+ > **Windows needs to sign you out in order to fully apply the new language. Continue?**
+
+ Select the **Yes, sign out now** button to finish applying the language including the additional language fonts.
+
+::: zone-end
+
+> [!IMPORTANT]
+>
+> Windows Update is used to add the language including the associated fonts. The device needs to be online so Windows Update can download the content that it needs to add.
+
+## Add optional fonts manually without changing language settings
+
+If fonts associated with a language are needed but aren't needed across the entire system, then that language should be added to the user profile as a supplemental font. Adding a font as a supplemental font doesn't require the user switch to that language. Adding a font as a supplemental font can be done via the **Settings** app.
+
+To add supplemental fonts associated with a language while staying with the current language:
+
+Open the **Optional features** pane in the **Settings** app by selecting the following link:
+
+> [!div class="nextstepaction"]
+> [Optional features](ms-settings:optionalfeatures)
+
+or
+
+1. Right-click on the **Start** menu and select **Run**.
+
+1. In the **Run** window, next to **Open:**, enter:
+
+ ```console
+ ms-settings:optionalfeatures
+ ```
+
+ and then select **OK**.
+
+or
+
+::: zone pivot="windows-11"
+
+1. Right-click on the **Start** menu and select **Settings**.
+
+1. In the left hand pane of the Settings app, select **System**.
+
+1. In the right hand **System** pane, select **Optional features**.
+
+> [!NOTE]
+>
+> The navigation steps, UI elements, and UI text in this section are based on the latest version of Windows 11 with the latest cumulative update installed. For other versions of Windows 11 that are currently supported or don't have the latest cumulative update, some of the navigation steps, UI elements, and UI text might be different. For example, the [**Optional features**](ms-settings:optionalfeatures) pane might be located under **Settings** > **Apps**.
+
+Once the **System > Optional features** pane is open, add a supplemental font with the following steps:
+
+1. Select the **View features** button next to **Add an optional feature**.
+
+1. In the **Add an optional feature** window that opens:
+
+ 1. Find the desired supplemental font to add and then select the box next to the supplemental font to add it. Multiple supplemental fonts can be selected.
+
+ 1. Once all of the desired supplemental fonts are selected, select the **Next** button.
+
+ 1. Review the selected list of features and then select the **Install** button to add the selected features.
+
+::: zone-end
+
+::: zone pivot="windows-10"
+
+1. Right-click on the **Start** menu and select **Settings**.
+
+1. In the Settings app, select **System**.
+
+1. In the left hand pane, select **Optional features**.
+
+> [!NOTE]
+>
+> The navigation steps, UI elements, and UI text in this section are based on Windows 10 22H2 with the latest cumulative update installed. For other versions of Windows 10 that are currently supported or don't have the latest cumulative update, some of the navigation steps, UI elements, and UI text might be different. For example, the [**Optional features**](ms-settings:optionalfeatures) pane might be located under **Settings** > **Apps** > **Apps & features**.
+
+Once the **Optional features** pane is open, add a supplemental font with the following steps:
+
+1. Select the **+** button next to **Add a feature**.
+
+1. In the **Add an optional feature** window that opens:
+
+ 1. Find the desired supplemental font to add and then select the box next to the supplemental font to add it. Multiple supplemental fonts can be selected.
+
+ 1. Once all of the desired supplemental fonts are selected, select the **Install** button.
+
+::: zone-end
+
+> [!IMPORTANT]
+>
+> Windows Update is used to add the optional features including the supplemental fonts. The device needs to be online so Windows Update can download the content that it needs to add.
+
+## Fonts included in optional font features
+
+Here's a comprehensive list of the font families in each of the optional features. Some font families might include multiple fonts for different weights and styles.
+
+- Arabic Script Supplemental Fonts: `Aldhabi, Andalus, Arabic Typesetting, Microsoft Uighur, Sakkal Majalla, Simplified Arabic, Traditional Arabic, Urdu Typesetting`
+- Bangla Script Supplemental Fonts: `Shonar Bangla, Vrinda`
+- Canadian Aboriginal Syllabics Supplemental Fonts: `Euphemia`
+- Cherokee Supplemental Fonts: `Plantagenet Cherokee`
+- Chinese (Simplified) Supplemental Fonts: `DengXian, FangSong, KaiTi, SimHei`
+- Chinese (Traditional) Supplemental Fonts: `DFKai-SB, MingLiU, MingLiU_HKSCS, PMingLiU`
+- Devanagari Supplemental Fonts: `Aparajita, Kokila, Mangal, Sanskrit Text, Utsaah`
+- Ethiopic Supplemental Fonts: `Nyala`
+- Gujarati Supplemental Fonts: `Shruti`
+- Gurmukhi Supplemental Fonts: `Raavi`
+- Hebrew Supplemental Fonts: `Aharoni Bold, David, FrankRuehl, Gisha, Levanim MT, Miriam, Miriam Fixed, Narkism, Rod`
+- Japanese Supplemental Fonts: `Meiryo, Meiryo UI, MS Gothic, MS PGothic, MS UI Gothic, MS Mincho, MS PMincho, Yu Mincho`
+- Kannada Supplemental Fonts: `Tunga`
+- Khmer Supplemental Fonts: `DaunPenh, Khmer UI, MoolBoran`
+- Korean Supplemental Fonts: `Batang, BatangChe, Dotum, DotumChe, Gulim, GulimChe, Gungsuh, GungsuhChe`
+- Lao Supplemental Fonts: `DokChampa, Lao UI`
+- Malayalam Supplemental Fonts: `Karthika`
+- Odia Supplemental Fonts: `Kalinga`
+- Pan-European Supplemental Fonts: `Arial Nova, Georgia Pro, Gill Sans Nova, Neue Haas Grotesk, Rockwell Nova, Verdana Pro`
+- Sinhala Supplemental Fonts: `Iskoola Pota`
+- Syriac Supplemental Fonts: `Estrangelo Edessa`
+- Tamil Supplemental Fonts: `Latha, Vijaya`
+- Telugu Supplemental Fonts: `Gautami, Vani`
+- Thai Supplemental Fonts: `Angsana New, AngsanaUPC, Browallia New, BrowalliaUPC, Cordia New, CordiaUPC, DilleniaUPC, EucrosiaUPC, FreesiaUPC, IrisUPC, JasmineUPC, KodchiangUPC, Leelawadee, LilyUPC`
+
+## Related content
+
+- [Download the list of all available language FODs](https://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx).
+- [Features On Demand V2 (Capabilities)](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities#span-idrelatedtopicsspanrelated-topics).
+- [Add Language Packs to Windows](/windows-hardware/manufacture/desktop/add-language-packs-to-windows).
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md b/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md
index bcce7c5578..008ae3d8ea 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md
@@ -26,6 +26,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
- csi.exe
- dbghost.exe
- dbgsvc.exe
+- dbgsrv.exe
- dnx.exe
- dotnet.exe
- fsi.exe
@@ -143,6 +144,7 @@ The blocklist policy that follows includes "Allow all" rules for both kernel and
+
@@ -854,6 +856,7 @@ The blocklist policy that follows includes "Allow all" rules for both kernel and
+
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md
index 1d76e0e5a9..b9655217a3 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md
@@ -2,7 +2,7 @@
title: Use multiple Windows Defender Application Control Policies
description: Windows Defender Application Control supports multiple code integrity policies for one device.
ms.localizationpriority: medium
-ms.date: 07/19/2021
+ms.date: 03/13/2024
ms.topic: article
---
@@ -11,17 +11,19 @@ ms.topic: article
>[!NOTE]
>Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md).
-Prior to Windows 10 1903, Windows Defender Application Control only supported a single active policy on a system at any given time. This limited customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports up to 32 active policies on a device at once in order to enable the following scenarios:
+Beginning with Windows 10 version 1903 and Windows Server 2022, you can deploy multiple Windows Defender Application Control (WDAC) policies side-by-side on a device. To allow more than 32 active policies, install the Windows security update released on, or after, March 12, 2024 and then restart the device. With these updates, there's no limit for the number of policies you can deploy at once to a given device. Until you install the Windows security update released on or after March 12, 2024, your device is limited to 32 active policies and you must not exceed that number.
+
+Here are some common scenarios where multiple side-by-side policies are useful:
1. Enforce and Audit Side-by-Side
- To validate policy changes before deploying in enforcement mode, users can now deploy an audit-mode base policy side by side with an existing enforcement-mode base policy
2. Multiple Base Policies
- Users can enforce two or more base policies simultaneously in order to allow simpler policy targeting for policies with different scope/intent
- - If two base policies exist on a device, an application has to be allowed by both to run
+ - If two base policies exist on a device, an application must pass both policies for it to run
3. Supplemental Policies
- Users can deploy one or more supplemental policies to expand a base policy
- A supplemental policy expands a single base policy, and multiple supplemental policies can expand the same base policy
- - For supplemental policies, applications that are allowed by either the base policy or its supplemental policy/policies are allowed to run
+ - For supplemental policies, applications allowed by either the base policy or its supplemental policy/policies run
> [!NOTE]
> Pre-1903 systems do not support the use of Multiple Policy Format WDAC policies.
@@ -31,11 +33,11 @@ Prior to Windows 10 1903, Windows Defender Application Control only supported a
- Multiple base policies: intersection
- Only applications allowed by both policies run without generating block events
- Base + supplemental policy: union
- - Files that are allowed by either the base policy or the supplemental policy aren't blocked
+ - Files allowed by either the base policy or the supplemental policy run
## Creating WDAC policies in Multiple Policy Format
-In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below example describes the process of creating a new policy in the multiple policy format.
+In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique values generated for the policy ID and 2) the policy type set as a Base policy. The below example describes the process of creating a new policy in the multiple policy format.
```powershell
New-CIPolicy -MultiplePolicyFormat -ScanPath "" -UserPEs -FilePath ".\policy.xml" -Level FilePublisher -Fallback SignedVersion,Publisher,Hash
@@ -55,7 +57,7 @@ Add-SignerRule -FilePath ".\policy.xml" -CertificatePath [-K
### Supplemental policy creation
-In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown above. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy.
+In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown earlier. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy.
- "SupplementsBasePolicyID": GUID of base policy that the supplemental policy applies to
- "BasePolicyToSupplementPath": path to base policy file that the supplemental policy applies to
@@ -66,11 +68,11 @@ Set-CIPolicyIdInfo -FilePath ".\supplemental_policy.xml" [-SupplementsBasePolicy
### Merging policies
-When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy will be a base policy with ID \.
+When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy is a base policy with ID \.
## Deploying multiple policies
-In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP, which is supported by Microsoft Intune's custom OMA-URI feature.
+In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP.
### Deploying multiple policies locally
@@ -86,15 +88,9 @@ To deploy policies locally using the new multiple policy format, follow these st
Multiple Windows Defender Application Control policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment.
-However, when policies are unenrolled from an MDM server, the CSP will attempt to remove every policy from devices, not just the policies added by the CSP. The reason for this is that the ApplicationControl CSP doesn't track enrollment sources for individual policies, even though it will query all policies on a device, regardless if they were deployed by the CSP.
+However, when policies are unenrolled from an MDM server, the CSP attempts to remove every policy not actively deployed, not just the policies added by the CSP. This behavior happens because the system doesn't know what deployment methods were used to apply individual policies.
For more information on deploying multiple policies, optionally using Microsoft Intune's custom OMA-URI capability, see [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp).
> [!NOTE]
> WMI and GP do not currently support multiple policies. Instead, customers who cannot directly access the MDM stack should use the [ApplicationControl CSP via the MDM Bridge WMI Provider](/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage Multiple Policy Format Windows Defender Application Control policies.
-
-### Known Issues in Multiple Policy Format
-
-* If the maximum number of policies is exceeded, the device may bluescreen referencing ci.dll with a bug check value of 0x0000003b.
-* If policies are loaded without requiring a reboot such as `PS_UpdateAndCompareCIPolicy`, they will still count towards this limit.
-* This may pose an especially large challenge if the value of `{PolicyGUID}.cip` changes between releases. It may result in a long window between a change and the resultant reboot.
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
index 2b18eadcc2..5b5d018a69 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
@@ -14,7 +14,7 @@ ms.topic: article
>[!NOTE]
>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
-Microsoft has strict requirements for code running in kernel. So, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers. When vulnerabilities in drivers are found, we work with our partners to ensure they're quickly patched and rolled out to the ecosystem. The vulnerable driver blocklist is designed to help harden systems against third party-developed drivers across the Windows ecosystem with any of the following attributes:
+Microsoft has strict requirements for code running in kernel. So, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers. When vulnerabilities in drivers are found, we work with our partners to ensure they're quickly patched and rolled out to the ecosystem. The vulnerable driver blocklist is designed to help harden systems against non-Microsoft-developed drivers across the Windows ecosystem with any of the following attributes:
- Known security vulnerabilities that can be exploited by attackers to elevate privileges in the Windows kernel
- Malicious behaviors (malware) or certificates used to sign malware
@@ -1071,7 +1071,7 @@ The following recommended blocklist xml policy file can also be downloaded from
-
+
@@ -1929,7 +1929,7 @@ The following recommended blocklist xml policy file can also be downloaded from
-
+
@@ -1938,10 +1938,10 @@ The following recommended blocklist xml policy file can also be downloaded from
-
-
+
+
-
+
@@ -2234,7 +2234,7 @@ The following recommended blocklist xml policy file can also be downloaded from
-
+
@@ -3312,7 +3312,7 @@ The following recommended blocklist xml policy file can also be downloaded from
-
+
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md
index 91af264958..fbccba4c71 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md
@@ -2,7 +2,7 @@
title: WDAC Admin Tips & Known Issues
description: WDAC Known Issues
ms.manager: jsuther
-ms.date: 11/22/2023
+ms.date: 03/13/2024
ms.topic: article
ms.localizationpriority: medium
---
@@ -43,32 +43,28 @@ When the WDAC engine evaluates files against the active set of policies on the d
4. Lastly, WDAC makes a cloud call to the ISG to get reputation about the file, if the policy enables the ISG option.
-5. If no explicit rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly.
+5. Any file not allowed by an explicit rule or based on ISG or MI is blocked implicitly.
## Known issues
### Boot stop failure (blue screen) occurs if more than 32 policies are active
-If the maximum number of policies is exceeded, the device will bluescreen referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit.
+Until you apply the Windows security update released on or after March 12, 2024, your device is limited to 32 active policies. If the maximum number of policies is exceeded, the device bluescreens referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. To remove the maximum policy limit, install the Windows security update released on, or after, March 12, 2024 and then restart the device. Otherwise, reduce the number of policies on the device to remain below 32 policies.
### Audit mode policies can change the behavior for some apps or cause app crashes
-Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that includes the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode:
+Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that turns on user mode code integrity (UMCI) with the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode:
- Some script hosts might block code or run code with fewer privileges even in audit mode. See [Script enforcement with WDAC](/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement) for information about individual script host behaviors.
- Option **19 Enabled:Dynamic Code Security** is always enforced if any UMCI policy includes that option. See [WDAC and .NET](/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet#wdac-and-net-hardening).
-### Managed Installer and ISG may cause excessive events
-
-When Managed Installer and ISG are enabled, 3091 and 3092 events are logged when a file didn't have Managed Installer or ISG authorization, regardless of whether the file was allowed. These events were moved to the verbose channel beginning with the September 2022 Update Preview since the events don't indicate an issue with the policy.
-
### .NET native images may generate false positive block events
In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written include error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image falls back to its corresponding assembly and .NET regenerates the native image at its next scheduled maintenance window.
### Signatures using elliptical curve cryptography (ECC) aren't supported
-WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If you try to allow files by signature based on ECC signatures, you'll see VerificationError = 23 on the corresponding 3089 signature information events. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA.
+WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If WDAC blocks a file based on ECC signatures, the corresponding 3089 signature information events show VerificationError = 23. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA.
### MSI installers are treated as user writeable on Windows 10 when allowed by FilePath rule
@@ -88,18 +84,19 @@ As a workaround, download the MSI file and run it locally:
```console
msiexec -i c:\temp\Windows10_Version_1511_ADMX.msi
```
+
### Slow boot and performance with custom policies
-WDAC evaluates all processes that run, including inbox Windows processes. If policies don't build off the WDAC templates or don't trust the Windows signers, you'll see slower boot times, degraded performance and possibly boot issues. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies.
+WDAC evaluates all processes that run, including inbox Windows processes. You can cause slower boot times, degraded performance, and possibly boot issues if your policies don't build upon the WDAC templates or don't trust the Windows signers. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies.
#### AppId Tagging policy considerations
-If the AppId Tagging Policy wasn't built off the WDAC base templates or doesn't allow the Windows in-box signers, you'll notice a significant increase in boot times (~2 minutes).
+AppId Tagging policies that aren't built upon the WDAC base templates or don't allow the Windows in-box signers might cause a significant increase in boot times (~2 minutes).
-If you can't allowlist the Windows signers, or build off the WDAC base templates, it's recommended to add the following rule to your policies to improve the performance:
+If you can't allowlist the Windows signers or build off the WDAC base templates, add the following rule to your policies to improve the performance:
:::image type="content" source="../images/known-issue-appid-dll-rule.png" alt-text="Allow all dlls in the policy.":::
:::image type="content" source="../images/known-issue-appid-dll-rule-xml.png" alt-text="Allow all dll files in the xml policy.":::
-Since AppId Tagging policies evaluate but can't tag dll files, this rule will short circuit dll evaluation and improve evaluation performance.
+Since AppId Tagging policies evaluate but can't tag dll files, this rule short circuits dll evaluation and improve evaluation performance.
diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index 7ecc2e42ce..87d822d8a1 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -55,17 +55,25 @@
},
"titleSuffix": "Windows Security",
"contributors_to_exclude": [
- "dstrome2",
- "rjagiewich",
+ "alekyaj",
+ "alexbuckgit",
"American-Dipper",
- "claydetels19",
+ "AngelaMotherofDragons",
+ "beccarobins",
+ "claydetels19",
+ "dstrome",
+ "dstrome2",
+ "garycentric",
"jborsecnik",
- "v-stchambers",
+ "rjagiewich",
+ "rmca14",
"shdyas",
"Stacyrch140",
- "garycentric",
- "dstrome",
- "alekyaj"
+ "tiburd",
+ "traya1",
+ "v-dihans",
+ "v-stchambers",
+ "v-stsavell"
],
"searchScope": [
"Windows 10"
@@ -79,10 +87,10 @@
"application-security/application-control/windows-defender-application-control/**/*.yml": "jsuther1974",
"hardware-security/**/*.md": "vinaypamnani-msft",
"hardware-security/**/*.yml": "vinaypamnani-msft",
- "information-protection/**/*.md": "vinaypamnani-msft",
- "information-protection/**/*.yml": "vinaypamnani-msft",
"identity-protection/**/*.md": "paolomatarazzo",
"identity-protection/**/*.yml": "paolomatarazzo",
+ "information-protection/**/*.md": "vinaypamnani-msft",
+ "information-protection/**/*.yml": "vinaypamnani-msft",
"operating-system-security/**/*.md": "vinaypamnani-msft",
"operating-system-security/**/*.yml": "vinaypamnani-msft",
"operating-system-security/data-protection/**/*.md": "paolomatarazzo",
@@ -97,10 +105,10 @@
"application-security/application-control/windows-defender-application-control/**/*.yml": "jsuther",
"hardware-security//**/*.md": "vinpa",
"hardware-security//**/*.yml": "vinpa",
- "information-protection/**/*.md": "vinpa",
- "information-protection/**/*.yml": "vinpa",
"identity-protection/**/*.md": "paoloma",
"identity-protection/**/*.yml": "paoloma",
+ "information-protection/**/*.md": "vinpa",
+ "information-protection/**/*.yml": "vinpa",
"operating-system-security/**/*.md": "vinpa",
"operating-system-security/**/*.yml": "vinpa",
"operating-system-security/data-protection/**/*.md": "paoloma",
@@ -208,23 +216,23 @@
"ms.reviewer": {
"application-security/application-control/windows-defender-application-control/**/*.md": "vinpa",
"application-security/application-isolation/microsoft-defender-application-guard/*.md": "sazankha",
- "identity-protection/hello-for-business/*.md": "erikdau",
- "identity-protection/credential-guard/*.md": "zwhittington",
"identity-protection/access-control/*.md": "sulahiri",
+ "identity-protection/credential-guard/*.md": "zwhittington",
+ "identity-protection/hello-for-business/*.md": "erikdau",
"identity-protection/smart-cards/*.md": "ardenw",
"identity-protection/virtual-smart-cards/*.md": "ardenw",
- "operating-system-security/network-security/windows-firewall/*.md": "nganguly",
- "operating-system-security/network-security/vpn/*.md": "pesmith",
"operating-system-security/data-protection/personal-data-encryption/*.md": "rhonnegowda",
- "operating-system-security/device-management/windows-security-configuration-framework/*.md": "jmunck"
+ "operating-system-security/device-management/windows-security-configuration-framework/*.md": "jmunck",
+ "operating-system-security/network-security/vpn/*.md": "pesmith",
+ "operating-system-security/network-security/windows-firewall/*.md": "nganguly"
},
"ms.collection": {
"identity-protection/hello-for-business/*.md": "tier1",
"information-protection/pluton/*.md": "tier1",
"information-protection/tpm/*.md": "tier1",
- "threat-protection/auditing/*.md": "tier3",
"operating-system-security/data-protection/bitlocker/*.md": "tier1",
- "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1"
+ "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1",
+ "threat-protection/auditing/*.md": "tier3"
}
},
"template": [],
diff --git a/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md b/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md
index b513a67096..fc6a8fad0f 100644
--- a/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md
+++ b/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md
@@ -33,7 +33,7 @@ The security features of Windows combined with the benefits of a TPM offer pract
Windows includes a cryptography framework called Cryptographic API: Next Generation (CNG), the basic approach of which is to implement cryptographic algorithms in different ways but with a common application programming interface (API). Applications that use cryptography can use the common API without knowing the details of how an algorithm is implemented much less the algorithm itself.
-Although CNG sounds like a mundane starting point, it illustrates some of the advantages that a TPM provides. Underneath the CNG interface, Windows or third parties supply a cryptographic provider (that is, an implementation of an algorithm) implemented as software libraries alone or in a combination of software and available system hardware or third-party hardware. If implemented through hardware, the cryptographic provider communicates with the hardware behind the software interface of CNG.
+Although CNG sounds like a mundane starting point, it illustrates some of the advantages that a TPM provides. Underneath the CNG interface, Windows or third parties supply a cryptographic provider (that is, an implementation of an algorithm) implemented as software libraries alone or in a combination of software and available system hardware or non-Microsoft hardware. If implemented through hardware, the cryptographic provider communicates with the hardware behind the software interface of CNG.
The Platform Crypto Provider, introduced in the Windows 8, exposes the following special TPM properties, which software-only CNG providers can't offer or can't offer as effectively:
@@ -94,7 +94,7 @@ For software measurements, Device Encryption relies on measurements of the autho
Windows 8 introduced Measured Boot as a way for the operating system to record the chain of measurements of software components and configuration information in the TPM through the initialization of the Windows operating system. In previous Windows versions, the measurement chain stopped at the Windows Boot Manager component itself, and the measurements in the TPM were not helpful for understanding the starting state of Windows.
-The Windows boot process happens in stages and often involves third-party drivers to communicate with vendor-specific hardware or implement antimalware solutions. For software, Measured Boot records measurements of the Windows kernel, Early-Launch Anti-Malware drivers, and boot drivers in the TPM. For configuration settings, Measured Boot records security-relevant information such as signature data that antimalware drivers use and configuration data about Windows security features (e.g., whether BitLocker is on or off).
+The Windows boot process happens in stages and often involves non-Microsoft drivers to communicate with vendor-specific hardware or implement antimalware solutions. For software, Measured Boot records measurements of the Windows kernel, Early-Launch Anti-Malware drivers, and boot drivers in the TPM. For configuration settings, Measured Boot records security-relevant information such as signature data that antimalware drivers use and configuration data about Windows security features (e.g., whether BitLocker is on or off).
Measured Boot ensures that TPM measurements fully reflect the starting state of Windows software and configuration settings. If security settings and other protections are set up correctly, they can be trusted to maintain the security of the running operating system thereafter. Other scenarios can use the operating system's starting state to determine whether the running operating system should be trusted.
diff --git a/windows/security/identity-protection/credential-guard/considerations-known-issues.md b/windows/security/identity-protection/credential-guard/considerations-known-issues.md
index dbf52336f8..ebae34dece 100644
--- a/windows/security/identity-protection/credential-guard/considerations-known-issues.md
+++ b/windows/security/identity-protection/credential-guard/considerations-known-issues.md
@@ -22,9 +22,9 @@ For WiFi and VPN connections, it's recommended to move from MSCHAPv2-based conne
When you enable Credential Guard, you can no longer use Kerberos unconstrained delegation or DES encryption. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process.\
Use constrained or resource-based Kerberos delegation instead.
-## Third party Security Support Providers considerations
+## Non-Microsoft Security Support Providers considerations
-Some third party Security Support Providers (SSPs and APs) might not be compatible with Credential Guard because it doesn't allow third-party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs aren't supported.\
+Some non-Microsoft Security Support Providers (SSPs and APs) might not be compatible with Credential Guard because it doesn't allow non-Microsoft SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs aren't supported.\
It's recommended that custom implementations of SSPs/APs are tested with Credential Guard. SSPs and APs that depend on any undocumented or unsupported behaviors fail. For example, using the KerbQuerySupplementalCredentialsMessage API isn't supported. Replacing the NTLM or Kerberos SSPs with custom SSPs and APs.
For more information, see [Restrictions around Registering and Installing a Security Package](/windows/win32/secauthn/restrictions-around-registering-and-installing-a-security-package).
@@ -110,15 +110,15 @@ Credential Guard blocks certain authentication capabilities. Applications that r
This article describes known issues when Credential Guard is enabled.
-### Single sign-on for Network services breaks after upgrading to Windows 11, version 22H2
+### Single sign-on for Network services breaks after upgrading to Windows 11, version 22H2
-Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication are unable to use SSO to sign in and are forced to manually re-authenticate in every new Windows session when Credential Guard is running.
+Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication are unable to use SSO to sign in and are forced to manually re-authenticate in every new Windows session when Credential Guard is running.
#### Affected devices
Any device with Credential Guard enabled may encounter the issue. As part of the Windows 11, version 22H2 update, eligible devices that didn't disable Credential Guard, have it enabled by default. This affected all devices on Enterprise (E3 and E5) and Education licenses, as well as some Pro licenses, as long as they met the [minimum hardware requirements](index.md#hardware-and-software-requirements).
-
-All Windows Pro devices that previously ran Credential Guard on an eligible license and later downgraded to Pro, and which still meet the [minimum hardware requirements](index.md#hardware-and-software-requirements), will receive default enablement.
+
+All Windows Pro devices that previously ran Credential Guard on an eligible license and later downgraded to Pro, and which still meet the [minimum hardware requirements](index.md#hardware-and-software-requirements), will receive default enablement.
> [!TIP]
> To determine if a Windows Pro device receives default enablement when upgraded to **Windows 11, version 22H2**, check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`.
@@ -188,16 +188,16 @@ MS-CHAP and NTLMv1 are relevant to the SSO breakage after the Windows 11, versio
#### How to fix the issue
-We recommend moving away from MSCHAPv2-based connections, such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication, like PEAP-TLS or EAP-TLS. Credential Guard doesn't block certificate-based authentication.
+We recommend moving away from MSCHAPv2-based connections, such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication, like PEAP-TLS or EAP-TLS. Credential Guard doesn't block certificate-based authentication.
For a more immediate, but less secure fix, [disable Credential Guard](configure.md#disable-credential-guard). Credential Guard doesn't have per-protocol or per-application policies, and it can either be turned on or off. If you disable Credential Guard, you leave stored domain credentials vulnerable to theft.
> [!TIP]
> To prevent default enablement, configure your devices [to disable Credential Guard](configure.md#disable-credential-guard) before updating to Windows 11, version 22H2. If the setting is not configured (which is the default state) and if the device is eligible, the device automatically enable Credential Guard after the update.
>
-> If Credential Guard is explicitly disabled, the device won't automatically enable Credential Guard after the update.
+> If Credential Guard is explicitly disabled, the device won't automatically enable Credential Guard after the update.
-### Issues with third-party applications
+### Issues with non-Microsoft applications
The following issue affects MSCHAPv2:
diff --git a/windows/security/identity-protection/credential-guard/how-it-works.md b/windows/security/identity-protection/credential-guard/how-it-works.md
index e618929b94..95c2cc6b76 100644
--- a/windows/security/identity-protection/credential-guard/how-it-works.md
+++ b/windows/security/identity-protection/credential-guard/how-it-works.md
@@ -25,7 +25,7 @@ Some ways to store credentials aren't protected by Credential Guard, including:
- Key loggers
- Physical attacks
- Doesn't prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access to high value assets in your organization
-- Third-party security packages
+- Non-Microsoft security packages
- When Credential Guard is enabled, NTLMv1, MS-CHAPv2, Digest, and CredSSP can't use the signed-in credentials. Thus, single sign-on doesn't work with these protocols. However, applications can prompt for credentials or use credentials stored in the Windows Vault, which aren't protected by Credential Guard with any of these protocols
> [!CAUTION]
> It's recommended that valuable credentials, such as the sign-in credentials, aren't used with NTLMv1, MS-CHAPv2, Digest, or CredSSP protocols. If these protocols must be used by domain or Microsoft Entra users, secondary credentials should be provisioned for these use cases.
diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md
index e384f47efe..55551c53ca 100644
--- a/windows/security/identity-protection/enterprise-certificate-pinning.md
+++ b/windows/security/identity-protection/enterprise-certificate-pinning.md
@@ -2,7 +2,7 @@
title: Enterprise certificate pinning
description: Enterprise certificate pinning is a Windows feature for remembering, or pinning, a root issuing certificate authority, or end-entity certificate to a domain name.
ms.topic: concept-article
-ms.date: 05/24/2023
+ms.date: 03/12/2024
---
# Enterprise certificate pinning overview
@@ -29,7 +29,7 @@ To deploy enterprise certificate pinning, you need to:
- Apply the pin rules certificate trust list file to a reference administrative computer
- Deploy the registry configuration on the reference computer via group policy
-### Create a pin rules XML file
+### Create a pin rules XML file
The XML-based pin rules file consists of a sequence of PinRule elements.
Each PinRule element contains a sequence of one or more Site elements and a sequence of zero or more Certificate elements.
@@ -61,12 +61,12 @@ Each PinRule element contains a sequence of one or more Site elements and a sequ
#### PinRules element
The PinRules element can have the following attributes.
-For help with formatting Pin Rules, see [Represent a date in XML](#represent-a-date-in-xml) or [Represent a duration in XML](#represent-a-duration-in-xml).
+For help with formatting Pin Rules, see [Represent a date in XML](#represent-a-date-in-xml) or [Represent a duration in XML](#represent-a-duration-in-xml).
| Attribute | Description | Required |
|-----------|-------------|----------|
| **Duration** or **NextUpdate** | Specifies when the Pin Rules expires. Either is required. **NextUpdate** takes precedence if both are specified. **Duration**, represented as an XML TimeSpan data type, doesn't allow years and months. You represent the **NextUpdate** attribute as an XML DateTime data type in UTC. | **Required?** Yes. At least one is required. |
-| **LogDuration** or **LogEndDate** | Configures auditing only to extend beyond the expiration of enforcing the Pin Rules. **LogEndDate**, represented as an XML DateTime data type in UTC, takes precedence if both are specified. You represent **LogDuration** as an XML TimeSpan data type, which doesn't allow years and months. If `none of the attributes are specified, auditing expiration uses **Duration** or **NextUpdate** attributes. | No. |
+| **LogDuration** or **LogEndDate** | Configures auditing only to extend beyond the expiration of enforcing the Pin Rules. **LogEndDate**, represented as an XML DateTime data type in UTC, takes precedence if both are specified. You represent **LogDuration** as an XML TimeSpan data type, which doesn't allow years and months. If `none of the attributes are specified, auditing expiration uses **Duration** or **NextUpdate** attributes. | No. |
| **ListIdentifier** | Provides a friendly name for the list of pin rules. Windows doesn't use this attribute for certificate pinning enforcement; however, it's included when the pin rules are converted to a certificate trust list (CTL). | No. |
#### PinRule element
@@ -86,7 +86,7 @@ The **Certificate** element can have the following attributes.
| Attribute | Description | Required |
|-----------|-------------|----------|
| **File** | Path to a file containing one or more certificates. Where the certificate(s) can be encoded as: - single certificate - p7b - sst These files can also be Base64 formatted. All **Site** elements included in the same **PinRule** element can match any of these certificates. | Yes (File, Directory, or Base64 must be present). |
-| **Directory** | Path to a directory containing one or more of the above certificate files. Skips any files not containing any certificates. | Yes (File, Directory, or Base64 must be present). |
+| **Directory** | Path to a directory containing one or more of the above certificate files. Skips any files not containing any certificates. | Yes (File, Directory, or Base64 must be present). |
| **Base64** | Base64 encoded certificate(s). Where the certificate(s) can be encoded as: - single certificate - p7b - sst This allows the certificates to be included in the XML file without a file directory dependency. Note: You can use **certutil -encode** to convert a .cer file into base64. You can then use Notepad to copy and paste the base64 encoded certificate into the pin rule. | Yes (File, Directory, or Base64 must be present). |
| **EndDate** | Enables you to configure an expiration date for when the certificate is no longer valid in the pin rule. If you are in the process of switching to a new root or CA, you can set the **EndDate** to allow matching of this element's certificates. If the current time is past the **EndDate**, when creating the certificate trust list (CTL) the parser outputs a warning message and excludes the certificate(s) from the Pin Rule in the generated CTL. For help with formatting Pin Rules, see [Represent a date in XML](#represent-a-date-in-xml).| No.|
@@ -138,8 +138,8 @@ certutil -generatePinRulesCTL certPinRules.xml pinrules.stl
### Apply certificate pinning rules to a reference computer
-Now that your certificate pinning rules are in the certificate trust list format, you need to apply the settings to a reference computer as a prerequisite to deploying the setting to your enterprise.
-To simplify the deployment configuration, it's best to apply your certificate pinning rules to a computer that has the Group Policy Management Console (GPMC) included in the Remote Server Administration Tools (RSAT).
+Now that your certificate pinning rules are in the certificate trust list format, you need to apply the settings to a reference computer as a prerequisite to deploying the setting to your enterprise.
+To simplify the deployment configuration, it's best to apply your certificate pinning rules to a computer that has the Group Policy Management Console (GPMC) included in the Remote Server Administration Tools (RSAT).
Use *certutil.exe* to apply your certificate pinning rules to your reference computer using the *setreg* argument.\
The *setreg* argument takes a secondary argument that determines the location of where certutil writes the certificate pining rules.\
@@ -148,7 +148,7 @@ The last argument you provide is the name of file that contains your certificate
You pass the name of the file as the last argument. You must prefix the file name with the `@` symbol as in the following example:
```cmd
-Certutil -setreg chain\PinRules @pinrules.stl
+Certutil -setreg chain\PinRules @pinrules.stl
```
> [!NOTE]
@@ -215,7 +215,7 @@ You can run the following commands from an elevated command prompt to achieve th
set PinRulesLogDir=c:\PinRulesLog
mkdir %PinRulesLogDir%
icacls %PinRulesLogDir% /grant *S-1-15-2-1:(OI)(CI)(F)
-icacls %PinRulesLogDir% /grant *S-1-1-0:(OI)(CI)(F)
+icacls %PinRulesLogDir% /grant *S-1-1-0:(OI)(CI)(F)
icacls %PinRulesLogDir% /grant *S-1-5-12:(OI)(CI)(F)
icacls %PinRulesLogDir% /inheritance:e /setintegritylevel (OI)(CI)L
```
@@ -233,7 +233,7 @@ For example:
- `DE28F4A4_www.yammer.com.p7b`
If there's either an enterprise certificate pin rule or a Microsoft certificate pin rule mismatch, then Windows writes the .p7b file to the **MismatchPinRules** child folder.
-If the pin rules have expired, then Windows writes the .p7b to the **ExpiredPinRules** child folder.
+If the pin rules have expired, then Windows writes the .p7b to the **ExpiredPinRules** child folder.
## Represent a date in XML
@@ -244,7 +244,7 @@ You can then copy and paste the output of the cmdlet into the XML file.
-For simplicity, you can truncate decimal point (.) and the numbers after it.
+For simplicity, you can truncate decimal point (.) and the numbers after it.
However, be certain to append the uppercase "Z" to the end of the XML date string.
```cmd
@@ -268,7 +268,7 @@ You can use Windows PowerShell to properly format and validate durations (timesp
## Convert an XML duration
-You can convert an XML formatted timespan into a timespan variable that you can read.
+You can convert an XML formatted timespan into a timespan variable that you can read.
diff --git a/windows/security/identity-protection/hello-for-business/deploy/cloud-only.md b/windows/security/identity-protection/hello-for-business/deploy/cloud-only.md
index 475b2dc597..d7e4822aaa 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/cloud-only.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/cloud-only.md
@@ -1,8 +1,8 @@
---
title: Windows Hello for Business cloud-only deployment guide
description: Learn how to deploy Windows Hello for Business in a cloud-only deployment scenario.
-ms.date: 01/03/2024
-ms.topic: how-to
+ms.date: 03/12/2024
+ms.topic: tutorial
---
# Cloud-only deployment guide
@@ -32,7 +32,7 @@ When you Microsoft Entra join a device, the system attempts to automatically enr
Cloud-only deployments use Microsoft Entra multifactor authentication (MFA) during Windows Hello for Business enrollment, and there's no other MFA configuration needed. If you aren't already registered in MFA, you're guided through the MFA registration as part of the Windows Hello for Business enrollment process.
-Policy settings can be configured to control the behavior of Windows Hello for Business, via configuration service provider (CSP) or group policy (GPO). In cloud-only deployments, devices are
+Policy settings can be configured to control the behavior of Windows Hello for Business, via configuration service provider (CSP) or group policy (GPO). In cloud-only deployments, devices are
typically configured via an MDM solution like Microsoft Intune, using the [PassportForWork CSP][WIN-1].
> [!NOTE]
diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs.md
index 447f1f5c55..94167d36b9 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs.md
@@ -1,7 +1,7 @@
---
title: Configure Active Directory Federation Services in a hybrid certificate trust model
description: Learn how to configure Active Directory Federation Services (AD FS) to support the Windows Hello for Business hybrid certificate trust model.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
@@ -21,7 +21,7 @@ The CRA enrolls for an *enrollment agent certificate*, and the Windows Hello for
Sign-in the AD FS server with *domain administrator* equivalent credentials.
Open a **Windows PowerShell** prompt and type the following command:
-
+
```PowerShell
Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication -WindowsHelloCertificateProxyEnabled $true
```
diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md
index 2bc061e33b..2891e83911 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md
@@ -1,7 +1,7 @@
---
title: Configure and enroll in Windows Hello for Business in hybrid certificate trust model
description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid certificate trust scenario.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md
index 85dd13860f..35d1ff0083 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md
@@ -1,7 +1,7 @@
---
title: Configure and validate the PKI in an hybrid certificate trust model
description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a hybrid certificate trust model.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md
index 3fcb86b928..58e8cc3e3d 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md
@@ -1,7 +1,7 @@
---
title: Windows Hello for Business hybrid certificate trust deployment guide
description: Learn how to deploy Windows Hello for Business in a hybrid certificate trust scenario.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
@@ -28,7 +28,7 @@ ms.topic: tutorial
> Once the prerequisites are met, deploying Windows Hello for Business consists of the following steps:
>
> - [Configure and validate the Public Key Infrastructure](hybrid-cert-trust-pki.md)
-> - [Configure Active Directory Federation Services](hybrid-cert-trust-adfs.md)
+> - [Configure Active Directory Federation Services](hybrid-cert-trust-adfs.md)
> - [Configure and enroll in Windows Hello for Business](hybrid-cert-trust-enroll.md)
> - (optional) [Configure single sign-on for Microsoft Entra joined devices](../hello-hybrid-aadj-sso.md)
diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md
index 1c67b375b7..9af88ba3bf 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md
@@ -1,7 +1,7 @@
---
title: Windows Hello for Business cloud Kerberos trust deployment guide
description: Learn how to deploy Windows Hello for Business in a cloud Kerberos trust scenario.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md
index a1686099b6..62f5d4401e 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md
@@ -1,7 +1,7 @@
---
title: Configure and enroll in Windows Hello for Business in a hybrid key trust model
description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid key trust scenario.
-ms.date: 12/29/2023
+ms.date: 03/12/2024
ms.topic: tutorial
---
diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md
index e5a08f2117..2b775003f0 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md
@@ -1,7 +1,7 @@
---
title: Windows Hello for Business hybrid key trust deployment guide
description: Learn how to deploy Windows Hello for Business in a hybrid key trust scenario.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
@@ -36,7 +36,7 @@ Windows Hello for Business must have a Public Key Infrastructure (PKI) when usin
Key trust deployments don't need client-issued certificates for on-premises authentication. *Microsoft Entra Connect Sync* configures Active Directory user accounts for public key mapping, by synchronizing the public key of the Windows Hello for Business credential to an attribute on the user's Active Directory object (`msDS-KeyCredentialLink` attribute).
-A Windows Server-based PKI or a third-party Enterprise certification authority can be used. For more information, see [Requirements for domain controller certificates from a third-party CA][SERV-1].
+A Windows Server-based PKI or a non-Microsoft Enterprise certification authority can be used. For more information, see [Requirements for domain controller certificates from a non-Microsoft CA][SERV-1].
[!INCLUDE [lab-based-pki-deploy](includes/lab-based-pki-deploy.md)]
diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/adfs-mfa.md b/windows/security/identity-protection/hello-for-business/deploy/includes/adfs-mfa.md
index e9f18f3925..a684145a1d 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/includes/adfs-mfa.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/includes/adfs-mfa.md
@@ -8,12 +8,12 @@ ms.topic: include
Windows Hello for Business requires users perform multifactor authentication (MFA) prior to enroll in the service. On-premises deployments can use, as MFA option:
- certificates
-- third-party authentication providers for AD FS
+- non-Microsoft authentication providers for AD FS
- custom authentication provider for AD FS
> [!IMPORTANT]
> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multifactor authentication from their users should use cloud-based Microsoft Entra multifactor authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual.
-For information on available third-party authentication methods see [Configure Additional Authentication Methods for AD FS](/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method)
+For information on available non-Microsoft authentication methods see [Configure Additional Authentication Methods for AD FS](/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method)
Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multifactor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies).
diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md
index e2d6f588de..a113cec641 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md
@@ -26,7 +26,7 @@ The certificate template is configured to supersede all the certificate template
However, the certificate template and the superseding of certificate templates isn't active until the template is published to one or more certificate authorities.
> [!NOTE]
-> The domain controller's certificate must chain to a root in the NTAuth store. By default, the Active Directory Certificate Authority's root certificate is added to the NTAuth store. If you are using a third-party CA, this may not be done by default. If the domain controller certificate does not chain to a root in the NTAuth store, user authentication will fail.
+> The domain controller's certificate must chain to a root in the NTAuth store. By default, the Active Directory Certificate Authority's root certificate is added to the NTAuth store. If you are using a non-Microsoft CA, this may not be done by default. If the domain controller certificate does not chain to a root in the NTAuth store, user authentication will fail.
>To see all certificates in the NTAuth store, use the following command:
>
> `Certutil -viewstore -enterprise NTAuth`
diff --git a/windows/security/identity-protection/hello-for-business/deploy/index.md b/windows/security/identity-protection/hello-for-business/deploy/index.md
index 061c4a62e1..b28e7db255 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/index.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/index.md
@@ -1,8 +1,8 @@
---
title: Plan a Windows Hello for Business Deployment
description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure.
-ms.date: 01/02/2024
-ms.topic: overview
+ms.date: 03/12/2024
+ms.topic: concept-article
---
# Plan a Windows Hello for Business deployment
@@ -112,11 +112,11 @@ Users can authenticate to Microsoft Entra ID using federated authentication or c
| | Deployment model | Trust type | Authentication to Microsoft Entra ID | Requirements |
|--|--|--|--|--|
| **🔲** | **Cloud-only** | n/a | Cloud authentication | n/a |
-| **🔲** | **Cloud-only** | n/a | Federated authentication | Third-party federation service |
+| **🔲** | **Cloud-only** | n/a | Federated authentication | Non-Microsoft federation service |
| **🔲** | **Hybrid** | Cloud Kerberos trust | Cloud authentication | Password hash sync (PHS) or Pass-through authentication (PTA) |
-| **🔲** | **Hybrid** | Cloud Kerberos trust | Federated authentication | AD FS or third-party federation service |
+| **🔲** | **Hybrid** | Cloud Kerberos trust | Federated authentication | AD FS or non-Microsoft federation service |
| **🔲** | **Hybrid** | Key trust | Cloud authentication | Password hash sync (PHS) or Pass-through authentication (PTA) |
-| **🔲** | **Hybrid** | Key trust | Federated authentication | AD FS or third-party federation service |
+| **🔲** | **Hybrid** | Key trust | Federated authentication | AD FS or non-Microsoft federation service |
| **🔲** | **Hybrid** | Certificate trust | Federated authentication | This deployment model doesn't support PTA or PHS. Active Directory must be federated with Microsoft Entra ID using AD FS|
To learn more:
@@ -143,7 +143,7 @@ For on-premises deployments, the server running the Active Directory Federation
The goal of Windows Hello for Business is to move organizations away from passwords by providing them with a *strong credential* that enables easy two-factor authentication. The built-in provisioning experience accepts the user's weak credentials (username and password) as the first factor authentication. However, the user must provide a second factor of authentication before Windows provisions a strong credential:
- For cloud-only and hybrid deployments, there are different choices for multifactor authentication, including [Microsoft Entra MFA][ENTRA-1]
-- On-premises deployments must use a multifactor option that can integrate as an AD FS multifactor adapter. Organizations can choose from third-party options that offer an AD FS MFA adapter. For more information, see [Microsoft and third-party additional authentication methods][SER-2]
+- On-premises deployments must use a multifactor option that can integrate as an AD FS multifactor adapter. Organizations can choose from non-Microsoft options that offer an AD FS MFA adapter. For more information, see [Microsoft and non-Microsoft additional authentication methods][SER-2]
> [!IMPORTANT]
> As of July 1, 2019, Microsoft doesn't offer MFA Server for new deployments. New deployments that require multifactor authentication should use cloud-based Microsoft Entra multifactor authentication. Existing deployment where the MFA Server was activated prior to July 1, 2019 can download the latest version, future updates, and generate activation credentials. For more information, see [Getting started with the Azure Multi-Factor Authentication Server][ENTRA-2].
@@ -151,9 +151,9 @@ The goal of Windows Hello for Business is to move organizations away from passwo
|| Deployment model | MFA options |
|--|--|--|
| **🔲** | **Cloud-only** | Microsoft Entra MFA |
-| **🔲** | **Cloud-only** | Third-party MFA via Microsoft Entra ID custom controls or federation |
+| **🔲** | **Cloud-only** | Non-Microsoft MFA via Microsoft Entra ID custom controls or federation |
| **🔲** | **Hybrid** | Microsoft Entra MFA |
-| **🔲** | **Hybrid** | Third-party MFA via Microsoft Entra ID custom controls or federation|
+| **🔲** | **Hybrid** | Non-Microsoft MFA via Microsoft Entra ID custom controls or federation|
| **🔲** | **On-premises** | AD FS MFA adapter |
For more information how to configure Microsoft Entra multifactor authentication, see [Configure Microsoft Entra multifactor authentication settings][ENTRA-4].
@@ -224,7 +224,7 @@ Windows Hello for Business provides a rich set of granular policy settings. Ther
Here are some considerations regarding licensing requirements for cloud services:
- Windows Hello for Business doesn't require a Microsoft Entra ID P1 or P2 subscription. However, some dependencies, such as [MDM automatic enrollment][MEM-1] and [Conditional Access][ENTRA-8] do
- - Devices managed via MDM don't require a Microsoft Entra ID P1 or P2 subscription. By forgoing the subscription, users must manually enroll devices in the MDM solution, such as Microsoft Intune or a supported third-party MDM
+ - Devices managed via MDM don't require a Microsoft Entra ID P1 or P2 subscription. By forgoing the subscription, users must manually enroll devices in the MDM solution, such as Microsoft Intune or a supported non-Microsoft MDM
- You can deploy Windows Hello for Business using the Microsoft Entra ID Free tier. All Microsoft Entra ID Free accounts can use Microsoft Entra multifactor authentication for the Windows passwordless features
- Some Microsoft Entra multifactor authentication features require a license. For more information, see [Features and licenses for Microsoft Entra multifactor authentication][ENTRA-9].
- Enrolling a certificate using the AD FS registration authority requires devices to authenticate to the AD FS server, which requires device write-back, a Microsoft Entra ID P1 or P2 feature
diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs.md
index 335e4d5cb6..dc000be03a 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs.md
@@ -1,7 +1,7 @@
---
title: Configure Active Directory Federation Services in an on-premises certificate trust model
description: Learn how to configure Active Directory Federation Services (AD FS) to support the Windows Hello for Business on-premises certificate trust model.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
@@ -36,7 +36,7 @@ Windows Hello for Business works exclusively with the Active Directory Federatio
> [!div class="checklist"]
> Before you continue with the deployment, validate your deployment progress by reviewing the following items:
>
-> - Record the information about the AD FS certificate, and set a renewal reminder at least six weeks before it expires. Relevant information includes: certificate serial number, thumbprint, common name, subject alternate name, name of the physical host server, the issued date, the expiration date, and issuing CA vendor (if a third-party certificate)
+> - Record the information about the AD FS certificate, and set a renewal reminder at least six weeks before it expires. Relevant information includes: certificate serial number, thumbprint, common name, subject alternate name, name of the physical host server, the issued date, the expiration date, and issuing CA vendor (if a non-Microsoft certificate)
> - Confirm you added the AD FS service account to the KeyAdmins group
> - Confirm you enabled the Device Registration service
@@ -72,7 +72,7 @@ Use the event logs on the AD FS service to confirm the service account enrolled
- The thumbprint of the certificate
- The certificate template used to issue the certificate
-You cannot use the Certificate Manager to view enrolled certificates for group managed service accounts. Use the event log information to confirm the AD FS service account enrolled a certificate. Use certutil.exe to view the details of the certificate shown in the event log.
+You cannot use the Certificate Manager to view enrolled certificates for group managed service accounts. Use the event log information to confirm the AD FS service account enrolled a certificate. Use `certutil.exe` to view the details of the certificate shown in the event log.
Group managed service accounts use user profiles to store user information, which included enrolled certificates. On the AD FS server, use a command prompt and navigate to `%systemdrive%\users\\appdata\roaming\Microsoft\systemcertificates\my\certificates`.
diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md
index 045a6ba24c..f856919e78 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md
@@ -1,5 +1,5 @@
---
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust
description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario
diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust.md
index 6bd1a94800..92ee0befff 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust.md
@@ -1,7 +1,7 @@
---
title: Windows Hello for Business on-premises certificate trust deployment guide
description: Learn how to deploy Windows Hello for Business in an on-premises, certificate trust scenario.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs.md
index 12685b46eb..d9e217575b 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs.md
@@ -1,7 +1,7 @@
---
title: Configure Active Directory Federation Services in an on-premises key trust model
description: Learn how to configure Active Directory Federation Services (AD FS) to support the Windows Hello for Business key trust model.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
@@ -21,7 +21,7 @@ Before you continue with the deployment, validate your deployment progress by re
> [!div class="checklist"]
>
-> - Record the information about the AD FS certificate, and set a renewal reminder at least six weeks before it expires. Relevant information includes: certificate serial number, thumbprint, common name, subject alternate name, name of the physical host server, the issued date, the expiration date, and issuing CA vendor (if a third-party certificate)
+> - Record the information about the AD FS certificate, and set a renewal reminder at least six weeks before it expires. Relevant information includes: certificate serial number, thumbprint, common name, subject alternate name, name of the physical host server, the issued date, the expiration date, and issuing CA vendor (if a non-Microsoft certificate)
> - Confirm you added the AD FS service account to the KeyAdmins group
> - Confirm you enabled the Device Registration service
diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md
index 442ead237c..34f55f78f3 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md
@@ -1,5 +1,5 @@
---
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
title: Configure Windows Hello for Business Policy settings in an on-premises key trust
description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises key trust scenario
diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust.md
index a5a2281196..0b7ef9d9a3 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust.md
@@ -1,7 +1,7 @@
---
title: Windows Hello for Business on-premises key trust deployment guide
description: Learn how to deploy Windows Hello for Business in an on-premises, key trust scenario.
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: tutorial
---
diff --git a/windows/security/identity-protection/hello-for-business/deploy/prepare-users.md b/windows/security/identity-protection/hello-for-business/deploy/prepare-users.md
index 9dbdfc8a07..0aeded8941 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/prepare-users.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/prepare-users.md
@@ -1,7 +1,7 @@
---
title: Prepare users to provision and use Windows Hello for Business
description: Learn how to prepare users to enroll and to use Windows Hello for Business.
-ms.date: 01/02/2024
+ms.date: 03/12/2024
ms.topic: end-user-help
---
diff --git a/windows/security/identity-protection/hello-for-business/faq.yml b/windows/security/identity-protection/hello-for-business/faq.yml
index 1b9e0947ca..3d8f631c06 100644
--- a/windows/security/identity-protection/hello-for-business/faq.yml
+++ b/windows/security/identity-protection/hello-for-business/faq.yml
@@ -37,18 +37,18 @@ sections:
Anytime key material is generated, it must be protected against attack. The most robust way to do this is through specialized hardware. There's a long history of using hardware security modules (HSMs) to generate, store, and process keys for security-critical applications. Smart cards are a special type of HSM, as are devices that are compliant with the Trusted Computing Group TPM standard. Wherever possible, the Windows Hello for Business implementation takes advantage of onboard TPM hardware to generate and protect keys. Administrators can choose to allow key operations in software, but it's recommended the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means the user will have to use MFA to reauthenticate to the IdP before the IdP allows re-registration). Resetting the PIN means that all keys and certificates encrypted with the old key material will be removed.
- question: How does PIN caching work with Windows Hello for Business?
answer: |
- Windows Hello for Business provides a PIN caching user experience by using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Microsoft Entra ID and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting, as long as the user is interactively signed-in. Microsoft Account sign-in keys are transactional keys, which means the user is always prompted when accessing the key.
-
- Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation prompts the user for the PIN on first use. Subsequent private key operations won't prompt the user for the PIN.
-
+ Windows Hello for Business provides a PIN caching user experience by using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Microsoft Entra ID and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting, as long as the user is interactively signed-in. Microsoft Account sign-in keys are transactional keys, which means the user is always prompted when accessing the key.
+
+ Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation prompts the user for the PIN on first use. Subsequent private key operations won't prompt the user for the PIN.
+
The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process doesn't receive the PIN, but rather the ticket that grants them private key operations. There isn't a policy setting to adjust the caching.
- question: Where is Windows Hello biometrics data stored?
answer: |
When you enroll in Windows Hello, a representation of your biometrics, called an enrollment profile, is created more information can be found on [Windows Hello face authentication](/windows-hardware/design/device-experiences/windows-hello-face-authentication). This enrollment profile biometrics data is device specific, is stored locally on the device, and does not leave the device or roam with the user. Some external fingerprint sensors store biometric data on the fingerprint module itself rather than on Windows device. Even in this case, the biometrics data is stored locally on those modules, is device specific, doesn't roam, never leaves the module, and is never sent to Microsoft cloud or external server. For more details, see [Windows Hello biometrics in the enterprise](/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise#where-is-windows-hello-data-stored).
- question: What is the format used to store Windows Hello biometrics data on the device?
answer: |
- Windows Hello biometrics data is stored on the device as an encrypted template database. The data from the biometrics sensor (like face camera or fingerprint reader) creates a data representation—or graph—that is then encrypted before it's stored on the device. Each biometrics sensor on the device which is used by Windows Hello (face or fingerprint) will have its own biometric database file where template data is stored. Each biometrics database file is encrypted with unique, randomly generated key that is encrypted to the system using AES encryption producing an SHA256 hash.
- - question: Who has access on Windows Hello biometrics data?
+ Windows Hello biometrics data is stored on the device as an encrypted template database. The data from the biometrics sensor (like face camera or fingerprint reader) creates a data representation—or graph—that is then encrypted before it's stored on the device. Each biometrics sensor on the device which is used by Windows Hello (face or fingerprint) will have its own biometric database file where template data is stored. Each biometrics database file is encrypted with unique, randomly generated key that is encrypted to the system using AES encryption producing an SHA256 hash.
+ - question: Who has access on Windows Hello biometrics data?
answer: |
Since Windows Hello biometrics data is stored in encrypted format, no user, or any process other than Windows Hello has access to it.
- question: When is Windows Hello biometrics database file created? How is a user enrolled into Windows Hello face or fingerprint authentication?
@@ -59,18 +59,18 @@ sections:
To remove Windows Hello and any associated biometric identification data from the device, open **Start > Settings > Accounts > Sign-in options**. Select the Windows Hello biometrics authentication method you want to remove, and then select **Remove**. The action unenrolls from Windows Hello biometrics authentication and deletes the associated biometrics template database file. For more details, see [Windows sign-in options and account protection (microsoft.com)](https://support.microsoft.com/windows/windows-sign-in-options-and-account-protection-7b34d4cf-794f-f6bd-ddcc-e73cdf1a6fbf#bkmk_helloandprivacy).
- name: Management and operations
- questions:
+ questions:
- question: Can I deploy and manage Windows Hello for Business by using Microsoft Configuration Manager?
answer: |
Starting in Configuration Manager, version 2203, Windows Hello for Business deployments using Configuration Manager are no longer supported.
- question: How do I delete a Windows Hello for Business container on a device?
- answer: |
- You can delete the Windows Hello for Business container by executing the command `certutil.exe -deleteHelloContainer`.
+ answer: |
+ You can delete the Windows Hello for Business container by executing the command `certutil.exe -deleteHelloContainer`.
- question: What happens when a user forgets their PIN?
answer: |
If the user can sign in with a password, they can reset their PIN by selecting the *I forgot my PIN* link in the Settings app or from the lock screen, by selecting the *I forgot my PIN* link on the PIN credential provider.
-
- For on-premises deployments, devices must be connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid deployments can onboard their Microsoft Entra tenant to use the *Windows Hello for Business PIN reset service* to reset their PINs. Non-destructive PIN reset works without access to the corporate network. Destructive PIN reset requires access to the corporate network. For more details about destructive and non-destructive PIN reset, see [PIN reset](/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset).
+
+ For on-premises deployments, devices must be connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid deployments can onboard their Microsoft Entra tenant to use the *Windows Hello for Business PIN reset service* to reset their PINs. Non-destructive PIN reset works without access to the corporate network. Destructive PIN reset requires access to the corporate network. For more details about destructive and non-destructive PIN reset, see [PIN reset](pin-reset.md).
- question: Does Windows Hello for Business prevent the use of simple PINs?
answer: |
Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at 10 ('zero').
@@ -84,7 +84,7 @@ sections:
- The PIN 7036 has a constant delta of (3,3,3), so it isn't allowed
- The PIN 1231 doesn't have a constant delta (1,1,2), so it's allowed
- The PIN 1872 doesn't have a constant delta (7,9,5), so it's allowed
-
+
This check prevents repeating numbers, sequential numbers, and simple patterns. It always results in a list of 100 disallowed PINs (independent of the PIN length). This algorithm doesn't apply to alphanumeric PINs.
- question: Which diagnostic data is collected when Windows Hello for Business is enabled?
answer: |
@@ -92,7 +92,7 @@ sections:
- Data about whether people sign in with their face, iris, fingerprint, or PIN
- The number of times they use it
- Whether it works or not
- All this is valuable information that helps Microsoft building a better product. The data is pseudonymized, does not include biometric information, and is encrypted before it is transmitted to Microsoft. You can choose to stop sending diagnostic data to Microsoft at any time. [Learn more about diagnostic data in Windows](https://support.microsoft.com/windows/diagnostics-feedback-and-privacy-in-windows-28808a2b-a31b-dd73-dcd3-4559a5199319).
+ All this is valuable information that helps Microsoft building a better product. The data is pseudonymized, does not include biometric information, and is encrypted before it is transmitted to Microsoft. You can choose to stop sending diagnostic data to Microsoft at any time. [Learn more about diagnostic data in Windows](https://support.microsoft.com/windows/diagnostics-feedback-and-privacy-in-windows-28808a2b-a31b-dd73-dcd3-4559a5199319).
- question: Can I disable the PIN while using Windows Hello for Business?
answer: |
No. The movement away from passwords is accomplished by gradually reducing the use of the password. In situations where you can't authenticate by using biometrics, you need a fallback mechanism that isn't a password. The PIN is the fallback mechanism. Disabling or hiding the PIN credential provider will disable the use of biometrics.
@@ -102,7 +102,7 @@ sections:
If the user attempts to unlock the device by entering random PINs, after three unsuccessful attempts the credential provider will display the following message: **You've entered an incorrect PIN several times. To try again, enter A1B2C3 below**.
Upon entering the challenge phrase *A1B2C3*, the user will be granted one more opportunity to enter the PIN. If unsuccessful, the provider will be disabled, leaving the user with the only option to reboot the device. Following the reboot, the aforementioned pattern repeats.
-
+
If unsuccessful attempts continue, the device will enter a lockout state, lasting for 1 minute after the first reboot, 2 minutes after the fourth reboot, and 10 minutes after the fifth reboot. The duration of each lockout increases accordingly. This behavior is a result of the TPM 2.0 anti-hammering feature.
For more information about the TPM anti-hammering feature, see [TPM 2.0 anti-hammering](/windows/security/information-protection/tpm/tpm-fundamentals#tpm-20-anti-hammering).
@@ -110,7 +110,7 @@ sections:
questions:
- question: Can Windows Hello for Business work in air-gapped environments?
answer: |
- Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that doesn't require internet connectivity to achieve an air-gapped Windows Hello for Business deployment.
+ Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a non-Microsoft MFA provider that doesn't require internet connectivity to achieve an air-gapped Windows Hello for Business deployment.
- question: How many users can enroll for Windows Hello for Business on a single Windows device?
answer: |
The maximum number of supported enrollments on a single device is 10. This lets 10 users each enroll their face and up to 10 fingerprints. For devices with more than 10 users, or for users that sign-in to many devices (for example, a support technician), it's recommended the use of FIDO2 security keys.
@@ -120,17 +120,17 @@ sections:
- question: What attributes are synchronized by Microsoft Entra Connect with Windows Hello for Business?
answer: |
Review [Microsoft Entra Connect Sync: Attributes synchronized to Microsoft Entra ID](/entra/identity/hybrid/connect/reference-connect-sync-attributes-synchronized) for a list of attributes that sync based on scenarios. The base scenarios that include Windows Hello for Business are the [Windows 10](/entra/identity/hybrid/connect/reference-connect-sync-attributes-synchronized#windows-10) scenario and the [Device writeback](/entra/identity/hybrid/connect/reference-connect-sync-attributes-synchronized#device-writeback) scenario. Your environment may include other attributes.
- - question: Can I use third-party MFA providers with Windows Hello for Business?
+ - question: Can I use non-Microsoft MFA providers with Windows Hello for Business?
answer: |
- Yes, if you're using federated hybrid deployment, you can use any third-party that provides an AD FS MFA adapter. A list of third-party MFA adapters can be found [here](/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods).
- - question: Does Windows Hello for Business work with third-party federation servers?
+ Yes, if you're using federated hybrid deployment, you can use any non-Microsoft that provides an AD FS MFA adapter. A list of non-Microsoft MFA adapters can be found [here](/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods).
+ - question: Does Windows Hello for Business work with non-Microsoft federation servers?
answer: |
- Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience.
-
+ Windows Hello for Business works with any non-Microsoft federation servers that support the protocols used during the provisioning experience.
+
| Protocol | Description |
| :--- | :--- |
| [[MS-KPP]: Key Provisioning Protocol](/openspecs/windows_protocols/ms-kpp/25ff7bd8-50e3-4769-af23-bcfd0b4d4567) | Specifies the Key Provisioning Protocol, which defines a mechanism for a client to register a set of cryptographic keys on a user and device pair. |
- | [[MS-OAPX]: OAuth 2.0 Protocol Extensions](/openspecs/windows_protocols/ms-oapx/7612efd4-f4c8-43c3-aed6-f5c5ce359da2)| Specifies the OAuth 2.0 Protocol Extensions, which are used to extend the OAuth 2.0 Authorization Framework. These extensions enable authorization features such as resource specification, request identifiers, and log in hints. |
+ | [[MS-OAPX]: OAuth 2.0 Protocol Extensions](/openspecs/windows_protocols/ms-oapx/7612efd4-f4c8-43c3-aed6-f5c5ce359da2)| Specifies the OAuth 2.0 Protocol Extensions, which are used to extend the OAuth 2.0 Authorization Framework. These extensions enable authorization features such as resource specification, request identifiers, and log in hints. |
| [[MS-OAPXBC]: OAuth 2.0 Protocol Extensions for Broker Clients](/openspecs/windows_protocols/ms-oapxbc/2f7d8875-0383-4058-956d-2fb216b44706) | Specifies the OAuth 2.0 Protocol Extensions for Broker Clients, extensions to RFC6749 (the OAuth 2.0 Authorization Framework) that allow a broker client to obtain access tokens on behalf of calling clients. |
| [[MS-OIDCE]: OpenID Connect 1.0 Protocol Extensions](/openspecs/windows_protocols/ms-oidce/718379cf-8bc1-487e-962d-208aeb8e70ee) | Specifies the OpenID Connect 1.0 Protocol Extensions. These extensions define other claims to carry information about the user, including the user principal name, a locally unique identifier, a time for password expiration, and a URL for password change. These extensions also define more provider meta-data that enables the discovery of the issuer of access tokens and gives additional information about provider capabilities. |
- question: Can I enroll local Windows accounts in Windows Hello for Business?
@@ -146,9 +146,9 @@ sections:
answer: |
A user will be prompted to set up a Windows Hello for Business key on a Microsoft Entra registered devices if the feature is enabled by policy. If the user has an existing Windows Hello container, the Windows Hello for Business key will be enrolled in that container and will be protected using existing gestures.
- If a user has signed into their Microsoft Entra registered device with Windows Hello, their Windows Hello for Business key will be used to authenticate the user's work identity when they try to use Microsoft Entra resources. The Windows Hello for Business key meets Microsoft Entra multifactor authentication (MFA) requirements and reduces the number of MFA prompts users will see when accessing resources.
+ If a user has signed into their Microsoft Entra registered device with Windows Hello, their Windows Hello for Business key will be used to authenticate the user's work identity when they try to use Microsoft Entra resources. The Windows Hello for Business key meets Microsoft Entra multifactor authentication (MFA) requirements and reduces the number of MFA prompts users will see when accessing resources.
- It's possible to Microsoft Entra register a domain joined device. If the domain joined device has a convenience PIN, sign in with the convenience PIN will no longer work. This configuration isn't supported by Windows Hello for Business.
+ It's possible to Microsoft Entra register a domain joined device. If the domain joined device has a convenience PIN, sign in with the convenience PIN will no longer work. This configuration isn't supported by Windows Hello for Business.
For more information, see [Microsoft Entra registered devices](/azure/active-directory/devices/concept-azure-ad-register).
- question: Does Windows Hello for Business work with non-Windows operating systems?
@@ -181,11 +181,11 @@ sections:
- question: What URLs do I need to allow for a hybrid deployment?
answer: |
For a list of required URLs, see [Microsoft 365 Common and Office Online](/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#microsoft-365-common-and-office-online).
-
+
If your environment uses Microsoft Intune, see [Network endpoints for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints).
- name: Features
- questions:
+ questions:
- question: Can I use an external Windows Hello compatible camera when my computer has a built-in Windows Hello compatible camera?
answer: |
Yes, you can use an external Windows Hello compatible camera if a device has an internal Windows Hello camera. When both cameras are present, the external camera is used for face authentication. For more information, see [IT tools to support Windows 10, version 21H1](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/it-tools-to-support-windows-10-version-21h1/ba-p/2365103). If ESS is enabled, see [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security).
@@ -217,7 +217,7 @@ sections:
- attempting to access on-premises resources secured by Active Directory
- question: Can I use RDP/VDI with Windows Hello for Business cloud Kerberos trust?
answer: |
- Windows Hello for Business cloud Kerberos trust can't be used as a supplied credential with RDP/VDI. Similar to key trust, cloud Kerberos trust can be used for RDP if a [certificate is enrolled into Windows Hello for Business](rdp-sign-in.md) for this purpose. As an alternative, consider using [Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard) which doesn't require to deploy certificates.
+ Windows Hello for Business cloud Kerberos trust can't be used as a supplied credential with RDP/VDI. Similar to key trust, cloud Kerberos trust can be used for RDP if a [certificate is enrolled into Windows Hello for Business](rdp-sign-in.md) for this purpose. As an alternative, consider using [Remote Credential Guard](../remote-credential-guard.md) which doesn't require to deploy certificates.
- question: Do all my domain controllers need to be fully patched as per the prerequisites for me to use Windows Hello for Business cloud Kerberos trust?
answer: |
No, only the number necessary to handle the load from all cloud Kerberos trust devices.
@@ -229,4 +229,4 @@ sections:
In a hybrid deployment, a user's public key must sync from Microsoft Entra ID to Active Directory before it can be used to authenticate against a domain controller. This sync is handled by Microsoft Entra Connect and will occur during a normal sync cycle.
- question: Can I use Windows Hello for Business key trust and RDP?
answer: |
- Remote Desktop Protocol (RDP) doesn't support using key-based authentication as supplied credentials. However, you can deploy certificates in the key trust model to enable RDP. For more information, see [Deploying certificates to key trust users to enable RDP](hello-deployment-rdp-certs.md). As an alternative, consider using [Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard) which doesn't require to deploy certificates.
+ Remote Desktop Protocol (RDP) doesn't support using key-based authentication as supplied credentials. However, you can deploy certificates in the key trust model to enable RDP. For more information, see [Deploying certificates to key trust users to enable RDP](hello-deployment-rdp-certs.md). As an alternative, consider using [Remote Credential Guard](../remote-credential-guard.md) which doesn't require to deploy certificates.
diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md
index a1df8320f4..4f77b96763 100644
--- a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md
+++ b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md
@@ -1,7 +1,7 @@
---
title: Windows Hello for Business known deployment issues
description: This article is a troubleshooting guide for known Windows Hello for Business deployment issues.
-ms.date: 06/02/2023
+ms.date: 03/12/2024
ms.topic: troubleshooting
---
@@ -17,7 +17,7 @@ PIN reset on Microsoft Entra joined devices uses a flow called *web sign-in* to
The user can launch the PIN reset flow from the lock screen using the *I forgot my PIN* link in the PIN credential provider. Selecting the link launches a full screen UI for the PIN experience on Microsoft Entra join devices. Typically, the UI displays an Azure authentication page, where the user authenticates using Microsoft Entra credentials and completes MFA.
-In federated environments, authentication may be configured to route to AD FS or a third-party identity provider. If the PIN reset flow is launched and attempts to navigate to a federated identity provider server page, it fails and displays the *We can't open that page right now* error, if the domain for the server page isn't included in an allowlist.
+In federated environments, authentication may be configured to route to AD FS or a non-Microsoft identity provider. If the PIN reset flow is launched and attempts to navigate to a federated identity provider server page, it fails and displays the *We can't open that page right now* error, if the domain for the server page isn't included in an allowlist.
If you're a customer of *Azure US Government* cloud, PIN reset also attempts to navigate to a domain that isn't included in the default allowlist. The result is the message *We can't open that page right now*.
@@ -49,18 +49,18 @@ After the initial sign-in attempt, the user's Windows Hello for Business public
To resolve the issue, update Windows Server 2016 and 2019 domain controllers with the latest patches. For Windows Server 2016, the behavior is fixed in build *14393.4104* ([KB4593226](https://support.microsoft.com/help/4593226)) and later. For Windows Server 2019, the behavior is fixed in build *17763.1637* ([KB4592440](https://support.microsoft.com/help/4592440)).
-## Microsoft Entra joined device access to on-premises resources using key trust and third-party Certificate Authority (CA)
+## Microsoft Entra joined device access to on-premises resources using key trust and non-Microsoft Certificate Authority (CA)
Applies to:
- Microsoft Entra joined key trust deployments
-- Third-party certificate authority (CA) issuing domain controller certificates
+- Non-Microsoft certificate authority (CA) issuing domain controller certificates
-Windows Hello for Business uses smart-card based authentication for many operations. This type of authentication has special guidelines when using a third-party CA for certificate issuance, some of which apply to the domain controllers. Not all Windows Hello for Business deployment types require these configurations. Accessing on-premises resources from a Microsoft Entra joined device does require special configuration when using a third-party CA to issue domain controller certificates.
+Windows Hello for Business uses smart-card based authentication for many operations. This type of authentication has special guidelines when using a non-Microsoft CA for certificate issuance, some of which apply to the domain controllers. Not all Windows Hello for Business deployment types require these configurations. Accessing on-premises resources from a Microsoft Entra joined device does require special configuration when using a non-Microsoft CA to issue domain controller certificates.
-For more information, read [Guidelines for enabling smart card sign in with third-party certification authorities](/troubleshoot/windows-server/windows-security/enabling-smart-card-logon-third-party-certification-authorities).
+For more information, read [Guidelines for enabling smart card sign in with non-Microsoft certification authorities](/troubleshoot/windows-server/windows-security/enabling-smart-card-logon-third-party-certification-authorities).
-### Identify on-premises resource access issues with third party CAs
+### Identify on-premises resource access issues with non-Microsoft CAs
The issue can be identified using network traces or Kerberos logging from the client. In the network trace, the client fails to place a `TGS_REQ` request when a user attempts to access a resource. On the client, it can be observed in the Kerberos operation event log under `Application and Services/Microsoft/Windows/Security-Kerberos/Operational`. The logs are disabled by default. The failure event for this case includes the following information:
@@ -80,7 +80,7 @@ Expected Domain Name: ad.contoso.com
Error Code: 0xC000006D
```
-### Resolve on-premises resource access issue with third party CAs
+### Resolve on-premises resource access issue with non-Microsoft CAs
To resolve the issue, domain controller certificates must be updated so that the certificate subject contains the directory path of the server object (distinguished name).
Example Subject: `CN=DC1,OU=Domain Controllers,DC=ad,DC=contoso,DC=com`
diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
index 2c3b021381..cfe9d5519f 100644
--- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
+++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
@@ -1,13 +1,16 @@
---
title: Windows Hello errors during PIN creation
-description: When you set up Windows Hello, you may get an error during the Create a work PIN step.
+description: Learn about the Windows Hello error codes that might happen during PIN creation.
ms.topic: troubleshooting
-ms.date: 01/26/2024
+ms.date: 03/12/2024
---
# Windows Hello errors during PIN creation
-When you set up Windows Hello in Windows client, you may get an error during the **Create a PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support.
+When you set up Windows Hello in Windows client, you might get an error during the **Create a PIN** step. This article lists some of the error codes with recommendations for mitigating the problem.
+
+> [!IMPORTANT]
+> If you get an error code that isn't listed here, contact Microsoft Support.
## Where is the error code?
@@ -19,72 +22,72 @@ The following image shows an example of an error during **Create a PIN**.
When a user encounters an error when creating the work PIN, advise the user to try the following steps. Many errors can be mitigated by one of these steps.
-1. Try to create the PIN again. Some errors are transient and resolve themselves.
-2. Sign out, sign in, and try to create the PIN again.
-3. Reboot the device and then try to create the PIN again.
-4. Unjoin the device from Microsoft Entra ID, rejoin, and then try to create the PIN again. To unjoin a device, go to **Settings > System > About > Disconnect from organization**.
+1. Try to create the PIN again. Some errors are transient and resolve themselves
+1. Sign out, sign in, and try to create the PIN again
+1. Reboot the device and then try to create the PIN again
+1. Unjoin the device from Microsoft Entra ID, rejoin, and then try to create the PIN again. To unjoin a device, go to **Settings > System > About > Disconnect from organization**
-If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance.
+If the error occurs again, check the error code against the following table to see if there's another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance.
-| Hex | Cause | Mitigation |
-| :--------- | :----------------------------------------------------------------- | :------------------------------------------ |
-| 0x80090005 | NTE_BAD_DATA | Unjoin the device from Microsoft Entra ID and rejoin. |
-| 0x8009000F | The container or key already exists. | Unjoin the device from Microsoft Entra ID and rejoin. |
-| 0x80090011 | The container or key was not found. | Unjoin the device from Microsoft Entra ID and rejoin. |
-| 0x80090029 | TPM is not set up. | Sign on with an administrator account. Select **Start**, type `tpm.msc`, and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**. |
-| 0x8009002A | NTE_NO_MEMORY | Close programs which are taking up memory and try again. |
-| 0x80090031 | NTE_AUTHENTICATION_IGNORED | Reboot the device. If the error occurs again after rebooting, [reset the TPM](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd851452(v=ws.11)) or run [Clear-TPM](/powershell/module/trustedplatformmodule/clear-tpm). |
-| 0x80090035 | Policy requires TPM and the device does not have TPM. | Change the Windows Hello for Business policy to not require a TPM. |
-| 0x80090036 | User canceled an interactive dialog. | User will be asked to try again. |
-| 0x801C0003 | User is not authorized to enroll. | Check if the user has permission to perform the operation. |
-| 0x801C000E | Registration quota reached. | Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](/azure/active-directory/devices/device-management-azure-portal). |
-| 0x801C000F | Operation successful, but the device requires a reboot. | Reboot the device. |
-| 0x801C0010 | The AIK certificate is not valid or trusted. | Sign out and then sign in again. |
-| 0x801C0011 | The attestation statement of the transport key is invalid. | Sign out and then sign in again. |
-| 0x801C0012 | Discovery request is not in a valid format. | Sign out and then sign in again. |
+| Hex | Cause | Mitigation |
+|:-|:-|:-|
+| 0x80090005 | NTE_BAD_DATA | Unjoin the device from Microsoft Entra ID and rejoin. |
+| 0x8009000F | The container or key already exists. | Unjoin the device from Microsoft Entra ID and rejoin. |
+| 0x80090011 | The container or key wasn't found. | Unjoin the device from Microsoft Entra ID and rejoin. |
+| 0x80090029 | TPM isn't set up. | Sign on with an administrator account. Select **Start**, type `tpm.msc`, and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**. |
+| 0x8009002A | NTE_NO_MEMORY | Close programs, which are taking up memory and try again. |
+| 0x80090031 | NTE_AUTHENTICATION_IGNORED | Reboot the device. If the error occurs again after rebooting, [reset the TPM](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd851452(v=ws.11)) or run [Clear-TPM](/powershell/module/trustedplatformmodule/clear-tpm). |
+| 0x80090035 | Policy requires TPM and the device doesn't have TPM. | Change the Windows Hello for Business policy to not require a TPM. |
+| 0x80090036 | User canceled an interactive dialog. | User is asked to try again. |
+| 0x801C0003 | User isn't authorized to enroll. | Check if the user has permission to perform the operation. |
+| 0x801C000E | Registration quota reached. | Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](/azure/active-directory/devices/device-management-azure-portal). |
+| 0x801C000F | Operation successful, but the device requires a reboot. | Reboot the device. |
+| 0x801C0010 | The AIK certificate isn't valid or trusted. | Sign out and then sign in again. |
+| 0x801C0011 | The attestation statement of the transport key is invalid. | Sign out and then sign in again. |
+| 0x801C0012 | Discovery request isn't in a valid format. | Sign out and then sign in again. |
| 0x801C0015 | The device is required to be joined to an Active Directory domain. | Join the device to an Active Directory domain. |
-| 0x801C0016 | The federation provider configuration is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the file is not empty. |
-| 0x801C0017 | The federation provider domain is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the FPDOMAINNAME element is not empty. |
-| 0x801C0018 | The federation provider client configuration URL is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the CLIENTCONFIG element contains a valid URL. |
-| 0x801C03E9 | Server response message is invalid | Sign out and then sign in again. |
-| 0x801C03EA | Server failed to authorize user or device. | Check if the token is valid and user has permission to register Windows Hello for Business keys. |
-| 0x801C03EB | Server response http status is not valid | Sign out and then sign in again. |
-| 0x801C03EC | Unhandled exception from server. | sign out and then sign in again. |
-| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed.
-or-
Token was not found in the Authorization header.
-or-
Failed to read one or more objects.
-or-
The request sent to the server was invalid.
-or-
User does not have permissions to join to Microsoft Entra ID. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure AD and rejoin. Allow user(s) to join to Microsoft Entra ID under Microsoft Entra Device settings.
-| 0x801C03EE | Attestation failed. | Sign out and then sign in again. |
-| 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. |
-| 0x801C03F2 | Windows Hello key registration failed. | ERROR_BAD_DIRECTORY_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in Microsoft Entra ID and the Primary SMTP address are the same in the proxy address.
-| 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Microsoft Entra ID and rejoin. |
-| | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. |
-| 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. |
-| 0x801C0451 | User token switch account. | Delete the Web Account Manager token broker files located in `%LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts\*.*\` and reboot.|
-| 0xC00000BB | Your PIN or this option is temporarily unavailable. | The destination domain controller doesn't support the login method. Most often the KDC service doesn't have the proper certificate to support the login. Another common cause can be the client cannot verify the KDC certificate CRL. Use a different login method.|
+| 0x801C0016 | The federation provider configuration is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the file isn't empty. |
+| 0x801C0017 | The federation provider domain is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the FPDOMAINNAME element isn't empty. |
+| 0x801C0018 | The federation provider client configuration URL is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the CLIENTCONFIG element contains a valid URL. |
+| 0x801C03E9 | Server response message is invalid | Sign out and then sign in again. |
+| 0x801C03EA | Server failed to authorize user or device. | Check if the token is valid and user has permission to register Windows Hello for Business keys. |
+| 0x801C03EB | Server response http status isn't valid | Sign out and then sign in again. |
+| 0x801C03EC | Unhandled exception from server. | sign out and then sign in again. |
+| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but wasn't performed.
-or-
Token wasn't found in the Authorization header.
-or-
Failed to read one or more objects.
-or-
The request sent to the server was invalid.
-or-
User doesn't have permissions to join to Microsoft Entra ID. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure AD and rejoin. Allow user(s) to join to Microsoft Entra ID under Microsoft Entra Device settings. |
+| 0x801C03EE | Attestation failed. | Sign out and then sign in again. |
+| 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. |
+| 0x801C03F2 | Windows Hello key registration failed. | ERROR_BAD_DIRECTORY_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in Microsoft Entra ID and the Primary SMTP address are the same in the proxy address. |
+| 0x801C044D | Authorization token doesn't contain device ID. | Unjoin the device from Microsoft Entra ID and rejoin. |
+| | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. |
+| 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. |
+| 0x801C0451 | User token switch account. | Delete the Web Account Manager token broker files located in `%LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts\*.*\` and reboot. |
+| 0xC00000BB | Your PIN or this option is temporarily unavailable. | The destination domain controller doesn't support the login method. Most often the KDC service doesn't have the proper certificate to support the login. Another common cause can be the client cannot verify the KDC certificate CRL. Use a different login method. |
## Errors with unknown mitigation
For errors listed in this table, contact Microsoft Support for assistance.
-| Hex | Cause |
-|-------------|---------|
-| 0x80070057 | Invalid parameter or argument is passed. |
-| 0X80072F0C | Unknown |
-| 0x80072F8F | A mismatch happens between the system's clock and the activation server's clock when attempting to activate Windows.|
-| 0x80090010 | NTE_PERM |
-| 0x80090020 | NTE_FAIL |
-| 0x80090027 | Caller provided a wrong parameter. If third-party code receives this error, they must change their code. |
-| 0x8009002D | NTE_INTERNAL_ERROR |
-| 0x801C0001 | ADRS server response is not in a valid format. |
-| 0x801C0002 | Server failed to authenticate the user. |
-| 0x801C0006 | Unhandled exception from server. |
-| 0x801C000B | Redirection is needed and redirected location is not a well known server. |
-| 0x801C000C | Discovery failed. |
-| 0x801C0013 | Tenant ID is not found in the token. |
-| 0x801C0014 | User SID is not found in the token. |
-| 0x801C0019 | The federation provider client configuration is empty |
-| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty. |
-| 0x801C001B | The device certificate is not found. |
-| 0x801C03F0 | There is no key registered for the user. |
-| 0x801C03F1 | There is no UPN in the token. |
-| 0x801C044C | There is no core window for the current thread. |
-| 0x801c004D | DSREG_NO_DEFAULT_ACCOUNT: NGC provisioning is unable to find the default WAM account to use to request Microsoft Entra token for provisioning. Unable to enroll a device to use a PIN for login. |
-| 0xCAA30193 | HTTP 403 Request Forbidden: it means request left the device, however either Server, proxy or firewall generated this response. |
+| Hex | Cause |
+|--|--|
+| 0x80070057 | Invalid parameter or argument is passed. |
+| 0X80072F0C | Unknown |
+| 0x80072F8F | A mismatch happens between the system's clock and the activation server's clock when attempting to activate Windows. |
+| 0x80090010 | NTE_PERM |
+| 0x80090020 | NTE_FAIL |
+| 0x80090027 | Caller provided a wrong parameter. If non-Microsoft code receives this error, they must change their code. |
+| 0x8009002D | NTE_INTERNAL_ERROR |
+| 0x801C0001 | ADRS server response isn't in a valid format. |
+| 0x801C0002 | Server failed to authenticate the user. |
+| 0x801C0006 | Unhandled exception from server. |
+| 0x801C000B | Redirection is needed and redirected location isn't a well known server. |
+| 0x801C000C | Discovery failed. |
+| 0x801C0013 | Tenant ID isn't found in the token. |
+| 0x801C0014 | User SID isn't found in the token. |
+| 0x801C0019 | The federation provider client configuration is empty |
+| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty. |
+| 0x801C001B | The device certificate isn't found. |
+| 0x801C03F0 | There's no key registered for the user. |
+| 0x801C03F1 | There's no UPN in the token. |
+| 0x801C044C | There's no core window for the current thread. |
+| 0x801c004D | DSREG_NO_DEFAULT_ACCOUNT: NGC provisioning is unable to find the default WAM account to use to request Microsoft Entra token for provisioning. Unable to enroll a device to use a PIN for login. |
+| 0xCAA30193 | HTTP 403 Request Forbidden: it means request left the device, however either Server, proxy or firewall generated this response. |
diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md
index 28401253c2..5fe562311d 100644
--- a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md
+++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md
@@ -1,7 +1,7 @@
---
title: Dynamic lock
description: Learn how to configure dynamic lock on Windows devices via group policies. This feature locks a device when a Bluetooth signal falls below a set value.
-ms.date: 03/10/2023
+ms.date: 02/29/2024
ms.topic: how-to
---
@@ -16,21 +16,21 @@ You can configure Windows devices to use the **dynamic lock** using a Group Poli
1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory.
1. Edit the Group Policy object from Step 1.
-1. Enable the **Configure dynamic lock factors** policy setting located under **Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business**.
+1. Enable the **Configure dynamic lock factors** policy setting located under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**.
1. Close the Group Policy Management Editor to save the Group Policy object.
The Group Policy Editor, when the policy is enabled, creates a default signal rule policy with the following value:
```xml
-
+
```
>[!IMPORTANT]
>Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting.
-For this policy setting, the **type** and **scenario** attribute values are static and can't change. The **classofDevice** is configurable but Phone is the only currently supported configuration. The attribute defaults to Phone and uses the values from the following table:
+For this policy setting, the `type` and `scenario` attribute values are static and can't change. The `classofDevice` is configurable but Phone is the only currently supported configuration. The attribute defaults to Phone and uses the values from the following table:
|Description|Value|
|:-------------|:-------:|
@@ -46,6 +46,6 @@ For this policy setting, the **type** and **scenario** attribute values are stat
|Health|2304|
|Uncategorized|7936|
-The **rssiMin** attribute value signal indicates the strength needed for the device to be considered *in-range*. The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows to lock the device once the signal strength weakens by more than measurement of 10.
+The `rssiMin` attribute value signal indicates the strength needed for the device to be considered *in-range*. The default value of `-10` enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The `rssiMaxDelta` has a default value of `-10`, which instruct Windows to lock the device once the signal strength weakens by more than measurement of 10.
RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other.
diff --git a/windows/security/identity-protection/hello-for-business/how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/how-it-works-provisioning.md
index 9c6ef249eb..ad4a07825a 100644
--- a/windows/security/identity-protection/hello-for-business/how-it-works-provisioning.md
+++ b/windows/security/identity-protection/hello-for-business/how-it-works-provisioning.md
@@ -1,6 +1,6 @@
---
title: How Windows Hello for Business provisioning works
-description: Explore the provisioning flows for Windows Hello for Business, from within a variety of environments.
+description: Learn about the provisioning flows for Windows Hello for Business.
ms.date: 01/03/2024
ms.topic: reference
appliesto:
@@ -8,7 +8,7 @@ appliesto:
# How Windows Hello for Business provisioning works
-Windows Hello for Business provisioning enables a user to enroll a new, strong, two-factor credential that they can use for passwordless authentication. Provisioning experience vary based on:
+Windows Hello for Business provisioning enables a user to enroll a new, strong, two-factor credential that they can use for passwordless authentication. Provisioning experience vary based on:
- How the device is joined to Microsoft Entra ID
- The Windows Hello for Business deployment type
@@ -23,8 +23,8 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
| Phase | Description |
|:-:|:-|
-| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service provides the second factor of authentication. If the user has performed Microsoft Entra multifactor authentication within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they aren't prompted for MFA because the current MFA remains valid. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
-| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
+| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service provides the second factor of authentication. If the user has performed Microsoft Entra multifactor authentication within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they aren't prompted for MFA because the current MFA remains valid. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
+| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Microsoft Entra ID, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Microsoft Entra ID returns a key ID to the application, which signals the end of user provisioning and the application exits. |
## Provisioning for Microsoft Entra joined devices with federated authentication
@@ -33,9 +33,9 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
| Phase | Description |
|:-:|:-|
-| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. In a federated environment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service provides the second factor of authentication. If the user has performed Microsoft Entra multifactor authentication within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they aren't prompted for MFA because the current MFA remains valid. The on-premises STS server issues an enterprise token on successful MFA. The application sends the token to Microsoft Entra ID. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
-| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
-| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates MFA claim remains current. On successful validation, Azure DRS locates the user's object in Microsoft Entra ID, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Microsoft Entra ID returns key ID to the application, which signals the end of user provisioning and the application exits. |
+| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. In a federated environment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service provides the second factor of authentication. If the user has performed Microsoft Entra multifactor authentication within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they aren't prompted for MFA because the current MFA remains valid. The on-premises STS server issues an enterprise token on successful MFA. The application sends the token to Microsoft Entra ID. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
+| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
+| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates MFA claim remains current. On successful validation, Azure DRS locates the user's object in Microsoft Entra ID, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Microsoft Entra ID returns key ID to the application, which signals the end of user provisioning and the application exits. |
## Provisioning in a cloud Kerberos trust deployment model with managed authentication
@@ -43,9 +43,9 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
| Phase | Description |
|:-:|:-|
-| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service provides the second factor of authentication. If the user has performed Microsoft Entra multifactor authentication within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they aren't prompted for MFA because the current MFA remains valid. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
-| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
-| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Microsoft Entra ID, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Microsoft Entra ID returns a key ID to the application, which signals the end of user provisioning and the application exits. |
+| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service provides the second factor of authentication. If the user has performed Microsoft Entra multifactor authentication within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they aren't prompted for MFA because the current MFA remains valid. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
+| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
+| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Microsoft Entra ID, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Microsoft Entra ID returns a key ID to the application, which signals the end of user provisioning and the application exits. |
> [!NOTE]
> Windows Hello for Business cloud Kerberos trust does not require users' keys to be synced from Microsoft Entra ID to Active Directory. Users can immediately authenticate to Microsoft Entra ID and AD after provisioning their credential.
@@ -56,9 +56,9 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
| Phase | Description |
|:-:|:-|
-| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service provides the second factor of authentication. If the user has performed Microsoft Entra multifactor authentication within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they aren't prompted for MFA because the current MFA remains valid. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
-| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
-| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Microsoft Entra ID, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Microsoft Entra ID returns a key ID to the application, which signals the end of user provisioning and the application exits. |
+| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service provides the second factor of authentication. If the user has performed Microsoft Entra multifactor authentication within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they aren't prompted for MFA because the current MFA remains valid. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
+| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
+| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Microsoft Entra ID, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Microsoft Entra ID returns a key ID to the application, which signals the end of user provisioning and the application exits. |
| D | Microsoft Entra Connect requests updates on its next synchronization cycle. Microsoft Entra ID sends the user's public key that was securely registered through provisioning. Microsoft Entra Connect receives the public key and writes it to user's `msDS-KeyCredentialLink` attribute in Active Directory. |
> [!IMPORTANT]
@@ -70,16 +70,16 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
| Phase | Description |
|:-|:-|
-| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. In a federated environment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service (or a third party MFA service) provides the second factor of authentication. The on-premises STS server issues an enterprise token on successful MFA. The application sends the token to Microsoft Entra ID. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
-| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
-| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Microsoft Entra ID, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Microsoft Entra ID returns a key ID and a key receipt to the application, which represents the end of user key registration. |
-| D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned. The application sends the key receipt and certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm. After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentialsLink for a list of registered public keys. |
+| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. In a federated environment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. The Microsoft Entra multifactor authentication service (or a non-Microsoft MFA service) provides the second factor of authentication. The on-premises STS server issues an enterprise token on successful MFA. The application sends the token to Microsoft Entra ID. Microsoft Entra ID validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. |
+| B | After receiving an ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv). |
+| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Microsoft Entra ID, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Microsoft Entra ID returns a key ID and a key receipt to the application, which represents the end of user key registration. |
+| D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned. The application sends the key receipt and certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm. After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentialsLink for a list of registered public keys. |
| E | The registration authority validates the public key in the certificate request matches a registered key for the user. If the public key in the certificate isn't found in the list of registered public keys, it then validates the key receipt to confirm the key was securely registered with Azure. After validating the key receipt or public key, the registration authority signs the certificate request using its enrollment agent certificate. |
| F | The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application. |
-| G | The application receives the newly issued certificate and installs it into the Personal store of the user. This signals the end of provisioning. |
+| G | The application receives the newly issued certificate and installs it into the Personal store of the user. This signals the end of provisioning. |
> [!IMPORTANT]
-> Synchronous certificate enrollment doesn't depend on Microsoft Entra Connect to synchronize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Microsoft Entra Connect continues to synchronize the public key to Active Directory, but is not shown in this flow.
+> Synchronous certificate enrollment doesn't depend on Microsoft Entra Connect to synchronize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Microsoft Entra Connect continues to synchronize the public key to Active Directory, but is not shown in this flow.
## Provisioning in an on-premises key trust deployment model
@@ -87,9 +87,9 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
| Phase | Description |
| :----: | :----------- |
-|A| The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Enterprise Device Registration Service (EDRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. In an on-premises deployment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Microsoft Entra multifactor authentication server (or a third party MFA service) provides the second factor of authentication. The on-premises STS server issues an enterprise DRS token on successful MFA.|
-| B| After receiving an EDRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv).|
-|C | The application sends the EDRS token, ukpub, attestation data, and device information to the Enterprise DRS for user key registration. Enterprise DRS validates the MFA claim remains current. On successful validation, the Enterprise DRS locates the user's object in Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. The Enterprise DRS returns a key ID to the application, which represents the end of user key registration.|
+|A| The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Enterprise Device Registration Service (EDRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. In an on-premises deployment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Microsoft Entra multifactor authentication server (or a non-Microsoft MFA service) provides the second factor of authentication. The on-premises STS server issues an enterprise DRS token on successful MFA.|
+| B| After receiving an EDRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv).|
+|C | The application sends the EDRS token, ukpub, attestation data, and device information to the Enterprise DRS for user key registration. Enterprise DRS validates the MFA claim remains current. On successful validation, the Enterprise DRS locates the user's object in Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. The Enterprise DRS returns a key ID to the application, which represents the end of user key registration.|
## Provisioning in an on-premises certificate trust deployment model
@@ -97,10 +97,10 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
| Phase | Description |
| :----: | :----------- |
-|A| The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Enterprise Device Registration Service (EDRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. In an on-premises deployment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Microsoft Entra multifactor authentication server (or a third party MFA service) provides the second factor of authentication. The on-premises STS server issues an enterprise DRS token on successful MFA.|
-| B| After receiving an EDRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv).|
-|C | The application sends the EDRS token, ukpub, attestation data, and device information to the Enterprise DRS for user key registration. Enterprise DRS validates the MFA claim remains current. On successful validation, the Enterprise DRS locates the user's object in Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. The Enterprise DRS returns a key ID to the application, which represents the end of user key registration.|
-|D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned. The application sends the certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm. After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentialsLink for a list of registered public keys.|
+|A| The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Enterprise Device Registration Service (EDRS). The application makes the request using the Microsoft Entra Web Account Manager plug-in. In an on-premises deployment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication. Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Microsoft Entra multifactor authentication server (or a non-Microsoft MFA service) provides the second factor of authentication. The on-premises STS server issues an enterprise DRS token on successful MFA.|
+| B| After receiving an EDRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pregeneration pool, which includes attestation data. This is the user key (ukpub/ukpriv).|
+|C | The application sends the EDRS token, ukpub, attestation data, and device information to the Enterprise DRS for user key registration. Enterprise DRS validates the MFA claim remains current. On successful validation, the Enterprise DRS locates the user's object in Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. The Enterprise DRS returns a key ID to the application, which represents the end of user key registration.|
+|D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned. The application sends the certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm. After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentialsLink for a list of registered public keys.|
|E | The registration authority validates the public key in the certificate request matches a registered key for the user. After validating the public key, the registration authority signs the certificate request using its enrollment agent certificate.|
|F |The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application.|
-|G | The application receives the newly issued certificate and installs it into the Personal store of the user. This signals the end of provisioning.|
+|G | The application receives the newly issued certificate and installs it into the Personal store of the user. This signals the end of provisioning.|
diff --git a/windows/security/identity-protection/hello-for-business/includes/allow-enumeration-of-emulated-smart-card-for-all-users.md b/windows/security/identity-protection/hello-for-business/includes/allow-enumeration-of-emulated-smart-card-for-all-users.md
index 9157046e94..52db564aea 100644
--- a/windows/security/identity-protection/hello-for-business/includes/allow-enumeration-of-emulated-smart-card-for-all-users.md
+++ b/windows/security/identity-protection/hello-for-business/includes/allow-enumeration-of-emulated-smart-card-for-all-users.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/configure-device-unlock-factors.md b/windows/security/identity-protection/hello-for-business/includes/configure-device-unlock-factors.md
index 23a614db9d..47e1022638 100644
--- a/windows/security/identity-protection/hello-for-business/includes/configure-device-unlock-factors.md
+++ b/windows/security/identity-protection/hello-for-business/includes/configure-device-unlock-factors.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/configure-dynamic-lock-factors.md b/windows/security/identity-protection/hello-for-business/includes/configure-dynamic-lock-factors.md
index 4cd7b376f1..1b5068c34f 100644
--- a/windows/security/identity-protection/hello-for-business/includes/configure-dynamic-lock-factors.md
+++ b/windows/security/identity-protection/hello-for-business/includes/configure-dynamic-lock-factors.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/configure-enhanced-anti-spoofing.md b/windows/security/identity-protection/hello-for-business/includes/configure-enhanced-anti-spoofing.md
index 057da41f74..5256533b74 100644
--- a/windows/security/identity-protection/hello-for-business/includes/configure-enhanced-anti-spoofing.md
+++ b/windows/security/identity-protection/hello-for-business/includes/configure-enhanced-anti-spoofing.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/enable-ess-with-supported-peripherals.md b/windows/security/identity-protection/hello-for-business/includes/enable-ess-with-supported-peripherals.md
index d5308cbb87..95e830989d 100644
--- a/windows/security/identity-protection/hello-for-business/includes/enable-ess-with-supported-peripherals.md
+++ b/windows/security/identity-protection/hello-for-business/includes/enable-ess-with-supported-peripherals.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/expiration.md b/windows/security/identity-protection/hello-for-business/includes/expiration.md
index 6d5e71de6c..f73356aa04 100644
--- a/windows/security/identity-protection/hello-for-business/includes/expiration.md
+++ b/windows/security/identity-protection/hello-for-business/includes/expiration.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/history.md b/windows/security/identity-protection/hello-for-business/includes/history.md
index f172d6e9f6..3aad27181a 100644
--- a/windows/security/identity-protection/hello-for-business/includes/history.md
+++ b/windows/security/identity-protection/hello-for-business/includes/history.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/maximum-pin-length.md b/windows/security/identity-protection/hello-for-business/includes/maximum-pin-length.md
index 9ab86cb5f7..552a814af0 100644
--- a/windows/security/identity-protection/hello-for-business/includes/maximum-pin-length.md
+++ b/windows/security/identity-protection/hello-for-business/includes/maximum-pin-length.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/minimum-pin-length.md b/windows/security/identity-protection/hello-for-business/includes/minimum-pin-length.md
index ba9b806c2b..6af211532d 100644
--- a/windows/security/identity-protection/hello-for-business/includes/minimum-pin-length.md
+++ b/windows/security/identity-protection/hello-for-business/includes/minimum-pin-length.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/require-digits.md b/windows/security/identity-protection/hello-for-business/includes/require-digits.md
index e2ca5a2621..148606301d 100644
--- a/windows/security/identity-protection/hello-for-business/includes/require-digits.md
+++ b/windows/security/identity-protection/hello-for-business/includes/require-digits.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/require-lowercase-letters.md b/windows/security/identity-protection/hello-for-business/includes/require-lowercase-letters.md
index b84ed743ee..6548a94ede 100644
--- a/windows/security/identity-protection/hello-for-business/includes/require-lowercase-letters.md
+++ b/windows/security/identity-protection/hello-for-business/includes/require-lowercase-letters.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/require-special-characters.md b/windows/security/identity-protection/hello-for-business/includes/require-special-characters.md
index deeb7f56e4..944b7caa4f 100644
--- a/windows/security/identity-protection/hello-for-business/includes/require-special-characters.md
+++ b/windows/security/identity-protection/hello-for-business/includes/require-special-characters.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/require-uppercase-letters.md b/windows/security/identity-protection/hello-for-business/includes/require-uppercase-letters.md
index b90cda9fa3..cd988bb6f7 100644
--- a/windows/security/identity-protection/hello-for-business/includes/require-uppercase-letters.md
+++ b/windows/security/identity-protection/hello-for-business/includes/require-uppercase-letters.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/turn-off-smart-card-emulation.md b/windows/security/identity-protection/hello-for-business/includes/turn-off-smart-card-emulation.md
index 502e1d18f1..8491027950 100644
--- a/windows/security/identity-protection/hello-for-business/includes/turn-off-smart-card-emulation.md
+++ b/windows/security/identity-protection/hello-for-business/includes/turn-off-smart-card-emulation.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/use-a-hardware-security-device.md b/windows/security/identity-protection/hello-for-business/includes/use-a-hardware-security-device.md
index 3dfb45f8ba..018d2f1834 100644
--- a/windows/security/identity-protection/hello-for-business/includes/use-a-hardware-security-device.md
+++ b/windows/security/identity-protection/hello-for-business/includes/use-a-hardware-security-device.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/use-biometrics.md b/windows/security/identity-protection/hello-for-business/includes/use-biometrics.md
index 761017763f..e21ef5fc23 100644
--- a/windows/security/identity-protection/hello-for-business/includes/use-biometrics.md
+++ b/windows/security/identity-protection/hello-for-business/includes/use-biometrics.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/use-certificate-for-on-premises-authentication.md b/windows/security/identity-protection/hello-for-business/includes/use-certificate-for-on-premises-authentication.md
index 78c1064fbe..4b7546777c 100644
--- a/windows/security/identity-protection/hello-for-business/includes/use-certificate-for-on-premises-authentication.md
+++ b/windows/security/identity-protection/hello-for-business/includes/use-certificate-for-on-premises-authentication.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/use-cloud-trust-for-on-premises-authentication.md b/windows/security/identity-protection/hello-for-business/includes/use-cloud-trust-for-on-premises-authentication.md
index 77b3878741..03e75dd008 100644
--- a/windows/security/identity-protection/hello-for-business/includes/use-cloud-trust-for-on-premises-authentication.md
+++ b/windows/security/identity-protection/hello-for-business/includes/use-cloud-trust-for-on-premises-authentication.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/use-pin-recovery.md b/windows/security/identity-protection/hello-for-business/includes/use-pin-recovery.md
index 8f28f8f8d1..fad4f27fef 100644
--- a/windows/security/identity-protection/hello-for-business/includes/use-pin-recovery.md
+++ b/windows/security/identity-protection/hello-for-business/includes/use-pin-recovery.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/use-windows-hello-for-business-certificates-as-smart-card-certificates.md b/windows/security/identity-protection/hello-for-business/includes/use-windows-hello-for-business-certificates-as-smart-card-certificates.md
index 2d3b0707f3..d57a3d459a 100644
--- a/windows/security/identity-protection/hello-for-business/includes/use-windows-hello-for-business-certificates-as-smart-card-certificates.md
+++ b/windows/security/identity-protection/hello-for-business/includes/use-windows-hello-for-business-certificates-as-smart-card-certificates.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
diff --git a/windows/security/identity-protection/hello-for-business/includes/use-windows-hello-for-business.md b/windows/security/identity-protection/hello-for-business/includes/use-windows-hello-for-business.md
index 9278bcd9ef..d850382fae 100644
--- a/windows/security/identity-protection/hello-for-business/includes/use-windows-hello-for-business.md
+++ b/windows/security/identity-protection/hello-for-business/includes/use-windows-hello-for-business.md
@@ -1,7 +1,7 @@
---
author: paolomatarazzo
ms.author: paoloma
-ms.date: 01/03/2024
+ms.date: 03/12/2024
ms.topic: include
---
@@ -11,7 +11,7 @@ ms.topic: include
- If you disable this policy setting, the device doesn't provision Windows Hello for Business for any user
- If you don't configure this policy setting, users can provision Windows Hello for Business
-Select the option *Don't start Windows Hello provisioning after sign-in* when you use a third-party solution to provision Windows Hello for Business:
+Select the option *Don't start Windows Hello provisioning after sign-in* when you use a non-Microsoft solution to provision Windows Hello for Business:
- If you select *Don't start Windows Hello provisioning after sign-in*, Windows Hello for Business doesn't automatically start provisioning after the user has signed in
- If you don't select *Don't start Windows Hello provisioning after sign-in*, Windows Hello for Business automatically starts provisioning after the user has signed in
diff --git a/windows/security/identity-protection/hello-for-business/multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/multifactor-unlock.md
index 2662652a30..3980ef906c 100644
--- a/windows/security/identity-protection/hello-for-business/multifactor-unlock.md
+++ b/windows/security/identity-protection/hello-for-business/multifactor-unlock.md
@@ -31,7 +31,7 @@ The policy setting has three components:
## Configure unlock factors
> [!CAUTION]
-> When the [DontDisplayLastUserName](/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name) security policy is enabled, it is known to interfere with the ability to use multi factor unlock.
+> When the [DontDisplayLastUserName](../../threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md) security policy is enabled, it is known to interfere with the ability to use multi factor unlock.
The **First unlock factor credential providers** and **Second unlock factor credential providers** portion of the policy setting each contain a comma separated list of credential providers.
@@ -39,13 +39,13 @@ Supported credential providers include:
|Credential Provider| GUID|
|:------------------|:----|
-|PIN| `{D6886603-9D2F-4EB2-B667-1971041FA96B}`|
+|PIN| `{D6886603-9D2F-4EB2-B667-1971041FA96B}`|
|Fingerprint| `{BEC09223-B018-416D-A0AC-523971B639F5}`|
|Facial Recognition| `{8AF662BF-65A0-4D0A-A540-A338A999D36F}`|
|Trusted Signal (Phone proximity, Network location) | `{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}`|
> [!NOTE]
-> Multifactor unlock does not support third-party credential providers or credential providers not listed in the above table.
+> Multifactor unlock does not support non-Microsoft credential providers or credential providers not listed in the above table.
The default credential providers for the **First unlock factor credential provider** include:
@@ -121,7 +121,7 @@ The **classofDevice** attribute defaults to Phone and uses the values from the f
|Health|2304|
|Uncategorized|7936|
-The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows to lock the device once the signal strength weakens by more than measurement of 10.
+The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows to lock the device once the signal strength weakens by more than measurement of 10.
RSSI measurements are relative, and lower as the bluetooth signals between the two paired devices reduces. A measurement of 0 is stronger than -10. A measurement of -10 is stronger than -60, and indicates that the devices are moving further apart from each other.
@@ -169,7 +169,7 @@ The IPv4 DNS server represented in Internet standard dotted-decimal notation. A
##### IPv6Prefix
-The IPv6 network prefix represented in IPv6 network using Internet standard hexadecimal encoding. A network prefix in CIDR notation is required as part of the network string. A network port or scope ID must not be present in the network string. A **signal** element may only contain one **ipv6Prefix** element. For example:
+The IPv6 network prefix represented in IPv6 network using Internet standard hexadecimal encoding. A network prefix in CIDR notation is required as part of the network string. A network port or scope ID must not be present in the network string. A **signal** element may only contain one **ipv6Prefix** element. For example:
```xml
21DA:D3::/48
@@ -243,7 +243,7 @@ Contains the type of security the client uses when connecting to the wireless ne
For example:
```xml
-WPA2-Enterprise
+WPA2-Enterprise
```
#### TrustedRootCA
@@ -273,13 +273,13 @@ For example:
The following example configures an **IPConfig** signal type using **Ipv4Prefix**, **Ipv4DnsServer**, and **DnsSuffix** elements.
```xml
-
-
+
+ 10.10.10.0/2410.10.0.110.10.0.2
- corp.contoso.com
-
+ corp.contoso.com
+
```
@@ -291,10 +291,10 @@ The following example configures an **IpConfig** signal type using a **dnsSuffix
>Separate each rule element using a comma.
```xml
-
-
- corp.contoso.com
-
+
+
+ corp.contoso.com
+ ,
@@ -310,7 +310,7 @@ The following example configures the same as example 2 using compounding `and` e
corp.microsoft.com
-
+
@@ -382,7 +382,7 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the
---
>[!IMPORTANT]
->You should remove all third party credential providers to ensure users cannot unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed).
+>You should remove all non-Microsoft credential providers to ensure users cannot unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed).
## User experience
diff --git a/windows/security/identity-protection/hello-for-business/pin-reset.md b/windows/security/identity-protection/hello-for-business/pin-reset.md
index 85a33cf10c..14caaa3144 100644
--- a/windows/security/identity-protection/hello-for-business/pin-reset.md
+++ b/windows/security/identity-protection/hello-for-business/pin-reset.md
@@ -179,7 +179,7 @@ The _PIN reset_ configuration can be viewed by running [**dsregcmd /status**](/a
**Applies to:** Microsoft Entra joined devices
PIN reset on Microsoft Entra joined devices uses a flow called *web sign-in* to authenticate users in the lock screen. Web sign-in only allows navigation to specific domains. If web sign-in attempts to navigate to a domain that isn't allowed, it displays a page with the error message: *We can't open that page right now*.\
-If you have a federated environment and authentication is handled using AD FS or a third-party identity provider, then you must configure your devices with a policy to allow a list of domains that can be reached during PIN reset flows. When set, it ensures that authentication pages from that identity provider can be used during Microsoft Entra joined PIN reset.
+If you have a federated environment and authentication is handled using AD FS or a non-Microsoft identity provider, then you must configure your devices with a policy to allow a list of domains that can be reached during PIN reset flows. When set, it ensures that authentication pages from that identity provider can be used during Microsoft Entra joined PIN reset.
[!INCLUDE [intune-settings-catalog-1](../../../../includes/configure/intune-settings-catalog-1.md)]
diff --git a/windows/security/identity-protection/hello-for-business/rdp-sign-in.md b/windows/security/identity-protection/hello-for-business/rdp-sign-in.md
index 6a84e6ea32..725c2d715d 100644
--- a/windows/security/identity-protection/hello-for-business/rdp-sign-in.md
+++ b/windows/security/identity-protection/hello-for-business/rdp-sign-in.md
@@ -197,9 +197,9 @@ Here are the steps to manually request a certificate using an Active Directory C
---
-## Use third-party certification authorities
+## Use non-Microsoft certification authorities
-If you're using a non-Microsoft PKI, the certificate templates published to the on-premises Active Directory may not be available. For guidance with integration of Intune/SCEP with non-Microsoft PKI deployments, refer to [Use third-party certification authorities (CA) with SCEP in Microsoft Intune][MEM-6].
+If you're using a non-Microsoft PKI, the certificate templates published to the on-premises Active Directory may not be available. For guidance with integration of Intune/SCEP with non-Microsoft PKI deployments, refer to [Use non-Microsoft certification authorities (CA) with SCEP in Microsoft Intune][MEM-6].
As an alternative to using SCEP, or if none of the previously covered solutions work in your environment, you can manually generate Certificate Signing Requests (CSR) for submission to your PKI. To assist with this approach, you can use the [Generate-CertificateRequest][HTTP-1] PowerShell commandlet.
diff --git a/windows/security/identity-protection/hello-for-business/toc.yml b/windows/security/identity-protection/hello-for-business/toc.yml
index d328574c69..946281222c 100644
--- a/windows/security/identity-protection/hello-for-business/toc.yml
+++ b/windows/security/identity-protection/hello-for-business/toc.yml
@@ -3,7 +3,7 @@ items:
href: index.md
- name: How Windows Hello for Business works
items:
- - name: Core concepts
+ - name: Core concepts
href: how-it-works.md
- name: How device registration works 🔗
href: /entra/identity/devices/device-registration-how-it-works
@@ -15,12 +15,12 @@ items:
href: configure.md
- name: Deployment guides
href: deploy/toc.yml
-- name: How-to-guides
+- name: How-to guides
items:
- name: Configure PIN reset
href: pin-reset.md
- name: Configure dual enrollment
- href: hello-feature-dual-enrollment.md
+ href: hello-feature-dual-enrollment.md
- name: Configure dynamic lock
href: hello-feature-dynamic-lock.md
- name: Configure multi-factor unlock
@@ -42,4 +42,4 @@ items:
- name: Windows Hello Enhanced Security Sign-in (ESS) 🔗
href: /windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security
- name: Frequently Asked Questions (FAQ)
- href: faq.yml
+ href: faq.yml
diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md
index c624632fcc..b9dc9037e7 100644
--- a/windows/security/identity-protection/index.md
+++ b/windows/security/identity-protection/index.md
@@ -2,7 +2,7 @@
title: Windows identity protection
description: Learn more about identity protection technologies in Windows.
ms.topic: overview
-ms.date: 07/27/2023
+ms.date: 03/12/2024
---
# Windows identity protection
diff --git a/windows/security/identity-protection/passwordless-experience/index.md b/windows/security/identity-protection/passwordless-experience/index.md
index 37dc49c775..2301f86f81 100644
--- a/windows/security/identity-protection/passwordless-experience/index.md
+++ b/windows/security/identity-protection/passwordless-experience/index.md
@@ -1,9 +1,9 @@
---
title: Windows passwordless experience
description: Learn how Windows passwordless experience enables your organization to move away from passwords.
-ms.collection:
+ms.collection:
- tier1
-ms.date: 09/27/2023
+ms.date: 03/12/2024
ms.topic: how-to
appliesto:
- ✅ Windows 11
@@ -19,7 +19,7 @@ With Windows passwordless experience, users who sign in with Windows Hello or a
- Can't use the password credential provider on the Windows lock screen
- Aren't prompted to use a password during in-session authentications (for example, UAC elevation, password manager in the browser, etc.)
- Don't have the option *Accounts > Change password* in the Settings app
-
+
>[!NOTE]
>Users can reset their password using CTRL+ALT+DEL > **Manage your account**
diff --git a/windows/security/identity-protection/passwordless-strategy/journey-step-2.md b/windows/security/identity-protection/passwordless-strategy/journey-step-2.md
index 4d8d3b920a..52859b1022 100644
--- a/windows/security/identity-protection/passwordless-strategy/journey-step-2.md
+++ b/windows/security/identity-protection/passwordless-strategy/journey-step-2.md
@@ -54,7 +54,7 @@ Mitigating password usage with applications is one of the more challenging obsta
The ideal mitigation for applications that prompt the user for a password is to enable those applications to use an existing authenticated identity, such as Microsoft Entra ID or Active Directory. Work with the applications vendors to have them add support for Microsoft Entra identities. For on-premises applications, have the application use Windows integrated authentication. The goal for your users should be a seamless single sign-on experience where each user authenticates once when they sign-in to Windows. Use this same strategy for applications that store their own identities in their own databases.
-Each scenario on your list should now have a problem statement, an investigation as to why the password was used, and a mitigation plan on how to make the password usage go away. Armed with this data, one-by-one, close the gaps on user-visible passwords. Change policies and procedures as needed, make infrastructure changes where possible. Convert in-house applications to integrate in your Microsoft Entra ID tenant, use federated identities, or use Windows integrated authentication. Work with third-party software publishers to update their software to integrate in Microsoft Entra ID, support federated identities, or use Windows integrated authentication.
+Each scenario on your list should now have a problem statement, an investigation as to why the password was used, and a mitigation plan on how to make the password usage go away. Armed with this data, one-by-one, close the gaps on user-visible passwords. Change policies and procedures as needed, make infrastructure changes where possible. Convert in-house applications to integrate in your Microsoft Entra ID tenant, use federated identities, or use Windows integrated authentication. Work with non-Microsoft software publishers to update their software to integrate in Microsoft Entra ID, support federated identities, or use Windows integrated authentication.
## Repeat until all user password usage is mitigated
diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md
index dc9d66ddbd..e07f9e5739 100644
--- a/windows/security/identity-protection/remote-credential-guard.md
+++ b/windows/security/identity-protection/remote-credential-guard.md
@@ -2,7 +2,7 @@
title: Remote Credential Guard
description: Learn how Remote Credential Guard helps to secure Remote Desktop credentials by never sending them to the target device.
ms.topic: how-to
-ms.date: 12/08/2023
+ms.date: 03/12/2024
appliesto:
- ✅ Windows 11
- ✅ Windows 10
@@ -169,7 +169,7 @@ Alternatively, you can configure devices using a [custom policy][INT-3] with the
| Setting |
|--|
-|- **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/ADMX_CredSsp/RestrictedRemoteAdministration` - **Data type:** string - **Value:** ``
Possible values for `RestrictedRemoteAdministrationDrop` are: - `0`: Disabled - `1`: Require Restricted Admin - `2`: Require Remote Credential Guard - `3`: Restrict credential delegation |
#### [:::image type="icon" source="../images/icons/group-policy.svg" border="false"::: **GPO**](#tab/gpo)
diff --git a/windows/security/identity-protection/web-sign-in/index.md b/windows/security/identity-protection/web-sign-in/index.md
index f4d5ddb8ce..61c01d2a42 100644
--- a/windows/security/identity-protection/web-sign-in/index.md
+++ b/windows/security/identity-protection/web-sign-in/index.md
@@ -1,7 +1,7 @@
---
title: Web sign-in for Windows
description: Learn how Web sign-in in Windows works, key scenarios, and how to configure it.
-ms.date: 12/11/2023
+ms.date: 03/12/2023
ms.topic: how-to
appliesto:
- ✅ Windows 11
@@ -11,8 +11,8 @@ ms.collection:
# Web sign-in for Windows
-Starting in Windows 11, version 22H2 with [KB5030310][KB-1], you can enable a web-based sign-in experience on Microsoft Entra joined devices, unlocking new sign-in options and capabilities.
-This feature is called *Web sign-in*.
+Starting in Windows 11, version 22H2 with [KB5030310][KB-1], you can enable a web-based sign-in experience on Microsoft Entra joined devices.
+This feature is called *Web sign-in*, and it unlocks new sign-in options and capabilities.
Web sign-in is a *credential provider*, and it was initially introduced in Windows 10 with support for Temporary Access Pass (TAP) only. With the release of Windows 11, the supported scenarios and capabilities of Web sign-in are expanded.\
For example, you can sign in with the Microsoft Authenticator app or with a SAML-P federated identity.
@@ -21,11 +21,11 @@ This article describes how to configure Web sign-in and the supported key scenar
## System requirements
-To use web sign-in, the clients must meet the following prerequisites:
+Here are the prerequisites for using Web sign-in:
- Windows 11, version 22H2 with [5030310][KB-1], or later
-- Must be [Microsoft Entra joined](/entra/identity/devices/concept-directory-join)
-- Must have Internet connectivity, as the authentication is done over the Internet
+- [Microsoft Entra joined](/entra/identity/devices/concept-directory-join)
+- Internet connectivity, as the authentication is done over the Internet
> [!IMPORTANT]
> Web sign-in is not supported for Microsoft Entra hybrid joined or domain joined devices.
@@ -134,7 +134,7 @@ For more information, see [Use a Temporary Access Pass][AAD-3].
:::row:::
:::column span="2":::
- If the Microsoft Entra tenant is federated with a third-party SAML-P identity provider (IdP), federated users can sign using the Web sign-in credential provider.
+ If the Microsoft Entra tenant is federated with a non-Microsoft SAML-P identity provider (IdP), federated users can sign using the Web sign-in credential provider.
:::column-end:::
:::column span="2":::
> [!VIDEO https://learn-video.azurefd.net/vod/player?id=88ad0efb-9031-428c-a3cf-612c47810ecf]
diff --git a/windows/security/includes/sections/identity.md b/windows/security/includes/sections/identity.md
index 5a643de599..f50a087c3c 100644
--- a/windows/security/includes/sections/identity.md
+++ b/windows/security/includes/sections/identity.md
@@ -22,7 +22,7 @@ ms.topic: include
| Feature name | Description |
|:---|:---|
| **[Web sign-in](/windows/security/identity-protection/web-sign-in)** | Web sign-in is a credential provider initially introduced in Windows 10 with support for Temporary Access Pass (TAP) only. With the release of Windows 11, the supported scenarios and capabilities of Web sign-in have been expanded. For example, users can sign-in to Windows using the Microsoft Authenticator app or with a federated identity. |
-| **[Federated sign-in](/education/windows/federated-sign-in)** | Windows 11 Education editions support federated sign-in with third-party identity providers. Federated sign-in enables secure sign in through methods like QR codes or pictures. |
+| **[Federated sign-in](/education/windows/federated-sign-in)** | Windows 11 Education editions support federated sign-in with non-Microsoft identity providers. Federated sign-in enables secure sign in through methods like QR codes or pictures. |
| **[Windows LAPS](/windows-server/identity/laps/laps-overview)** | Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it. |
| **[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)** | Account Lockout Policy settings control the response threshold for failed logon attempts and the actions to be taken after the threshold is reached. |
| **[Enhanced phishing protection with SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection)** | Users who are still using passwords can benefit from powerful credential protection. Microsoft Defender SmartScreen includes enhanced phishing protection to automatically detect when a user enters their Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if the credentials are at risk. Since users are alerted at the moment of potential credential theft, they can take preemptive action before their password is used against them or their organization. |
diff --git a/windows/security/includes/sections/operating-system-security.md b/windows/security/includes/sections/operating-system-security.md
index ea66bca2df..4fa55308cf 100644
--- a/windows/security/includes/sections/operating-system-security.md
+++ b/windows/security/includes/sections/operating-system-security.md
@@ -13,7 +13,7 @@ ms.topic: include
| **[Measured boot](/windows/compatibility/measured-boot)** | Measured Boot measures all important code and configuration settings during the boot of Windows. This includes: the firmware, boot manager, hypervisor, kernel, secure kernel and operating system. Measured Boot stores the measurements in the TPM on the machine, and makes them available in a log that can be tested remotely to verify the boot state of the client.
The Measured Boot feature provides anti-malware software with a trusted (resistant to spoofing and tampering) log of all boot components that started before it. The anti-malware software can use the log to determine whether components that ran before it are trustworthy, or if they're infected with malware. The anti-malware software on the local machine can send the log to a remote server for evaluation. The remote server may initiate remediation actions, either by interacting with software on the client, or through out-of-band mechanisms, as appropriate. |
| **[Device health attestation service](/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters, to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and haven't been tampered with before they can access corporate resources. The determinations are made with data stored in the TPM, which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Intune reviews device health and connects this information with Microsoft Entra ID for conditional access. |
| **[Windows security policy settings and auditing](/windows/security/threat-protection/security-policy-settings/security-policy-settings)** | Microsoft provides a robust set of security settings policies that IT administrators can use to protect Windows devices and other resources in their organization. |
-| **[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)** | Some desktop devices in an enterprise serve a special purpose. For example, a PC in the lobby that customers use to see your product catalog. Or, a PC displaying visual content as a digital sign. Windows client offers two different locked-down experiences for public or specialized use: A single-app kiosk that runs a single Universal Windows Platform (UWP) app in full screen above the lock screen, or A multi-app kiosk that runs one or more apps from the desktop.
Kiosk configurations are based on Assigned Access, a feature in Windows that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. |
+| **[Assigned Access](/windows/configuration/)** | Some desktop devices in an enterprise serve a special purpose. For example, a PC in the lobby that customers use to see your product catalog. Or, a PC displaying visual content as a digital sign. Windows client offers two different locked-down experiences for public or specialized use: A single-app kiosk that runs a single Universal Windows Platform (UWP) app in full screen above the lock screen, or A multi-app kiosk that runs one or more apps from the desktop.
Kiosk configurations are based on Assigned Access, a feature in Windows that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. |
## Virus and threat protection
diff --git a/windows/security/index.yml b/windows/security/index.yml
index 8f543bcde6..afb32d0f77 100644
--- a/windows/security/index.yml
+++ b/windows/security/index.yml
@@ -1,167 +1,156 @@
-### YamlMime:Hub
+### YamlMime:Landing
-title: Windows client security documentation
-summary: Learn how to secure Windows clients for your organization.
-brand: windows
+title: Windows security documentation
+summary: Windows is designed with zero-trust principles at its core, offering powerful security from chip to cloud. As organizations embrace hybrid work environments, the need for robust security solutions becomes paramount. Windows integrates advanced hardware and software protection, ensuring data integrity and access control across devices. Learn about the different security features included in Windows.
metadata:
- ms.topic: hub-page
+ ms.topic: landing-page
ms.collection:
- tier1
- essentials-navigation
author: paolomatarazzo
ms.author: paoloma
manager: aaroncz
- ms.date: 09/18/2023
+ ms.date: 03/12/2024
-highlightedContent:
- items:
- - title: Get started with Windows security
- itemType: get-started
- url: introduction.md
- - title: Windows 11, version 22H2
- itemType: whats-new
- url: /windows/whats-new/whats-new-windows-11-version-22H2
- - title: Advance your security posture with Microsoft Intune from chip to cloud
- itemType: learn
- url: https://learn.microsoft.com/training/modules/m365-advance-organization-security-posture/
- - title: Security features licensing and edition requirements
- itemType: overview
- url: /windows/security/licensing-and-edition-requirements
+# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | tutorial | overview | quickstart | reference | sample | tutorial | video | whats-new
+landingContent:
-productDirectory:
- title: Get started
- items:
+ - title: Learn about hardware security
+ linkLists:
+ - linkListType: overview
+ links:
+ - text: Trusted Platform Module (TPM)
+ url: /windows/security/hardware-security/tpm/trusted-platform-module-overview
+ - text: Microsoft Pluton
+ url: /windows/security/hardware-security/pluton/microsoft-pluton-security-processor
+ - text: Windows Defender System Guard
+ url: /windows-hardware/design/device-experiences/oem-vbs
+ - text: Virtualization-based security (VBS)
+ url: /windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows
+ - text: Secured-core PC
+ url: /windows-hardware/design/device-experiences/oem-highly-secure-11
- - title: Hardware security
- imageSrc: /media/common/i_usb.svg
- links:
- - url: /windows/security/hardware-security/tpm/trusted-platform-module-overview
- text: Trusted Platform Module
- - url: /windows/security/hardware-security/pluton/microsoft-pluton-security-processor
- text: Microsoft Pluton
- - url: /windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows
- text: Windows Defender System Guard
- - url: /windows-hardware/design/device-experiences/oem-vbs
- text: Virtualization-based security (VBS)
- - url: /windows-hardware/design/device-experiences/oem-highly-secure-11
- text: Secured-core PC
- - url: /windows/security/hardware-security
- text: Learn more about hardware security >
+ - title: Learn about OS security
+ linkLists:
+ - linkListType: overview
+ links:
+ - text: Trusted boot
+ url: /windows/security/operating-system-security
+ - text: Windows security settings
+ url: /windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center
+ - text: BitLocker
+ url: /windows/security/operating-system-security/data-protection/bitlocker/
+ - text: Personal Data Encryption (PDE)
+ url: /windows/security/operating-system-security/data-protection/personal-data-encryption
+ - text: Windows security baselines
+ url: /windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines
+ - text: Microsoft Defender SmartScreen
+ url: /windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/
+ - text: Windows Firewall
+ url: /windows/security/operating-system-security/network-security/windows-firewall/
+ - linkListType: architecture
+ links:
+ - text: BitLocker planning guide
+ url: /windows/security/operating-system-security/data-protection/bitlocker/planning-guide
+ - linkListType: how-to-guide
+ links:
+ - text: Configure BitLocker
+ url: /windows/security/operating-system-security/data-protection/bitlocker/configure
+ - text: Configure PDE
+ url: /windows/security/operating-system-security/data-protection/personal-data-encryption/configure
+ - linkListType: whats-new
+ links:
+ - text: Hyper-V firewall
+ url: /windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall
- - title: OS security
- imageSrc: /media/common/i_threat-protection.svg
- links:
- - url: /windows/security/operating-system-security
- text: Trusted boot
- - url: /windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center
- text: Windows security settings
- - url: /windows/security/operating-system-security/data-protection/bitlocker/
- text: BitLocker
- - url: /windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines
- text: Windows security baselines
- - url: /windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/
- text: Microsoft Defender SmartScreen
- - url: /windows/security/operating-system-security
- text: Learn more about OS security >
+ - title: Learn about identity protection
+ linkLists:
+ - linkListType: overview
+ links:
+ - text: Passwordless strategy
+ url: /windows/security/identity-protection/passwordless-strategy
+ - text: Windows Hello for Business
+ url: /windows/security/identity-protection/hello-for-business
+ - text: Windows passwordless experience
+ url: /windows/security/identity-protection/passwordless-experience
+ - text: Web sign-in for Windows
+ url: /windows/security/identity-protection/web-sign-in
+ - text: Passkeys
+ url: /windows/security/identity-protection/passkeys
+ - text: FIDO2 security keys
+ url: /azure/active-directory/authentication/howto-authentication-passwordless-security-key
+ - text: Enhanced phishing protection with SmartScreen
+ url: /windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection
+ - linkListType: how-to-guide
+ links:
+ - text: Configure PIN reset
+ url: /windows/security/identity-protection/hello-for-business/pin-reset
+ - text: RDP sign-in with Windows Hello for Business
+ url: /windows/security/identity-protection/hello-for-business/rdp-sign-in
+ - linkListType: architecture
+ links:
+ - text: Plan a Windows Hello for Business deployment
+ url: /windows/security/identity-protection/hello-for-business/deploy/
+ - linkListType: deploy
+ links:
+ - text: Cloud Kerberos trust deployment guide
+ url: /windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust
- - title: Identity protection
- imageSrc: /media/common/i_identity-protection.svg
- links:
- - url: /windows/security/identity-protection/hello-for-business
- text: Windows Hello for Business
- - url: /windows/security/identity-protection/passwordless-experience
- text: Windows passwordless experience
- - url: /windows/security/identity-protection/web-sign-in
- text: Web sign-in for Windows
- - url: /windows/security/identity-protection/passkeys
- text: Support for passkeys in Windows
- - url: /windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection
- text: Enhanced phishing protection with SmartScreen
- - url: /windows/security/identity-protection
- text: Learn more about identity protection >
+ - title: Learn about application security
+ linkLists:
+ - linkListType: overview
+ links:
+ - text: Windows Defender Application Control (WDAC)
+ url: /windows/security/application-security/application-control/windows-defender-application-control/
+ - text: User Account Control (UAC)
+ url: /windows/security/application-security/application-control/user-account-control
+ - text: Microsoft vulnerable driver blocklist
+ url: /windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules
+ - text: Microsoft Defender Application Guard (MDAG)
+ url: /windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview
+ - text: Windows Sandbox
+ url: /windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview
+ - linkListType: how-to-guide
+ links:
+ - text: Configure Windows Sandbox
+ url: /windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file
- - title: Application security
- imageSrc: /media/common/i_queries.svg
- links:
- - url: /windows/security/application-security/application-control/windows-defender-application-control/
- text: Windows Defender Application Control (WDAC)
- - url: /windows/security/application-security/application-control/user-account-control
- text: User Account Control (UAC)
- - url: /windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules
- text: Microsoft vulnerable driver blocklist
- - url: /windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview
- text: Microsoft Defender Application Guard (MDAG)
- - url: /windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview
- text: Windows Sandbox
- - url: /windows/security/application-security
- text: Learn more about application security >
+ - title: Learn about security foundations
+ linkLists:
+ - linkListType: overview
+ links:
+ - text: Zero trust
+ url: /windows/security/security-foundations/zero-trust-windows-device-health
+ - text: FIPS 140 validation
+ url: /windows/security/security-foundations/certification/fips-140-validation
+ - text: Common Criteria Certifications
+ url: /windows/security/security-foundations/certification/windows-platform-common-criteria
+ - text: Microsoft Security Development Lifecycle (SDL)
+ url: /windows/security/security-foundations/msft-security-dev-lifecycle
+ - text: Microsoft Windows Insider Preview bounty program
+ url: https://www.microsoft.com/msrc/bounty-windows-insider-preview
+ - text: OneFuzz service
+ url: https://www.microsoft.com/security/blog/2020/09/15/microsoft-onefuzz-framework-open-source-developer-tool-fix-bugs/
+ - linkListType: whats-new
+ links:
+ - text: Completed FIPS validations - Windows 11
+ url: /windows/security/security-foundations/certification/validations/fips-140-windows11
+ - text: Completed CC certifications - Windows 11
+ url: /windows/security/security-foundations/certification/validations/cc-windows11
- - title: Security foundations
- imageSrc: /media/common/i_build.svg
- links:
- - url: /windows/security/security-foundations/certification/fips-140-validation
- text: FIPS 140-2 validation
- - url: /windows/security/security-foundations/certification/windows-platform-common-criteria
- text: Common Criteria Certifications
- - url: /windows/security/security-foundations/msft-security-dev-lifecycle
- text: Microsoft Security Development Lifecycle (SDL)
- - url: https://www.microsoft.com/msrc/bounty-windows-insider-preview
- text: Microsoft Windows Insider Preview bounty program
- - url: https://www.microsoft.com/security/blog/2020/09/15/microsoft-onefuzz-framework-open-source-developer-tool-fix-bugs/
- text: OneFuzz service
- - url: /windows/security/security-foundations
- text: Learn more about security foundations >
-
- - title: Cloud security
- imageSrc: /media/common/i_cloud-security.svg
- links:
- - url: /mem/intune/protect/security-baselines
- text: Security baselines with Intune
- - url: /windows/deployment/windows-autopatch
- text: Windows Autopatch
- - url: /windows/deployment/windows-autopilot
- text: Windows Autopilot
- - url: /universal-print
- text: Universal Print
- - url: /windows/client-management/mdm/remotewipe-csp
- text: Remote wipe
- - url: /windows/security/cloud-security
- text: Learn more about cloud security >
-
-additionalContent:
- sections:
- - title: More Windows resources
- items:
-
- - title: Windows Server
- links:
- - text: Windows Server documentation
- url: /windows-server
- - text: What's new in Windows Server 2022?
- url: /windows-server/get-started/whats-new-in-windows-server-2022
- - text: Windows Server blog
- url: https://cloudblogs.microsoft.com/windowsserver/
-
- - title: Windows product site and blogs
- links:
- - text: Find out how Windows enables your business to do more
- url: https://www.microsoft.com/microsoft-365/windows
- - text: Windows blogs
- url: https://blogs.windows.com/
- - text: Windows IT Pro blog
- url: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/bg-p/Windows10Blog
- - text: Microsoft Intune blog
- url: https://techcommunity.microsoft.com/t5/microsoft-intune-blog/bg-p/MicrosoftEndpointManagerBlog
- - text: "Windows help & learning: end-user documentation"
- url: https://support.microsoft.com/windows
-
- - title: Participate in the community
- links:
- - text: Windows community
- url: https://techcommunity.microsoft.com/t5/windows/ct-p/Windows10
- - text: Microsoft Intune community
- url: https://techcommunity.microsoft.com/t5/microsoft-intune/bd-p/Microsoft-Intune
- - text: Microsoft Support community
- url: https://answers.microsoft.com/windows/forum
\ No newline at end of file
+ - title: Learn about cloud security
+ linkLists:
+ - linkListType: overview
+ links:
+ - text: Security baselines with Intune
+ url: /mem/intune/protect/security-baselines
+ - text: Windows Autopatch
+ url: /windows/deployment/windows-autopatch
+ - text: Windows Autopilot
+ url: /windows/deployment/windows-autopilot
+ - text: Universal Print
+ url: /universal-print
+ - text: Remote wipe
+ url: /windows/client-management/mdm/remotewipe-csp
\ No newline at end of file
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/faq.yml b/windows/security/operating-system-security/data-protection/bitlocker/faq.yml
index e67401c81a..d82b8f6355 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/faq.yml
+++ b/windows/security/operating-system-security/data-protection/bitlocker/faq.yml
@@ -19,53 +19,53 @@ sections:
answer: Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive.
- question: How can I tell if a computer has a TPM?
- answer: The TPM status can be checked in **Windows Defender Security Center** > **Device Security** > **Security processor details**.
+ answer: The TPM status can be checked in **Windows Defender Security Center** > **Device Security** > **Security processor details**.
- question: Can I use BitLocker on an operating system drive without a TPM?
answer: |
Yes, BitLocker can be enabled on an operating system drive without a TPM, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. BitLocker won't unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs won't be able to use the system integrity verification that BitLocker can also provide.
To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements.
-
+
- question: How do I obtain BIOS support for the TPM on my computer?
answer: |
Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements:
-
+
- It's compliant with the TCG standards for a client computer
- It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer
-
+
- question: What user rights are required to use BitLocker?
answer: To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership to the local *Administrators* group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives.
- question: What is the recommended boot order for computers that are going to be BitLocker-protected?
- answer: The computer's startup options should be configured to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk isn't first and the computer typically boots from the hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause a prompt for the BitLocker recovery key. For the same reason, if a laptop is used with a docking station, ensure that the hard disk drive is first in the boot order both when the laptop is docked and undocked.
+ answer: The computer's startup options should be configured to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk isn't first and the computer typically boots from the hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause a prompt for the BitLocker recovery key. For the same reason, if a laptop is used with a docking station, ensure that the hard disk drive is first in the boot order both when the laptop is docked and undocked.
- name: BitLocker and Windows upgrade
questions:
- question: |
Can I upgrade Windows versions with BitLocker enabled?
answer: |
- Yes.
+ Yes.
- question: |
What is the difference between suspending and decrypting BitLocker?
answer: |
*Decrypt* completely removes BitLocker protection and fully decrypts the drive.
-
+
*Suspend* keeps the data encrypted but encrypts the BitLocker volume master key with a clear key. The clear key is a cryptographic key stored unencrypted and unprotected on the disk drive. By storing this key unencrypted, the *Suspend* option allows for changes or upgrades to the computer without the time and cost of decrypting and re-encrypting the entire drive. After the changes are made and BitLocker is again enabled, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade, the volume master key is changed, the protectors are updated to match and the clear key is erased.
-
+
- question: |
Do I have to suspend BitLocker protection to download and install system updates and upgrades?
answer: |
- No user action is required for BitLocker in order to apply updates from Microsoft, including [Windows quality updates and feature updates](/windows/deployment/update/waas-quick-start).
- Users need to suspend BitLocker for Non-Microsoft software updates, such as:
-
+ No user action is required for BitLocker in order to apply updates from Microsoft, including [Windows quality updates and feature updates](/windows/deployment/update/waas-quick-start).
+ Users need to suspend BitLocker for Non-Microsoft software updates, such as:
+
- Some TPM firmware updates if these updates clear the TPM outside of the Windows API. Not every TPM firmware update will clear the TPM. Users don't have to suspend BitLocker if the TPM firmware update uses Windows API to clear the TPM because in this case, BitLocker will be automatically suspended. It's recommended that users test their TPM firmware updates if they don't want to suspend BitLocker protection
- Non-Microsoft application updates that modify the UEFI\BIOS configuration
- - Manual or third-party updates to secure boot databases (only if BitLocker uses Secure Boot for integrity validation)
+ - Manual or non-Microsoft updates to secure boot databases (only if BitLocker uses Secure Boot for integrity validation)
- Updates to UEFI\BIOS firmware, installation of additional UEFI drivers, or UEFI applications without using the Windows update mechanism (only if BitLocker doesn't use Secure Boot for integrity validation during updates)
- BitLocker can be checked if it uses Secure Boot for integrity validation with the command line `manage-bde.exe -protectors -get C:`. If Secure Boot for integrity validation is being used, it reports **Uses Secure Boot for integrity validation**
-
-
+
+
> [!NOTE]
> If BitLocker is suspended, you can resume BitLocker protection after the upgrade or update is installed. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, the computer will enter recovery mode when restarting and will require a recovery key or password to access the computer.
@@ -74,16 +74,16 @@ sections:
- question: Can BitLocker deployment be automated in an enterprise environment?
answer: |
Yes, the deployment and configuration BitLocker can be automated using either Windows PowerShell or with the `manage-bde.exe` command. For more information about common BitLocker management commands, check the [BitLocker operations guide](operations-guide.md).
-
+
- question: Is there a noticeable performance impact when BitLocker is enabled on a computer?
answer: Typically, there's a small performance overhead, often in single-digit percentages, which is relative to the throughput of the storage operations on which it needs to operate.
- question: How long will initial encryption take when BitLocker is turned on?
answer: |
Although BitLocker encryption occurs in the background while a user continues to work with the system remaining usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If encrypting large drives, encryption may want to be scheduled during times when the drive isn't being used.
-
+
When BitLocker is enabled, BitLocker can also be set to encrypt the entire drive or just the used space on the drive. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted.
-
+
- question: What happens if the computer is turned off during encryption or decryption?
answer: If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. BitLocker resuming encryption or decryption is true even if the power is suddenly unavailable.
@@ -94,35 +94,35 @@ sections:
answer: |
Policy settings can be configured to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker policy settings](configure.md).
When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that aren't protected by BitLocker as read-only.
-
+
- question: |
What is Used Disk Space Only encryption?
answer: |
BitLocker lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to be encrypted. For more information, see [Used Disk Space Only encryption](planning-guide.md#used-disk-space-only-encryption).
-
+
- question: |
What system changes would cause the integrity check on the OS drive to fail?
answer: |
The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive:
-
+
- Moving the BitLocker-protected drive into a new computer
- Installing a new motherboard with a new TPM
- Turning off, disabling, or clearing the TPM
- Changing any boot configuration settings
- Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data
-
+
- question: What causes BitLocker to start into recovery mode when attempting to start the operating system drive?
answer: |
- Because BitLocker is designed to protect computers from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode.
- For example:
-
+ Because BitLocker is designed to protect computers from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode.
+ For example:
+
- Changing the BIOS boot order to boot another drive in advance of the hard drive
- Adding or removing hardware, such as inserting a new card in the computer
- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer
-
- In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password.
+
+ In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password.
The TPM isn't involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed.
-
+
- question: What can prevent BitLocker from binding to PCR 7?
answer: BitLocker can be prevented from binding to PCR 7 if a non-Windows OS booted prior to Windows, or if Secure Boot isn't available to the device, either because it's disabled or the hardware doesn't support it.
@@ -139,15 +139,15 @@ sections:
answer: Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported.
- name: Key Management
- questions:
+ questions:
- question: How can I authenticate or unlock my removable data drive?
answer: |
Removable data drives can be unlocked using a password or a smart card. A SID protector can also be configured to unlock a drive by using user domain credentials. After encryption has started, the drive can also be automatically unlocked on a specific computer for a specific user account. System administrators can configure which options are available for users including password complexity and minimum length requirements. To unlock by using a SID protector, use `manage-bde.exe`:
-
+
```cmd
Manage-bde.exe -protectors -add e: -sid domain\username
```
-
+
- question: What is the difference between a TPM owner password, recovery password, recovery key, PIN, enhanced PIN, and startup key?
answer: |
There are multiple keys that can be generated and used by BitLocker. Some keys are required and some are optional protectors you can choose to use depending on the level of security you require.
@@ -164,7 +164,7 @@ sections:
- A key file on a USB flash drive that is read directly by the BitLocker recovery console. During recovery, you need to insert this USB device
**PIN and enhanced PIN**
-
+
For a higher level of security with the TPM, you can configure BitLocker with a personal identification number (PIN). The PIN is a user-created value that must be entered each time the computer starts or resumes from hibernation. The PIN can consist of 4 to 20 digits as specified by the *Configure minimum PIN length for startup* policy setting and is stored internally as a 256-bit hash of the entered Unicode characters. This value is never displayed to the user. The PIN is used to provide another factor of authentication in conjunction with TPM authentication.\
For an even higher level of security with the TPM, you can configure BitLocker to use enhanced PINs. Enhanced PINs are PINs that use the full keyboard character set in addition to the numeric set to allow for more possible PIN combinations and are between 4 and 20 characters in length. To use enhanced PINs, you must enable the *Allow enhanced PINs for startup* policy setting before adding the PIN to the drive. By enabling this policy, all PINs created can utilize full keyboard characters.
@@ -178,15 +178,15 @@ sections:
- question: How can the recovery password and recovery key be stored?
answer: |
The recovery password and recovery key for an operating system drive or a fixed data drive can be saved to a folder, saved to one or more USB devices, saved to a Microsoft Account, or printed.
-
+
For removable data drives, the recovery password and recovery key can be saved to a folder, saved to a Microsoft Account, or printed. By default, a recovery key for a removable drive can't be stored on a removable drive.
-
+
A domain administrator can also configure policy settings to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) or Microsoft Entra ID for any BitLocker-protected drive.
-
+
- question: Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled?
answer: |
The `Manage-bde.exe` command-line tool can be used to replace TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and PIN authentication needs to be added, use the following commands from an elevated Command Prompt, replacing *4-20 digit numeric PIN* with the desired numeric PIN:
-
+
```cmd
manage-bde.exe -protectors -delete %systemdrive% -type tpm
@@ -195,13 +195,13 @@ sections:
- question: When should an additional method of authentication be considered?
answer: |
- New hardware that meets [Windows Hardware Compatibility Program](/windows-hardware/design/compatibility/) requirements make a PIN less critical as a mitigation, and having a TPM-only protector is likely sufficient when combined with policies like device lockout. For example, Surface Pro and Surface Book don't have external DMA ports to attack.
- For older hardware, where a PIN may be needed, it's recommended to enable [enhanced PINs](configure.md) that allow non-numeric characters such as letters and punctuation marks, and to set the PIN length based on the risk tolerance and the hardware anti-hammering capabilities available to the TPMs on the computers.
-
+ New hardware that meets [Windows Hardware Compatibility Program](/windows-hardware/design/compatibility/) requirements make a PIN less critical as a mitigation, and having a TPM-only protector is likely sufficient when combined with policies like device lockout. For example, Surface Pro and Surface Book don't have external DMA ports to attack.
+ For older hardware, where a PIN may be needed, it's recommended to enable [enhanced PINs](configure.md) that allow non-numeric characters such as letters and punctuation marks, and to set the PIN length based on the risk tolerance and the hardware anti-hammering capabilities available to the TPMs on the computers.
+
- question: If I lose my recovery information, will the BitLocker-protected data be unrecoverable?
answer: |
BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive.
-
+
> [!IMPORTANT]
> Store the recovery information in Microsoft Entra ID, AD DS, Microsoft Account, or another safe location.
@@ -226,39 +226,39 @@ sections:
- question: Where are the encryption keys stored?
answer: |
The full volume encryption key is encrypted by the volume master key and stored in the encrypted drive. The volume master key is encrypted by the appropriate key protector and stored in the encrypted drive. If BitLocker has been suspended, the clear key that is used to encrypt the volume master key is also stored in the encrypted drive, along with the encrypted volume master key.
-
+
This storage process ensures that the volume master key is never stored unencrypted and is protected unless BitLocker is disabled. The keys are also saved to two additional locations on the drive for redundancy. The keys can be read and processed by the boot manager.
-
+
- question: Why do I have to use the function keys to enter the PIN or the 48-character recovery password?
answer: |
The F1 through F10 keys are universally mapped scan codes available in the pre-boot environment on all computers and in all languages. The numeric keys 0 through 9 aren't usable in the pre-boot environment on all keyboards.
-
+
When using an enhanced PIN, users should run the optional system check during the BitLocker setup process to ensure that the PIN can be entered correctly in the pre-boot environment.
-
+
- question: How does BitLocker help prevent an attacker from discovering the PIN that unlocks my operating system drive?
answer: |
It's possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker has physical access to the computer.
-
+
The TPM has the built-in ability to detect and react to these types of attacks. Because different manufacturers' TPMs may support different PIN and attack mitigations, contact the TPM's manufacturer to determine how the computer's TPM mitigates PIN brute force attacks.
After the TPM's manufacturer is determined, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset.
-
+
- question: How can I determine the manufacturer of my TPM?
answer: The TPM manufacturer can be determined in **Windows Defender Security Center** > **Device Security** > **Security processor details**.
- question: How can I evaluate a TPM's dictionary attack mitigation mechanism?
answer: |
The following questions can assist when asking a TPM manufacturer about the design of a dictionary attack mitigation mechanism:
-
+
- How many failed authorization attempts can occur before lockout?
- What is the algorithm for determining the duration of a lockout based on the number of failed attempts and any other relevant parameters?
- What actions can cause the failure count and lockout duration to be decreased or reset?
-
+
- question: Can PIN length and complexity be managed with policy settings?
answer: |
The minimum personal identification number (PIN) length can be configured by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** policy setting. PIN complexity can't be required via policy settings.
-
+
For more info, see [BitLocker policy settings](configure.md).
-
+
- question: How are the PIN and TPM used to derive the volume master key?
answer: |
BitLocker hashes the user-specified personal identification number (PIN) by using SHA-256, and the first 160 bits of the hash are used as authorization data sent to the TPM to seal the volume master key. The volume master key is now protected by both the TPM and the PIN. To unseal the volume master key, you are required to enter the PIN each time the computer restarts or resumes from hibernation.
@@ -267,18 +267,18 @@ sections:
questions:
- question: What is BitLocker To Go?
answer: |
- BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of:
-
+ BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of:
+
- USB flash drives
- SD cards
- External hard disk drives
- - Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system.
+ - Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system.
Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements).
-
+
As with BitLocker, drives that are encrypted by BitLocker To Go can be opened by using a password or smart card on another computer. In Control Panel, use **BitLocker Drive Encryption**.
- - name: BitLocker and Active Directory Domain Services (AD DS)
+ - name: BitLocker and Active Directory Domain Services (AD DS)
questions:
- question: |
What type of information is stored in AD DS?
@@ -286,15 +286,15 @@ sections:
Stored information | Description
-------------------|------------
BitLocker recovery password | The recovery password allows unlocking of and access to the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md).
- BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`.
-
+ BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`.
+
- question: |
What if BitLocker is enabled on a computer before the computer joins the domain?
answer: |
If BitLocker is enabled on a drive before policy settings are applied to enforce a backup, the recovery information won't be automatically backed up to AD DS when the computer joins the domain or when the policy settings are subsequently applied. However, the policy settings **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** can be chosen to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in the organization is backed up to AD DS.
-
+
For more information how to back up the recovery password to AD DS or Microsoft Entra ID, review the [BitLocker operations guide](operations-guide.md).
-
+
> [!IMPORTANT]
> Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled with policy settings).
@@ -302,9 +302,9 @@ sections:
Is there an event log entry recorded on the client computer to indicate the success or failure of the Microsoft Entra ID or Active Directory backup?
answer: |
Yes, an event log entry that indicates the success or failure of a backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it's also possible that the log entry could be spoofed.
-
+
Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool.
-
+
- question: |
If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password?
answer: |
@@ -314,11 +314,11 @@ sections:
What happens if the backup initially fails? Will BitLocker retry it?
answer: |
If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker doesn't try again to back up the recovery information to AD DS.
-
+
When an administrator selects the **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker can't be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization.
-
+
For more info, see [BitLocker policy settings](configure.md).
-
+
When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker won't automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer joins the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-joins-the-domain-) to capture the information after connectivity is restored.
- name: Security
@@ -336,29 +336,29 @@ sections:
- question: |
What are the implications of using the sleep or hibernate power management options?
answer: |
- BitLocker on operating system drives in its basic configuration provides extra security for the hibernate mode. In sleep mode, the computer is vulnerable to direct memory access attacks, since unprotected data remains in RAM. Therefore, for improved security, it's recommended to disable sleep mode. Startup authentication can be configured by using a [policy setting](configure.md).
-
+ BitLocker on operating system drives in its basic configuration provides extra security for the hibernate mode. In sleep mode, the computer is vulnerable to direct memory access attacks, since unprotected data remains in RAM. Therefore, for improved security, it's recommended to disable sleep mode. Startup authentication can be configured by using a [policy setting](configure.md).
+
- question: |
What are the advantages of a TPM?
answer: |
Most operating systems use a shared memory space and rely on the operating system to manage physical memory. A TPM is a hardware component that uses its own internal firmware and logic circuits for processing instructions, thus shielding it from external software vulnerabilities. Attacking the TPM requires physical access to the computer. Additionally, the tools and skills necessary to attack hardware are often more expensive, and usually aren't as available as the ones used to attack software. And because each TPM is unique to the computer that contains it, attacking multiple TPM computers would be difficult and time-consuming.
-
+
> [!NOTE]
> Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks.
-
+
- name: Network Unlock
questions:
- question: |
What is BitLocker Network Unlock?
- answer: |
+ answer: |
BitLocker Network Unlock enables easier management for BitLocker-enabled clients and servers that use the TPM+PIN protection method in a domain environment. When a computer that is connected to a wired corporate network is rebooted, Network Unlock allows the PIN entry prompt to be bypassed. It automatically unlocks BitLocker-protected operating system volumes by using a trusted key that is provided by the Windows Deployment Services server as its secondary authentication method.
-
+
To use Network Unlock, a PIN must be configured for the computer. When the computer isn't connected to the network, a PIN will need to be provided to unlock it.
-
+
BitLocker Network Unlock has software and hardware requirements for both client computers, Windows Deployment services, and domain controllers that must be met before it can be used.
-
+
Network Unlock uses two protectors - the TPM protector and the protector provided by the network or by the PIN. Automatic unlock uses a single protector - the one stored in the TPM. If the computer is joined to a network without the key protector, it will prompt to enter a PIN. If the PIN isn't available, the recovery key will need to be used to unlock the computer if it can't be connected to the network.
-
+
For more info, see [BitLocker: How to enable Network Unlock](network-unlock.md).
- name: Use BitLocker with other programs
@@ -397,7 +397,7 @@ sections:
Why is the system check failing when I'm encrypting my operating system drive?
answer: |
The system check is designed to ensure the computer's BIOS or UEFI firmware is compatible with BitLocker and that the TPM is working correctly. The system check can fail for several reasons:
-
+
- The computer's BIOS or UEFI firmware can't read USB flash drives
- The computer's BIOS, uEFI firmware, or boot menu doesn't have reading USB flash drives enabled
- There are multiple USB flash drives inserted into the computer
@@ -405,7 +405,7 @@ sections:
- The computer's BIOS or UEFI firmware only supports using the function keys (F1-F10) to enter numerals in the pre-boot environment
- The startup key was removed before the computer finished rebooting
- The TPM has malfunctioned and fails to unseal the keys
-
+
- question: |
What can I do if the recovery key on my USB flash drive can't be read?
answer: |
@@ -430,18 +430,18 @@ sections:
How do I "lock" a data drive?
answer: |
Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the -lock command.
-
+
> [!NOTE]
> Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible.
The syntax of this command is:
-
+
```cmd
manage-bde.exe -lock
````
-
+
Outside of using this command, data drives will be locked on shutdown and restart of the operating system. A removable data drive will also be locked automatically when the drive is removed from the computer.
-
+
- question: |
Can I use BitLocker with the Volume Shadow Copy Service?
answer: |
@@ -453,9 +453,9 @@ sections:
BitLocker should work like any specific physical machine within its hardware limitations as long as the environment (physical or virtual) meets Windows Operating System requirements to run.
- With TPM: Yes, it's supported.
- Without TPM: Yes, it's supported (with password protector).
-
+
BitLocker is also supported on data volume VHDs, such as those used by clusters.
-
+
- question: |
Can I use BitLocker with virtual machines (VMs)?
answer: |
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.svg b/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.svg
index f70257047f..b23a99c61d 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.svg
+++ b/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.svg
@@ -1,9 +1,9 @@
-