mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 14:57:23 +00:00
Merge branch 'master' into w11
This commit is contained in:
Greg Lindsay
GitHub
commit
4a4b456adf
@ -18,6 +18,9 @@ ms.author: greglin
|
||||
**Applies to**
|
||||
- Windows 10, version 1607
|
||||
|
||||
> [!NOTE]
|
||||
> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)]
|
||||
|
||||
Before you deploy App-V into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V in a lab environment for evaluation purposes only.
|
||||
|
||||
## Configure lab computers for App-V Evaluation
|
||||
|
||||
@ -16,6 +16,9 @@ ms.topic: article
|
||||
|
||||
>Applies to: Windows 10, version 1607
|
||||
|
||||
> [!NOTE]
|
||||
> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)]
|
||||
|
||||
The topics in this section provide information and instructions to help you administer App-V and its components. This information is for system administrators who manage large installations with many servers and clients, and for support personnel who interact directly with the computers or users.
|
||||
|
||||
[Getting started with App-V](appv-getting-started.md)
|
||||
|
||||
@ -16,6 +16,9 @@ ms.topic: article
|
||||
|
||||
>Applies to: Windows 10, version 1607
|
||||
|
||||
> [!NOTE]
|
||||
> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)]
|
||||
|
||||
Microsoft Application Virtualization (App-V) for Windows 10 delivers Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service in real time and on an as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally.
|
||||
|
||||
With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise). If you're new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md).
|
||||
|
||||
@ -16,6 +16,9 @@ ms.topic: article
|
||||
|
||||
>Applies to: Windows 10, version 1607
|
||||
|
||||
> [!NOTE]
|
||||
> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)]
|
||||
|
||||
Use the following information to plan to deploy App-V without disrupting your existing network or user experience.
|
||||
|
||||
## Planning information
|
||||
|
||||
@ -134,7 +134,7 @@ When your apps are ready, you can add or deploy these apps to your Windows devic
|
||||
- **Application Virtualization (App-V)**: App-V allows Win32 apps to be used as virtual apps.
|
||||
|
||||
> [!NOTE]
|
||||
> Application Virtualization will be [end of life in April 2026](/lifecycle/announcements/mdop-extended). We recommend looking at **Azure Virtual desktop with MSIX app attach**. For more information, see [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) and [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal).
|
||||
> [!INCLUDE [Application Virtualization will be end of life in April 2026](./includes/app-v-end-life-statement.md)]
|
||||
|
||||
On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they're installed locally.
|
||||
|
||||
|
||||
@ -0,0 +1,12 @@
|
||||
---
|
||||
author: MandiOhlinger
|
||||
ms.author: mandia
|
||||
ms.date: 09/20/2021
|
||||
ms.reviewer:
|
||||
audience: itpro
|
||||
manager: dansimp
|
||||
ms.prod: w10
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
Application Virtualization will be [end of life in April 2026](/lifecycle/announcements/mdop-extended). We recommend looking at Azure Virtual Desktop with MSIX app attach. For more information, see [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) and [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal).
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Administrative Tools in Windows 10 (Windows 10)
|
||||
title: Administrative Tools in Windows
|
||||
description: Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users.
|
||||
ms.assetid: FDC63933-C94C-43CB-8373-629795926DC8
|
||||
ms.reviewer:
|
||||
@ -10,16 +10,17 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/27/2017
|
||||
ms.date: 09/14/2021
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Administrative Tools in Windows 10
|
||||
# Administrative Tools in Windows
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users.
|
||||
|
||||
@ -29,7 +30,7 @@ The tools in the folder might vary depending on which edition of Windows you are
|
||||
|
||||
|
||||
|
||||
These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders.
|
||||
These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders.
|
||||
|
||||
|
||||
|
||||
@ -54,7 +55,7 @@ These tools were included in previous versions of Windows. The associated docume
|
||||
- [Windows Memory Diagnostic]( https://go.microsoft.com/fwlink/p/?LinkId=708507)
|
||||
|
||||
> [!TIP]
|
||||
> If the content that is linked to a tool in the following list doesn't provide the information you need to use that tool, send us a comment by using the **Was this page helpful?** feature on this **Administrative Tools in Windows 10** page. Details about the information you want for a tool will help us plan future content.
|
||||
> If the content that is linked to a tool in the following list doesn't provide the information you need to use that tool, send us a comment by using the **Was this page helpful?** feature on this **Administrative Tools in Windows 10** or **Administrative Tools in Windows 11** page. Details about the information you want for a tool will help us plan future content.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ This article includes general troubleshooting for 802.1X wireless and wired clie
|
||||
|
||||
## Scenarios
|
||||
|
||||
This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 10 for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS.
|
||||
This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 11 for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS.
|
||||
|
||||
## Known issues
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Connect to remote Azure Active Directory-joined PC (Windows 10)
|
||||
title: Connect to remote Azure Active Directory-joined PC (Windows)
|
||||
description: You can use Remote Desktop Connection to connect to an Azure AD-joined PC.
|
||||
keywords: ["MDM", "device management", "RDP", "AADJ"]
|
||||
ms.prod: w10
|
||||
@ -9,7 +9,7 @@ ms.pagetype: devices
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.author: dansimp
|
||||
ms.date: 08/02/2018
|
||||
ms.date: 09/14/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.topic: article
|
||||
@ -21,6 +21,7 @@ ms.topic: article
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics).
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ Use the following steps to collect wireless and wired logs on Windows and Window
|
||||
1. Create C:\MSLOG on the client machine to store captured logs.
|
||||
2. Launch an elevated command prompt on the client machine, and run the following commands to start a RAS trace log and a Wireless/Wired scenario log.
|
||||
|
||||
**Wireless Windows 8.1 and Windows 10:**
|
||||
**Wireless Windows 8.1, Windows 10, and Windows 11:**
|
||||
```
|
||||
netsh ras set tracing * enabled
|
||||
netsh trace start scenario=wlan,wlan_wpp,wlan_dbg,wireless_dbg globallevel=0xff capture=yes maxsize=1024 tracefile=C:\MSLOG\%COMPUTERNAME%_wireless_cli.etl
|
||||
|
||||
@ -74,7 +74,7 @@ By default, page files are system-managed. This means that the page files increa
|
||||
|
||||
For example, when the system commit charge is more than 90 percent of the system commit limit, the page file is increased to back it. This continues to occur until the page file reaches three times the size of physical memory or 4 GB, whichever is larger. This all assumes that the logical disk that is hosting the page file is large enough to accommodate the growth.
|
||||
|
||||
The following table lists the minimum and maximum page file sizes of system-managed page files in Windows 10.
|
||||
The following table lists the minimum and maximum page file sizes of system-managed page files in Windows 10 and Windows 11.
|
||||
|
||||
|Minimum page file size |Maximum page file size|
|
||||
|---------------|------------------|
|
||||
|
||||
@ -6,7 +6,7 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/13/2017
|
||||
ms.date: 09/14/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
@ -17,7 +17,8 @@ ms.topic: troubleshooting
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
In Windows 10, version 1607, the following Group Policy settings apply only to Windows 10 Enterprise and Windows 10 Education.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Manage corporate devices (Windows 10)
|
||||
description: You can use the same management tools to manage all device types running Windows 10 desktops, laptops, tablets, and phones.
|
||||
title: Manage corporate devices (Windows)
|
||||
description: You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones.
|
||||
ms.assetid: 62D6710C-E59C-4077-9C7E-CE0A92DFC05D
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
@ -12,7 +12,7 @@ ms.sitesec: library
|
||||
ms.pagetype: devices
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/21/2017
|
||||
ms.date: 09/14/2021
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
@ -21,9 +21,10 @@ ms.topic: article
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
You can use the same management tools to manage all device types running Windows 10 : desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, System Center tools, and so on, will continue to work for Windows 10.
|
||||
You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, System Center tools, and so on, will continue to work for Windows 10 and Windows 11.
|
||||
|
||||
## In this section
|
||||
|
||||
@ -35,7 +36,7 @@ You can use the same management tools to manage all device types running Windows
|
||||
| [New policies for Windows 10](new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 |
|
||||
| [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education |
|
||||
| [Changes to Group Policy settings for Start in Windows 10](/windows/configuration/changes-to-start-policies-in-windows-10) | Changes to the Group Policy settings that you use to manage Start |
|
||||
| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 in their organizations |
|
||||
| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 or Windows 11 in their organizations |
|
||||
|
||||
|
||||
## Learn more
|
||||
|
||||
@ -1,11 +1,11 @@
|
||||
---
|
||||
title: Manage Device Installation with Group Policy (Windows 10)
|
||||
title: Manage Device Installation with Group Policy (Windows 10 and Windows 11)
|
||||
description: Find out how to manage Device Installation Restrictions with Group Policy.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: barakm
|
||||
ms.date: 07/05/2021
|
||||
ms.date: 09/14/2021
|
||||
ms.reviewer:
|
||||
manager: barakm
|
||||
ms.author: barakm
|
||||
@ -17,16 +17,18 @@ ms.topic: article
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, Windows Server 2022
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
- Windows Server 2022
|
||||
|
||||
|
||||
## Summary
|
||||
By using Windows 10 operating systems, administrators can determine what devices can be installed on computers they manage. This guide summarizes the device installation process and demonstrates several techniques for controlling device installation by using Group Policy.
|
||||
By using Windows operating systems, administrators can determine what devices can be installed on computers they manage. This guide summarizes the device installation process and demonstrates several techniques for controlling device installation by using Group Policy.
|
||||
|
||||
## Introduction
|
||||
|
||||
### General
|
||||
This step-by-step guide describes how you can control device installation on the computers that you manage, including designating which devices users can and cannot install. This guide applies to all Windows 10 versions starting with RS5 (1809). The guide includes the following scenarios:
|
||||
This step-by-step guide describes how you can control device installation on the computers that you manage, including designating which devices users can and cannot install. This guide applies to all Windows versions starting with RS5 (1809). The guide includes the following scenarios:
|
||||
|
||||
- Prevent users from installing devices that are on a "prohibited" list. If a device is not on the list, then the user can install it.
|
||||
- Allow users to install only devices that are on an "approved" list. If a device is not on the list, then the user cannot install it.
|
||||
@ -44,7 +46,7 @@ It is important to understand that the Group Policies that are presented in this
|
||||
|
||||
This guide is targeted at the following audiences:
|
||||
|
||||
- Information technology planners and analysts who are evaluating Windows 10 and Windows Server 2022
|
||||
- Information technology planners and analysts who are evaluating Windows 10, Windows 11 or Windows Server 2022
|
||||
- Enterprise information technology planners and designers
|
||||
- Security architects who are responsible for implementing trustworthy computing in their organization
|
||||
- Administrators who want to become familiar with the technology
|
||||
@ -102,7 +104,7 @@ A device is a piece of hardware with which Windows interacts to perform some fun
|
||||
|
||||
When Windows detects a device that has never been installed on the computer, the operating system queries the device to retrieve its list of device identification strings. A device usually has multiple device identification strings, which the device manufacturer assigns. The same device identification strings are included in the .inf file (also known as an _INF_) that is part of the driver package. Windows chooses which driver package to install by matching the device identification strings retrieved from the device to those included with the driver packages.
|
||||
|
||||
Windows uses four types of identifiers to control device installation and configuration. You can use the Group Policy settings in Windows 10 to specify which of these identifiers to allow or block.
|
||||
Windows uses four types of identifiers to control device installation and configuration. You can use the Group Policy settings in Windows to specify which of these identifiers to allow or block.
|
||||
|
||||
The four types of identifiers are:
|
||||
|
||||
@ -223,7 +225,7 @@ Some of these policies take precedence over other policies. The flowchart shown
|
||||
|
||||
To complete each of the scenarios, please ensure your have:
|
||||
|
||||
- A client computer running Windows 10.
|
||||
- A client computer running Windows.
|
||||
|
||||
- A USB thumb drive. The scenarios described in this guide use a USB thumb drive as the example device (also known as a “removable disk drive”, "memory drive," a "flash drive," or a "keyring drive"). Most USB thumb drives do not require any manufacturer-provided drivers, and these devices work with the inbox drivers provided with the Windows build.
|
||||
|
||||
|
||||
@ -1,11 +1,11 @@
|
||||
---
|
||||
title: Manage the Settings app with Group Policy (Windows 10)
|
||||
title: Manage the Settings app with Group Policy (Windows 10 and Windows 11)
|
||||
description: Find out how to manage the Settings app with Group Policy so you can hide specific pages from users.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: dansimp
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/14/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
@ -17,7 +17,8 @@ ms.topic: article
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, Windows Server 2016
|
||||
- Windows 10, Windows Server 2016
|
||||
- Windows 11
|
||||
|
||||
You can now manage the pages that are shown in the Settings app by using Group Policy. When you use Group Policy to manage pages, you can hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely.
|
||||
To make use of the Settings App group policies on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Create mandatory user profiles (Windows 10)
|
||||
title: Create mandatory user profiles (Windows 10 and Windows 11)
|
||||
description: A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users.
|
||||
keywords: [".man","ntuser"]
|
||||
ms.prod: w10
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
ms.date: 10/02/2018
|
||||
ms.date: 09/14/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.topic: article
|
||||
@ -16,7 +16,9 @@ ms.topic: article
|
||||
# Create mandatory user profiles
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Enable ADMX-backed policies in MDM
|
||||
description: Use this step-by-step guide to configure a selected set of Group Policy administrative templates (ADMX-backed policies) in Mobile Device Management (MDM).
|
||||
title: Enable ADMX policies in MDM
|
||||
description: Use this step-by-step guide to configure a selected set of Group Policy administrative templates (ADMX policies) in Mobile Device Management (MDM).
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
@ -12,30 +12,30 @@ ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Enable ADMX-backed policies in MDM
|
||||
# Enable ADMX policies in MDM
|
||||
|
||||
|
||||
This is a step-by-step guide to configuring ADMX-backed policies in MDM.
|
||||
Here's how to configure Group Policy administrative templates (ADMX policies) in Mobile Device Management (MDM).
|
||||
|
||||
Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support was expanded to allow access of [selected set of Group Policy administrative templates (ADMX-backed policies)](./policies-in-policy-csp-admx-backed.md) for Windows PCs via the [Policy configuration service provider (CSP)](policy-configuration-service-provider.md). Configuring ADMX-backed policies in Policy CSP is different from the typical way you configure a traditional MDM policy.
|
||||
Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support was expanded to allow access of [selected set of Group Policy administrative templates (ADMX policies)](./policies-in-policy-csp-admx-backed.md) for Windows PCs via the [Policy configuration service provider (CSP)](policy-configuration-service-provider.md). Configuring ADMX policies in Policy CSP is different from the typical way you configure a traditional MDM policy.
|
||||
|
||||
Summary of steps to enable a policy:
|
||||
- Find the policy from the list ADMX-backed policies.
|
||||
- Find the policy from the list ADMX policies.
|
||||
- Find the Group Policy related information from the MDM policy description.
|
||||
- Use the Group Policy Editor to determine whether there are parameters necessary to enable the policy.
|
||||
- Create the data payload for the SyncML.
|
||||
|
||||
See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Ingesting-Office-ADMX-Backed-policies-using/ba-p/354824) and [Deploying ADMX-Backed policies using Microsoft Intune](/archive/blogs/senthilkumar/intune-deploying-admx-backed-policies-using-microsoft-intune) for a walk-through using Intune.
|
||||
See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Ingesting-Office-ADMX-Backed-policies-using/ba-p/354824) and [Deploying ADMX policies using Microsoft Intune](/archive/blogs/senthilkumar/intune-deploying-admx-backed-policies-using-microsoft-intune) for a walk-through using Intune.
|
||||
|
||||
>[!TIP]
|
||||
>Intune has added a number of ADMX-backed administrative templates in public preview. Check if the policy settings you need are available in a template before using the SyncML method described below. [Learn more about Intune's administrative templates.](/intune/administrative-templates-windows)
|
||||
<!-- >[!TIP] -->
|
||||
<!-- >Intune has added a number of ADMX administrative templates in public preview. Check if the policy settings you need are available in a template before using the SyncML method described below. [Learn more about Intune's administrative templates.](/intune/administrative-templates-windows) -->
|
||||
|
||||
## Enable a policy
|
||||
|
||||
> [!NOTE]
|
||||
> See [Understanding ADMX-backed policies in Policy CSP](./understanding-admx-backed-policies.md).
|
||||
> See [Understanding ADMX policies in Policy CSP](./understanding-admx-backed-policies.md).
|
||||
|
||||
1. Find the policy from the list [ADMX-backed policies](./policies-in-policy-csp-admx-backed.md). You need the following information listed in the policy description.
|
||||
1. Find the policy from the list [ADMX policies](./policies-in-policy-csp-admx-backed.md). You need the following information listed in the policy description.
|
||||
- GP English name
|
||||
- GP name
|
||||
- GP ADMX file name
|
||||
@ -63,7 +63,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune](
|
||||
|
||||
3. Create the SyncML to enable the policy that does not require any parameter.
|
||||
|
||||
In this example you configure **Enable App-V Client** to **Enabled**.
|
||||
In this example, you configure **Enable App-V Client** to **Enabled**.
|
||||
|
||||
> [!NOTE]
|
||||
> The \<Data> payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type.
|
||||
@ -109,12 +109,12 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune](
|
||||
|
||||
|
||||
|
||||
3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the admx files) and open appv.admx.
|
||||
3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the ADMX files) and open appv.admx.
|
||||
|
||||
4. Search for GP name **Publishing_Server2_policy**.
|
||||
|
||||
|
||||
5. Under **policy name="Publishing_Server2_Policy"** you can see the \<elements> listed. The text id and enum id represents the data id you need to include in the SyncML data payload. They correspond to the fields you see in GP Editor.
|
||||
5. Under **policy name="Publishing_Server2_Policy"** you can see the \<elements> listed. The *text id* and *enum id* represents the *data id* you need to include in the SyncML data payload. They correspond to the fields you see in the Group Policy Editor.
|
||||
|
||||
Here is the snippet from appv.admx:
|
||||
|
||||
@ -206,9 +206,9 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune](
|
||||
</policy>
|
||||
```
|
||||
|
||||
6. From the \<elements> tag, copy all the text id and enum id and create an XML with data id and value fields. The value field contains the configuration settings you would enter in the GP Editor.
|
||||
6. From the **\<elements>** tag, copy all of the *text id* and *enum id* and create an XML with *data id* and *value* fields. The *value* field contains the configuration settings that you would enter in the Group Policy Editor.
|
||||
|
||||
Here is the example XML for Publishing_Server2_Policy :
|
||||
Here is the example XML for Publishing_Server2_Policy:
|
||||
|
||||
```xml
|
||||
<data id="Publishing_Server2_Name_Prompt" value="Name"/>
|
||||
@ -308,4 +308,4 @@ The \<Data> payload is empty. Here an example to set AppVirtualization/Publishin
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
```
|
||||
|
||||
@ -284,7 +284,7 @@ ms.date: 10/08/2020
|
||||
- [ADMX_FileServerVSSProvider/Pol_EncryptProtocol](./policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol)
|
||||
- [ADMX_FileSys/DisableCompression](./policy-csp-admx-filesys.md#admx-filesys-disablecompression)
|
||||
- [ADMX_FileSys/DisableDeleteNotification](./policy-csp-admx-filesys.md#admx-filesys-disabledeletenotification)
|
||||
- ADMX_FileSys/DisableEncryption](./policy-csp-admx-filesys.md#admx-filesys-disableencryption)
|
||||
- [ADMX_FileSys/DisableEncryption](./policy-csp-admx-filesys.md#admx-filesys-disableencryption)
|
||||
- [ADMX_FileSys/EnablePagefileEncryption](./policy-csp-admx-filesys.md#admx-filesys-enablepagefileencryption)
|
||||
- [ADMX_FileSys/LongPathsEnabled](./policy-csp-admx-filesys.md#admx-filesys-longpathsenabled)
|
||||
- [ADMX_FileSys/ShortNameCreationSettings](./policy-csp-admx-filesys.md#admx-filesys-shortnamecreationsettings)
|
||||
@ -299,6 +299,9 @@ ms.date: 10/08/2020
|
||||
- [ADMX_FolderRedirection/LocalizeXPRelativePaths_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-2)
|
||||
- [ADMX_FolderRedirection/PrimaryComputer_FR_1](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-1)
|
||||
- [ADMX_FolderRedirection/PrimaryComputer_FR_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-2)
|
||||
- [ADMX_FramePanes/NoReadingPane](./policy-csp-admx-framepanes.md#admx-framepanes-noreadingpane)
|
||||
- [ADMX_FramePanes/NoPreviewPane](./policy-csp-admx-framepanes.md#admx-framepanes-nopreviewpane)
|
||||
- [ADMX_FTHSVC/WdiScenarioExecutionPolicy](./policy-csp-admx-fthsvc.md#admx-fthsvc-wdiscenarioexecutionpolicy)
|
||||
- [ADMX_Globalization/BlockUserInputMethodsForSignIn](./policy-csp-admx-globalization.md#admx-globalization-blockuserinputmethodsforsignin)
|
||||
- [ADMX_Globalization/CustomLocalesNoSelect_1](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-1)
|
||||
- [ADMX_Globalization/CustomLocalesNoSelect_2](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-2)
|
||||
@ -400,6 +403,7 @@ ms.date: 10/08/2020
|
||||
- [ADMX_ICM/ShellRemovePublishToWeb_2](./policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-2)
|
||||
- [ADMX_ICM/WinMSG_NoInstrumentation_1](./policy-csp-admx-icm.md#admx-icm-winmsg_noinstrumentation-1)
|
||||
- [ADMX_ICM/WinMSG_NoInstrumentation_2](./policy-csp-admx-icm.md#admx-icm-winmsg_noinstrumentation-2)
|
||||
- [ADMX_IIS/PreventIISInstall](./policy-csp-admx-iis.md#admx-iis-preventiisinstall)
|
||||
- [ADMX_kdc/CbacAndArmor](./policy-csp-admx-kdc.md#admx-kdc-cbacandarmor)
|
||||
- [ADMX_kdc/ForestSearch](./policy-csp-admx-kdc.md#admx-kdc-forestsearch)
|
||||
- [ADMX_kdc/PKINITFreshness](./policy-csp-admx-kdc.md#admx-kdc-pkinitfreshness)
|
||||
@ -421,8 +425,10 @@ ms.date: 10/08/2020
|
||||
- [ADMX_LanmanWorkstation/Pol_CipherSuiteOrder](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-ciphersuiteorder)
|
||||
- [ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enablehandlecachingforcafiles)
|
||||
- [ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enableofflinefilesforcashares)
|
||||
- [ADMX_LeakDiagnostic/WdiScenarioExecutionPolicy](./policy-csp-admx-leakdiagnostic.md#admx-leakdiagnostic-wdiscenarioexecutionpolicy)
|
||||
- [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablelltdio)
|
||||
- [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablerspndr)
|
||||
- [ADMX_LocationProviderAdm/DisableWindowsLocationProvider_1](./policy-csp-admx-locationprovideradm.md#admx-locationprovideradm-disablewindowslocationprovider_1)
|
||||
- [ADMX_Logon/BlockUserFromShowingAccountDetailsOnSignin](./policy-csp-admx-logon.md#admx-logon-blockuserfromshowingaccountdetailsonsignin)
|
||||
- [ADMX_Logon/DisableAcrylicBackgroundOnLogon](./policy-csp-admx-logon.md#admx-logon-disableacrylicbackgroundonlogon)
|
||||
- [ADMX_Logon/DisableExplorerRunLegacy_1](./policy-csp-admx-logon.md#admx-logon-disableexplorerrunlegacy-1)
|
||||
@ -1761,4 +1767,4 @@ ms.date: 10/08/2020
|
||||
|
||||
## Related topics
|
||||
|
||||
[Policy CSP](policy-configuration-service-provider.md)
|
||||
[Policy CSP](policy-configuration-service-provider.md)
|
||||
|
||||
@ -1218,6 +1218,23 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_FramePanes policies
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-framepanes.md#admx-framepanes-noreadingpane" id="admx-framepanes-noreadingpane">ADMX_FramePanes/NoReadingPane</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-framepanes.md#admx-framepanes-nopreviewpane" id="admx-framepanes-nopreviewpane">ADMX_FramePanes/NoPreviewPane</a>
|
||||
</dd>
|
||||
<dl>
|
||||
|
||||
### ADMX_FTHSVC policies
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-fthsvc.md#admx-fthsvc-wdiscenarioexecutionpolicy" id="admx-fthsvc-wdiscenarioexecutionpolicy">ADMX_FTHSVC/WdiScenarioExecutionPolicy</a>
|
||||
</dd>
|
||||
<dl>
|
||||
|
||||
### ADMX_Help policies
|
||||
<dl>
|
||||
<dd>
|
||||
@ -1234,6 +1251,13 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_HotSpotAuth policies
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-hotspotauth.md#admx-hotspotauth-hotspotauth_enable" id="admx-hotspotauth-hotspotauth_enable">ADMX_HotSpotAuth/HotspotAuth_Enable</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_Globalization policies
|
||||
|
||||
<dl>
|
||||
@ -1545,6 +1569,15 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_IIS policies
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-iis.md#admx-iis-preventiisinstall
|
||||
" id="admx-iis-preventiisinstall
|
||||
">ADMX_IIS/PreventIISInstall</a>
|
||||
</dd>
|
||||
<dl>
|
||||
|
||||
### ADMX_kdc policies
|
||||
<dl>
|
||||
<dd>
|
||||
@ -1626,6 +1659,13 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_LeakDiagnostic policies
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-leakdiagnostic.md#admx-leakdiagnostic-wdiscenarioexecutionpolicy" id="admx-leakdiagnostic-wdiscenarioexecutionpolicy">ADMX_LeakDiagnostic/WdiScenarioExecutionPolicy</a>
|
||||
</dd>
|
||||
<dl>
|
||||
|
||||
### ADMX_LinkLayerTopologyDiscovery policies
|
||||
<dl>
|
||||
<dd>
|
||||
@ -1636,6 +1676,14 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_LocationProviderAdm policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-locationprovideradm.md#admx-locationprovideradm-disablewindowslocationprovider_1" id="admx-locationprovideradm-disablewindowslocationprovider_1">ADMX_LocationProviderAdm/BlockUserFromShowingAccountDetailsOnSignin</a>
|
||||
</dd>
|
||||
<dl>
|
||||
|
||||
### ADMX_Logon policies
|
||||
|
||||
<dl>
|
||||
@ -6025,6 +6073,13 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### Feeds policies
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-feeds.md#feeds-feedsenabled" id="feeds-feedsenabled">Feeds/FeedsEnabled</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### FileExplorer policies
|
||||
|
||||
<dl>
|
||||
|
||||
193
windows/client-management/mdm/policy-csp-admx-framepanes.md
Normal file
193
windows/client-management/mdm/policy-csp-admx-framepanes.md
Normal file
@ -0,0 +1,193 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_FramePanes
|
||||
description: Policy CSP - ADMX_FramePanes
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nimishasatapathy
|
||||
ms.date: 09/14/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_FramePanes
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_FramePanes policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-framepanes-noreadingpane">ADMX_FramePanes/NoReadingPane</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-framepanes-nopreviewpane">ADMX_FramePanes/NoPreviewPane</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-framepanes-noreadingpane"></a>**ADMX_FramePanes/NoReadingPane**
|
||||
<table>
|
||||
<tr>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting shows or hides the Details Pane in File Explorer.
|
||||
|
||||
- If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the user.
|
||||
|
||||
- If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and cannot be hidden by the user.
|
||||
|
||||
> [!NOTE]
|
||||
> This has a side effect of not being able to toggle to the Preview Pane since the two cannot be displayed at the same time.
|
||||
|
||||
- If you disable, or do not configure this policy setting, the Details Pane is hidden by default and can be displayed by the user.
|
||||
|
||||
This is the default policy setting.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Turn on or off details pane*
|
||||
- GP name: *NoReadingPane*
|
||||
- GP path: *Windows Components\File Explorer\Explorer Frame Pane*
|
||||
- GP ADMX file name: *FramePanes.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-framepanes-nopreviewpane"></a>**ADMX_FramePanes/NoPreviewPane**
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Hides the Preview Pane in File Explorer.
|
||||
|
||||
- If you enable this policy setting, the Preview Pane in File Explorer is hidden and cannot be turned on by the user.
|
||||
|
||||
- If you disable, or do not configure this setting, the Preview Pane is hidden by default and can be displayed by the user.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Turn off Preview Pane*
|
||||
- GP name: *NoPreviewPane*
|
||||
- GP path: *Windows Components\File Explorer\Explorer Frame Pane*
|
||||
- GP ADMX file name: *FramePanes.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
> [!NOTE]
|
||||
> These policies are currently only available as part of a Windows Insider release.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
116
windows/client-management/mdm/policy-csp-admx-fthsvc.md
Normal file
116
windows/client-management/mdm/policy-csp-admx-fthsvc.md
Normal file
@ -0,0 +1,116 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_FTHSVC
|
||||
description: Policy CSP - ADMX_FTHSVC
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nimishasatapathy
|
||||
ms.date: 09/15/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_FTHSVC
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_FTHSVC policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-fthsvc-wdiscenarioexecutionpolicy">ADMX_FTHSVC/WdiScenarioExecutionPolicy</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-fthsvc-wdiscenarioexecutionpolicy"></a>**ADMX_FTHSVC/WdiScenarioExecutionPolicy**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Machine
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting permits or prohibits the Diagnostic Policy Service (DPS) from automatically resolving any heap corruption problems.
|
||||
|
||||
- If you enable this policy setting, the DPS detects, troubleshoots, and attempts to resolve automatically any heap corruption problems.
|
||||
|
||||
- If you disable this policy setting, Windows cannot detect, troubleshoot, and attempt to resolve automatically any heap corruption problems that are handled by the DPS.
|
||||
If you do not configure this policy setting, the DPS enables Fault Tolerant Heap for resolution by default.
|
||||
This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.
|
||||
This policy setting takes effect only when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed.
|
||||
The DPS can be configured with the Services snap-in to the Microsoft Management Console.
|
||||
No system restart or service restart is required for this policy setting to take effect: changes take effect immediately.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Configure Scenario Execution Level*
|
||||
- GP name: *WdiScenarioExecutionPolicy*
|
||||
- GP path: *System\Troubleshooting and Diagnostics\Fault Tolerant Heap*
|
||||
- GP ADMX file name: *FTHSVC.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
> [!NOTE]
|
||||
> These policies are currently only available as part of a Windows Insider release.
|
||||
<!--/Policies-->
|
||||
|
||||
115
windows/client-management/mdm/policy-csp-admx-hotspotauth.md
Normal file
115
windows/client-management/mdm/policy-csp-admx-hotspotauth.md
Normal file
@ -0,0 +1,115 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_HotSpotAuth
|
||||
description: Policy CSP - ADMX_HotSpotAuth
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nimishasatapathy
|
||||
ms.date: 09/15/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_HotSpotAuth
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_HotSpotAuth policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-hotspotauth-hotspotauth_enable">ADMX_HotSpotAuth/HotspotAuth_Enable</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-hotspotauth-hotspotauth_enable"></a>**ADMX_HotSpotAuth/HotspotAuth_Enable**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Machine
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting defines whether WLAN hotspots are probed for Wireless Internet Service Provider roaming (WISPr) protocol support.
|
||||
|
||||
- If a WLAN hotspot supports the WISPr protocol, users can submit credentials when manually connecting to the network.
|
||||
|
||||
- If authentication is successful, users will be connected automatically on subsequent attempts. Credentials can also be configured by network operators.
|
||||
|
||||
- If you enable this policy setting, or if you do not configure this policy setting, WLAN hotspots are automatically probed for WISPR protocol support.
|
||||
|
||||
- If you disable this policy setting, WLAN hotspots are not probed for WISPr protocol support, and users can only authenticate with WLAN hotspots using a web browser.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Enable Hotspot Authentication*
|
||||
- GP name: *HotspotAuth_Enable*
|
||||
- GP path: *Network\Hotspot Authentication*
|
||||
- GP ADMX file name: *HotSpotAuth.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
> [!NOTE]
|
||||
> These policies are currently only available as part of a Windows Insider release.
|
||||
<!--/Policies-->
|
||||
|
||||
113
windows/client-management/mdm/policy-csp-admx-iis.md
Normal file
113
windows/client-management/mdm/policy-csp-admx-iis.md
Normal file
@ -0,0 +1,113 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_IIS
|
||||
description: Policy CSP - ADMX_IIS
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nimishasatapathy
|
||||
ms.date: 09/17/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_IIS
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_IIS policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-iis-preventiisinstall">ADMX_IIS/PreventIISInstall</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-iis-preventiisinstall"></a>**ADMX_IIS/PreventIISInstall**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Machine
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting prevents installation of Internet Information Services (IIS) on this computer.
|
||||
|
||||
- If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not receive a warning that IIS cannot be installed because of this Group Policy setting.
|
||||
|
||||
Enabling this setting will not have any effect on IIS if IIS is already installed on the computer.
|
||||
|
||||
- If you disable or do not configure this policy setting, IIS can be installed, as well as all the programs and applications that require IIS to run."
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Prevent IIS installation*
|
||||
- GP name: *PreventIISInstall*
|
||||
- GP path: *Windows Components\Internet Information Services*
|
||||
- GP ADMX file name: *IIS.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
> [!NOTE]
|
||||
> These policies are currently only available as part of a Windows Insider release.
|
||||
<!--/Policies-->
|
||||
|
||||
123
windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md
Normal file
123
windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md
Normal file
@ -0,0 +1,123 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_LeakDiagnostic
|
||||
description: Policy CSP - ADMX_LeakDiagnostic
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nimishasatapathy
|
||||
ms.date: 09/17/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_LeakDiagnostic
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_LeakDiagnostic policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-leakdiagnostic-wdiscenarioexecutionpolicy">ADMX_LeakDiagnostic/WdiScenarioExecutionPolicy</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-leakdiagnostic-wdiscenarioexecutionpolicy"></a>**ADMX_LeakDiagnostic/WdiScenarioExecutionPolicy**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Machine
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S.M.A.R.T. fault.
|
||||
|
||||
- If you enable this policy setting, Windows displays custom alert text in the disk diagnostic message. The custom text may not exceed 512 characters.
|
||||
|
||||
- If you disable or do not configure this policy setting, Windows displays the default alert text in the disk diagnostic message.
|
||||
|
||||
No reboots or service restarts are required for this policy setting to take effect: changes take effect immediately.
|
||||
|
||||
This policy setting only takes effect if the Disk Diagnostic scenario policy setting is enabled or not configured and the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed.
|
||||
|
||||
The DPS can be configured with the Services snap-in to the Microsoft Management Console.
|
||||
|
||||
> [!NOTE]
|
||||
> For Windows Server systems, this policy setting applies only if the Desktop Experience optional component is installed and the Remote Desktop Services role is not installed.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Configure custom alert text*
|
||||
- GP name: *WdiScenarioExecutionPolicy*
|
||||
- GP path: *System\Troubleshooting and Diagnostics\Disk Diagnostic*
|
||||
- GP ADMX file name: *LeakDiagnostic.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
|
||||
> [!NOTE]
|
||||
> These policies are currently only available as part of a Windows Insider release.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -0,0 +1,112 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_LocationProviderAdm
|
||||
description: Policy CSP - ADMX_LocationProviderAdm
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nimishasatapathy
|
||||
ms.date: 09/20/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_LocationProviderAdm
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_LocationProviderAdm policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-locationprovideradm-disablewindowslocationprovider_1">ADMX_LocationProviderAdm/DisableWindowsLocationProvider_1</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-locationprovideradm-disablewindowslocationprovider_1"></a>**ADMX_LocationProviderAdm/DisableWindowsLocationProvider_1**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Machine
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting turns off the Windows Location Provider feature for this computer.
|
||||
|
||||
- If you enable this policy setting, the Windows Location Provider feature will be turned off, and all programs on this computer will not be able to use the Windows Location Provider feature.
|
||||
|
||||
- If you disable or do not configure this policy setting, all programs on this computer can use the Windows Location Provider feature.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Turn off Windows Location Provider*
|
||||
- GP name: *DisableWindowsLocationProvider_1*
|
||||
- GP path: *Windows Components\Location and Sensors\Windows Location Provider*
|
||||
- GP ADMX file name: *LocationProviderAdm.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
> [!NOTE]
|
||||
> These policies are currently only available as part of a Windows Insider release.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -78,23 +78,23 @@ manager: dansimp
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -147,23 +147,23 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -216,23 +216,23 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -285,23 +285,23 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -356,23 +356,23 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -424,23 +424,23 @@ Most restricted value: 0
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>8</sup></td>
|
||||
<td>✔️<sup>8</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>8</sup></td>
|
||||
<td>✔️<sup>8</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>8</sup></td>
|
||||
<td>✔️<sup>8</sup></td>
|
||||
</tr>
|
||||
|
||||
</table>
|
||||
@ -501,23 +501,23 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>✔️<sup>1</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>✔️<sup>1</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -567,23 +567,23 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>✔️<sup>5</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>✔️<sup>5</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>✔️<sup>5</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>✔️<sup>5</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -638,23 +638,23 @@ For this policy to work, the Windows apps need to declare in their manifest that
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td>✔️<sup>4</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td>✔️<sup>4</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td>✔️<sup>4</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -709,23 +709,23 @@ This setting supports a range of values between 0 and 1.
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td>✔️<sup>4</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td>✔️<sup>4</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td>✔️<sup>4</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -781,23 +781,23 @@ This setting supports a range of values between 0 and 1.
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -851,23 +851,23 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -919,23 +919,23 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>✔️</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -987,23 +987,23 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>❌</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>✔️<sup>5</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>✔️<sup>5</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
@ -37,9 +37,6 @@ manager: dansimp
|
||||
<dd>
|
||||
<a href="#experience-allowmanualmdmunenrollment">Experience/AllowManualMDMUnenrollment</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#experience-allownewsandinterestsonthetaskbar">Experience/AllowNewsAndInterestsOnTheTaskbar</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#experience-allowsaveasofofficefiles">Experience/AllowSaveAsOfOfficeFiles</a>
|
||||
</dd>
|
||||
@ -105,28 +102,34 @@ manager: dansimp
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -184,28 +187,34 @@ ADMX Info:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -252,28 +261,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -314,28 +329,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -384,28 +405,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -442,65 +469,6 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="experience-allownewsandinterestsonthetaskbar"></a>**Experience/AllowNewsAndInterestsOnTheTaskbar**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Machine
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Specifies whether to allow "News and interests" on the Taskbar.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The values for this policy are 1 and 0. This policy defaults to 1.
|
||||
|
||||
- 1 - Default - News and interests feature will be allowed on the taskbar. The settings UI will be present in Taskbar context menu, and users will be able to turn off or switch mode.
|
||||
|
||||
- 0 - News and interests feature will be turned off completely, and the settings UI in Taskbar context menu will be removed.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
<!--Policy-->
|
||||
<a href="" id="experience-allowsaveasofofficefiles"></a><b>Experience/AllowSaveAsOfOfficeFiles</b>
|
||||
|
||||
@ -531,28 +499,34 @@ This policy is deprecated.
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -589,28 +563,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -665,28 +645,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -735,28 +721,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -808,28 +800,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -880,28 +878,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -951,28 +955,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1021,28 +1031,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1093,28 +1109,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1159,28 +1181,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>No</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td>No</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1217,28 +1245,34 @@ The values for this policy are 0, 1, 2, and 3. This policy defaults to 0 if not
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1286,28 +1320,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1356,28 +1396,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1426,28 +1472,34 @@ The following list shows the supported values:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1512,36 +1564,40 @@ _**Turn syncing off by default but don’t disable**_
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="experience-preventusersfromturningonbrowsersyncing"></a>**Experience/PreventUsersFromTurningOnBrowserSyncing**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1615,28 +1671,34 @@ Validation procedure:
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
<td>Yes</td>
|
||||
<td>Yes</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
103
windows/client-management/mdm/policy-csp-feeds.md
Normal file
103
windows/client-management/mdm/policy-csp-feeds.md
Normal file
@ -0,0 +1,103 @@
|
||||
---
|
||||
title: Policy CSP - Feeds
|
||||
description: Use the Policy CSP - Feeds setting policy specifies whether news and interests is allowed on the device.
|
||||
ms.author: v-nsatapathy
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nimishasatapathy
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/17/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - Feeds
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## Feeds policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#feeds-feedsenabled">Feeds/FeedsEnabled</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="feeds-feedsenabled"></a>**Feeds/FeedsEnabled**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Edition</th>
|
||||
<th>Windows 10</th>
|
||||
<th>Windows 11</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td>No</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td>Yes</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td>Yes</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td>Yes</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td>Yes</td>
|
||||
<td>No</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Machine
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting specifies whether news and interests is allowed on the device.
|
||||
|
||||
The values for this policy are 1 and 0. This policy defaults to 1.
|
||||
|
||||
- 1 - Default - News and interests feature will be allowed on the taskbar. The settings UI will be present in Taskbar context menu, and users will be able to turn off or switch mode.
|
||||
|
||||
- 0 - News and interests feature will be turned off completely, and the settings UI in Taskbar context menu will be removed.
|
||||
|
||||
<!--/Description-->
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP Friendly name: *Enable news and interests on the taskbar*
|
||||
- GP name: *FeedsEnabled*
|
||||
- GP path: *Windows Components\News and interests*
|
||||
- GP ADMX file name: *Feeds.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -23,9 +23,9 @@ items:
|
||||
href: certificate-authentication-device-enrollment.md
|
||||
- name: On-premises authentication device enrollment
|
||||
href: on-premise-authentication-device-enrollment.md
|
||||
- name: Understanding ADMX-backed policies
|
||||
- name: Understanding ADMX policies
|
||||
href: understanding-admx-backed-policies.md
|
||||
- name: Enable ADMX-backed policies in MDM
|
||||
- name: Enable ADMX policies in MDM
|
||||
href: enable-admx-backed-policies-in-mdm.md
|
||||
- name: Win32 and Desktop Bridge app policy configuration
|
||||
href: win32-and-centennial-app-policy-configuration.md
|
||||
@ -381,7 +381,7 @@ items:
|
||||
href: policy-ddf-file.md
|
||||
- name: Policies in Policy CSP supported by Group Policy
|
||||
href: policies-in-policy-csp-supported-by-group-policy.md
|
||||
- name: ADMX-backed policies in Policy CSP
|
||||
- name: ADMX policies in Policy CSP
|
||||
href: policies-in-policy-csp-admx-backed.md
|
||||
- name: Policies in Policy CSP supported by HoloLens 2
|
||||
href: policies-in-policy-csp-supported-by-hololens2.md
|
||||
@ -480,7 +480,7 @@ items:
|
||||
- name: ADMX_Explorer
|
||||
href: policy-csp-admx-explorer.md
|
||||
- name: ADMX_ExternalBoot
|
||||
href: policy-csp-admx-externalboot.md
|
||||
href: policy-csp-admx-externalboot.md
|
||||
- name: ADMX_FileRecovery
|
||||
href: policy-csp-admx-filerecovery.md
|
||||
- name: ADMX_FileRevocation
|
||||
@ -491,6 +491,10 @@ items:
|
||||
href: policy-csp-admx-filesys.md
|
||||
- name: ADMX_FolderRedirection
|
||||
href: policy-csp-admx-folderredirection.md
|
||||
- name: ADMX_FramePanes
|
||||
href: policy-csp-admx-framepanes.md
|
||||
- name: ADMX_FTHSVC
|
||||
href: policy-csp-admx-fthsvc.md
|
||||
- name: ADMX_Globalization
|
||||
href: policy-csp-admx-globalization.md
|
||||
- name: ADMX_GroupPolicy
|
||||
@ -501,6 +505,8 @@ items:
|
||||
href: policy-csp-admx-helpandsupport.md
|
||||
- name: ADMX_ICM
|
||||
href: policy-csp-admx-icm.md
|
||||
- name: ADMX_IIS
|
||||
href: policy-csp-admx-iis.md
|
||||
- name: ADMX_kdc
|
||||
href: policy-csp-admx-kdc.md
|
||||
- name: ADMX_Kerberos
|
||||
@ -509,8 +515,12 @@ items:
|
||||
href: policy-csp-admx-lanmanserver.md
|
||||
- name: ADMX_LanmanWorkstation
|
||||
href: policy-csp-admx-lanmanworkstation.md
|
||||
- name: ADMX_LeakDiagnostic
|
||||
href: policy-csp-admx-leakdiagnostic.md
|
||||
- name: ADMX_LinkLayerTopologyDiscovery
|
||||
href: policy-csp-admx-linklayertopologydiscovery.md
|
||||
- name: ADMX_LocationProviderAdm
|
||||
href: policy-csp-admx-locationprovideradm.md
|
||||
- name: ADMX_Logon
|
||||
href: policy-csp-admx-logon.md
|
||||
- name: ADMX_MicrosoftDefenderAntivirus
|
||||
@ -705,6 +715,8 @@ items:
|
||||
href: policy-csp-experience.md
|
||||
- name: ExploitGuard
|
||||
href: policy-csp-exploitguard.md
|
||||
- name: Feeds
|
||||
href: policy-csp-feeds.md
|
||||
- name: FileExplorer
|
||||
href: policy-csp-fileexplorer.md
|
||||
- name: Games
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Understanding ADMX-backed policies
|
||||
description: Starting in Windows 10, version 1703, you can use ADMX-backed policies for Windows 10 mobile device management (MDM) across Windows 10 devices.
|
||||
title: Understanding ADMX policies
|
||||
description: In Windows 10, you can use ADMX policies for Windows 10 mobile device management (MDM) across Windows 10 devices.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
@ -11,15 +11,15 @@ ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Understanding ADMX-backed policies
|
||||
# Understanding ADMX policies
|
||||
|
||||
Due to increased simplicity and the ease with which devices can be targeted, enterprise businesses are finding it increasingly advantageous to move their PC management to a cloud-based device management solution. Unfortunately, current Windows PC device-management solutions lack the critical policy and app settings configuration capabilities that are supported in a traditional PC management solution.
|
||||
Due to increased simplicity and the ease with which devices can be targeted, enterprise businesses are finding it increasingly advantageous to move their PC management to a cloud-based device management solution. Unfortunately, the modern Windows PC device-management solutions lack the critical policy and app settings configuration capabilities that are supported in a traditional PC management solution.
|
||||
|
||||
Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support will be expanded to allow access of select Group Policy administrative templates (ADMX-backed policies) for Windows PCs via the Policy configuration service provider (CSP). This expanded access ensures that enterprises do not need to compromise security of their devices in the cloud.
|
||||
Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support expanded to allow access of selected set of Group Policy administrative templates (ADMX policies) for Windows PCs via the Policy configuration service provider (CSP). This expanded access ensures that enterprises can keep their devices compliant and prevent the risk on compromising security of their devices managed through the cloud.
|
||||
|
||||
## <a href="" id="background"></a>Background
|
||||
|
||||
In addition to standard policies, the Policy CSP can now also handle ADMX-backed policies. In an ADMX-backed policy, an administrative template contains the metadata of a Window Group Policy and can be edited in the Local Group Policy Editor on a PC. Each administrative template specifies the registry keys (and their values) that are associated with a Group Policy and defines the policy settings that can be managed. Administrative templates organize Group Policies in a hierarchy in which each segment in the hierarchical path is defined as a category. Each setting in a Group Policy administrative template corresponds to a specific registry value. These Group Policy settings are defined in a standards-based, XML file format known as an ADMX file. For more information, see [Group Policy ADMX Syntax Reference Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753471(v=ws.10)).
|
||||
In addition to standard MDM policies, the Policy CSP can also handle selected set of ADMX policies. In an ADMX policy, an administrative template contains the metadata of a Window Group Policy and can be edited in the Local Group Policy Editor on a PC. Each administrative template specifies the registry keys (and their values) that are associated with a Group Policy and defines the policy settings that can be managed. Administrative templates organize Group Policies in a hierarchy in which each segment in the hierarchical path is defined as a category. Each setting in a Group Policy administrative template corresponds to a specific registry value. These Group Policy settings are defined in a standards-based, XML file format known as an ADMX file. For more information, see [Group Policy ADMX Syntax Reference Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753471(v=ws.10)).
|
||||
|
||||
ADMX files can either describe operating system (OS) Group Policies that are shipped with Windows or they can describe settings of applications, which are separate from the OS and can usually be downloaded and installed on a PC.
|
||||
Depending on the specific category of the settings that they control (OS or application), the administrative template settings are found in the following two locations in the Local Group Policy Editor:
|
||||
@ -30,29 +30,29 @@ In a domain controller/Group Policy ecosystem, Group Policies are automatically
|
||||
|
||||
An ADMX file can either be shipped with Windows (located at `%SystemRoot%\policydefinitions`) or it can be ingested to a device through the Policy CSP URI (`./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`). Inbox ADMX files are processed into MDM policies at OS-build time. ADMX files that are ingested are processed into MDM policies post-OS shipment through the Policy CSP. Because the Policy CSP does not rely upon any aspect of the Group Policy client stack, including the PC's Group Policy Service (GPSvc), the policy handlers that are ingested to the device are able to react to policies that are set by the MDM.
|
||||
|
||||
Windows maps the name and category path of a Group Policy to a MDM policy area and policy name by parsing the associated ADMX file, finding the specified Group Policy, and storing the definition (metadata) in the MDM Policy CSP client store. When the MDM policy is referenced by a SyncML command and the Policy CSP URI, `.\[device|user]\vendor\msft\policy\[config|result]\<area>\<policy>`, this metadata is referenced and determines which registry keys are set or removed. For a list of ADMX-backed policies supported by MDM, see [Policy CSP - ADMX-backed policies](./policy-configuration-service-provider.md).
|
||||
Windows maps the name and category path of a Group Policy to a MDM policy area and policy name by parsing the associated ADMX file, finding the specified Group Policy, and storing the definition (metadata) in the MDM Policy CSP client store. When the MDM policy is referenced by a SyncML command and the Policy CSP URI, `.\[device|user]\vendor\msft\policy\[config|result]\<area>\<policy>`, this metadata is referenced and determines which registry keys are set or removed. For a list of ADMX policies supported by MDM, see [Policy CSP - ADMX policies](./policy-configuration-service-provider.md).
|
||||
|
||||
>[!TIP]
|
||||
>Intune has added a number of ADMX-backed administrative templates in public preview. Check if the policy settings you need are available in a template before using the SyncML method described below. [Learn more about Intune's administrative templates.](/intune/administrative-templates-windows)
|
||||
<!-- [!TIP] -->
|
||||
<!-- Intune has added a number of ADMX administrative templates in public preview. Check if the policy settings you need are available in a template before using the SyncML method described below. [Learn more about Intune's administrative templates.](/intune/administrative-templates-windows) -->
|
||||
|
||||
## <a href="" id="admx-files-and-the-group-policy-editor"></a>ADMX files and the Group Policy Editor
|
||||
|
||||
To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrator must use a UI, such as the Group Policy Editor (gpedit.msc), to gather the necessary data. The MDM ISV console UI determines how to gather the needed Group Policy data from the IT administrator. ADMX-backed Group Policies are organized in a hierarchy and can have a scope of machine, user, or both. The Group Policy example in the next section uses a machine-wide Group Policy named "Publishing Server 2 Settings." When this Group Policy is selected, its available states are **Not Configured**, **Enabled**, and **Disabled**.
|
||||
To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrator must use a UI, such as the Group Policy Editor (gpedit.msc), to gather the necessary data. The MDM ISV console UI determines how to gather the needed Group Policy data from the IT administrator. ADMX Group Policies are organized in a hierarchy and can have a scope of machine, user, or both. The Group Policy example in the next section uses a machine-wide Group Policy named "Publishing Server 2 Settings." When this Group Policy is selected, its available states are **Not Configured**, **Enabled**, and **Disabled**.
|
||||
|
||||
The ADMX file that the MDM ISV uses to determine what UI to display to the IT administrator is the same ADMX file that the client uses for the policy definition. The ADMX file is processed either by the OS at build time or set by the client at OS runtime. In either case, the client and the MDM ISV must be synchronized with the ADMX policy definitions. Each ADMX file corresponds to a Group Policy category and typically contains several policy definitions, each of which represents a single Group Policy. For example, the policy definition for the "Publishing Server 2 Settings" is contained in the appv.admx file, which holds the policy definitions for the Microsoft Application Virtualization (App-V) Group Policy category.
|
||||
|
||||
Group Policy option button setting:
|
||||
- If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur:
|
||||
- The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data.
|
||||
- The MDM client stack receives this data, which causes the Policy CSP to update the device's registry per the ADMX-backed policy definition.
|
||||
- The MDM client stack receives this data, which causes the Policy CSP to update the device's registry per the ADMX policy definition.
|
||||
|
||||
- If **Disabled** is selected and you click **Apply**, the following events occur:
|
||||
- The MDM ISV server sets up a Replace SyncML command with a payload set to `<disabled\>`.
|
||||
- The MDM client stack receives this command, which causes the Policy CSP to either delete the device's registry settings, set the registry keys, or both, per the state change directed by the ADMX-backed policy definition.
|
||||
- The MDM client stack receives this command, which causes the Policy CSP to either delete the device's registry settings, set the registry keys, or both, per the state change directed by the ADMX policy definition.
|
||||
|
||||
- If **Not Configured** is selected and you click **Apply**, the following events occur:
|
||||
- MDM ISV server sets up a Delete SyncML command.
|
||||
- The MDM client stack receives this command, which causes the Policy CSP to delete the device's registry settings per the ADMX-backed policy definition.
|
||||
- The MDM client stack receives this command, which causes the Policy CSP to delete the device's registry settings per the ADMX policy definition.
|
||||
|
||||
The following diagram shows the main display for the Group Policy Editor.
|
||||
|
||||
@ -83,9 +83,9 @@ Appv.admx file:
|
||||
```
|
||||
|
||||
|
||||
## <a href="" id="admx-backed-policy-examples"></a>ADMX-backed policy examples
|
||||
## <a href="" id="admx-backed-policy-examples"></a>ADMX policy examples
|
||||
|
||||
The following SyncML examples describe how to set a MDM policy that is defined by an ADMX template, specifically the Publishing_Server2_Policy Group Policy description in the application virtualization ADMX file, appv.admx. Note that the functionality that this Group Policy manages is not important; it is used to illustrate only how an MDM ISV can set an ADMX-backed policy. These SyncML examples illustrate common options and the corresponding SyncML code that can be used for testing your policies. Note that the payload of the SyncML must be XML-encoded; for this XML encoding, you can use favorite online tool. To avoid encoding the payload, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
The following SyncML examples describe how to set a MDM policy that is defined by an ADMX template, specifically the Publishing_Server2_Policy Group Policy description in the application virtualization ADMX file, appv.admx. Note that the functionality that this Group Policy manages is not important; it is used to illustrate only how an MDM ISV can set an ADMX policy. These SyncML examples illustrate common options and the corresponding SyncML code that can be used for testing your policies. Note that the payload of the SyncML must be XML-encoded; for this XML encoding, you can use favorite online tool. To avoid encoding the payload, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
|
||||
### <a href="" id="enabling-a-policy"></a>Enabling a policy
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 10/30/2020
|
||||
ms.date: 09/21/2021
|
||||
---
|
||||
|
||||
# VPNv2 CSP
|
||||
@ -591,7 +591,7 @@ Valid values:
|
||||
- True = Register the connection's addresses in DNS.
|
||||
|
||||
<a href="" id="vpnv2-profilename-dnssuffix"></a>**VPNv2/**<em>ProfileName</em>**/DnsSuffix**
|
||||
Optional. Specifies one or more comma-separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList.
|
||||
Optional. Specifies one or more comma-separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList. Windows has a limit of 50 DNS suffixes that can be set. Windows name resolution will apply each suffix in order. Long DNS suffix lists may impact performance.
|
||||
|
||||
Value type is chr. Supported operations include Get, Add, Replace, and Delete.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Win32 and Desktop Bridge app policy configuration
|
||||
description: Starting in Windows 10, version 1703, you can import ADMX files and set those ADMX-backed policies for Win32 and Desktop Bridge apps.
|
||||
title: Win32 and Desktop Bridge app ADMX policy Ingestion
|
||||
description: Starting in Windows 10, version 1703, you can ingest ADMX files and set those ADMX policies for Win32 and Desktop Bridge apps.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
@ -11,21 +11,21 @@ ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Win32 and Desktop Bridge app policy configuration
|
||||
# Win32 and Desktop Bridge app ADMX policy Ingestion
|
||||
|
||||
## In this section
|
||||
|
||||
- [Overview](#overview)
|
||||
- [Ingesting an app ADMX file](#ingesting-an-app-admx-file)
|
||||
- [URI format for configuring an app policy](#uri-format-for-configuring-an-app-policy)
|
||||
- [ADMX-backed app policy examples](#admx-backed-app-policy-examples)
|
||||
- [ADMX app policy examples](#admx-backed-app-policy-examples)
|
||||
- [Enabling an app policy](#enabling-an-app-policy)
|
||||
- [Disabling an app policy](#disabling-an-app-policy)
|
||||
- [Setting an app policy to not configured](#setting-an-app-policy-to-not-configured)
|
||||
|
||||
## <a href="" id="overview"></a>Overview
|
||||
|
||||
Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies.
|
||||
Starting in Windows 10, version 1703, you can ingest ADMX files (ADMX ingestion) and set those ADMX policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies.
|
||||
|
||||
NOTE: Starting from the following Windows 10 version Replace command is supported
|
||||
- Windows 10, version 1903 with KB4512941 and KB4517211 installed
|
||||
@ -33,7 +33,7 @@ NOTE: Starting from the following Windows 10 version Replace command is supporte
|
||||
- Windows 10, version 1803 with KB4512509 and KB installed
|
||||
- Windows 10, version 1709 with KB4516071 and KB installed
|
||||
|
||||
When the ADMX policies are imported, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten. This precaution helps to avoid security concerns over opening the entire registry. Currently, the ingested policies are not allowed to write to locations within the **System**, **Software\Microsoft**, and **Software\Policies\Microsoft** keys, except for the following locations:
|
||||
When the ADMX policies are ingested, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten. This precaution helps to avoid security concerns over opening the entire registry. Currently, the ingested policies are not allowed to write to locations within the **System**, **Software\Microsoft**, and **Software\Policies\Microsoft** keys, except for the following locations:
|
||||
|
||||
- Software\Policies\Microsoft\Office\
|
||||
- Software\Microsoft\Office\
|
||||
@ -58,7 +58,7 @@ When the ADMX policies are imported, the registry keys to which each policy is w
|
||||
- Software\Microsoft\EdgeUpdate\
|
||||
|
||||
> [!Warning]
|
||||
> Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined.
|
||||
> Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still ingest ADMX files and set ADMX policies regardless of whether the device is domain joined or non-domain joined.
|
||||
|
||||
> [!NOTE]
|
||||
> Settings that cannot be configured using custom policy ingestion have to be set by pushing the appropriate registry keys directly (for example, by using PowerShell script).
|
||||
|
||||
@ -11,7 +11,7 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/24/2017
|
||||
ms.date: 09/15/2021
|
||||
ms.topic: reference
|
||||
---
|
||||
|
||||
@ -20,7 +20,8 @@ ms.topic: reference
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
As of September 2020 This page will no longer be updated. To find the Group Polices that ship in each version of Windows, refer to the Group Policy Settings Reference Spreadsheet. You can always locate the most recent version of the Spreadsheet by searching the Internet for "Windows Version + Group Policy Settings Reference".
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ manager: laurawi
|
||||
|
||||
# Use Quick Assist to help users
|
||||
|
||||
Quick Assist is a Windows 10 application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user’s device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices.
|
||||
Quick Assist is a Windows application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user’s device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices.
|
||||
|
||||
## Before you begin
|
||||
|
||||
|
||||
@ -196,4 +196,4 @@ goto loop
|
||||
|
||||
- [Port Exhaustion and You!](/archive/blogs/askds/port-exhaustion-and-you-or-why-the-netstat-tool-is-your-friend) - this article gives a detail on netstat states and how you can use netstat output to determine the port status
|
||||
|
||||
- [Detecting ephemeral port exhaustion](/archive/blogs/yongrhee/windows-server-2012-r2-ephemeral-ports-a-k-a-dynamic-ports-hotfixes): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10)
|
||||
- [Detecting ephemeral port exhaustion](/archive/blogs/yongrhee/windows-server-2012-r2-ephemeral-ports-a-k-a-dynamic-ports-hotfixes): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10, and Windows 11)
|
||||
|
||||
@ -10,11 +10,11 @@ ms.technology: storage
|
||||
ms.topic: article
|
||||
author: dansimp
|
||||
description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures.
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/15/2021
|
||||
---
|
||||
# Windows libraries
|
||||
|
||||
> Applies to: Windows 10, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2
|
||||
> Applies to: Windows 10, Windows 11, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2
|
||||
|
||||
Libraries are virtual containers for users’ content. A library can contain files and folders stored on the local computer or in a remote storage location. In Windows Explorer, users interact with libraries in ways similar to how they would interact with other folders. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with, and these known folders are automatically included in the default libraries and set as the default save location.
|
||||
|
||||
|
||||
@ -90,9 +90,9 @@
|
||||
|
||||
- name: Use provisioning packages
|
||||
items:
|
||||
- name: Provisioning packages for Windows 10
|
||||
- name: Provisioning packages for Windows client
|
||||
href: provisioning-packages/provisioning-packages.md
|
||||
- name: How provisioning works in Windows 10
|
||||
- name: How provisioning works in Windows client
|
||||
href: provisioning-packages/provisioning-how-it-works.md
|
||||
- name: Introduction to configuration service providers (CSPs)
|
||||
href: provisioning-packages/how-it-pros-can-use-configuration-service-providers.md
|
||||
@ -112,7 +112,7 @@
|
||||
href: provisioning-packages/provisioning-script-to-install-app.md
|
||||
- name: Create a provisioning package with multivariant settings
|
||||
href: provisioning-packages/provisioning-multivariant.md
|
||||
- name: PowerShell cmdlets for provisioning Windows 10 (reference)
|
||||
- name: PowerShell cmdlets for provisioning Windows client (reference)
|
||||
href: provisioning-packages/provisioning-powershell.md
|
||||
- name: Windows Configuration Designer command-line interface (reference)
|
||||
href: provisioning-packages/provisioning-command-line.md
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Add or remove pinned apps on the Start menu in Windows 11 | Microsoft Docs
|
||||
description: Export Start layout to LayoutModification.json with pinned apps, add or remove pinned apps, and use the JSON text in an MDM policy to deploy a custom Start menu layout to Windows 11 devices.
|
||||
description: Export Start layout to LayoutModification.json with pinned apps, and add or remove pinned apps. Use the JSON text in an MDM policy to deploy a custom Start menu layout to Windows 11 devices.
|
||||
ms.assetid:
|
||||
manager: dougeby
|
||||
ms.author: mandia
|
||||
@ -10,7 +10,6 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: mobile
|
||||
author: MandiOhlinger
|
||||
ms.date: 09/14/2021
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
@ -28,7 +27,7 @@ For example, you can override the default set of apps with your own a set of pin
|
||||
|
||||
To add apps you want pinned to the Start menu, you use a JSON file. In previous Windows versions, IT administrators used an XML file to customize the Start menu. The XML file isn't available on Windows 11 and later ***unless*** [you're an OEM](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu).
|
||||
|
||||
This article shows you how to export an existing Start menu layout, and use the JSON in a Microsoft Intune MDM policy.
|
||||
This article shows you how to export an existing Start menu layout, and use the JSON in a Microsoft Endpoint Manager policy.
|
||||
|
||||
## Before you begin
|
||||
|
||||
@ -52,12 +51,29 @@ Start has the following areas:
|
||||
|
||||
- **Pinned**: Shows pinned apps, or a subset of all of the apps installed on the device. You can create a list of pinned apps you want on the devices using the **ConfigureStartPins** policy. **ConfigureStartPins** overrides the entire layout, which also removes apps that are pinned by default.
|
||||
|
||||
This article shows you how to use the **ConfigureStartPins** policy.
|
||||
This article shows you [how to use the **ConfigureStartPins** policy](#get-the-pinnedlist-json).
|
||||
|
||||
- **All apps**: Users select this option to see an alphabetical list of all the apps on the device. This section can't be customized using the JSON file. You can use the `Start/ShowOrHideMostUsedApps` CSP, which is a policy to configure the "Most used" section at the top of the all apps list.
|
||||
- **Recommended**: Shows recently opened files and recently installed apps. This section can't be customized using the JSON file. To prevent files from showing in this section, you can use the [Start/HideRecentJumplists CSP](/windows/client-management/mdm/policy-csp-start#start-hiderecentjumplists). This CSP also hides recent files that show from the taskbar.
|
||||
- **All apps**: Users select this option to see an alphabetical list of all the apps on the device. This section can't be customized using the JSON file.
|
||||
|
||||
You can use an MDM provider, like Microsoft Intune, to manage the [Start/HideRecentJumplists CSP](/windows/client-management/mdm/policy-csp-start#start-hiderecentjumplists) on your devices. For more information on the Start menu settings you can configure in a Microsoft Intune policy, see [Windows 10 (and later) device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#start).
|
||||
The [Start/HideFrequentlyUsedApps CSP](/windows/client-management/mdm/policy-csp-start#start-hidefrequentlyusedapps) exposes settings that configure the "Most used" section, which is at the top of the all apps list.
|
||||
|
||||
In **Endpoint Manager**, you can configure this Start menu layout feature, and more. For more information on the Start menu settings you can configure in an Endpoint Manager policy, see [Windows 10/11 device settings to allow or restrict features](/mem/intune/configuration/device-restrictions-windows-10#start).
|
||||
|
||||
In **Group Policy**, there are policies that include settings that control the Start menu layout. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices:
|
||||
|
||||
- `Computer Configuration\Administrative Templates\Start Menu and Taskbar`
|
||||
- `User Configuration\Administrative Templates\Start Menu and Taskbar`
|
||||
|
||||
- **Recommended**: Shows recently opened files and recently installed apps. This section can't be customized using the JSON file.
|
||||
|
||||
The [Start/HideRecentJumplists CSP](/windows/client-management/mdm/policy-csp-start#start-hiderecentjumplists) exposes settings that prevent files from showing in this section. This CSP also hides recent files that show from the taskbar.
|
||||
|
||||
In **Endpoint Manager**, you can configure this feature, and more. For more information on the Start menu settings you can configure in an Endpoint Manager policy, see [Windows 10/11 device settings to allow or restrict features](/mem/intune/configuration/device-restrictions-windows-10#start).
|
||||
|
||||
In **Group Policy**, there are policies that include settings that control the Start menu layout. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices:
|
||||
|
||||
- `Computer Configuration\Administrative Templates\Start Menu and Taskbar`
|
||||
- `User Configuration\Administrative Templates\Start Menu and Taskbar`
|
||||
|
||||
## Create the JSON file
|
||||
|
||||
@ -111,13 +127,13 @@ If you're familiar with creating JSON files, you can create your own `LayoutModi
|
||||
|
||||
Now that you have the JSON syntax, you're ready to deploy your customized Start layout to devices in your organization.
|
||||
|
||||
MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list.
|
||||
MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Endpoint Manager, you can deploy a policy that configures the pinned list.
|
||||
|
||||
This section shows you how to create a pinned list policy in Microsoft Intune. There isn't a Group Policy to create a pinned list.
|
||||
This section shows you how to create a pinned list policy in Endpoint Manager. There isn't a Group Policy to create a pinned list.
|
||||
|
||||
### Create a pinned list using a Microsoft Intune policy
|
||||
### Create a pinned list using an Endpoint Manager policy
|
||||
|
||||
To deploy this policy in Microsoft Intune, the devices must be enrolled in Microsoft Intune, and managed by your organization. For more information, see [What is device enrollment in Intune?](/mem/intune/enrollment/device-enrollment).
|
||||
To deploy this policy, the devices must be enrolled, and managed by your organization. For more information, see [What is device enrollment?](/mem/intune/enrollment/device-enrollment).
|
||||
|
||||
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
2. Select **Devices** > **Configuration profiles** > **Create profile**.
|
||||
@ -157,13 +173,12 @@ To deploy this policy in Microsoft Intune, the devices must be enrolled in Micro
|
||||
:::image type="content" source="./images/customize-start-menu-layout-windows-11/endpoint-manager-admin-center-custom-oma-uri-start-layout.png" alt-text="Custom OMA-URI settings to customize Start menu layout using pinnedList":::
|
||||
|
||||
8. Select **Save** > **Next** to save your changes.
|
||||
9. Configure the rest of the policy settings. For more specific information, see [Create a profile with custom settings in Intune](/mem/intune/configuration/custom-settings-configure).
|
||||
9. Configure the rest of the policy settings. For more specific information, see [Create a profile with custom settings](/mem/intune/configuration/custom-settings-configure).
|
||||
|
||||
The Windows OS has many CSPs that apply to the Start menu. Using an MDM provider, like Intune, you can use these CSPs to customize Start even more. For a list, see [Supported CSP policies for Windows 11 Start menu](supported-csp-start-menu-layout-windows.md).
|
||||
The Windows OS exposes many CSPs that apply to the Start menu. For a list, see [Supported CSP policies for Windows 11 Start menu](supported-csp-start-menu-layout-windows.md).
|
||||
|
||||
### Deploy the policy using Microsoft Intune
|
||||
### Deploy the policy using Endpoint Manager
|
||||
|
||||
When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized Start layout, the policy can be deployed before users sign in the first time.
|
||||
|
||||
For more information on assigning policies using Microsoft Intune, see [Assign user and device profiles in Microsoft Intune](/mem/intune/configuration/device-profile-assign).
|
||||
When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized Start layout, the policy can be deployed anytime, including before users sign in the first time.
|
||||
|
||||
For more information and guidance on assigning policies to devices in your organization, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Customize Windows 10 Start and tasbkar with provisioning packages (Windows 10)
|
||||
title: Customize Windows 10 Start and taskbar with provisioning packages (Windows 10)
|
||||
description: In Windows 10, you can use a provisioning package to deploy a customized Start layout to users.
|
||||
ms.assetid: AC952899-86A0-42FC-9E3C-C25F45B1ACAC
|
||||
ms.reviewer:
|
||||
@ -21,9 +21,11 @@ ms.localizationpriority: medium
|
||||
|
||||
- Windows 10
|
||||
|
||||
|
||||
> **Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630)
|
||||
|
||||
> [!NOTE]
|
||||
> Currently, using provisioning packages to customize the Start menu layout is supported on Windows 10. It's not supported on Windows 11.
|
||||
|
||||
In Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, version 1703, you can use a provisioning package that you create with Windows Configuration Designer to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead.
|
||||
|
||||
> [!IMPORTANT]
|
||||
@ -136,5 +138,5 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
|
||||
- [Add image for secondary tiles](start-secondary-tiles.md)
|
||||
- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md)
|
||||
- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
|
||||
- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
|
||||
- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
|
||||
- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
|
||||
- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Configuration service providers for IT pros (Windows 10)
|
||||
title: Configuration service providers for IT pros (Windows 10/11)
|
||||
description: Describes how IT pros and system administrators can use configuration service providers (CSPs) to configure devices.
|
||||
ms.assetid: 25C1FDCA-0E10-42A1-A368-984FFDB2B7B6
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
@ -11,34 +11,28 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Configuration service providers for IT pros
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
This article explains how IT pros and system administrators can take advantage of many settings available through configuration service providers (CSPs) to configure devices running Windows 10 and Windows 10 Mobile in their organizations. CSPs expose device configuration settings in Windows 10. The CSPs are used by mobile device management (MDM) service providers and are documented in the [Hardware Dev Center](/windows/client-management/mdm/configuration-service-provider-reference).
|
||||
|
||||
> [!NOTE]
|
||||
> The information provided here about CSPs and CSP documentation also applies to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile.
|
||||
|
||||
[See what's new for CSPs in Windows 10, version 1809.](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1809)
|
||||
This article explains how IT pros and system administrators can take advantage of many settings available through configuration service providers (CSPs) to configure devices running Windows client in their organizations. CSPs expose device configuration settings in Windows client. The CSPs are used by mobile device management (MDM) service providers and are documented in the [Hardware Dev Center](/windows/client-management/mdm/configuration-service-provider-reference).
|
||||
|
||||
## What is a CSP?
|
||||
|
||||
In the client operating system, a CSP is the interface between configuration settings that are specified in a provisioning document and configuration settings that are on the device. CSPs are similar to Group Policy client-side extensions in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files, or permissions. Some of these settings are configurable, and some are read-only.
|
||||
|
||||
Starting with Windows Mobile 5.0, CSPs were used to manage Windows mobile devices. On the Windows 10 platform, the management approach for both desktop and mobile devices converges, taking advantage of the same CSPs to configure and manage all devices running Windows 10.
|
||||
On the Windows client platform, the management approach for desktop uses CSPs to configure and manage all devices running Windows client.
|
||||
|
||||
Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) contains the settings to create a Wi-Fi profile.
|
||||
|
||||
CSPs are behind many of the management tasks and policies for Windows 10, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider).
|
||||
CSPs are behind many of the management tasks and policies for Windows client, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider).
|
||||
|
||||
|
||||
:::image type="content" source="../images/policytocsp.png" alt-text="How intune maps to CSP":::
|
||||
|
||||
CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Endpoint Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge.
|
||||
|
||||
@ -48,7 +42,7 @@ The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based
|
||||
|
||||
### The WMI-to-CSP Bridge
|
||||
|
||||
The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs using scripts and traditional enterprise management software, such as Configuration Manager using WMI. The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device.
|
||||
The WMI-to-CSP Bridge is a component allowing configuration of Windows client CSPs using scripts and traditional enterprise management software, such as Configuration Manager using WMI. The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device.
|
||||
|
||||
[Learn how to use the WMI Bridge Provider with PowerShell.](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider)
|
||||
|
||||
@ -56,9 +50,7 @@ The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs u
|
||||
|
||||
Generally, enterprises rely on Group Policy or MDM to configure and manage devices. For devices running Windows, MDM services use CSPs to configure your devices.
|
||||
|
||||
In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried.
|
||||
|
||||
Some of the articles in the [Windows 10 and Windows 10 Mobile](/windows/windows-10) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](../cortana-at-work/cortana-at-work-overview.md), which links to the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). In the CSP topics, you can learn about all of the available configuration settings.
|
||||
In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. You can also learn about all of the available configuration settings.
|
||||
|
||||
### CSPs in Windows Configuration Designer
|
||||
|
||||
@ -66,9 +58,9 @@ You can use Windows Configuration Designer to create [provisioning packages](./p
|
||||
|
||||
Many settings in Windows Configuration Designer will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image.
|
||||
|
||||
|
||||
:::image type="content" source="../images/cspinicd.png" alt-text="In Windows Configuration Designer, how help content appears in icd.":::
|
||||
|
||||
[Provisioning packages in Windows 10](provisioning-packages.md) explains how to use the Windows Configuration Designer tool to create a runtime provisioning package.
|
||||
[Provisioning packages in Windows client](provisioning-packages.md) explains how to use the Windows Configuration Designer tool to create a runtime provisioning package.
|
||||
|
||||
### CSPs in MDM
|
||||
|
||||
@ -78,15 +70,15 @@ When a CSP is available but is not explicitly included in your MDM solution, you
|
||||
|
||||
### CSPs in Lockdown XML
|
||||
|
||||
Lockdown XML can be used to configure devices running Windows 10 Mobile. You can manually author a [Lockdown XML file](../mobile-devices/lockdown-xml.md) to make use of the configuration settings available through the [EnterpriseAssignedAccess configuration service provider (CSP)](/windows/client-management/mdm/enterpriseassignedaccess-csp). In Windows 10, version 1703, you can also use the new [Lockdown Designer app](../mobile-devices/mobile-lockdown-designer.md) to configure your Lockdown XML.
|
||||
Starting with Windows 10 version 1703, you can use the [Lockdown Designer app](../mobile-devices/mobile-lockdown-designer.md) to configure your Lockdown XML.
|
||||
|
||||
## <a href="" id="bkmk-csp-doc"></a>How do you use the CSP documentation?
|
||||
|
||||
All CSPs in Windows 10 are documented in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference).
|
||||
All CSPs are documented in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference).
|
||||
|
||||
The [main CSP topic](/windows/client-management/mdm/configuration-service-provider-reference) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP.
|
||||
The [CSP reference](/windows/client-management/mdm/configuration-service-provider-reference) tells you which CSPs are supported on each edition of Windows, and links to the documentation for each individual CSP.
|
||||
|
||||
|
||||
:::image type="content" source="../images/csptable.png" alt-text="The CSP reference shows the supported Windows editions":::
|
||||
|
||||
The documentation for each CSP follows the same structure. After an introduction that explains the purpose of the CSP, a diagram shows the parts of the CSP in tree format.
|
||||
|
||||
@ -94,7 +86,7 @@ The full path to a specific configuration setting is represented by its Open Mob
|
||||
|
||||
The following example shows the diagram for the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes, and rectangular elements are settings or policies for which a value must be supplied.
|
||||
|
||||
|
||||
:::image type="content" source="../images/provisioning-csp-assignedaccess.png" alt-text="The CSP reference shows the assigned access csp tree.":::
|
||||
|
||||
The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see that it uses the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp).
|
||||
|
||||
@ -104,7 +96,7 @@ The element in the tree diagram after the root node tells you the name of the CS
|
||||
|
||||
When an element in the diagram uses _italic_ font, it indicates a placeholder for specific information, such as the tenant ID in the following example.
|
||||
|
||||
|
||||
:::image type="content" source="../images/csp-placeholder.png" alt-text="The placeholder in the CSP tree":::
|
||||
|
||||
After the diagram, the documentation describes each element. For each policy or setting, the valid values are listed.
|
||||
|
||||
@ -114,26 +106,11 @@ The documentation for most CSPs will also include an XML example.
|
||||
|
||||
## CSP examples
|
||||
|
||||
CSPs provide access to a number of settings useful to enterprises. This section introduces the CSPs that an enterprise might find useful.
|
||||
CSPs provide access to many settings useful to enterprises. This section introduces the CSPs that an enterprise might find useful.
|
||||
|
||||
- [EnterpriseAssignedAccess CSP](/windows/client-management/mdm/enterpriseassignedaccess-csp)
|
||||
|
||||
The EnterpriseAssignedAccess CSP lets IT administrators configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app.
|
||||
|
||||
In addition to lock screen wallpaper, theme, time zone, and language, the EnterpriseAssignedAccess CSP includes AssignedAccessXml that can be used to lock down the device through the following settings:
|
||||
|
||||
- Enabling or disabling the Action Center.
|
||||
- Configuring the number of tile columns in the Start layout.
|
||||
- Restricting the apps that will be available on the device.
|
||||
- Restricting the settings that the user can access.
|
||||
- Restricting the hardware buttons that will be operable.
|
||||
- Restricting access to the context menu.
|
||||
- Enabling or disabling tile manipulation.
|
||||
- Creating role-specific configurations.
|
||||
|
||||
- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider)
|
||||
|
||||
The Policy CSP enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings.
|
||||
The Policy CSP enables the enterprise to configure policies on Windows client. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings.
|
||||
|
||||
Some of the settings available in the Policy CSP include the following:
|
||||
|
||||
@ -153,7 +130,7 @@ CSPs provide access to a number of settings useful to enterprises. This section
|
||||
- **Update**, such as whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store.
|
||||
- **WiFi**, such as whether Internet sharing is enabled.
|
||||
|
||||
Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Enterprise, or both:
|
||||
Here is a list of CSPs supported on Windows 10 Enterprise:
|
||||
|
||||
- [ActiveSync CSP](/windows/client-management/mdm/activesync-csp)
|
||||
- [Application CSP](/windows/client-management/mdm/application-csp)
|
||||
@ -211,4 +188,4 @@ Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Ent
|
||||
- [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp)
|
||||
- [Wi-Fi CSP](/documentation/)
|
||||
- [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp)
|
||||
- [WindowsSecurityAuditing CSP](/windows/client-management/mdm/windowssecurityauditing-csp)
|
||||
- [WindowsSecurityAuditing CSP](/windows/client-management/mdm/windowssecurityauditing-csp)
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Provision PCs with common settings (Windows 10)
|
||||
title: Provision PCs with common settings (Windows 10/11)
|
||||
description: Create a provisioning package to apply common settings to a PC running Windows 10.
|
||||
ms.assetid: 66D14E97-E116-4218-8924-E2A326C9367E
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
keywords: ["runtime provisioning", "provisioning package"]
|
||||
ms.prod: w10
|
||||
@ -12,7 +12,6 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Provision PCs with common settings for initial deployment (desktop wizard)
|
||||
@ -20,16 +19,17 @@ ms.date: 07/27/2017
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
This topic explains how to create and apply a provisioning package that contains common enterprise settings to a device running all desktop editions of Windows 10 except Windows 10 Home.
|
||||
This topic explains how to create and apply a provisioning package that contains common enterprise settings to a device running all desktop editions of Windows client except Home.
|
||||
|
||||
You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices.
|
||||
|
||||
## Advantages
|
||||
- You can configure new devices without reimaging.
|
||||
|
||||
- Works on both mobile and desktop devices.
|
||||
- Works on desktop devices.
|
||||
|
||||
- No network connectivity required.
|
||||
|
||||
@ -51,14 +51,14 @@ The desktop wizard helps you configure the following settings in a provisioning
|
||||
- Add applications and certificates
|
||||
|
||||
>[!WARNING]
|
||||
>You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.
|
||||
>You must run Windows Configuration Designer on Windows client to configure Azure Active Directory enrollment using any of the wizards.
|
||||
|
||||
Provisioning packages can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more.
|
||||
|
||||
> [!TIP]
|
||||
> Use the desktop wizard to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc.
|
||||
>
|
||||
>
|
||||
> :::image type="content" source="../images/icd-simple-edit.png" alt-text="In the desktop wizard, open the advanced editor.":::
|
||||
|
||||
## Create the provisioning package
|
||||
|
||||
@ -68,26 +68,76 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
|
||||
|
||||
2. Click **Provision desktop devices**.
|
||||
|
||||
|
||||
:::image type="content" source="../images/icd-create-options-1703.png" alt-text="In Windows Configuration Designer, see the ICD start options.":::
|
||||
|
||||
3. Name your project and click **Finish**. The pages for desktop provisioning will walk you through the following steps.
|
||||
|
||||
|
||||
:::image type="content" source="../images/icd-desktop-1703.png" alt-text="In Windows Configuration Designer, select Finish, and see the ICD desktop provisioning.":::
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
|
||||
|
||||
## Configure settings
|
||||
|
||||
1. Enable device setup:
|
||||
|
||||
<table>
|
||||
<tr><td valign="top"><img src="../images/one.png" alt="step one"/><img src="../images/set-up-device.png" alt="set up device"/></br></br>Enter a name for the device.</br></br>(Optional) Select a license file to upgrade Windows 10 to a different edition. <a href="/windows/deployment/upgrade/windows-10-edition-upgrades" data-raw-source="[See the permitted upgrades.](/windows/deployment/upgrade/windows-10-edition-upgrades)">See the permitted upgrades.</a></br></br>Toggle <strong>Yes</strong> or <strong>No</strong> to <strong>Configure devices for shared use</strong>. This setting optimizes Windows 10 for shared use scenarios. <a href="../set-up-shared-or-guest-pc.md" data-raw-source="[Learn more about shared PC configuration.](../set-up-shared-or-guest-pc.md)">Learn more about shared PC configuration.</a></br></br>You can also select to remove pre-installed software from the device. </td><td><img src="../images/set-up-device-details-desktop.png" alt="device name, upgrade to enterprise, shared use, remove pre-installed software"/></td></tr>
|
||||
<tr><td valign="top"><img src="../images/two.png" alt="step two"/> <img src="../images/set-up-network.png" alt="set up network"/></br></br>Toggle <strong>On</strong> or <strong>Off</strong> for wireless network connectivity. If you select <strong>On</strong>, enter the SSID, the network type (<strong>Open</strong> or <strong>WPA2-Personal</strong>), and (if <strong>WPA2-Personal</strong>) the password for the wireless network.</td><td><img src="../images/set-up-network-details-desktop.png" alt="Enter network SSID and type"/></td></tr>
|
||||
<tr><td valign="top"><img src="../images/three.png" alt="step three"/> <img src="../images/account-management.png" alt="account management"/></br></br>Enable account management if you want to configure settings on this page. </br></br>You can enroll the device in Active Directory, enroll in Azure Active Directory, or create a local administrator account on the device</br></br>To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain.</br></br>Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, <a href="/azure/active-directory/active-directory-azureadjoin-setup" data-raw-source="[set up Azure AD join in your organization](/azure/active-directory/active-directory-azureadjoin-setup)">set up Azure AD join in your organization</a>. The <strong>maximum number of devices per user</strong> setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 180 days from the date you get the token). Click <strong>Get bulk token</strong>. In the <strong>Let's get you signed in</strong> window, enter an account that has permissions to join a device to Azure AD, and then the password. Click <strong>Accept</strong> to give Windows Configuration Designer the necessary permissions. </br></br>To create a local administrator account, select that option and enter a user name and password. </br></br><strong>Important:</strong> If you create a local account in the provisioning package, you must change the password using the <strong>Settings</strong> app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. </td><td><img src="../images/account-management-details.png" alt="join Active Directory, Azure AD, or create a local admin account"/></td></tr>
|
||||
<tr><td valign="top"><img src="../images/four.png" alt="step four"/> <img src="../images/add-applications.png" alt="add applications"/></br></br>You can install multiple applications, both Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see <a href="provision-pcs-with-apps.md" data-raw-source="[Provision PCs with apps](provision-pcs-with-apps.md)">Provision PCs with apps</a>. </td><td><img src="../images/add-applications-details.png" alt="add an application"/></td></tr>
|
||||
<tr><td valign="top"><img src="../images/five.png" alt="step five"/> <img src="../images/add-certificates.png" alt="add certificates"/></br></br>To provision the device with a certificate, click <strong>Add a certificate</strong>. Enter a name for the certificate, and then browse to and select the certificate to be used.</td><td><img src="../images/add-certificates-details.png" alt="add a certificate"/></td></tr>
|
||||
<tr><td valign="top"> <img src="../images/finish.png" alt="The 'finish' button as displayed when provisioning a desktop device in Windows Configuration Designer."/></br></br>You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.</td><td><img src="../images/finish-details.png" alt="Protect your package"/></td></tr>
|
||||
</table>
|
||||
:::image type="content" source="../images/set-up-device-details-desktop.png" alt-text="In Windows Configuration Designer, enable device setup, enter the device name, the product key to upgrade, turn off shared use, and remove preinstalled software.":::
|
||||
|
||||
If you want to enable device setup, select **Set up device**, and configure the following settings:
|
||||
|
||||
- **Device name**: Required. Enter a unique 15-character name for the device. You can use variables to add unique characters to the name, such as `Contoso-%SERIAL%` and `Contoso-%RAND:5%`.
|
||||
- **Enter product key**: Optional. Select a license file to upgrade Windows client to a different edition. For more information, see [the permitted upgrades](/windows/deployment/upgrade/windows-10-edition-upgrades).
|
||||
- **Configure devices for shared use**: Select **Yes** or **No** to optimize the Windows client for shared use scenarios.
|
||||
- **Remove pre-installed software**: Optional. Select **Yes** if you want to remove preinstalled software.
|
||||
|
||||
2. Set up the network:
|
||||
|
||||
:::image type="content" source="../images/set-up-network-details-desktop.png" alt-text="In Windows Configuration Designer, turn on wireless connectivity, enter the network SSID, and network type.":::
|
||||
|
||||
If you want to enable network setup, select **Set up network**, and configure the following settings:
|
||||
|
||||
- **Set up network**: To enable wireless connectivity, select **On**.
|
||||
- **Network SSID**: Enter the Service Set IDentifier (SSID) of the network.
|
||||
- **Network type**: Select **Open** or **WPA2-Personal**. If you select **WPA2-Personal**, enter the password for the wireless network.
|
||||
|
||||
3. Enable account management:
|
||||
|
||||
:::image type="content" source="../images/account-management-details.png" alt-text="In Windows Configuration Designer, join Active Directory, Azure AD, or create a local admin account.":::
|
||||
|
||||
If you want to enable account management, select **Account Management**, and configure the following settings:
|
||||
|
||||
- **Manage organization/school accounts**: Choose how devices are enrolled. Your options:
|
||||
- **Active Directory**: Enter the credentials for a least-privileged user account to join the device to the domain.
|
||||
- **Azure Active Directory**: Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Azure AD tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used.
|
||||
|
||||
If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Azure AD, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions.
|
||||
|
||||
You must run Windows Configuration Designer on Windows client to configure Azure AD enrollment using any of the wizards.
|
||||
|
||||
- **Local administrator**: If you select this option, enter a user name and password. If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password isn't changed during that period, the account might be locked out, and unable to sign in.
|
||||
|
||||
4. Add applications:
|
||||
|
||||
:::image type="content" source="../images/add-applications-details.png" alt-text="In Windows Configuration Designer, add an application.":::
|
||||
|
||||
To add applications to the devices, select **Add applications**. You can install multiple applications, including Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps. The settings in this step vary depending on the application you select. For help with the settings, see [Provision PCs with apps](provision-pcs-with-apps.md).
|
||||
|
||||
5. Add certificates:
|
||||
|
||||
:::image type="content" source="../images/add-certificates-details.png" alt-text="In Windows Configuration Designer, add a certificate.":::
|
||||
|
||||
To add a certificate to the devices, select **Add certificates**, and configure the following settings:
|
||||
|
||||
- **Certificate name**: Enter a name for the certificate.
|
||||
- **Certificate path**: Browse and select the certificate you want to add.
|
||||
|
||||
6. Finish:
|
||||
|
||||
:::image type="content" source="../images/finish-details.png" alt-text="In Windows Configuration Designer, protect your package with a password.":::
|
||||
|
||||
To complete the wizard, select **Finish**, and configure the following setting:
|
||||
|
||||
- **Protect your package**: Select **Yes** or **No** to password protect your provisioning package. When you apply the provisioning package to a device, you must enter this password.
|
||||
|
||||
After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page.
|
||||
|
||||
@ -98,19 +148,17 @@ After you're done, click **Create**. It only takes a few seconds. When the packa
|
||||
|
||||
- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
||||
|
||||
- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
|
||||
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [NFC-based device provisioning](../mobile-devices/provisioning-nfc.md)
|
||||
- [Use the package splitter tool](../mobile-devices/provisioning-package-splitter.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Provision PCs with apps (Windows 10)
|
||||
title: Provision PCs with apps (Windows 10/11)
|
||||
description: Learn how to install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package.
|
||||
keywords: ["runtime provisioning", "provisioning package"]
|
||||
ms.prod: w10
|
||||
@ -9,8 +9,7 @@ author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 09/06/2017
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
@ -20,9 +19,10 @@ manager: dansimp
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
|
||||
In Windows 10, version 1703, you can install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. This topic explains the various settings in [Windows Configuration Designer](provisioning-install-icd.md) for app install.
|
||||
You can install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. This article explains the various settings in [Windows Configuration Designer](provisioning-install-icd.md) for app install.
|
||||
|
||||
When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv).
|
||||
|
||||
@ -33,7 +33,7 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate
|
||||
|
||||
- **License Path**: Specify the license file if it is an app from the Microsoft Store. This is optional if you have a certificate for the app.
|
||||
|
||||
- **Package family name**: Specify the package family name if you don’t specify a license. This field will be auto-populated after you specify a license.
|
||||
- **Package family name**: Specify the package family name if you don’t specify a license. This field will be autopopulated after you specify a license.
|
||||
|
||||
- **Required appx dependencies**: Specify the appx dependency packages that are required for the installation of the app
|
||||
|
||||
@ -44,25 +44,25 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate
|
||||
> [!NOTE]
|
||||
> You can find more information about command-line options for Msiexec.exe [here](/windows/win32/msi/command-line-options).
|
||||
|
||||
- **Command line arguments**: Optionally, append additional command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE
|
||||
- **Command line arguments**: Optionally, append more command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE
|
||||
|
||||
- **Continue installations after failure**: Optionally, specify if you want to continue installing additional apps if this app fails to install
|
||||
- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install
|
||||
|
||||
- **Restart required**: Optionally, specify if you want to initiate a reboot after a successful install of this app
|
||||
- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app
|
||||
|
||||
- **Required win32 app dependencies**: Optionally, specify additional files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract).
|
||||
- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract).
|
||||
|
||||
### Exe or other installer
|
||||
|
||||
- **Command line arguments**: Append the command line arguments with a silent flag (required). Optionally, append additional flags
|
||||
- **Command line arguments**: Append the command line arguments with a silent flag (required). Optionally, append more flags
|
||||
|
||||
- **Return Codes**: Specify the return codes for success and success with restart (0 and 3010 by default respectively) Any return code that is not listed will be interpreted as failure. The text boxes are space delimited.
|
||||
|
||||
- **Continue installations after failure**: Optionally, specify if you want to continue installing additional apps if this app fails to install
|
||||
- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install
|
||||
|
||||
- **Restart required**: Optionally, specify if you want to initiate a reboot after a successful install of this app
|
||||
- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app
|
||||
|
||||
- **Required win32 app dependencies**: Optionally, specify additional files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract).
|
||||
- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract).
|
||||
|
||||
|
||||
<span id="adv" />
|
||||
@ -72,7 +72,7 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate
|
||||
|
||||
1. In the **Available customizations** pane, go to **Runtime settings** > **ProvisioningCommands** > **PrimaryContext** > **Command**.
|
||||
|
||||
2. Enter a name for the first app, and then click **Add**.
|
||||
2. Enter a name for the first app, and then select **Add**.
|
||||
|
||||
|
||||
|
||||
@ -90,9 +90,9 @@ Universal apps that you can distribute in the provisioning package can be line-o
|
||||
|
||||
|
||||
|
||||
3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle).
|
||||
3. For **ApplicationFile**, select **Browse** to find and select the target app (either an \*.appx or \*.appxbundle).
|
||||
|
||||
4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page.
|
||||
4. For **DependencyAppxFiles**, select **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page.
|
||||
|
||||
|
||||
|
||||
@ -102,11 +102,11 @@ Universal apps that you can distribute in the provisioning package can be line-o
|
||||
|
||||
|
||||
|
||||
- Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and click **Add**.
|
||||
- Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and select **Add**.
|
||||
|
||||
6. In the **Available customizations** pane, click the **LicenseProductId** that you just added.
|
||||
6. In the **Available customizations** pane, select the **LicenseProductId** that you just added.
|
||||
|
||||
7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed *\<file name>*.**ms-windows-store-license**, and select the license file.
|
||||
7. For **LicenseInstall**, select **Browse**, navigate to the license file that you renamed *\<file name>*.**ms-windows-store-license**, and select the license file.
|
||||
|
||||
[Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps)
|
||||
|
||||
@ -119,7 +119,7 @@ Universal apps that you can distribute in the provisioning package can be line-o
|
||||
|
||||
1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**.
|
||||
|
||||
2. Enter a **CertificateName** and then click **Add**.
|
||||
2. Enter a **CertificateName** and then select **Add**.
|
||||
|
||||
2. Enter the **CertificatePassword**.
|
||||
|
||||
@ -136,12 +136,13 @@ For details about the settings you can customize in provisioning packages, see [
|
||||
|
||||
## Build your package
|
||||
|
||||
1. When you are done configuring the provisioning package, on the **File** menu, click **Save**.
|
||||
1. When you are done configuring the provisioning package, on the **File** menu, select **Save**.
|
||||
|
||||
2. Read the warning that project files may contain sensitive information, and click **OK**.
|
||||
> **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
|
||||
2. Read the warning that project files may contain sensitive information, and select **OK**.
|
||||
|
||||
3. On the **Export** menu, click **Provisioning package**.
|
||||
When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location, and delete the project files when they're no longer needed.
|
||||
|
||||
3. On the **Export** menu, select **Provisioning package**.
|
||||
|
||||
4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
|
||||
|
||||
@ -154,25 +155,25 @@ For details about the settings you can customize in provisioning packages, see [
|
||||
|
||||
- **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
|
||||
|
||||
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package.
|
||||
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select...** and choosing the certificate you want to use to sign the package.
|
||||
|
||||
**Important**
|
||||
We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.
|
||||
> [!TIP]
|
||||
> We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store. Any package signed with that certificate can be applied silently.
|
||||
|
||||
7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.<p>
|
||||
Optionally, you can click **Browse** to change the default output location.
|
||||
7. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.<p>
|
||||
Optionally, you can select **Browse** to change the default output location.
|
||||
|
||||
8. Click **Next**.
|
||||
8. Select **Next**.
|
||||
|
||||
9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.<p>
|
||||
If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
|
||||
9. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.<p>
|
||||
If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
|
||||
|
||||
10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.<p>
|
||||
If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
|
||||
|
||||
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
|
||||
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build.
|
||||
|
||||
- If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
|
||||
- If you are done, select **Finish** to close the wizard and go back to the **Customizations Page**.
|
||||
|
||||
11. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods:
|
||||
|
||||
@ -184,33 +185,25 @@ For details about the settings you can customize in provisioning packages, see [
|
||||
|
||||
- Email
|
||||
|
||||
- USB tether (mobile only)
|
||||
|
||||
- NFC (mobile only)
|
||||
|
||||
|
||||
|
||||
**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
|
||||
|
||||
## Learn more
|
||||
|
||||
- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
||||
|
||||
- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
|
||||
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [NFC-based device provisioning](../mobile-devices/provisioning-nfc.md)
|
||||
- [Use the package splitter tool](../mobile-devices/provisioning-package-splitter.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Apply a provisioning package (Windows 10)
|
||||
title: Apply a provisioning package (Windows 10/11)
|
||||
description: Provisioning packages can be applied to a device during the first-run experience (OOBE) and after ("runtime").
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -8,8 +8,7 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 08/22/2017
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
@ -19,19 +18,16 @@ manager: dansimp
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 11
|
||||
|
||||
Provisioning packages can be applied to a device during the first-run experience (out-of-box experience or "OOBE") and after ("runtime").
|
||||
Provisioning packages can be applied to client devices during the first-run experience (out-of-box experience or "OOBE") and after ("runtime").
|
||||
|
||||
>[!NOTE]
|
||||
>Applying a provisioning package to a desktop device requires administrator privileges on the device.
|
||||
>
|
||||
> - Applying a provisioning package to a desktop device requires administrator privileges on the device.
|
||||
> - You can interrupt a long-running provisioning process by pressing ESC.
|
||||
|
||||
## Desktop editions
|
||||
|
||||
>[!NOTE]
|
||||
>In Windows 10, version 1709, you can interrupt a long-running provisioning process by pressing ESC.
|
||||
|
||||
### During initial setup, from a USB drive
|
||||
## During initial setup, from a USB drive
|
||||
|
||||
1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**.
|
||||
|
||||
@ -41,66 +37,33 @@ Provisioning packages can be applied to a device during the first-run experience
|
||||
|
||||
|
||||
|
||||
3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**.
|
||||
3. The next screen asks you to select a provisioning source. Select **Removable Media** and select **Next**.
|
||||
|
||||
|
||||
|
||||
4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**.
|
||||
|
||||
4. Select the provisioning package (`.ppkg`) that you want to apply, and select **Next**.
|
||||
|
||||
|
||||
|
||||
5. Select **Yes, add it**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### After setup, from a USB drive, network folder, or SharePoint site
|
||||
## After setup, from a USB drive, network folder, or SharePoint site
|
||||
|
||||
Insert the USB drive to a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. For a provisioning package stored on a network folder or on a SharePoint site, navigate to the provisioning package and double-click it to begin installation.
|
||||
|
||||
|
||||
|
||||
## Mobile editions
|
||||
|
||||
### Using removable media
|
||||
## Related articles
|
||||
|
||||
1. Insert an SD card containing the provisioning package into the device.
|
||||
2. Navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install.
|
||||
|
||||
|
||||
|
||||
3. Click **Add**.
|
||||
|
||||
4. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**.
|
||||
|
||||
|
||||
|
||||
### Copying the provisioning package to the device
|
||||
|
||||
1. Connect the device to your PC through USB.
|
||||
|
||||
2. On the PC, select the provisioning package that you want to use to provision the device and then drag and drop the file to your device.
|
||||
|
||||
3. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Configuration Designer command-line interface (Windows 10)
|
||||
description:
|
||||
title: Windows Configuration Designer command-line interface (Windows 10/11)
|
||||
description: Learn more about the ICD syntax, switches, and arguments that you can use in the Windows Configuration Designer command-line interface for Windows10/11 client devices.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -8,8 +8,7 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/27/2017
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
@ -19,11 +18,11 @@ manager: dansimp
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 11
|
||||
|
||||
You can use the Windows Configuration Designer command-line interface (CLI) to automate the building of provisioning packages.
|
||||
|
||||
- IT pros can use the Windows Configuration Designer CLI to require less re-tooling of existing processes. You must run the Windows Configuration Designer CLI from a command window with administrator privileges.
|
||||
- IT pros can use the Windows Configuration Designer CLI to require less retooling of existing processes. You must run the Windows Configuration Designer CLI from a command window with administrator privileges.
|
||||
|
||||
- You must use the Windows Configuration Designer CLI and edit the customizations.xml sources to create a provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows Configuration Designer CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
|
||||
|
||||
@ -31,7 +30,7 @@ You can use the Windows Configuration Designer command-line interface (CLI) to a
|
||||
|
||||
## Syntax
|
||||
|
||||
```
|
||||
``` cmd
|
||||
icd.exe /Build-ProvisioningPackage /CustomizationXML:<path_to_xml> /PackagePath:<path_to_ppkg>
|
||||
[/StoreFile:<path_to_storefile>] [/MSPackageRoot:<path_to_mspackage_directory>] [/OEMInputXML:<path_to_xml>]
|
||||
[/ProductName:<product_name>] [/Variables:<name>:<value>] [[+|-]Encrypted] [[+|-]Overwrite] [/?]
|
||||
@ -45,28 +44,20 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML:<path_to_xml> /PackagePath:
|
||||
| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package will be saved. |
|
||||
| /StoreFile | No</br></br></br>See Important note. | For partners using a settings store other than the default store(s) used by Windows Configuration Designer, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions will be loaded by Windows Configuration Designer.</br></br></br>**Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. |
|
||||
| /Variables | No | Specifies a semicolon separated `<name>` and `<value>` macro pair. The format for the argument must be `<name>=<value>`. |
|
||||
| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer auto-generates the decryption password and includes this information in the output.</br></br></br>Precede with + for encryption or - for no encryption. The default is no encryption. |
|
||||
| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer autogenerates the decryption password and includes this information in the output.</br></br></br>Precede with `+` for encryption, or `-` for no encryption. The default is no encryption. |
|
||||
| Overwrite | No | Denotes whether to overwrite an existing provisioning package.</br></br></br>Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). |
|
||||
| /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. |
|
||||
|
||||
## Related articles
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Create a provisioning package (Windows 10)
|
||||
description: Learn how to create a provisioning package for Windows 10, which lets you quickly configure a device without having to install a new image.
|
||||
title: Create a provisioning package (Windows 10/11)
|
||||
description: Learn how to create a provisioning package for Windows 10/11, which lets you quickly configure a device without having to install a new image.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -8,20 +8,19 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/27/2017
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Create a provisioning package for Windows 10
|
||||
# Create a provisioning package
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 11
|
||||
|
||||
You can use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings, and then apply the provisioning package to a device running Windows 10 or Windows 10 Mobile.
|
||||
You can use Windows Configuration Designer to create a provisioning package (`.ppkg`) that contains customization settings, and then apply the provisioning package to a device running Windows client.
|
||||
|
||||
>[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md)
|
||||
|
||||
@ -30,26 +29,20 @@ You can use Windows Configuration Designer to create a provisioning package (.pp
|
||||
|
||||
## Start a new project
|
||||
|
||||
1. Open Windows Configuration Designer:
|
||||
- From either the Start screen or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut.
|
||||
|
||||
or
|
||||
|
||||
- If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then select **ICD.exe**.
|
||||
1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut.
|
||||
|
||||
2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image:
|
||||
|
||||
|
||||
|
||||
- The following wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices:
|
||||
- The following wizard options provide a simple interface for configuring common settings for desktop and kiosk devices:
|
||||
|
||||
- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
|
||||
- [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md)
|
||||
- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard)
|
||||
- [Instructions for HoloLens wizard](/hololens/hololens-provisioning)
|
||||
- [Instructions for Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub)
|
||||
|
||||
Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards).
|
||||
|
||||
Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards).
|
||||
|
||||
- The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.)
|
||||
|
||||
@ -63,47 +56,55 @@ You can use Windows Configuration Designer to create a provisioning package (.pp
|
||||
4. Select the settings you want to configure, based on the type of device, and then select **Next**. The following table describes the options.
|
||||
|
||||
|
||||
| Windows edition | Settings available for customization | Provisioning package can apply to |
|
||||
|-----------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
|
||||
| All Windows editions | Common settings | All Windows 10 devices |
|
||||
| All Windows desktop editions | Common settings and settings specific to desktop devices | All Windows 10 desktop editions (Home, Pro, Enterprise, Pro Education, Enterprise Education) |
|
||||
| All Windows mobile editions | Common settings and settings specific to mobile devices | All Windows 10 Mobile devices |
|
||||
| Windows 10 IoT Core | Common settings and settings specific to Windows 10 IoT Core | All Windows 10 IoT Core devices |
|
||||
| Windows 10 Holographic | Common settings and settings specific to Windows 10 Holographic | [Microsoft HoloLens](/hololens/hololens-provisioning) |
|
||||
| Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](/surface-hub/provisioning-packages-for-surface-hub) |
|
||||
| Windows edition | Settings available for customization | Provisioning package can apply to |
|
||||
|---|---|---|
|
||||
| All Windows editions | Common settings | All Windows client devices |
|
||||
| All Windows desktop editions | Common settings and settings specific to desktop devices | All Windows client desktop editions (Home, Pro, Enterprise, Pro Education, Enterprise Education) |
|
||||
| Windows 10 IoT Core | Common settings and settings specific to Windows 10 IoT Core | All Windows 10 IoT Core devices |
|
||||
| Windows 10 Holographic | Common settings and settings specific to Windows 10 Holographic | [Microsoft HoloLens](/hololens/hololens-provisioning) |
|
||||
| Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](/surface-hub/provisioning-packages-for-surface-hub) |
|
||||
|
||||
|
||||
5. On the **Import a provisioning package (optional)** page, you can select **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then select **Finish**.
|
||||
|
||||
>[!TIP]
|
||||
>**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages that you create so you don't have to reconfigure those common settings repeatedly.
|
||||
>[!TIP]
|
||||
>**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that includes the settings for your organization's network. Then, import that package into other packages that you create so you don't have to reconfigure those common settings repeatedly.
|
||||
|
||||
6. In the **Available customizations** pane, you can now configure settings for the package.
|
||||
|
||||
|
||||
|
||||
|
||||
## Configure settings
|
||||
|
||||
For an advanced provisioning project, Windows Configuration Designer opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings.
|
||||
|
||||
|
||||
|
||||
The settings in Windows Configuration Designer are based on Windows 10 configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md).
|
||||
The settings in Windows Configuration Designer are based on Windows client configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md).
|
||||
|
||||
The process for configuring settings is similar for all settings. The following table shows an example.
|
||||
|
||||
<table>
|
||||
<tr><td><img src="../images/one.png" alt="step one"/></br>Expand a category.</td><td><img src="../images/icd-step1.png" alt="Expand Certificates category"/></td></tr>
|
||||
<tr><td><img src="../images/two.png" alt="step two"/></br>Select a setting.</td><td><img src="../images/icd-step2.png" alt="Select ClientCertificates"/></td></tr>
|
||||
<tr><td><img src="../images/three.png" alt="step three"/></br>Enter a value for the setting. Select <strong>Add</strong> if the button is displayed.</td><td><img src="../images/icd-step3.png" alt="Enter a name for the certificate"/></td></tr>
|
||||
<tr><td><img src="../images/four.png" alt="step four"/></br>Some settings, such as this example, require additional information. In <strong>Available customizations</strong>, select the value you just created, and additional settings are displayed.</td><td><img src="../images/icd-step4.png" alt="Additional settings for client certificate"/></td></tr>
|
||||
<tr><td><img src="../images/five.png" alt="step five"/></br>When the setting is configured, it is displayed in the <strong>Selected customizations</strong> pane.</td><td><img src="../images/icd-step5.png" alt="Selected customizations pane"/></td></tr>
|
||||
</table>
|
||||
1. Expand a category:
|
||||
|
||||
For details on each specific setting, see [Windows Provisioning settings reference](../wcd/wcd.md). The reference topic for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image.
|
||||
:::image type="content" source="../images/icd-step1.png" alt-text="In Windows Configuration Designer, expand the Certificates category.":::
|
||||
|
||||
|
||||
2. Select a setting:
|
||||
|
||||
:::image type="content" source="../images/icd-step2.png" alt-text="In Windows Configuration Designer, select ClientCertificates.":::
|
||||
|
||||
3. Enter a value for the setting. Select **Add** if the button is displayed:
|
||||
|
||||
:::image type="content" source="../images/icd-step3.png" alt-text="In Windows Configuration Designer, enter a name for the certificate.":::
|
||||
|
||||
4. Some settings, such as this example, require additional information. In **Available customizations**, select the value you just created, and more settings are displayed:
|
||||
|
||||
:::image type="content" source="../images/icd-step4.png" alt-text="In Windows Configuration Designer, additional settings for client certificate are available.":::
|
||||
|
||||
5. When the setting is configured, it is displayed in the **Selected customizations** pane:
|
||||
|
||||
:::image type="content" source="../images/icd-step5.png" alt-text="In Windows Configuration Designer, the selected customizations pane shows your settings.":::
|
||||
|
||||
For details on each specific setting, see [Windows Provisioning settings reference](../wcd/wcd.md). The reference article for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image.
|
||||
|
||||
|
||||
|
||||
|
||||
## Build package
|
||||
@ -120,7 +121,7 @@ For details on each specific setting, see [Windows Provisioning settings referen
|
||||
|
||||
3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional:
|
||||
|
||||
- **Encrypt package** - If you select this option, an auto-generated password will be shown on the screen.
|
||||
- **Encrypt package** - If you select this option, an autogenerated password will be shown on the screen.
|
||||
- **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package.
|
||||
|
||||
>[!NOTE]
|
||||
@ -148,19 +149,17 @@ For details on each specific setting, see [Windows Provisioning settings referen
|
||||
|
||||
- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
||||
|
||||
- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
|
||||
|
||||
- [How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Endpoint Configuration Manager](/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm)
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: How provisioning works in Windows
|
||||
description: A provisioning package (.ppkg) is a container for a collection of configuration settings.
|
||||
title: How provisioning works in Windows 10/11
|
||||
description: Learn more about how provisioning package work on Windows client devices. A provisioning package (.ppkg) is a container for a collection of configuration settings.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -8,8 +8,7 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/03/2021
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
@ -21,11 +20,11 @@ manager: dansimp
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Provisioning packages in Windows 10 provide IT administrators with a simplified way to apply configuration settings to Windows 10 and 11 devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from <!-- the [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) or through the --> Microsoft Store.
|
||||
Provisioning packages in Windows client provide IT administrators with a simplified way to apply configuration settings to Windows client devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from <!-- the [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) or through the --> Microsoft Store.
|
||||
|
||||
## Provisioning packages
|
||||
|
||||
A provisioning package contains specific configurations/settings and assets that can be provided through a removable media or simply downloaded to the device.
|
||||
A provisioning package contains specific configurations/settings and assets that can be provided through a removable media or downloaded to the device.
|
||||
|
||||
To enable adding multiple sets of settings or configurations, the configuration data used by the provisioning engine is built out of multiple configuration sources that consist of separate provisioning packages. Each provisioning package contains the provisioning data from a different source.
|
||||
|
||||
@ -69,7 +68,7 @@ When the provisioning engine selects a configuration, the Windows provisioning X
|
||||
|
||||
## Provisioning engine
|
||||
|
||||
The provisioning engine is the core component for managing provisioning and configuration at runtime in a device running Windows 10 or 11.
|
||||
The provisioning engine is the core component for managing provisioning and configuration at runtime in a device running Windows 10/11.
|
||||
|
||||
The provisioning engine provides the following functionality:
|
||||
|
||||
@ -82,7 +81,7 @@ The provisioning engine provides the following functionality:
|
||||
|
||||
## Configuration manager
|
||||
|
||||
The configuration manager provides the unified way of managing Windows 10 and 11 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to [Configuration Service Providers (CSPs)](/windows/client-management/mdm/configuration-service-provider-reference) to perform the specific management requests and settings.
|
||||
The configuration manager provides the unified way of managing Windows 10/11 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to [Configuration Service Providers (CSPs)](/windows/client-management/mdm/configuration-service-provider-reference) to perform the specific management requests and settings.
|
||||
|
||||
The provisioning engine relies on configuration manager for all of the actual processing and application of a chosen configuration. The provisioning engine determines the stage of provisioning and, based on a set of keys, determines the set of configuration to send to the configuration manager. The configuration manager in turn parses and calls into the CSPs for the setting to be applied.
|
||||
|
||||
@ -110,14 +109,6 @@ When a trigger occurs, provisioning is initiated for a particular provisioning s
|
||||
- **Update**: Runs after an update to apply potential updated settings changes.
|
||||
- **User**: runs during a user account first run to configure per-user settings.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Device provisioning during OOBE
|
||||
|
||||
The provisioning engine always applies provisioning packages persisted in the `C:\Recovery\Customizations` folder on the OS partition. When the provisioning engine applies provisioning packages in the `%ProgramData%\Microsoft\Provisioning` folder, certain runtime setting applications, such as the setting to install and configure Windows apps, may be extended past the OOBE pass and continually be processed in the background when the device gets to the desktop. Settings for configuring policies and certain crucial system configurations are always be completed before the first point at which they must take effect.
|
||||
@ -129,8 +120,8 @@ The following table shows how device provisioning can be initiated when a user f
|
||||
|
||||
| Package delivery | Initiation method | Supported device |
|
||||
| --- | --- | --- |
|
||||
| Removable media - USB drive or SD card</br> (Packages must be placed at media root) | 5 fast taps on the Windows key to launch the provisioning UI |All Windows devices |
|
||||
| From an administrator device through machine-to-machine NFC or NFC tag</br>(The administrator device must run an app that can transfer the package over NFC) | 5 fast taps on the Windows key to launch the provisioning UI | Windows <!-- 10 Mobile devices and -->IoT Core devices |
|
||||
| Removable media - USB drive or SD card</br> (Packages must be placed at media root) | Five fast taps on the Windows key to launch the provisioning UI |All Windows devices |
|
||||
| From an administrator device through machine-to-machine NFC or NFC tag</br>(The administrator device must run an app that can transfer the package over NFC) | Five fast taps on the Windows key to launch the provisioning UI | Windows IoT Core devices |
|
||||
|
||||
The provisioning engine always copies the acquired provisioning packages to the `%ProgramData%\Microsoft\Provisioning` folder before processing them during OOBE. The provisioning engine always applies provisioning packages embedded in the installed Windows image during Windows Setup OOBE pass regardless of whether the package is signed and trusted. When the provisioning engine applies an encrypted provisioning package on an end-user device during OOBE, users must first provide a valid password to decrypt the package. The provisioning engine also checks whether a provisioning package is signed and trusted; if it's not, the user must provide consent before the package is applied to the device.
|
||||
|
||||
@ -143,8 +134,8 @@ At device runtime, stand-alone provisioning packages can be applied by user init
|
||||
| Package delivery | Initiation method | Supported device |
|
||||
| --- | --- | --- |
|
||||
| Removable media - USB drive or SD card</br>(Packages must be placed at media root) | **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** | All Windows devices |
|
||||
| Downloaded from a network connection and copied to a local folder | Double-click the package file | Windows 10 for desktop editions devices |
|
||||
| From an administrator device connected to the target device through USB tethering | Drag and drop the package file onto the target device | Windows <!--10 Mobile devices and -->IoT Core devices |
|
||||
| Downloaded from a network connection and copied to a local folder | Double-click the package file | Windows client for desktop editions devices |
|
||||
| From an administrator device connected to the target device through USB tethering | Drag and drop the package file onto the target device | Windows IoT Core devices |
|
||||
|
||||
When applying provisioning packages from a removable media attached to the device, the Settings UI allows viewing contents of a package before selecting the package for provisioning. To minimize the risk of the device being spammed by applying provisioning packages from unknown sources, a provisioning package can be signed and encrypted. Partners can also set policies to limit the application of provisioning packages at device runtime. Applying provisioning packages at device runtime requires administrator privilege. If the package is not signed or trusted, a user must provide consent before the package is applied to the device. If the package is encrypted, a valid password is needed to decrypt the package before it can be applied to the device.
|
||||
|
||||
@ -157,25 +148,16 @@ After a stand-alone provisioning package is applied to the device, the package i
|
||||
|
||||
- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
||||
|
||||
<!-- - Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) -->
|
||||
|
||||
## Related articles
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Install Windows Configuration Designer (Windows 10)
|
||||
description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10.
|
||||
title: Install Windows Configuration Designer (Windows 10/11)
|
||||
description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10/11.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -8,30 +8,35 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/16/2017
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Install Windows Configuration Designer
|
||||
# Install Windows Configuration Designer, and learn about any limitations
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows 10. Windows Configuration Designer is primarily designed for use by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices.
|
||||
Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows client. Windows Configuration Designer is primarily used by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices.
|
||||
|
||||
## Supported platforms
|
||||
|
||||
Windows Configuration Designer can create provisioning packages for Windows 10 desktop and mobile editions, including Windows 10 IoT Core, as well as Microsoft Surface Hub and Microsoft HoloLens. You can run Windows Configuration Designer on the following operating systems:
|
||||
Windows Configuration Designer can create provisioning packages for Windows client desktop, including Windows IoT Core, Microsoft Surface Hub, and Microsoft HoloLens. You can run Windows Configuration Designer on the following operating systems:
|
||||
|
||||
**Client OS**:
|
||||
|
||||
- Windows 11
|
||||
- Windows 10 - x86 and amd64
|
||||
- Windows 8.1 Update - x86 and amd64
|
||||
- Windows 8.1 - x86 and amd64
|
||||
- Windows 8 - x86 and amd64
|
||||
- Windows 7 - x86 and amd64
|
||||
|
||||
**Server OS**:
|
||||
|
||||
- Windows Server 2016
|
||||
- Windows Server 2012 R2 Update
|
||||
- Windows Server 2012 R2
|
||||
@ -39,54 +44,38 @@ Windows Configuration Designer can create provisioning packages for Windows 10 d
|
||||
- Windows Server 2008 R2
|
||||
|
||||
>[!WARNING]
|
||||
>You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.
|
||||
>You must run Windows Configuration Designer on Windows client to configure Azure Active Directory enrollment using any of the wizards.
|
||||
|
||||
## Install Windows Configuration Designer
|
||||
|
||||
On devices running Windows 10, you can install [the Windows Configuration Designer app from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). To run Windows Configuration Designer on other operating systems or in languages other than English, install it from the [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit).
|
||||
|
||||
>[!NOTE]
|
||||
>If you install Windows Configuration Designer from both the ADK and Microsoft Store, the Store app will not open.
|
||||
>
|
||||
>The Windows Configuration Designer App from Microsoft Store currently supports only English. For a localized version of the Windows Configuration Designer, install it from the Windows ADK.
|
||||
|
||||
1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) and select **Get Windows ADK** for the version of Windows 10 that you want to create provisioning packages for (version 1511, 1607, or 1703).
|
||||
|
||||
>[!NOTE]
|
||||
>The rest of this procedure uses Windows ADK for Windows 10, version 1703 as an example.
|
||||
|
||||
2. Save **adksetup.exe** and then run it.
|
||||
|
||||
3. On the **Specify Location** page, select an installation path and then click **Next**.
|
||||
>[!NOTE]
|
||||
>The estimated disk space listed on this page applies to the full Windows ADK. If you only install Windows Configuration Designer, the space requirement is approximately 32 MB.
|
||||
4. Make a selection on the **Windows Kits Privacy** page, and then click **Next**.
|
||||
|
||||
5. Accept the **License Agreement**, and then click **Next**.
|
||||
|
||||
6. On the **Select the features you want to install** page, clear all selections except **Configuration Designer**, and then click **Install**.
|
||||
|
||||
|
||||
On devices running Windows client, you can install [the Windows Configuration Designer app](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store.
|
||||
|
||||
## Current Windows Configuration Designer limitations
|
||||
|
||||
- Windows Configuration Designer will not work properly if the Group Policy setting **Policies > Administrative Templates > Windows Components > Internet Explorer > Security Zones: Use only machine settings** is enabled. We recommend that you run Windows Configuration Designer on a different device, rather than change the security setting.
|
||||
- Windows Configuration Designer doesn't work properly if the **Policies > Administrative Templates > Windows Components > Internet Explorer > Security Zones: Use only machine settings** Group Policy setting is enabled. Instead of changing the security setting, we recommend you run Windows Configuration Designer on a different device.
|
||||
|
||||
- You can only run one instance of Windows Configuration Designer on your computer at a time.
|
||||
|
||||
- Be aware that when adding apps and drivers, all files stored in the same folder will be imported and may cause errors during the build process.
|
||||
- When adding apps and drivers, all files stored in the same folder are imported, and may cause errors during the build process.
|
||||
|
||||
- The Windows Configuration Designer UI does not support multivariant configurations. Instead, you must use the Windows Configuration Designer command-line interface to configure multivariant settings. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
|
||||
- The Windows Configuration Designer UI doesn't support multivariant configurations. Instead, you must use the Windows Configuration Designer command-line interface to configure multivariant settings. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
|
||||
|
||||
- While you can open multiple projects at the same time within Windows Configuration Designer, you can only build one project at a time.
|
||||
- In Windows Configuration Designer, you can only build one project at a time. You can open multiple projects at the same time, but you can only build one at a time.
|
||||
|
||||
- In order to enable the simplified authoring jscripts to work on a server SKU running Windows Configuration Designer, you need to explicitly enable **Allow websites to prompt for information using scripted windows**. Do this by opening Internet Explorer and then navigating to **Settings** > **Internet Options** > **Security** -> **Custom level** > **Allow websites to prompt for information using scripted windows**, and then choose **Enable**.
|
||||
- To enable the simplified authoring jscripts to work on a server SKU running Windows Configuration Designer, you must enable **Allow websites to prompt for information using scripted windows**:
|
||||
|
||||
- If you copy a Windows Configuration Designer project from one PC to another PC, make sure that all the associated files for the deployment assets, such as apps and drivers, are copied along with the project to the same path as it was on the original PC.
|
||||
1. Open Internet Explorer.
|
||||
2. Go to **Settings** > **Internet Options** > **Security** > **Custom level**.
|
||||
3. Select **Allow websites to prompt for information using scripted windows** > **Enable**.
|
||||
|
||||
For example, when you add a driver to a provisioned package, you must copy the .INF file to a local directory on the PC that is running Windows Configuration Designer. If you don't do this, and attempt to use a copied version of this project on a different PC, Windows Configuration Designer might attempt to resolve the path to the files that point to the original PC.
|
||||
|
||||
- **Recommended**: Before starting, copy all source files to the PC running Windows Configuration Designer, rather than using external sources like network shares or removable drives. This reduces the risk of interrupting the build process from a temporary network issue or from disconnecting the USB device.
|
||||
- If you copy a Windows Configuration Designer project from one PC to another PC, then:
|
||||
|
||||
- Copy all the associated files for the deployment assets with the project, including apps and drivers.
|
||||
- Copy all the files to the same path as the original PC.
|
||||
|
||||
For example, when you add a driver to a provisioned package, you must copy the `.INF` file to a local directory on the PC that's running Windows Configuration Designer. If you don't copy the `.INF` file, and use a copied version of this project on a different PC, then Windows Configuration Designer might resolve the file paths to the original PC.
|
||||
|
||||
- **Recommended**: Before starting, copy all source files to the PC running Windows Configuration Designer. Don't use external sources, like network shares or removable drives. Using local files reduces the risk of interrupting the build process from a network issue, or from disconnecting the USB device.
|
||||
|
||||
**Next step**: [How to create a provisioning package](provisioning-create-package.md)
|
||||
|
||||
@ -94,27 +83,15 @@ On devices running Windows 10, you can install [the Windows Configuration Design
|
||||
|
||||
- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
||||
|
||||
- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
|
||||
## Related articles
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Create a provisioning package with multivariant settings (Windows 10)
|
||||
title: Create a provisioning package with multivariant settings (Windows 10/11)
|
||||
description: Create a provisioning package with multivariant settings to customize the provisioned settings for defined conditions.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -7,8 +7,7 @@ ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 11/08/2017
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
ms.author: greglin
|
||||
---
|
||||
@ -19,7 +18,7 @@ ms.author: greglin
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 11
|
||||
|
||||
|
||||
In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that will apply to devices set up for French and a different set of customization settings for devices set up for Japanese.
|
||||
@ -37,38 +36,43 @@ A **Target** can have more than one **TargetState**, and a **TargetState** can h
|
||||
|
||||
|
||||
|
||||
The following table describes the logic for the target definition.
|
||||
The following information describes the logic for the target definition:
|
||||
|
||||
<table><tr><td>When all <strong>Condition</strong> elements are TRUE, <strong>TargetState</strong> is TRUE.</td><td><img src="../images/icd-multi-targetstate-true.png" alt="Target state is true when all conditions are true"/></td></tr>
|
||||
<tr><td>If any of the <strong>TargetState</strong> elements is TRUE, <strong>Target</strong> is TRUE, and the <strong>Id</strong> can be used for setting customizations.</td><td><img src="../images/icd-multi-target-true.png" alt="Target is true if any target state is true"/></td></tr></table>
|
||||
- When all **Condition** elements are TRUE, **TargetState** is TRUE:
|
||||
|
||||
:::image type="content" source="../images/icd-multi-targetstate-true.png" alt-text="Target state is true when all conditions are true.":::
|
||||
|
||||
- If any of the **TargetState** elements is TRUE, **Target** is TRUE, and the **ID** can be used for setting customizations:
|
||||
|
||||
:::image type="content" source="../images/icd-multi-target-true.png" alt-text="Target is true if any target state is true":::
|
||||
|
||||
### Conditions
|
||||
|
||||
The following table shows the conditions supported in Windows 10 provisioning for a **TargetState**:
|
||||
The following table shows the conditions supported in Windows client provisioning for a **TargetState**:
|
||||
|
||||
|
||||
| Condition Name | Condition priority | Windows 10 Mobile | Windows 10 for desktop editions | Value type | Value description |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| MNC | P0 | Supported | Supported | Digit string | Use to target settings based on the Mobile Network Code (MNC) value. |
|
||||
| MCC | P0 | Supported | Supported | Digit string | Use to target settings based on the Mobile Country Code (MCC) value. |
|
||||
| SPN | P0 | Supported | Supported | String | Use to target settings based on the Service Provider Name (SPN) value. |
|
||||
| PNN | P0 | Supported | Supported | String | Use to target settings based on public land mobile network (PLMN) Network Name value. |
|
||||
| GID1 | P0 | Supported | Supported | Digit string | Use to target settings based on the Group Identifier (level 1) value. |
|
||||
| ICCID | P0 | Supported | Supported | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. |
|
||||
| Roaming | P0 | Supported | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (non-roaming). |
|
||||
| UICC | P0 | Supported | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of the following:</br></br></br>- 0 - Empty</br>- 1 - Ready</br>- 2 - Locked |
|
||||
| UICCSLOT | P0 | Supported | N/A | Digit string | Use to specify the UICC slot. Set the value one of the following:</br></br></br>- 0 - Slot 0</br>- 1 - Slot 1 |
|
||||
| ProcessorType | P1 | Supported | Supported | String | Use to target settings based on the processor type. |
|
||||
| ProcessorName | P1 | Supported | Supported | String | Use to target settings based on the processor name. |
|
||||
| AoAc ("Always On, Always Connected") | P1 | Supported | Supported | Boolean | Set the value to **0** (false) or **1** (true). If this condition is TRUE, the system supports the S0 low power idle model. |
|
||||
| PowerPlatformRole | P1 | Supported | Supported | Enumeration | Indicates the preferred power management profile. Set the value based on the [POWER_PLATFORM_ROLE enumeration](/windows/win32/api/winnt/ne-winnt-power_platform_role). |
|
||||
| Architecture | P1 | Supported | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. |
|
||||
| Server | P1 | Supported | Supported | Boolean | Set the value to **0** (false) or **1** (true) to identify a server. |
|
||||
| Region | P1 | Supported | Supported | Enumeration | Use to target settings based on country/region, using the 2-digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). |
|
||||
| Lang | P1 | Supported | Supported | Enumeration | Use to target settings based on language code, using the 2-digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). |
|
||||
| Condition Name | Condition priority | Windows client for desktop editions | Value type | Value description |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| MNC | P0 | Supported | Digit string | Use to target settings based on the Mobile Network Code (MNC) value. |
|
||||
| MCC | P0 | Supported | Digit string | Use to target settings based on the Mobile Country Code (MCC) value. |
|
||||
| SPN | P0 | Supported | String | Use to target settings based on the Service Provider Name (SPN) value. |
|
||||
| PNN | P0 | Supported | String | Use to target settings based on public land mobile network (PLMN) Network Name value. |
|
||||
| GID1 | P0 | Supported | Digit string | Use to target settings based on the Group Identifier (level 1) value. |
|
||||
| ICCID | P0 | Supported | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. |
|
||||
| Roaming | P0 | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (non-roaming). |
|
||||
| UICC | P0 | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of the following:</br></br></br>- 0 - Empty</br>- 1 - Ready</br>- 2 - Locked |
|
||||
| UICCSLOT | P0 | N/A | Digit string | Use to specify the UICC slot. Set the value one of the following:</br></br></br>- 0 - Slot 0</br>- 1 - Slot 1 |
|
||||
| ProcessorType | P1 | Supported | String | Use to target settings based on the processor type. |
|
||||
| ProcessorName | P1 | Supported | String | Use to target settings based on the processor name. |
|
||||
| AoAc ("Always On, Always Connected") | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true). If this condition is TRUE, the system supports the S0 low power idle model. |
|
||||
| PowerPlatformRole | P1 | Supported | Enumeration | Indicates the preferred power management profile. Set the value based on the [POWER_PLATFORM_ROLE enumeration](/windows/win32/api/winnt/ne-winnt-power_platform_role). |
|
||||
| Architecture | P1 | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. |
|
||||
| Server | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true) to identify a server. |
|
||||
| Region | P1 | Supported | Enumeration | Use to target settings based on country/region, using the 2-digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). |
|
||||
| Lang | P1 | Supported | Enumeration | Use to target settings based on language code, using the 2-digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). |
|
||||
|
||||
|
||||
The matching types supported in Windows 10 are:
|
||||
The matching types supported in Windows client are:
|
||||
|
||||
| Matching type | Syntax | Example |
|
||||
| --- | --- | --- |
|
||||
@ -79,7 +83,7 @@ The matching types supported in Windows 10 are:
|
||||
|
||||
### TargetState priorities
|
||||
|
||||
You can define more than one **TargetState** within a provisioning package to apply settings to devices that match device conditions. When the provisioning engine evalues each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the settings are applied, the system assigns a priority to every **TargetState**.
|
||||
You can define more than one **TargetState** within a provisioning package to apply settings to devices that match device conditions. When the provisioning engine evaluates each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the settings are applied, the system assigns a priority to every **TargetState**.
|
||||
|
||||
A setting that matches a **TargetState** with a lower priority is applied before the setting that matches a **TargetState** with a higher priority. This means that a setting for the **TargetState** with the higher priority can overwrite a setting for the **TargetState** with the lower priority.
|
||||
|
||||
@ -281,38 +285,29 @@ In this example, the **StoreFile** corresponds to the location of the settings s
|
||||
|
||||
## Events that trigger provisioning
|
||||
|
||||
When you install the multivariant provisioning package on a Windows 10 device, the provisioning engine applies the matching condition settings at every event and triggers provisioning.
|
||||
When you install the multivariant provisioning package on a Windows client device, the provisioning engine applies the matching condition settings at every event and triggers provisioning.
|
||||
|
||||
The following events trigger provisioning on Windows 10 devices:
|
||||
The following events trigger provisioning on Windows client devices:
|
||||
|
||||
| Event | Windows 10 Mobile | Windows 10 for desktop editions |
|
||||
| --- | --- | --- |
|
||||
| System boot | Supported | Supported |
|
||||
| Operating system update | Supported | Planned |
|
||||
| Package installation during device first run experience | Supported | Supported |
|
||||
| Detection of SIM presence or update | Supported | Supported |
|
||||
| Package installation at runtime | Supported | Supported |
|
||||
| Roaming detected | Supported | Not supported |
|
||||
| Event | Windows client for desktop editions |
|
||||
| --- | --- |
|
||||
| System boot | Supported |
|
||||
| Operating system update | Planned |
|
||||
| Package installation during device first run experience | Supported |
|
||||
| Detection of SIM presence or update | Supported |
|
||||
| Package installation at runtime | Supported |
|
||||
| Roaming detected | Not supported |
|
||||
|
||||
## Related articles
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Provisioning packages (Windows)
|
||||
description: With Windows 10 and Windows 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
|
||||
title: Provisioning packages overview on Windows 10/11
|
||||
description: With Windows 10 and Windows 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages, are and what they do.
|
||||
ms.assetid: 287706E5-063F-4AB5-902C-A0DF6D0730BC
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -11,7 +11,7 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/07/2021
|
||||
|
||||
---
|
||||
|
||||
# Provisioning packages for Windows
|
||||
@ -24,9 +24,9 @@ ms.date: 09/07/2021
|
||||
|
||||
Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers.
|
||||
|
||||
A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows 10 and 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
|
||||
A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows client, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
|
||||
|
||||
Provisioning packages are simple enough that with a short set of written instructions, a student or non-technical employee can use them to configure their device. This can result in a significant reduction in the time required to configure multiple devices in your organization.
|
||||
Provisioning packages are simple enough that with a short set of written instructions, a student, or non-technical employee can use them to configure their device. This can result in a significant reduction in the time required to configure multiple devices in your organization.
|
||||
|
||||
<!-- The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Windows Configuration Designer, a tool for configuring provisioning packages.-->
|
||||
Windows Configuration Designer is available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22).
|
||||
@ -75,17 +75,18 @@ Provisioning packages can be:
|
||||
|
||||
The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages.
|
||||
|
||||
| Step | Description | Desktop wizard | Kiosk wizard | HoloLens wizard |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| Set up device | Assign device name, enter product key to upgrade Windows, configure shared used, remove pre-installed software | ✔️ | ✔️ | ✔️ |
|
||||
| Set up network | Connect to a Wi-Fi network | ✔️ | ✔️ | ✔️ |
|
||||
| Account management | Enroll device in Active Directory, enroll device in Azure Active Directory, or create a local administrator account | ✔️ | ✔️ | ✔️ |
|
||||
| Bulk Enrollment in Azure AD | Enroll device in Azure Active Directory</br></br>Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). | ❌ | ❌ | ❌ |
|
||||
| Add applications | Install applications using the provisioning package. | ✔️ | ✔️ | ❌ |
|
||||
| Add certificates | Include a certificate file in the provisioning package. | ✔️ | ✔️ | ✔️ |
|
||||
| Configure kiosk account and app | Create local account to run the kiosk mode app, specify the app to run in kiosk mode | ❌ | ✔️ | ❌ |
|
||||
| Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | ✔️ | ❌ |
|
||||
| Developer Setup | Enable Developer Mode | ❌ | ❌ | ✔️ |
|
||||
|
||||
<table><tr><td align="left"><strong>Step</strong></td><td align="left"><strong>Description</strong></td><td><strong>Desktop wizard</strong></td><td><strong>Kiosk wizard</strong></td><td><strong>HoloLens wizard</strong></td></tr>
|
||||
<tr><td valign="top">Set up device</td><td valign="top">Assign device name,</br>enter product key to upgrade Windows,</br>configure shared used,</br>remove pre-installed software</td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td></tr>
|
||||
<tr><td valign="top">Set up network</td><td valign="top">Connect to a Wi-Fi network</td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td></tr>
|
||||
<tr><td valign="top">Account management</td><td valign="top">Enroll device in Active Directory,</br>enroll device in Azure Active Directory,</br>or create a local administrator account</td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="no1"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td></tr>
|
||||
<tr><td valign="top">Bulk Enrollment in Azure AD</td><td valign="top">Enroll device in Azure Active Directory</br></br>Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, <a href="/azure/active-directory/active-directory-azureadjoin-setup" data-raw-source="[set up Azure AD join in your organization](/azure/active-directory/active-directory-azureadjoin-setup)">set up Azure AD join in your organization</a>.</td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no5"/></td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no4"/></td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no2"/></td></tr>
|
||||
<tr><td valign="top">Add applications</td><td valign="top">Install applications using the provisioning package.</td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no3"/></td></tr>
|
||||
<tr><td valign="top">Add certificates</td><td valign="top">Include a certificate file in the provisioning package.</td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td></tr>
|
||||
<tr><td valign="top">Configure kiosk account and app</td><td valign="top">Create local account to run the kiosk mode app,</br>specify the app to run in kiosk mode</td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no6"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no7"/></td></tr>
|
||||
<tr><td valign="top">Configure kiosk common settings</td><td valign="top">Set tablet mode,</br>configure welcome and shutdown screens,</br>turn off timeout settings</td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no8"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no9"/></td></tr>
|
||||
<tr><td valign="top">Developer Setup</td><td valign="top">Enable Developer Mode.</td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no22"/></td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no11"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td></tr></table>
|
||||
|
||||
<!-- <table><tr><td align="left"><strong>Step</strong></td><td align="left"><strong>Description</strong></td><td><strong>Desktop wizard</strong></td><td align="center"><strong>Mobile wizard</strong></td><td><strong>Kiosk wizard</strong></td><td><strong>HoloLens wizard</strong></td></tr> -->
|
||||
<!-- <tr><td valign="top">Set up device</td><td valign="top">Assign device name,</br>enter product key to upgrade Windows,</br>configure shared used,</br>remove pre-installed software</td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></br>(Only device name and upgrade key)</td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td></tr> -->
|
||||
@ -99,7 +100,6 @@ The following table describes settings that you can configure using the wizards
|
||||
<!-- <tr><td valign="top">Developer Setup</td><td valign="top">Enable Developer Mode.</td><td align="center" valign="top"><img src="../images/crossmark.png" alt="n777o"/></td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no444"/></td><td align="center" valign="top"><img src="../images/crossmark.png" alt="no888"/></td><td align="center" valign="top"><img src="../images/checkmark.png" alt="yes"/></td></tr></table> -->
|
||||
|
||||
- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
|
||||
- [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md)
|
||||
- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard)
|
||||
- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#wizard)
|
||||
|
||||
@ -112,20 +112,17 @@ The following table describes settings that you can configure using the wizards
|
||||
The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages.
|
||||
|
||||
|
||||
| Customization options | Examples |
|
||||
|--------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
|
||||
| Customization options | Examples |
|
||||
|---|---|
|
||||
| Bulk Active Directory join and device name | Join devices to Active Directory domain and assign device names using hardware-specific serial numbers or random characters |
|
||||
| Applications | Windows apps, line-of-business applications |
|
||||
| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service\* |
|
||||
| Certificates | Root certification authority (CA), client certificates |
|
||||
| Connectivity profiles | Wi-Fi, proxy settings, Email |
|
||||
| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings |
|
||||
| Data assets | Documents, music, videos, pictures |
|
||||
| Start menu customization | Start menu layout, application pinning |
|
||||
| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on |
|
||||
|
||||
\* Using a provisioning package for auto-enrollment to Microsoft Endpoint Manager is not supported. Use the Configuration Manager console to enroll devices.
|
||||
|
||||
| Applications | Windows apps, line-of-business applications |
|
||||
| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service <br/><br/>Using a provisioning package for auto-enrollment to Microsoft Endpoint Manager isn't supported. To enroll devices, use the Configuration Manager console. |
|
||||
| Certificates | Root certification authority (CA), client certificates |
|
||||
| Connectivity profiles | Wi-Fi, proxy settings, Email |
|
||||
| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings |
|
||||
| Data assets | Documents, music, videos, pictures |
|
||||
| Start menu customization | Start menu layout, application pinning |
|
||||
| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on |
|
||||
|
||||
For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
|
||||
|
||||
@ -136,7 +133,7 @@ For details about the settings you can customize in provisioning packages, see [
|
||||
|
||||
WCD, simplified common provisioning scenarios.
|
||||
|
||||
|
||||
:::image type="content" source="../images/icd.png" alt-text="Configuration Designer options":::
|
||||
|
||||
WCD supports the following scenarios for IT administrators:
|
||||
|
||||
@ -146,34 +143,31 @@ WCD supports the following scenarios for IT administrators:
|
||||
|
||||
* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use WCD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices.
|
||||
|
||||
* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows devices and enroll them into mobile device management (MDM) before handing them to end-users in the organization. IT administrators can use WCD to specify the management end-point and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include:
|
||||
* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows devices and enroll them into mobile device management (MDM) before handing them to end users in the organization. IT administrators can use WCD to specify the management endpoint and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include:
|
||||
|
||||
* Microsoft Intune (certificate-based enrollment)
|
||||
* AirWatch (password-string based enrollment)
|
||||
* Mobile Iron (password-string based enrollment)
|
||||
* Other MDMs (cert-based enrollment)
|
||||
- Microsoft Intune (certificate-based enrollment)
|
||||
- AirWatch (password-string based enrollment)
|
||||
- MobileIron (password-string based enrollment)
|
||||
- Other MDMs (cert-based enrollment)
|
||||
|
||||
<!-- > [!NOTE] -->
|
||||
<!-- > Windows ICD in Windows 10, version 1607, also provided a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](/education/windows/). -->
|
||||
|
||||
## Learn more
|
||||
|
||||
For more information about provisioning, watch the following videos:
|
||||
For more information about provisioning, watch the following video:
|
||||
|
||||
- [Provisioning Windows 10 devices with new tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
||||
- [Provisioning Windows client devices with new tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
||||
|
||||
- [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
|
||||
## Related articles
|
||||
|
||||
## Related topics
|
||||
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
- [Use Windows Configuration Designer to configure Windows 10 Mobile devices](../mobile-devices/provisioning-configure-mobile.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: PowerShell cmdlets for provisioning Windows 10 (Windows 10)
|
||||
description:
|
||||
title: PowerShell cmdlets for provisioning Windows 10/11 (Windows 10/11)
|
||||
description: Learn more about the Windows PowerShell cmdlets that you can use with Provisioning packages on Windows10/11 client desktop devices.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -8,32 +8,68 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/27/2017
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# PowerShell cmdlets for provisioning Windows 10 (reference)
|
||||
# PowerShell cmdlets for provisioning Windows client (reference)
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 11
|
||||
|
||||
Windows 10, version 1703, ships with Windows Provisioning PowerShell cmdlets. These cmdlets make it easy to script the following functions.
|
||||
Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it easy to script the following functions.
|
||||
|
||||
## cmdlets
|
||||
|
||||
- **Add-ProvisioningPackage**: Applies a provisioning package.
|
||||
|
||||
<table><tr><th>Cmdlet</th><th>Use this cmdlet to</th><th>Syntax</th></tr>
|
||||
<tr><td>Add-ProvisioningPackage</td><td> Apply a provisioning package</td><td><code>Add-ProvisioningPackage [-Path] <string> [-ForceInstall] [-LogsFolder <string>] [-QuietInstall] [-WprpFile <string>] [<CommonParameters>]</code></td></tr>
|
||||
<tr><td rowspan="3">Remove-ProvisioningPackage</td><td rowspan="3">Remove a provisioning package</td><td> <code>Remove-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]</code> </td></tr><tr><td> <code>Remove-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]</code> </td></tr><tr><td> <code>Remove-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]</code> </td></tr>
|
||||
<tr><td rowspan="3">Get-ProvisioningPackage </td><td rowspan="3"> Get information about an installed provisioning package </td><td> <code>Get-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]</code> </td></tr><tr><td><code>Get-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]</code> </td></tr><tr><td> <code>Get-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]</code> </td></tr>
|
||||
<tr><td rowspan="2"> Export-ProvisioningPackage</td><td rowspan="2"> Extract the contents of a provisioning package</td><td> <code>Export-ProvisioningPackage -PackageId <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]</code> </td></tr><tr><td> <code>Export-ProvisioningPackage -Path <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]</code> </td></tr>
|
||||
<tr><td> Install-TrustedProvisioningCertificate </td><td> Adds a certificate to the Trusted Certificate store </td><td><code>Install-TrustedProvisioningCertificate <path to local certificate file on disk></code> </td></tr>
|
||||
<tr><td>Get-TrustedProvisioningCertificate</td><td> List all installed trusted provisioning certificates; use this cmdlet to get the certificate thumbprint to use with the <strong>Uninstall-TrustedProvisioningCertificate</strong> cmdlet</td><td><code>Get-TrustedProvisioningCertificate</code></td></tr>
|
||||
<tr><td>Uninstall-TrustedProvisioningCertificate </td><td> Remove a previously installed provisioning certificate</td><td><code>Uninstall-TrustedProvisioningCertificate <thumbprint></code></td></tr>
|
||||
</table>
|
||||
Syntax:
|
||||
|
||||
- `Add-ProvisioningPackage [-Path] <string> [-ForceInstall] [-LogsFolder <string>] [-QuietInstall] [-WprpFile <string>] [<CommonParameters>]`
|
||||
|
||||
- **Remove-ProvisioningPackage**: Removes a provisioning package.
|
||||
|
||||
Syntax:
|
||||
|
||||
- `Remove-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]`
|
||||
- `Remove-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]`
|
||||
- `Remove-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]`
|
||||
|
||||
- **Get-ProvisioningPackage**: Gets information about an installed provisioning package.
|
||||
|
||||
Syntax:
|
||||
|
||||
- `Get-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]`
|
||||
- `Get-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]`
|
||||
- `Get-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]`
|
||||
|
||||
- **Export-ProvisioningPackage**: Extracts the contents of a provisioning package.
|
||||
|
||||
Syntax:
|
||||
|
||||
- `Export-ProvisioningPackage -PackageId <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]`
|
||||
- `Export-ProvisioningPackage -Path <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]`
|
||||
|
||||
- **Install-TrustedProvisioningCertificate**: Adds a certificate to the Trusted Certificate store.
|
||||
|
||||
Syntax:
|
||||
|
||||
- `Install-TrustedProvisioningCertificate <path to local certificate file on disk>`
|
||||
|
||||
- **Get-TrustedProvisioningCertificate**: Lists all installed trusted provisioning certificates. Use this cmdlet to get the certificate thumbprint to use with the `Uninstall-TrustedProvisioningCertificate` cmdlet.
|
||||
|
||||
Syntax:
|
||||
|
||||
- `Get-TrustedProvisioningCertificate`
|
||||
|
||||
- **Uninstall-TrustedProvisioningCertificate**: Removes a previously installed provisioning certificate.
|
||||
|
||||
Syntax:
|
||||
|
||||
- `Uninstall-TrustedProvisioningCertificate <thumbprint>`
|
||||
|
||||
>[!NOTE]
|
||||
> You can use Get-Help to get usage help on any command. For example: `Get-Help Add-ProvisioningPackage`
|
||||
@ -51,9 +87,9 @@ Trace logs are captured when using cmdlets. The following logs are available in
|
||||
>When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts.
|
||||
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
@ -63,15 +99,3 @@ Trace logs are captured when using cmdlets. The following logs are available in
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Use a script to install a desktop app in provisioning packages (Windows 10)
|
||||
description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
|
||||
title: Use a script to install a desktop app in provisioning packages (Windows 10/11)
|
||||
description: With Windows 10/11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -8,8 +8,7 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/27/2017
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
@ -19,14 +18,9 @@ manager: dansimp
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 11
|
||||
|
||||
This walkthrough describes how to leverage the ability to include scripts in a Windows 10 provisioning package to install Win32 applications. Scripted operations other than installing apps can also be performed, however, some care is needed in order to avoid unintended behavior during script execution (see [Remarks](#remarks) below).
|
||||
|
||||
>**Prerequisite**: [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit), version 1511 or higher
|
||||
|
||||
>[!NOTE]
|
||||
>This scenario is only supported for installing applications on Windows 10 for desktop, version 1511 or higher.
|
||||
This walkthrough describes how to include scripts in a Windows client provisioning package to install Win32 applications. Scripted operations other than installing apps can also be performed. However, some care is needed to avoid unintended behavior during script execution (see [Remarks](#remarks) below).
|
||||
|
||||
## Assemble the application assets
|
||||
|
||||
@ -34,12 +28,11 @@ This walkthrough describes how to leverage the ability to include scripts in a W
|
||||
|
||||
2. If you need to include a directory structure of files, you will need to cab the assets for easy inclusion in the provisioning packages.
|
||||
|
||||
<span id="cab" />
|
||||
## Cab the application assets
|
||||
|
||||
1. Create a .DDF file as below, replacing *file1* and *file2* with the files you want to package, and adding the name of file/directory.
|
||||
1. Create a `.DDF` file as below, replacing *file1* and *file2* with the files you want to package, and adding the name of file/directory.
|
||||
|
||||
```
|
||||
```ddf
|
||||
;*** MSDN Sample Source Code MakeCAB Directive file example
|
||||
|
||||
;
|
||||
@ -89,15 +82,15 @@ This walkthrough describes how to leverage the ability to include scripts in a W
|
||||
|
||||
2. Use makecab to create the cab files.
|
||||
|
||||
```
|
||||
```makecab
|
||||
Makecab -f <path to DDF file>
|
||||
```
|
||||
|
||||
## Create the script to install the application
|
||||
|
||||
In Windows 10, version 1607 and earlier, create a script to perform whatever work is needed to install the application(s). The following examples are provided to help get started authoring the orchestrator script that will execute the required installers. In practice, the orchestrator script may reference many more assets than those in these examples.
|
||||
Create a script to perform whatever work is needed to install the application(s). The following examples are provided to help get started authoring the orchestrator script that will execute the required installers. In practice, the orchestrator script may reference many more assets than those in these examples.
|
||||
|
||||
In Windows 10, version 1703, you don’t need to create an orchestrator script. You can have one command line per app. If necessary, you can create a script that logs the output per app, as mentioned below (rather than one orchestrator script for the entire provisioning package).
|
||||
You don’t need to create an orchestrator script. You can have one command line per app. If necessary, you can create a script that logs the output per app, as mentioned below (rather than one orchestrator script for the entire provisioning package).
|
||||
|
||||
>[!NOTE]
|
||||
>All actions performed by the script must happen silently, showing no UI and requiring no user interaction.
|
||||
@ -108,15 +101,16 @@ In Windows 10, version 1703, you don’t need to create an orchestrator script.
|
||||
|
||||
Granular logging is not built in, so the logging must be built into the script itself. Here is an example script that logs ‘Hello World’ to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you will see in the following examples, it’s recommended that you log each action that your script performs.
|
||||
|
||||
```
|
||||
```log
|
||||
set LOGFILE=%SystemDrive%\HelloWorld.log
|
||||
echo Hello, World >> %LOGFILE%
|
||||
```
|
||||
|
||||
### .exe example
|
||||
|
||||
This example script shows how to create a log output file on the system drive, install an app from a .exe installer, and echo the results to the log file.
|
||||
This example script shows how to create a log output file on the system drive, install an app from an `.exe` installer, and echo the results to the log file.
|
||||
|
||||
```
|
||||
```exe
|
||||
set LOGFILE=%SystemDrive%\Fiddler_install.log
|
||||
echo Installing Fiddler.exe >> %LOGFILE%
|
||||
fiddler4setup.exe /S >> %LOGFILE%
|
||||
@ -127,7 +121,7 @@ echo result: %ERRORLEVEL% >> %LOGFILE%
|
||||
|
||||
This is the same as the previous installer, but installs the app from an MSI installer. Notice that msiexec is called with the /quiet flag in order to meet the silent requirement of scripts run from within a provisioning package.
|
||||
|
||||
```
|
||||
```msi
|
||||
set LOGFILE=%SystemDrive%\IPOverUsb_install.log
|
||||
echo Installing IpOverUsbInstaller.msi >> %LOGFILE%
|
||||
msiexec /i IpOverUsbInstaller.msi /quiet >> %LOGFILE%
|
||||
@ -136,9 +130,9 @@ echo result: %ERRORLEVEL% >> %LOGFILE%
|
||||
|
||||
### PowerShell example
|
||||
|
||||
This is an example script with logging that shows how to run a powershell script from the provisioning commands setting. Note that the PowerShell script referenced from this example must also be included in the package, and obey the same requirements as all scripts run from within the provisioning package: it must execute silently, with no user interaction.
|
||||
This is an example script with logging that shows how to run a PowerShell script from the provisioning commands setting. The PowerShell script referenced from this example must also be included in the package, and obey the same requirements as all scripts run from within the provisioning package: it must execute silently, with no user interaction.
|
||||
|
||||
```
|
||||
```powershell
|
||||
set LOGFILE=%SystemDrive%\my_powershell_script.log
|
||||
echo Running my_powershell_script.ps1 in system context >> %LOGFILE%
|
||||
echo Executing "PsExec.exe -accepteula -i -s cmd.exe /c powershell.exe my_powershell_script.ps1" >> %LOGFILE%
|
||||
@ -147,11 +141,12 @@ echo result: %ERRORLEVEL% >> %LOGFILE%
|
||||
```
|
||||
|
||||
<span id="cab-extract" />
|
||||
|
||||
### Extract from a .CAB example
|
||||
|
||||
This example script shows expansion of a .cab from the provisioning commands script, as well as installation of the expanded setup.exe
|
||||
This example script shows expansion of a .cab from the provisioning commands script, and installation of the expanded setup.exe
|
||||
|
||||
```
|
||||
```cab
|
||||
set LOGFILE=%SystemDrive%\install_my_app.log
|
||||
echo Expanding installer_assets.cab >> %LOGFILE%
|
||||
expand -r installer_assets.cab -F:* . >> %LOGFILE%
|
||||
@ -163,9 +158,9 @@ echo result: %ERRORLEVEL% >> %LOGFILE%
|
||||
|
||||
### Calling multiple scripts in the package
|
||||
|
||||
In Windows 10, version 1703, your provisioning package can include multiple CommandLines.
|
||||
Your provisioning package can include multiple CommandLines.
|
||||
|
||||
In Windows 10, version 1607 and earlier, you are allowed one CommandLine per provisioning package. The batch files shown above are orchestrator scripts that manage the installation and call any other scripts included in the provisioning package. The orchestrator script is what should be invoked from the CommandLine specified in the package.
|
||||
You are allowed one CommandLine per provisioning package. The batch files shown above are orchestrator scripts that manage the installation and call any other scripts included in the provisioning package. The orchestrator script is what should be invoked from the CommandLine specified in the package.
|
||||
|
||||
Here’s a table describing this relationship, using the PowerShell example from above:
|
||||
|
||||
@ -174,16 +169,16 @@ Here’s a table describing this relationship, using the PowerShell example from
|
||||
| --- | --- | --- |
|
||||
| ProvisioningCommands/DeviceContext/CommandLine | cmd /c PowerShell_Example.bat | The command line needed to invoke the orchestrator script. |
|
||||
| ProvisioningCommands/DeviceContext/CommandFiles | PowerShell_Example.bat | The single orchestrator script referenced by the command line that handles calling into the required installers or performing any other actions such as expanding cab files. This script must do the required logging. |
|
||||
| ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example there is only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. |
|
||||
| ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example, there is only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. |
|
||||
|
||||
|
||||
### Add script to provisioning package (Windows 10, version 1607)
|
||||
### Add script to provisioning package
|
||||
|
||||
When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Window Configuration Designer.
|
||||
|
||||
Using Windows Configuration Designer, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to:
|
||||
|
||||
```
|
||||
```bat
|
||||
cmd /c InstallMyApp.bat
|
||||
```
|
||||
|
||||
@ -201,20 +196,21 @@ When you are done, [build the package](provisioning-create-package.md#build-pack
|
||||
|
||||
|
||||
### Remarks
|
||||
|
||||
1. No user interaction or console output is supported via ProvisioningCommands. All work needs to be silent. If your script attempts to do any of the following it will cause undefined behavior, and could put the device in an unrecoverable state if executed during setup or the Out of Box Experience:
|
||||
a. Echo to console
|
||||
b. Display anything on the screen
|
||||
c. Prompt the user with a dialog or install wizard
|
||||
2. When applied at first boot, provisioning runs early in the boot sequence and before a user context has been established; care must be taken to only include installers that can run at this time. Other installers can be provisioned via a management tool.
|
||||
3. If the device is put into an unrecoverable state because of a bad script, you can reset it using [recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options).
|
||||
3. If the device is put into an unrecoverable state because of a bad script, you can reset it using [recovery options in Windows client](https://support.microsoft.com/help/12415/windows-10-recovery-options).
|
||||
4. The CommandFile assets are deployed on the device to a temporary folder unique to each package.
|
||||
- For Windows 10, version 1607 and earlier:
|
||||
a. For packages added during the out of box experience, this is usually in `%WINDIR%\system32\config\systemprofile\appdata\local\Temp\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands`
|
||||
b. For packages added by double-clicking on an already deployed device, this will be in the temp folder for the user executing the PPKG: `%TMP%\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands`
|
||||
- For Windows 10, version 1703:
|
||||
a. For packages added during the out of box experience, this is usually in `%WINDIR%\system32\config\systemprofile\appdata\local\Temp\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0`
|
||||
|
||||
1. For packages added during the out of box experience, this is usually in `%WINDIR%\system32\config\systemprofile\appdata\local\Temp\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0`
|
||||
|
||||
The `0` after `Commands\` refers to the installation order and indicates the first app to be installed. The number will increment for each app in the package.
|
||||
b. For packages added by double-clicking on an already deployed device, this will be in the temp folder for the user executing the provisioning package: `%TMP%\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0`
|
||||
|
||||
2. For packages added by double-clicking on an already deployed device, this will be in the temp folder for the user executing the provisioning package: `%TMP%\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0`
|
||||
|
||||
5. The command line will be executed with the directory the CommandFiles were deployed to as the working directory. This means you do not need to specific the full path to assets in the command line or from within any script.
|
||||
6. The runtime provisioning component will attempt to run the scripts from the provisioning package at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the out of box experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and “please wait” will be displayed on the screen.
|
||||
|
||||
@ -223,15 +219,15 @@ When you are done, [build the package](provisioning-create-package.md#build-pack
|
||||
7. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there is no notification that provisioning or script execution has completed
|
||||
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Uninstall a provisioning package - reverted settings (Windows 10)
|
||||
description: This topic lists the settings that are reverted when you uninstall a provisioning package.
|
||||
title: Uninstall a provisioning package - reverted settings (Windows 10/11)
|
||||
description: This article lists the settings that are reverted when you uninstall a provisioning package on Windows 10/11 desktop client devices.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -8,8 +8,7 @@ author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/27/2017
|
||||
ms.reviewer:
|
||||
ms.reviewer: gkomatsu
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
@ -19,9 +18,9 @@ manager: dansimp
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 11
|
||||
|
||||
When you uninstall a provisioning package, only certain settings are revertible. This topic lists the settings that are reverted when you uninstall a provisioning package.
|
||||
When you uninstall a provisioning package, only certain settings are revertible. This article lists the settings that are reverted when you uninstall a provisioning package.
|
||||
|
||||
|
||||
As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**.
|
||||
@ -79,19 +78,15 @@ Here is the list of revertible settings based on configuration service providers
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
||||
- [Provisioning packages for Windows client](provisioning-packages.md)
|
||||
- [How provisioning works in Windows client](provisioning-how-it-works.md)
|
||||
- [Install Windows Configuration Designer](provisioning-install-icd.md)
|
||||
- [Create a provisioning package](provisioning-create-package.md)
|
||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
||||
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
|
||||
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
|
||||
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
|
||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -13,9 +13,14 @@ ms.topic: article
|
||||
|
||||
# Create a deployment plan
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
A "service management" mindset means that the devices in your organization fall into a continuum, with the software update process being constantly planned, deployed, monitored, and optimized. And once you use this process for feature updates, quality updates become a lightweight procedure that is simple and fast to execute, ultimately increasing velocity.
|
||||
|
||||
When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We’ve found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method to separate devices into a deployment timeline.
|
||||
When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We’ve found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows client are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method to separate devices into a deployment timeline.
|
||||
|
||||
At the highest level, each “ring” comprises a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur.
|
||||
|
||||
@ -99,8 +104,7 @@ Once the devices in the Limited ring have had a sufficient stabilization period,
|
||||
In most businesses, the Broad ring includes the rest of your organization. Because of the work in the previous ring to vet stability and minimize disruption (with diagnostic data to support your decision) broad deployment can occur relatively quickly.
|
||||
|
||||
> [!NOTE]
|
||||
> In some instances, you might hold back on mission critical devices (such as medical devices) until deployment in the Broad ring is complete. Get best practices and recommendations for deploying Windows 10 feature
|
||||
> updates to mission critical devices.
|
||||
> In some instances, you might hold back on mission-critical devices (such as medical devices) until deployment in the Broad ring is complete. Get best practices and recommendations for deploying Windows client feature updates to mission critical-devices.
|
||||
|
||||
During the broad deployment phase, you should focus on the following activities:
|
||||
|
||||
@ -116,7 +120,7 @@ Previously, we have provided methods for analyzing your deployments, but these h
|
||||
[Desktop Analytics](/mem/configmgr/desktop-analytics/overview) is a cloud-based service and a key tool in [Microsoft Endpoint Manager](/mem/configmgr/core/understand/microsoft-endpoint-manager-faq). Using artificial intelligence and machine learning, Desktop Analytics is a powerful tool to give you insights and intelligence to
|
||||
make informed decisions about the readiness of your Windows devices.
|
||||
|
||||
In Windows 10 deployments, we have seen compatibility issues on < 0.5% of apps when using Desktop Analytics. Using Desktop Analytics with Microsoft Endpoint Manager can help you assess app compatibility with the latest
|
||||
In Windows client deployments, we have seen compatibility issues on < 0.5% of apps when using Desktop Analytics. Using Desktop Analytics with Microsoft Endpoint Manager can help you assess app compatibility with the latest
|
||||
feature update and create groups that represent the broadest number of hardware and software configurations on the smallest set of devices across your organization. In addition, Desktop Analytics can provide you with a device and software inventory and identify issues, giving you data that equate to actionable decisions.
|
||||
|
||||
> [!IMPORTANT]
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy Windows 10 updates with Configuration Manager (Windows 10)
|
||||
description: Deploy Windows 10 updates with Configuration Manager
|
||||
title: Deploy Windows client updates with Configuration Manager
|
||||
description: Deploy Windows client updates with Configuration Manager
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
@ -15,6 +15,7 @@ ms.topic: article
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
See the Microsoft Endpoint Manager [documentation](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) for details about using Configuration Manager to deploy and manage Windows 10 updates.
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy updates with Intune
|
||||
description: Deploy Windows 10 updates with Intune
|
||||
description: Deploy Windows client updates with Intune
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
@ -15,6 +15,7 @@ ms.topic: article
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
See the Microsoft Intune [documentation](/mem/intune/protect/windows-update-for-business-configure#windows-10-feature-updates) for details about using Intune to deploy and manage Windows 10 updates.
|
||||
See the Microsoft Intune [documentation](/mem/intune/protect/windows-update-for-business-configure#windows-10-feature-updates) for details about using Intune to deploy and manage Windows client updates.
|
||||
@ -16,7 +16,10 @@ ms.topic: article
|
||||
|
||||
# Windows Update for Business deployment service
|
||||
|
||||
> Applies to: Windows 10
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
The Windows Update for Business deployment service is a cloud service within the Windows Update for Business product family. It provides control over the approval, scheduling, and safeguarding of updates delivered from Windows Update. It's designed to work in harmony with your existing Windows Update for Business policies.
|
||||
|
||||
@ -56,18 +59,18 @@ The deployment service exposes these capabilities through Microsoft [Graph REST
|
||||
|
||||
To work with the deployment service, devices must meet all these requirements:
|
||||
|
||||
- Be running Windows 10, version 1709 or later
|
||||
- Be running Windows 10, version 1709 or later (or Windows 11)
|
||||
- Be joined to Azure Active Directory (AD) or Hybrid AD
|
||||
- Have one of the following Windows 10 editions installed:
|
||||
- Windows 10 Pro
|
||||
- Windows 10 Enterprise
|
||||
- Windows 10 Education
|
||||
- Windows 10 Pro Education
|
||||
- Windows 10 Pro for Workstations
|
||||
- Have one of the following Windows 10 or Windows 11 editions installed:
|
||||
- Pro
|
||||
- Enterprise
|
||||
- Education
|
||||
- Pro Education
|
||||
- Pro for Workstations
|
||||
|
||||
Additionally, your organization must have one of the following subscriptions:
|
||||
- Windows 10 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)
|
||||
- Windows 10 Education A3 or A5 (included in Microsoft 365 A3 or A5)
|
||||
- Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)
|
||||
- Windows 10/11 Education A3 or A5 (included in Microsoft 365 A3 or A5)
|
||||
- Windows Virtual Desktop Access E3 or E5
|
||||
- Microsoft 365 Business Premium
|
||||
|
||||
@ -78,7 +81,7 @@ To use the deployment service, you use a management tool built on the platform,
|
||||
|
||||
### Using Microsoft Endpoint Manager
|
||||
|
||||
Microsoft Endpoint Manager integrates with the deployment service to provide Windows 10 update management capabilities. For more information, see [Windows 10 feature updates policy in Intune](/mem/intune/protect/windows-10-feature-updates).
|
||||
Microsoft Endpoint Manager integrates with the deployment service to provide Windows client update management capabilities. For more information, see [Windows 10 feature updates policy in Intune](/mem/intune/protect/windows-10-feature-updates).
|
||||
|
||||
### Scripting common actions using PowerShell
|
||||
|
||||
@ -141,18 +144,27 @@ To enroll devices in Windows Update for Business cloud processing, set the **All
|
||||
Following is an example of setting the policy using Microsoft Endpoint Manager:
|
||||
|
||||
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
|
||||
2. Select **Devices** > **Configuration profiles** > **Create profile**.
|
||||
|
||||
3. Select **Windows 10 and later** in **Platform**, select **Templates** in **Profile type**, select **Custom** in **Template name**, and then select **Create**.
|
||||
|
||||
4. In **Basics**, enter a meaningful name and a description for the policy, and then select **Next**.
|
||||
|
||||
5. In **Configuration settings**, select **Add**, enter the following settings, select **Save**, and then select **Next**.
|
||||
- Name: **AllowWUfBCloudProcessing**
|
||||
- Description: Enter a description.
|
||||
- OMA-URI: `./Vendor/MSFT/Policy/Config/System/AllowWUfBCloudProcessing`
|
||||
- Data type: **Integer**
|
||||
- Value: **8**
|
||||
|
||||
6. In **Assignments**, select the groups that will receive the profile, and then select **Next**.
|
||||
|
||||
7. In **Review + create**, review your settings, and then select **Create**.
|
||||
8. (Optional) To verify that the policy reached the client, check the value of the following registry entry: **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager \\default\\System\\AllowWUfBCloudProcessing**.
|
||||
|
||||
8. (Optional) To verify that the policy reached the client, check the value of the following registry entry:
|
||||
|
||||
**HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager \\default\\System\\AllowWUfBCloudProcessing**
|
||||
|
||||
## Best practices
|
||||
Follow these suggestions for the best results with the service.
|
||||
@ -160,6 +172,7 @@ Follow these suggestions for the best results with the service.
|
||||
### Device onboarding
|
||||
|
||||
- Wait until devices finish provisioning before managing with the service. If a device is being provisioned by Autopilot, it can only be managed by the deployment service after it finishes provisioning (typically one day).
|
||||
|
||||
- Use the deployment service for feature update management without feature update deferral policy. If you want to use the deployment service to manage feature updates on a device that previously used a feature update deferral policy, it's best to set the feature update deferral policy to **0** days to avoid having multiple conditions governing feature updates. You should only change the feature update deferral policy value to 0 days after you've confirmed that the device was enrolled in the service with no errors.
|
||||
|
||||
### General
|
||||
|
||||
@ -16,7 +16,10 @@ ms.topic: article
|
||||
|
||||
# Troubleshoot the Windows Update for Business deployment service
|
||||
|
||||
> Applies to: Windows 10
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
This troubleshooting guide addresses the most common issues that IT administrators face when using the Windows Update for Business [deployment service](deployment-service-overview.md). For a general troubleshooting guide for Windows Update, see [Windows Update troubleshooting](windows-update-troubleshooting.md).
|
||||
|
||||
|
||||
@ -15,34 +15,39 @@ ms.collection: m365initiative-coredeploy
|
||||
|
||||
# Evaluate infrastructure and tools
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Before you deploy an update, it's best to assess your deployment infrastructure (that is, tools such as Configuration Manager, Microsoft Intune, or similar) and current configurations (such as security baselines, administrative templates, and policies that affect updates). Then, set some criteria to define your operational readiness.
|
||||
|
||||
## Infrastructure
|
||||
|
||||
Do your deployment tools need updates?
|
||||
|
||||
- If you use Configuration Manager, is it on the Current Branch with the latest release installed. Being on this branch ensures that it supports the next Windows 10 feature update. Configuration Manager releases are supported for 18 months.
|
||||
- If you use Configuration Manager, is it on the Current Branch with the latest release installed.? Being on this branch ensures that it supports the next Windows client feature update. Configuration Manager releases are supported for 18 months.
|
||||
- Using a cloud-based management tool like Microsoft Intune reduces support challenges, since no related products need to be updated.
|
||||
- If you use a non-Microsoft tool, check with its product support to make sure you're using the current version and that it supports the next Windows 10 feature update.
|
||||
- If you use a non-Microsoft tool, check with its product support to make sure you're using the current version and that it supports the next Windows client feature update.
|
||||
|
||||
Rely on your experiences and data from previous deployments to help you judge how long infrastructure changes take and identify any problems you've encountered while doing so.
|
||||
|
||||
## Device settings
|
||||
|
||||
Make sure your security baseline, administrative templates, and policies have the right settings to support your devices once the new Windows 10 update is installed.
|
||||
Make sure your security baseline, administrative templates, and policies have the right settings to support your devices once the new Windows client update is installed.
|
||||
|
||||
### Security baseline
|
||||
|
||||
Keep security baselines current to help ensure that your environment is secure and that new security feature in the coming Windows 10 update are set properly.
|
||||
Keep security baselines current to help ensure that your environment is secure and that new security feature in the coming Windows client update are set properly.
|
||||
|
||||
- **Microsoft security baselines**: You should implement security baselines from Microsoft. They are included in the [Security Compliance Toolkit](https://www.microsoft.com/download/details.aspx?id=55319), along with tools for managing them.
|
||||
- **Industry- or region-specific baselines**: Your specific industry or region might have particular baselines that you must follow per regulations. Ensure that any new baselines support the version of Windows 10 you are about to deploy.
|
||||
- **Industry- or region-specific baselines**: Your specific industry or region might have particular baselines that you must follow per regulations. Ensure that any new baselines support the version of Windows client you are about to deploy.
|
||||
|
||||
### Configuration updates
|
||||
|
||||
There are a number of Windows policies (set by Group Policy, Intune, or other methods) that affect when Windows updates are installed, deferral, end-user experience, and many other aspects. Check these policies to make sure they are set appropriately.
|
||||
|
||||
- **Windows 10 Administrative templates**: Each Windows 10 feature update has a supporting Administrative template (.admx) file. Group Policy tools use Administrative template files to populate policy settings in the user interface. The templates are available in the Download Center, for example, this one for [Windows 10, version 1909](https://www.microsoft.com/download/100591).
|
||||
- **Windows Administrative templates**: Each Windows client feature update has a supporting Administrative template (.admx) file. Group Policy tools use Administrative template files to populate policy settings in the user interface. The templates are available in the Download Center, for example, this one for [Windows 10, version 1909](https://www.microsoft.com/download/100591).
|
||||
- **Policies for update compliance and end-user experience**: A number of settings affect when a device installs updates, whether and for how long a user can defer an update, restart behavior after installation, and many other aspects of update behavior. It's especially important to look for existing policies that are out of date or could conflict with new ones.
|
||||
|
||||
|
||||
@ -50,9 +55,9 @@ There are a number of Windows policies (set by Group Policy, Intune, or other me
|
||||
|
||||
When you’ve deployed an update, you’ll need to make sure the update isn’t introducing new operational issues. And you’ll also ensure that if incidents arise, the needed documentation and processes are available. Work with your operations and support team to define acceptable trends and what documents or processes require updating:
|
||||
|
||||
- **Call trend**: Define what percentage increase in calls relating to Windows 10 feature updates are acceptable or can be supported.
|
||||
- **Incident trend**: Define what percentage of increase in calls asking for support relating to Windows 10 feature updates are acceptable or can be supported.
|
||||
- **Support documentation**: Review supporting documentation that requires an update to support new infrastructure tooling or configuration as part of the Windows 10 feature update.
|
||||
- **Call trend**: Define what percentage increase in calls relating to Windows client feature updates are acceptable or can be supported.
|
||||
- **Incident trend**: Define what percentage of increase in calls asking for support relating to Windows client feature updates are acceptable or can be supported.
|
||||
- **Support documentation**: Review supporting documentation that requires an update to support new infrastructure tooling or configuration as part of the Windows client feature update.
|
||||
- **Process changes:** Define and update any processes that will change as a result of the Windows 10 feature update.
|
||||
|
||||
Your operations and support staff can help you determine if the appropriate information is being tracked at the moment. If it isn't, work out how to get this information so you can gain the right insight.
|
||||
|
||||
@ -16,15 +16,18 @@ ms.custom: seo-marvel-apr2020
|
||||
---
|
||||
# How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager
|
||||
|
||||
> Applies to: Windows 10
|
||||
**Applies to**
|
||||
|
||||
In Windows 10 version 21H2, non-Administrator user accounts can add both a display language and its corresponding language features.
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
In Windows 10 version 21H2 and later, non-Administrator user accounts can add both a display language and its corresponding language features.
|
||||
|
||||
As of Windows 10 version 1709, you can't use Windows Server Update Services (WSUS) to host [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FODs) locally. Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS.
|
||||
|
||||
The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it's important to note this policy only allows specifying one alternate location and behaves differently across OS versions.
|
||||
|
||||
In Windows 10 version 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions does not influence how language packs are acquired.
|
||||
In Windows 10 versions 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions does not influence how language packs are acquired.
|
||||
|
||||
In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It's currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location.
|
||||
|
||||
|
||||
@ -15,9 +15,12 @@ ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
---
|
||||
|
||||
# How does Windows Update work?
|
||||
# How Windows Update works
|
||||
|
||||
> Applies to: Windows 10
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
The Windows Update workflow has four core areas of functionality:
|
||||
|
||||
|
||||
@ -16,7 +16,10 @@ ms.topic: article
|
||||
|
||||
# Update Windows installation media with Dynamic Update
|
||||
|
||||
**Applies to**: Windows 10, Windows 11
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
This topic explains how to acquire and apply Dynamic Update packages to existing Windows images *prior to deployment* and includes Windows PowerShell scripts you can use to automate this process.
|
||||
|
||||
|
||||
@ -15,9 +15,14 @@ ms.topic: article
|
||||
|
||||
# Migrating and acquiring optional Windows content during updates
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
This article provides some background on the problem of keeping language resources and Features on Demand during operating system updates and offers guidance to help you move forward in the short term and prepare for the long term.
|
||||
|
||||
When you update the operating system, it’s critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows 10 setup using a local Windows image or WIM file (a “media-based” or “task-sequence-based” update). Others do in-place updates using an approved Windows 10 feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a "servicing-based” update).
|
||||
When you update the operating system, it’s critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows client setup using a local Windows image or WIM file (a “media-based” or “task-sequence-based” update). Others do in-place updates using an approved Windows client feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a "servicing-based” update).
|
||||
|
||||
Neither approach contains the full set of Windows optional features that a user’s device might need, so those features are not migrated to the new operating system. Further, those features are not available in Configuration Manager or WSUS for on-premises acquisition after a feature update
|
||||
|
||||
@ -29,7 +34,7 @@ Optional content includes the following items:
|
||||
- Language-based and regional FODs (for example, Language.Basic~~~ja-jp~0.0.1.0)
|
||||
- Local Experience Packs
|
||||
|
||||
Optional content isn’t included by default in the Windows image file that is part of the operating system media available in the Volume Licensing Service Center (VLSC). Instead, it’s released as an additional ISO file on VLSC. Shipping these features out of the operating system media and shipping them separately reduces the disk footprint of Windows. This provides more space for user’s data. It also reduces the time needed to service the operating system, whether installing a monthly quality update or upgrading to a newer version. A smaller default Windows image also means less data to transmit over the network.
|
||||
Optional content isn’t included by default in the Windows image file that is part of the operating system media available in the Volume Licensing Service Center (VLSC). Instead, it’s released as an additional ISO file on VLSC. Shipping these features out of the operating system media and shipping them separately reduces the disk footprint of Windows. This approach provides more space for user’s data. It also reduces the time needed to service the operating system, whether installing a monthly quality update or upgrading to a newer version. A smaller default Windows image also means less data to transmit over the network.
|
||||
|
||||
## Why is acquiring optional content challenging?
|
||||
|
||||
@ -37,17 +42,17 @@ The challenges surrounding optional content typically fall into two groups:
|
||||
|
||||
### Incomplete operating system updates
|
||||
|
||||
The first challenge is related to content migration during a feature update. When Windows Setup performs an in-place update, the new operating is written to the user’s disk alongside the old version. This is a temporary folder, where a second clean operating system is installed and prepared for the user to "move into." When this happens, Windows Setup enumerates optional content installed already in the current version and plans to install the new version of this content in the new operating system.
|
||||
The first challenge is related to content migration during a feature update. When Windows Setup performs an in-place update, the new operating system is written to the user’s disk alongside the old version in a temporary folder, where a second clean operating system is installed and prepared for the user to "move into." When operation happens, Windows Setup enumerates optional content installed already in the current version and plans to install the new version of this content in the new operating system.
|
||||
|
||||
Windows Setup needs access to the optional content to do this. Since optional content is not in the Windows image by default, Windows Setup must look elsewhere to get the Windows packages, stage them, and then install them in the new operating system. When the content can’t be found, the result is an update that is missing features on the device, a frustrated end user, and likely a help desk call. This pain point is sometimes referred to "failure to migrate optional content during update." For media-based updates, Windows will automatically try again once the new operating system boots. We call this “latent acquisition.”
|
||||
Windows Setup needs access to the optional content. Since optional content is not in the Windows image by default, Windows Setup must look elsewhere to get the Windows packages, stage them, and then install them in the new operating system. When the content can’t be found, the result is an update that is missing features on the device, a frustrated end user, and likely a help desk call. This pain point is sometimes referred to "failure to migrate optional content during update." For media-based updates, Windows will automatically try again once the new operating system boots. We call this “latent acquisition.”
|
||||
|
||||
### User-initiated feature acquisition failure
|
||||
|
||||
The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows 10, either by using a clean installation or an in-place update. The user visits Settings, and attempts to install a second language, additional language experience features, or other optional content. Again, since these features are not in the operating system, the packages need to be acquired. For a typical user with internet access, Windows will acquire the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can’t be found, users are frustrated and another help desk call could result. This pain point is sometimes referred to as "failure to acquire optional content.”
|
||||
The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows client, either by using a clean installation or an in-place update. The user visits Settings, and attempts to install a second language, more language experience features, or other optional content. Again, since these features are not in the operating system, the packages need to be acquired. For a typical user with internet access, Windows will acquire the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can’t be found, users are frustrated and another help desk call could result. This pain point is sometimes referred to as "failure to acquire optional content.”
|
||||
|
||||
## Options for acquiring optional content
|
||||
|
||||
Most commercial organizations understand the pain points outlined above, and discussions typically start with them asking what plans are available to address these challenges. The following table includes multiple options for consideration, depending on how you are currently deploying Windows 10. In this table,
|
||||
Most commercial organizations understand the pain points outlined above, and discussions typically start with them asking what plans are available to address these challenges. The following table includes multiple options for consideration, depending on how you are currently deploying Windows client. In this table,
|
||||
|
||||
- Migration means it supports optional content migration during an update.
|
||||
- Acquisition means it supports optional content acquisition (that is, initiated by the user).
|
||||
@ -70,30 +75,30 @@ Most commercial organizations understand the pain points outlined above, and dis
|
||||
|
||||
Windows Update for Business solves the optional content problem. Optional content is published and available for acquisition by Windows Setup from a nearby Microsoft content delivery network and acquired using the Unified Update Platform. Optional content migration and acquisition scenarios "just work" when the device is connected to an update service that uses the Unified Update Platform, such as Windows Update or Windows Update for Business. If for some reason a language pack fails to install during the update, the update will automatically roll back.
|
||||
|
||||
Starting with Windows 10, version 1709, we introduced the [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/). The Unified Update Platform is an improvement in the underlying Windows update technology that results in smaller download sizes and a more efficient protocol for checking for updates, acquiring and installing the packages needed, and getting current in one update step. The technology is "unified" because it brings together the update stack for Windows 10, Windows Server, and other products, such as HoloLens. The Unified Update Platform is not currently integrated with WSUS.
|
||||
Starting with Windows 10, version 1709, we introduced the [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/). The Unified Update Platform is an improvement in the underlying Windows update technology that results in smaller download sizes and a more efficient protocol for checking for updates, acquiring and installing the packages needed, and getting current in one update step. The technology is "unified" because it brings together the update stack for Windows client, Windows Server, and other products, such as HoloLens. The Unified Update Platform is not currently integrated with WSUS.
|
||||
|
||||
You should consider moving to Windows Update for Business. Not only will the optional content scenario work seamlessly (as it does for consumer devices today), but you also get the full benefits of smaller download sizes also known as Express Updates. Further, devices that use devices are immune to the challenge of upgrading a Windows 10 device where the operating system installation language is inadvertently changed to a new language. Otherwise, any future media-based feature updates can fail when the installation media has a different installation language. See [Upgrading Windows 10 devices with installation media different than the original OS install language](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/upgrading-windows-10-devices-with-installation-media-different/ba-p/746126) for more details, as well as our [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002) on this topic.
|
||||
Consider moving to Windows Update for Business. Not only will the optional content scenario work seamlessly (as it does for consumer devices today), but you also get the full benefits of smaller download sizes also known as Express Updates. Further, devices that use devices are immune to the challenge of upgrading a Windows client device where the operating system installation language is inadvertently changed to a new language. Otherwise, any future media-based feature updates can fail when the installation media has a different installation language. For more info, see [Upgrading Windows 10 devices with installation media different than the original OS install language](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/upgrading-windows-10-devices-with-installation-media-different/ba-p/746126) for more details, and our [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002) on this topic.
|
||||
|
||||
### Option 2: Enable Dynamic Update
|
||||
|
||||
If you’re not ready to move to Windows Update, another option is to enable Dynamic Update during a feature update. As soon as a Windows 10 feature update starts, whether via a media-based update or a WSUS-based feature update, Dynamic Update is one of the first steps invoked. Windows 10 Setup connects to an internet-facing URL hosted by Microsoft to fetch Dynamic Update content, and then applies those updates to the operating system installation media. The content acquired includes the following:
|
||||
If you’re not ready to move to Windows Update, another option is to enable Dynamic Update during a feature update. As soon as a Windows feature update starts, whether via a media-based update or a WSUS-based feature update, Dynamic Update is one of the first steps invoked. Windows Setup connects to an internet-facing URL hosted by Microsoft to fetch Dynamic Update content, and then applies those updates to the operating system installation media. The content acquired includes the following:
|
||||
|
||||
- Setup updates: Fixes to Setup.exe binaries or any files that Setup uses for feature updates.
|
||||
- Safe OS updates: Fixes for the "safe OS" that are used to update Windows recovery environment (WinRE).
|
||||
- Servicing stack updates: Fixes that are necessary to address the Windows 10 servicing stack issue and thus required to complete the feature update.
|
||||
- Servicing stack updates: Fixes that are necessary to address the Windows servicing stack issue and thus required to complete the feature update.
|
||||
- Latest cumulative update: Installs the latest cumulative quality update.
|
||||
- Driver updates: Latest version of applicable drivers that have already been published by manufacturers into Windows Update and meant specifically for Dynamic Update.
|
||||
|
||||
In addition to these updates for the new operating system, Dynamic Update will acquire optional content during the update process to ensure that the device has this content present when the update completes. So, although the device is not connected to Windows Update, it will fetch content from a nearby Microsoft content download network (CDN). This addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows 10 Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this with setupconfig.ini. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details.
|
||||
In addition to these updates for the new operating system, Dynamic Update will acquire optional content during the update process to ensure that the device has this content present when the update completes. So, although the device is not connected to Windows Update, it will fetch content from a nearby Microsoft content download network (CDN). This approach addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this value with setupconfig.ini. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details.
|
||||
|
||||
Starting in Windows 10, version 2004, Dynamic Update can be configured with additional options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device will go through an additional reboot for the latest cumulative update since it was not available during the feature update.
|
||||
Starting in Windows 10, version 2004, Dynamic Update can be configured with more options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device will reboot again for the latest cumulative update since it was not available during the feature update.
|
||||
|
||||
One additional consideration when using Dynamic Update is the impact to your network. One of the top blockers for this approach is the concern that each device will separately fetch this content from Microsoft. Windows 10, version 2004 setup now downloads Dynamic Update content using Delivery Optimization when available.
|
||||
One further consideration when using Dynamic Update is the affect on your network. One of the top blockers for this approach is the concern that each device will separately fetch this content from Microsoft. Windows 10, version 2004 setup now downloads Dynamic Update content using Delivery Optimization when available.
|
||||
For devices that aren’t connected to the internet, a subset of the Dynamic Update content is available by using WSUS and the Microsoft catalog.
|
||||
|
||||
### Option 3: Customize the Windows Image before deployment
|
||||
|
||||
For many organizations, the deployment workflow involves a Configuration Manager task sequence that performs a media-based update. Some customers either don’t have internet connectivity, or the connectivity is poor and so they can’t enable Dynamic Update. In these cases, we recommend installing optional content prior to deployment. This is sometimes referred to as customizing the installation media.
|
||||
For many organizations, the deployment workflow involves a Configuration Manager task sequence that performs a media-based update. Some customers either don’t have internet connectivity, or the connectivity is poor and so they can’t enable Dynamic Update. In these cases, we recommend installing optional content prior to deployment. This activity is sometimes referred to as customizing the installation media.
|
||||
|
||||
You can customize the Windows image in these ways:
|
||||
|
||||
@ -104,24 +109,24 @@ You can customize the Windows image in these ways:
|
||||
- Adding or removing languages
|
||||
- Adding or removing Features on Demand
|
||||
|
||||
The benefit of this option is that the Windows image can include those additional languages, language experience features, and other Features on Demand through one-time updates to the image. Then you can use them in an existing task sequence or custom deployment where Setup.exe is involved. The downside of this approach is that it requires some preparation of the image in advance, including scripting with DISM to install the additional packages. It also means the image is the same for all devices that consume it and might contain more features than some users need. For more information on customizing your media, see [Updating Windows 10 media with Dynamic Update packages](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/updating-windows-10-media-with-dynamic-update-packages/ba-p/982477) and our [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073). Also like Option 2, you still have a solution for migration of optional content, but not supporting user-initiated optional content acquisition. Also, there is a variation of this option in which media is updated *on the device* just before installation. This allows for device-specific image customization based on what's currently installed.
|
||||
The benefit of this option is that the Windows image can include those additional languages, language experience features, and other Features on Demand through one-time updates to the image. Then you can use them in an existing task sequence or custom deployment where Setup.exe is involved. The downside of this approach is that it requires some preparation of the image in advance, including scripting with DISM to install the additional packages. It also means the image is the same for all devices that consume it and might contain more features than some users need. For more information on customizing your media, see [Updating Windows 10 media with Dynamic Update packages](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/updating-windows-10-media-with-dynamic-update-packages/ba-p/982477) and our [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073). Also like Option 2, you still have a solution for migration of optional content, but not supporting user-initiated optional content acquisition. Also, there is a variation of this option in which media is updated *on the device* just before installation. This option allows for device-specific image customization based on what's currently installed.
|
||||
|
||||
|
||||
### Option 4: Install language features during deployment
|
||||
|
||||
A partial solution to address the first pain point of failing to migrate optional content during upgrade is to inject a subset of optional content during the upgrade process. This approach uses the Windows 10 Setup option [/InstallLangPacks](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) to add Language Packs and language capabilities such as text-to-speech recognition from a folder that contains the packages. This approach lets an IT pro take a subset of optional content and stage them within their network. If you use the servicing-based approach, you can configure InstallLangPacks using setupconfig.ini. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details.
|
||||
A partial solution to address the first pain point of failing to migrate optional content during upgrade is to inject a subset of optional content during the upgrade process. This approach uses the Windows Setup option [/InstallLangPacks](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) to add Language Packs and language capabilities such as text-to-speech recognition from a folder that contains the packages. This approach lets an IT pro take a subset of optional content and stage them within their network. If you use the servicing-based approach, you can configure InstallLangPacks using setupconfig.ini. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details.
|
||||
|
||||
When Setup runs, it will inject these packages into the new operating system during installation. This means it can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages cannot be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, as well as the architecture-specific Language Pack .cabs from the LPLIP ISO. Also, starting with Windows 10, version 1903, the behavior changed. In Windows 10, version 1809 and earlier, failure to install the packages wasn’t a fatal error. Starting with Windows 10, version 1903, we treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don’t migrate FOD and languages (unless Dynamic Update is enabled).
|
||||
When Setup runs, it will inject these packages into the new operating system during installation. It can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages cannot be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, and the architecture-specific Language Pack .cabs from the LPLIP ISO. Also, starting with Windows 10, version 1903, the behavior changed. In Windows 10, version 1809 and earlier, failure to install the packages wasn’t a fatal error. Starting with Windows 10, version 1903, we treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don’t migrate FOD and languages (unless Dynamic Update is enabled).
|
||||
|
||||
This approach has some interesting benefits. The original Windows image doesn’t need to be modified, possibly saving time and scripting. For some commercial customers, this is implemented as their primary pain point has to do with language support immediately after the update.
|
||||
This approach has some interesting benefits. The original Windows image doesn’t need to be modified, possibly saving time and scripting.
|
||||
|
||||
### Option 5: Install optional content after deployment
|
||||
|
||||
This option is like Option 3 in that you customize the operating system image with additional optional content after it’s deployed. IT pros can extend the behavior of Windows Setup by running their own custom action scripts during and after a feature update. See [Run custom actions during feature update](/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) for details. With this approach, you can create a device-specific migration of optional content by capturing the optional content that is installed in the operating system, and then saving this list to install the same optional content in the new operating system. Like Option 4, you would internally host a network share that contains the source of the optional content packages. Then, during the execution of Setup on the device, capture the list of installed optional content from the source operating system and save. Later, after Setup completes, you use the list to install the optional content, which leaves the user’s device without loss of functionality.
|
||||
This option is like Option 3 in that you customize the operating system image with more optional content after it’s deployed. IT pros can extend the behavior of Windows Setup by running their own custom action scripts during and after a feature update. See [Run custom actions during feature update](/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) for details. With this approach, you can create a device-specific migration of optional content by capturing the optional content that is installed in the operating system, and then saving this list to install the same optional content in the new operating system. Like Option 4, you would internally host a network share that contains the source of the optional content packages. Then, during the execution of Setup on the device, capture the list of installed optional content from the source operating system and save. Later, after Setup completes, you use the list to install the optional content, which leaves the user’s device without loss of functionality.
|
||||
|
||||
### Option 6: Configure an alternative source for optional content
|
||||
|
||||
Several of the options address ways to address optional content migration issues during an in-place update. To address the second pain point of easily acquiring optional content in the user-initiated case, you can configure each device by using the Specify settings for optional component installation and component repair Group Policy. This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed. This approach has the disadvantage of additional content to be hosted within your network (additional to the operating system image you might be still deploying to some clients) but has the advantage of acquiring content within your network. Some reminders about this policy:
|
||||
Several of the options address ways to address optional content migration issues during an in-place update. To address the second pain point of easily acquiring optional content in the user-initiated case, you can configure each device by using the Specify settings for optional component installation and component repair Group Policy. This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed. This approach has the disadvantage of more content to be hosted within your network (in addition to the operating system image you might be still deploying to some clients) but has the advantage of acquiring content within your network. Some reminders about this policy:
|
||||
|
||||
- The file path to the alternate source must be a fully qualified path; multiple locations can be separated by a semicolon.
|
||||
- This setting does not support installing language packs from Alternate source file path, only Features on Demand. If the policy is configured to acquire content from Windows Update, language packs will be acquired.
|
||||
@ -141,7 +146,7 @@ For more information about the Unified Update Platform and the approaches outlin
|
||||
- [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002)
|
||||
- [Run custom actions during feature update](/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions)
|
||||
- [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/)
|
||||
- [Updating Windows 10 media with Dynamic Update packages](media-dynamic-update.md)
|
||||
- [Updating Windows installation media with Dynamic Update packages](media-dynamic-update.md)
|
||||
- [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview)
|
||||
|
||||
|
||||
@ -564,7 +569,7 @@ Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction ignore | Out-Null
|
||||
|
||||
### Saving optional content in the source operating system
|
||||
|
||||
To save optional content state in the source operating system, we create a custom action script to run before the operating system installs. In this script, we save optional features and language resources to a file. We also make a local copy of the repo with only those files needed based on the languages installed on the source operating system. This will limit the files to copy.
|
||||
To save optional content state in the source operating system, we create a custom action script to run before the operating system installs. In this script, we save optional features and language resources to a file. We also make a local copy of the repo with only those files needed based on the languages installed on the source operating system. This action will limit the files to copy.
|
||||
|
||||
|
||||
```powershell
|
||||
|
||||
@ -15,6 +15,11 @@ ms.collection: m365initiative-coredeploy
|
||||
|
||||
# Define readiness criteria
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
## Figure out roles and personnel
|
||||
|
||||
Planning and managing a deployment involves a variety of distinct activities and roles best suited to each. As you plan, it's worth figuring out which roles you'll need to carry out the deployment and who should fill them. Different roles are active at various phases of a deployment. Depending on the size and complexity of your organization, some of the roles could be filled by the same person. However, it's best to have an established *process manager*, who will oversee all of the tasks for the deployment.
|
||||
|
||||
@ -16,7 +16,12 @@ author: jaimeo
|
||||
|
||||
# Determine application readiness
|
||||
|
||||
Before you deploy a Windows 10 update, you should know which apps will continue to work without problems, which need their own updates, and which just won't work and must be replaced. If you haven't already, it's worth [classifying your apps]<link to plan-define-readiness> with respect to their criticality in your organization.
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Before you deploy a Windows client update, you should know which apps will continue to work without problems, which need their own updates, and which just won't work and must be replaced. If you haven't already, it's worth [classifying your apps](plan-define-readiness.md) with respect to their criticality in your organization.
|
||||
|
||||
## Validation methods
|
||||
|
||||
|
||||
@ -15,7 +15,12 @@ ms.collection: m365initiative-coredeploy
|
||||
|
||||
# Prepare to deploy Windows
|
||||
|
||||
Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows 10. The planning phase will have left you with these useful items:
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows client. The planning phase will have left you with these useful items:
|
||||
|
||||
- A clear understanding of necessary personnel and their roles and criteria for [rating app readiness](plan-define-readiness.md)
|
||||
- A plan for [testing and validating](plan-determine-app-readiness.md) apps
|
||||
@ -114,7 +119,7 @@ Ensure that devices can reach necessary Windows Update endpoints through the fir
|
||||
> [!NOTE]
|
||||
> Be sure not to use HTTPS for those endpoints that specify HTTP, and vice versa. The connection will fail.
|
||||
|
||||
The specific endpoints can vary between Windows 10 versions. See, for example, [Windows 10 2004 Enterprise connection endpoints](/windows/privacy/manage-windows-2004-endpoints). Similar articles for other Windows 10 versions are available in the table of contents nearby.
|
||||
The specific endpoints can vary between Windows versions. See, for example, [Windows 10 2004 Enterprise connection endpoints](/windows/privacy/manage-windows-2004-endpoints). Similar articles for other Windows client versions are available in the table of contents nearby.
|
||||
|
||||
|
||||
### Optimize download bandwidth
|
||||
@ -124,7 +129,7 @@ Set up [Delivery Optimization](waas-delivery-optimization.md) for peer network s
|
||||
|
||||
In the course of surveying your device population, either with Desktop Analytics or by some other means, you might find devices that have systemic problems that could interfere with update installation. Now is the time to fix those problems.
|
||||
|
||||
- **Low disk space:** Quality updates require a minimum of 2 GB to successfully install. Feature updates require between 8 GB and 15 GB depending upon the configuration. On Windows 10, version 1903 and later you can proactively use the "reserved storage" feature (for wipe and loads, rebuilds, and new builds) to avoid running out of disk space. If you find a group of devices that don't have enough disk space, you can often resolve the problem by cleaning up log files and asking users to clean up data if necessary. A good place to start is to delete the following files:
|
||||
- **Low disk space:** Quality updates require a minimum of 2 GB to successfully install. Feature updates require between 8 GB and 15 GB depending upon the configuration. On Windows 10, version 1903 and later (and Windows 11) you can proactively use the "reserved storage" feature (for wipe and loads, rebuilds, and new builds) to avoid running out of disk space. If you find a group of devices that don't have enough disk space, you can often resolve the problem by cleaning up log files and asking users to clean up data if necessary. A good place to start is to delete the following files:
|
||||
|
||||
- C:\Windows\temp
|
||||
- C:\Windows\cbstemp (though this file might be necessary to investigate update failures)
|
||||
|
||||
@ -12,9 +12,14 @@ ms.topic: article
|
||||
|
||||
# Safeguard holds
|
||||
|
||||
Microsoft uses quality and compatibility data to identify issues that might cause a Windows 10 feature update to fail or roll back. When we find such an issue, we might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available.
|
||||
**Applies to**
|
||||
|
||||
Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows 10.
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When we find such an issue, we might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available.
|
||||
|
||||
Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows client.
|
||||
|
||||
The lifespan of holds varies depending on the time required to investigate and fix an issue. During this time Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the hold. Once we release the hold, Windows Update will resume offering new operating system versions to devices.
|
||||
|
||||
|
||||
@ -12,21 +12,26 @@ ms.topic: article
|
||||
|
||||
# Opt out of safeguard holds
|
||||
|
||||
Safeguard holds prevent a device with a known compatibility issue from being offered a new Windows 10 feature update by using Windows Update. We use safeguard holds to protect the device and user from a failed or poor update experience. We renew the offering once a fix is issued and is verified on an affected device. For more information about safeguard holds, see [Safeguard holds](safeguard-holds.md).
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Safeguard holds prevent a device with a known compatibility issue from being offered a new Windows client feature update by using Windows Update. We use safeguard holds to protect the device and user from a failed or poor update experience. We renew the offering once a fix is issued and is verified on an affected device. For more information about safeguard holds, see [Safeguard holds](safeguard-holds.md).
|
||||
|
||||
## How can I opt out of safeguard holds?
|
||||
|
||||
IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update.
|
||||
IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update and in Windows 11.
|
||||
|
||||
> [!CAUTION]
|
||||
> Opting out of a safeguard hold can put devices at risk from known performance issues.
|
||||
|
||||
We recommend opting out only in an IT environment and for validation purposes. You can also validate an upcoming Windows 10 feature update version without the safeguards being applied by using the Release Preview channel of the Windows Insider Program for Business.
|
||||
We recommend opting out only in an IT environment and for validation purposes. You can also validate an upcoming Windows client feature update version without the safeguards being applied by using the Release Preview channel of the Windows Insider Program for Business.
|
||||
|
||||
Disabling safeguards does not guarantee your device will be able to successfully update. The update might still fail and will likely result in a bad experience since you are bypassing the protection against known issues.
|
||||
|
||||
> [!NOTE]
|
||||
> After a device installs a new Windows 10 version, the **Disable safeguards for Feature Updates** Group Policy will revert to “not configured” even if it was previously enabled. We do this to ensure the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update.
|
||||
> After a device installs a new Windows client version, the **Disable safeguards for Feature Updates** Group Policy will revert to “not configured” even if it was previously enabled. We do this to ensure the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Servicing stack updates (Windows 10)
|
||||
title: Servicing stack updates
|
||||
description: In this article, learn how servicing stack updates improve the code that installs the other updates.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
@ -20,7 +20,8 @@ ms.custom: seo-marvel-apr2020
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, Windows 8.1, Windows 8, Windows 7
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
## What is a servicing stack update?
|
||||
Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month.
|
||||
@ -38,7 +39,7 @@ Servicing stack update are released depending on new issues or vulnerabilities.
|
||||
|
||||
## What's the difference between a servicing stack update and a cumulative update?
|
||||
|
||||
Both Windows 10 and Windows Server use the cumulative update mechanism, in which many fixes to improve the quality and security of Windows are packaged into a single update. Each cumulative update includes the changes and fixes from all previous updates.
|
||||
Both Windows client and Windows Server use the cumulative update mechanism, in which many fixes to improve the quality and security of Windows are packaged into a single update. Each cumulative update includes the changes and fixes from all previous updates.
|
||||
|
||||
Servicing stack updates must ship separately from the cumulative updates because they modify the component that installs Windows updates. The servicing stack is released separately because the servicing stack itself requires an update. For example, the cumulative update [KB4284880](https://support.microsoft.com/help/4284880/windows-10-update-kb4284880) requires the [May 17, 2018 servicing stack update](https://support.microsoft.com/help/4132216), which includes updates to Windows Update.
|
||||
|
||||
|
||||
@ -15,7 +15,10 @@ ms.topic: article
|
||||
|
||||
**Applies to:** Windows 10
|
||||
|
||||
With the large number of different policies offered for Windows 10, Update Baseline provides a clear list of recommended Windows Update policy settings for IT administrators who want the best user experience while also meeting their monthly update compliance goals. See [Policies included in the Update Baseline](#policies-included-in-the-update-baseline) for the full list of policy configurations.
|
||||
> [!NOTE]
|
||||
> Update Baseline is not currently available for Windows 11.
|
||||
|
||||
With the large number of different policies offered for Windows client, Update Baseline provides a clear list of recommended Windows Update policy settings for IT administrators who want the best user experience while also meeting their monthly update compliance goals. See [Policies included in the Update Baseline](#policies-included-in-the-update-baseline) for the full list of policy configurations.
|
||||
|
||||
## Why is Update Baseline needed?
|
||||
|
||||
|
||||
@ -16,6 +16,10 @@ ms.topic: article
|
||||
---
|
||||
|
||||
# Configuring Microsoft Endpoint Manager devices for Update Compliance
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
> [!NOTE]
|
||||
> As of May 10, 2021, a new policy is required to use Update Compliance: "Allow Update Compliance Processing." For more details, see the Mobile Device Management policies and Group policies tables.
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Policies for update compliance, activity, and end-user experience
|
||||
title: Policies for update compliance, activity, and user experience
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
description:
|
||||
description: Explanation and recommendations for settings
|
||||
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
@ -14,7 +14,13 @@ ms.topic: article
|
||||
ms.collection: M365-modern-desktop
|
||||
---
|
||||
|
||||
# Policies for update compliance, activity, and end-user experience
|
||||
# Policies for update compliance, activity, and user experience
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Keeping devices up to date is the best way to keep them working smoothly and securely.
|
||||
|
||||
## Deadlines for update compliance
|
||||
@ -25,7 +31,7 @@ deadline approaches, and then prioritize velocity as the deadline nears, while s
|
||||
### Deadlines
|
||||
|
||||
Beginning with Windows 10, version 1903 and with the August 2019 security update for Windows 10, version 1709
|
||||
and late, a new policy was introduced to replace older deadline-like policies: **Specify deadlines for automatic updates and restarts**.
|
||||
and later (including Windows 11), a new policy was introduced to replace older deadline-like policies: **Specify deadlines for automatic updates and restarts**.
|
||||
|
||||
The older policies started enforcing deadlines once the device reached a “restart pending” state for
|
||||
an update. The new policy starts the countdown for the update installation deadline from when the
|
||||
@ -40,7 +46,7 @@ restarts for maximum update velocity).
|
||||
We recommend you set deadlines as follows:
|
||||
- Quality update deadline, in days: 3
|
||||
- Feature update deadline, in days: 7
|
||||
-
|
||||
|
||||
Notifications are automatically presented to the user at appropriate times, and users can choose to be reminded
|
||||
later, to reschedule, or to restart immediately, depending on how close the deadline is. We recommend that you
|
||||
do **not** set any notification policies, because they are automatically configured with appropriate defaults. An exception is if you
|
||||
@ -172,7 +178,7 @@ The default timeout on devices that support traditional sleep is set to three ho
|
||||
|
||||
## Old or conflicting policies
|
||||
|
||||
Each release of Windows 10 can introduce new policies to make the experience better for both administrators and their organizations. When we release a new client policy, we either release it purely for that release and later or we backport the policy to make it available on earlier versions.
|
||||
Each release of Windows client can introduce new policies to make the experience better for both administrators and their organizations. When we release a new client policy, we either release it purely for that release and later or we backport the policy to make it available on earlier versions.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you are using Group Policy, note that we don't update the old ADMX templates and you must use the newer (1903) ADMX template in order to use the newer policy. Also, if you are
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Build deployment rings for Windows 10 updates (Windows 10)
|
||||
description: Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades.
|
||||
title: Build deployment rings for Windows client updates
|
||||
description: Deployment rings in Windows client are similar to the deployment groups most organizations constructed for previous major revision upgrades.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
@ -12,12 +12,13 @@ ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Build deployment rings for Windows 10 updates
|
||||
|
||||
# Build deployment rings for Windows client updates
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
@ -26,7 +27,7 @@ ms.topic: article
|
||||
|
||||
For Windows as a service, maintenance is ongoing and iterative. Deploying previous versions of Windows required organizations to build sets of users to roll out the changes in phases. Typically, these users ranged (in order) from the most adaptable and least risky to the least adaptable or riskiest. With Windows 10, a similar methodology exists, but construction of the groups is a little different.
|
||||
|
||||
Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method by which to separate machines into a deployment timeline. With Windows 10, you construct deployment rings a bit differently in each servicing tool, but the concepts remain the same. Each deployment ring should reduce the risk of issues derived from the deployment of the feature updates by gradually deploying the update to entire departments. As previously mentioned, consider including a portion of each department’s employees in several deployment rings.
|
||||
Deployment rings in Windows client are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method by which to separate machines into a deployment timeline. With Windows client, you construct deployment rings a bit differently in each servicing tool, but the concepts remain the same. Each deployment ring should reduce the risk of issues derived from the deployment of the feature updates by gradually deploying the update to entire departments. As previously mentioned, consider including a portion of each department’s employees in several deployment rings.
|
||||
|
||||
Defining deployment rings is generally a one-time event (or at least infrequent), but IT should revisit these groups to ensure that the sequencing is still correct. Also, there are times in which client computers could move between different deployment rings when necessary.
|
||||
|
||||
@ -36,36 +37,26 @@ Table 1 provides an example of the deployment rings you might use.
|
||||
|
||||
| Deployment ring | Servicing channel | Deferral for feature updates | Deferral for quality updates | Example |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| Preview | Windows Insider Program | None | None | A few machines to evaluate early builds prior to their arrival to the semi-annual channel |
|
||||
| Broad | Semi-annual channel | 120 days | 7-14 days | Broadly deployed to most of the organization and monitored for feedback</br>Pause updates if there are critical issues |
|
||||
| Critical | Semi-annual channel | 180 days | 30 days | Devices that are critical and will only receive updates once they've been vetted for a period of time by the majority of the organization |
|
||||
| Preview | Windows Insider Program | None | None | A few machines to evaluate early builds prior to their arrival to the Semi-Annual channel |
|
||||
| Broad | Semi-Annual channel | 120 days | 7-14 days | Broadly deployed to most of the organization and monitored for feedback</br>Pause updates if there are critical issues |
|
||||
| Critical | Semi-Annual channel | 180 days | 30 days | Devices that are critical and will only receive updates once they've been vetted for some time by most of the organization |
|
||||
|
||||
>[!NOTE]
|
||||
>In this example, there are no rings made up of the long-term servicing channel (LTSC). The LTSC does not receive feature updates.
|
||||
|
||||
|
||||
As Table 1 shows, each combination of servicing channel and deployment group is tied to a specific deployment ring. As you can see, the associated groups of devices are combined with a servicing channel to specify which deployment ring those devices and their users fall into. The naming convention used to identify the rings is completely customizable as long as the name clearly identifies the sequence. Deployment rings represent a sequential deployment timeline, regardless of the servicing channel they contain. Deployment rings will likely rarely change for an organization, but they should be periodically assessed to ensure that the deployment cadence still makes sense.
|
||||
As Table 1 shows, each combination of servicing channel and deployment group is tied to a specific deployment ring. As you can see, the associated groups of devices are combined with a servicing channel to specify which deployment ring those devices and their users fall into. The naming convention used to identify the rings is customizable as long as the name clearly identifies the sequence. Deployment rings represent a sequential deployment timeline, regardless of the servicing channel they contain. Deployment rings will likely rarely change for an organization, but they should be periodically assessed to ensure that the deployment cadence still makes sense.
|
||||
|
||||
|
||||
## Steps to manage updates for Windows 10
|
||||
## Steps to manage updates for Windows client
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | Build deployment rings for Windows 10 updates (this topic) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) |
|
||||
|  | [Prepare servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | Build deployment rings for Windows client updates (this article) |
|
||||
|  | [Assign devices to servicing channels for Windows client updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows client updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows client updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) |
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
|
||||
- [Manage software updates in Intune](/intune/windows-update-for-business-configure)
|
||||
- [Walkthrough: use Intune to configure Windows Update for Business](/intune/windows-update-for-business-configure)
|
||||
- [Manage device restarts after updates](waas-restart.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Deploy Windows 10 updates using Windows Server Update Services (Windows 10)
|
||||
title: Deploy Windows client updates using Windows Server Update Services
|
||||
description: WSUS allows companies to defer, selectively approve, choose when delivered, and determine which devices receive updates.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
@ -11,12 +11,13 @@ manager: laurawi
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Deploy Windows 10 updates using Windows Server Update Services (WSUS)
|
||||
# Deploy Windows client updates using Windows Server Update Services (WSUS)
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
@ -26,13 +27,13 @@ ms.topic: article
|
||||
|
||||
WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that Microsoft Endpoint Manager provides.
|
||||
|
||||
When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows 10 client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 10.
|
||||
When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 11.
|
||||
|
||||
|
||||
|
||||
## Requirements for Windows 10 servicing with WSUS
|
||||
## Requirements for Windows client servicing with WSUS
|
||||
|
||||
To be able to use WSUS to manage and deploy Windows 10 feature updates, you must use a supported WSUS version:
|
||||
To be able to use WSUS to manage and deploy Windows feature updates, you must use a supported WSUS version:
|
||||
- WSUS 10.0.14393 (role in Windows Server 2016)
|
||||
- WSUS 10.0.17763 (role in Windows Server 2019)
|
||||
- WSUS 6.2 and 6.3 (role in Windows Server 2012 and Windows Server 2012 R2)
|
||||
@ -108,7 +109,7 @@ As Windows clients refresh their computer policies (the default Group Policy ref
|
||||
## Create computer groups in the WSUS Administration Console
|
||||
|
||||
>[!NOTE]
|
||||
>The following procedures use the groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) as examples.
|
||||
>The following procedures use the groups from Table 1 in [Build deployment rings for Windows client updates](waas-deployment-rings-windows-10-updates.md) as examples.
|
||||
|
||||
You can use computer groups to target a subset of devices that have specific quality and feature updates. These groups represent your deployment rings, as controlled by WSUS. You can populate the groups either manually by using the WSUS Administration Console or automatically through Group Policy. Regardless of the method you choose, you must first create the groups in the WSUS Administration Console.
|
||||
|
||||
@ -241,10 +242,11 @@ The next time the clients in the **Ring 4 Broad Business Users** security group
|
||||
For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS.
|
||||
|
||||
>[!NOTE]
|
||||
>WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for Semi-Annual Channel, the devices in the Semi-Annual Channel will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS.
|
||||
>WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for Semi-Annual Channel (or General Availability Channel), the devices in that will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS.
|
||||
|
||||
|
||||
**To configure an Automatic Approval rule for Windows 10 feature updates and approve them for the Ring 3 Broad IT deployment ring**
|
||||
**To configure an Automatic Approval rule for Windows client feature updates and approve them for the Ring 3 Broad IT deployment ring**
|
||||
This example uses Windows 10, but the process is the same for Windows 11.
|
||||
|
||||
1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Options, and then select **Automatic Approvals**.
|
||||
|
||||
@ -273,16 +275,16 @@ For clients that should have their feature updates approved as soon as they’re
|
||||
>[!NOTE]
|
||||
>WSUS does not honor any existing month/week/day [deferral settings](waas-configure-wufb.md#configure-when-devices-receive-feature-updates). That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait.
|
||||
|
||||
Now, whenever Windows 10 feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week.
|
||||
Now, whenever Windows client feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week.
|
||||
|
||||
> [!WARNING]
|
||||
> The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows 10 version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actually want--which can be a problem when the download sizes are very large.
|
||||
> The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows client version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actually want--which can be a problem when the download sizes are very large.
|
||||
|
||||
## Manually approve and deploy feature updates
|
||||
|
||||
You can manually approve updates and set deadlines for installation within the WSUS Administration Console, as well. It might be best to approve update rules manually after your pilot deployment has been updated.
|
||||
|
||||
To simplify the manual approval process, start by creating a software update view that contains only Windows 10 updates.
|
||||
To simplify the manual approval process, start by creating a software update view that contains only Windows 10 (in this example) updates. The process is the same for Windows 11 updates.
|
||||
|
||||
> [!NOTE]
|
||||
> If you approve more than one feature update for a computer, an error can result with the client. Approve only one feature update per computer.
|
||||
@ -329,33 +331,16 @@ Now that you have the **All Windows 10 Upgrades** view, complete the following s
|
||||
|
||||
</br>
|
||||
|
||||
## Steps to manage updates for Windows 10
|
||||
## Steps to manage updates for Windows client
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or Deploy Windows 10 updates using Windows Server Update Services (this topic)</br>or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) |
|
||||
|  | [Prepare servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows client updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows client updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows client updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or Deploy Windows client updates using Windows Server Update Services (this topic)</br>or [Deploy Windows client updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) |
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
|
||||
- [Walkthrough: use Intune to configure Windows Update for Business](/intune/windows-update-for-business-configure)
|
||||
- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service)
|
||||
- [Manage device restarts after updates](waas-restart.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Optimize update delivery for Windows 10 updates (Windows 10)
|
||||
title: Optimize update delivery for Windows client updates
|
||||
description: Two methods of peer-to-peer content distribution are available in Windows 10, Delivery Optimization and BranchCache.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
@ -11,24 +11,25 @@ manager: laurawi
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Optimize Windows 10 update delivery
|
||||
# Optimize Windows client update delivery
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
When considering your content distribution strategy for Windows 10, think about enabling a form of peer-to-peer content sharing to reduce bandwidth issues during updates. Windows 10 offers two peer-to-peer options for update content distribution: Delivery Optimization and BranchCache. These technologies can be used with several of the servicing tools for Windows 10.
|
||||
When considering your content distribution strategy for Windows 10, think about enabling a form of peer-to-peer content sharing to reduce bandwidth issues during updates. Windows client offers two peer-to-peer options for update content distribution: Delivery Optimization and BranchCache. These technologies can be used with several of the servicing tools for Windows client.
|
||||
|
||||
Two methods of peer-to-peer content distribution are available in Windows 10.
|
||||
Two methods of peer-to-peer content distribution are available.
|
||||
|
||||
- [Delivery Optimization](waas-delivery-optimization.md) is a new peer-to-peer distribution method in Windows 10. Windows 10 clients can source content from other devices on their local network that have already downloaded the updates or from peers over the internet. Using the settings available for Delivery Optimization, clients can be configured into groups, allowing organizations to identify devices that are possibly the best candidates to fulfill peer-to-peer requests.
|
||||
- [Delivery Optimization](waas-delivery-optimization.md) is a peer-to-peer distribution method in Windows. Windows clients can source content from other devices on their local network that have already downloaded the updates or from peers over the internet. Using the settings available for Delivery Optimization, clients can be configured into groups, allowing organizations to identify devices that are possibly the best candidates to fulfill peer-to-peer requests.
|
||||
|
||||
Windows Update, Windows Update for Business, and Windows Server Update Services (WSUS) can use Delivery Optimization. Delivery Optimization can significantly reduce the amount of network traffic to external Windows Update sources as well as the time it takes for clients to retrieve the updates.
|
||||
|
||||
- [BranchCache](waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of Windows Server 2016 and Windows 10 operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7.
|
||||
- [BranchCache](waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of Windows Server 2016 and Windows operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7.
|
||||
|
||||
>[!NOTE]
|
||||
>Full BranchCache functionality is supported in Windows 10 Enterprise and Education; Windows 10 Pro supports some BranchCache functionality, including BITS transfers used for servicing operations.
|
||||
@ -49,7 +50,7 @@ Two methods of peer-to-peer content distribution are available in Windows 10.
|
||||
|
||||
## Express update delivery
|
||||
|
||||
Windows 10 quality update downloads can be large because every package contains all previously released fixes to ensure consistency and simplicity. Windows has been able to reduce the size of Windows Update downloads with a feature called Express.
|
||||
Windows client quality update downloads can be large because every package contains all previously released fixes to ensure consistency and simplicity. Windows has been able to reduce the size of Windows Update downloads with a feature called Express.
|
||||
|
||||
> [!NOTE]
|
||||
> Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business.
|
||||
@ -84,25 +85,15 @@ At this point, the download is complete and the update is ready to be installed.
|
||||
> [!TIP]
|
||||
> Express will **always** be leveraged if your machines are updated regularly with the latest cumulative updates.
|
||||
|
||||
## Steps to manage updates for Windows 10
|
||||
## Steps to manage updates for Windows client
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Prepare servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows client updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows client updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | Optimize update delivery for Windows 10 updates (this topic) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)<br/>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)<br/>or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)<br/>or [Deploy Windows client updates using Windows Server Update Services](waas-manage-updates-wsus.md)<br/>or [Deploy Windows client updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) |
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
|
||||
- [Walkthrough: use Intune to configure Windows Update for Business](/intune/windows-update-for-business-configure)
|
||||
- [Manage device restarts after updates](waas-restart.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Prepare servicing strategy for Windows 10 updates (Windows 10)
|
||||
description: A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update.
|
||||
title: Prepare servicing strategy for Windows client updates
|
||||
description: A strong Windows client deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
@ -17,7 +17,8 @@ ms.collection: m365initiative-coredeploy
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
@ -48,25 +49,13 @@ Each time Microsoft releases a Windows 10 feature update, the IT department shou
|
||||
3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings, like the ones discussed in Table 1. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don’t prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more people have been updated in any particular department.
|
||||
|
||||
|
||||
## Steps to manage updates for Windows 10
|
||||
## Steps to manage updates for Windows client
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | Prepare servicing strategy for Windows 10 updates (this topic) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) |
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
|
||||
- [Walkthrough: use Intune to configure Windows Update for Business](/intune/windows-update-for-business-configure)
|
||||
- [Manage device restarts after updates](waas-restart.md)
|
||||
|  | Prepare servicing strategy for Windows client updates (this topic) |
|
||||
|  | [Build deployment rings for Windows client updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows client updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows client updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows client updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows client updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) |
|
||||
|
||||
@ -16,7 +16,8 @@ ms.topic: article
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
@ -29,7 +30,7 @@ An IT administrator can set policies for Windows Update for Business by using Mi
|
||||
|
||||
To manage updates with Windows Update for Business, you should prepare with these steps, if you haven't already:
|
||||
|
||||
- Create Active Directory security groups that align with the deployment rings you use to phase deployment of updates. See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to learn more about deployment rings in Windows 10.
|
||||
- Create Active Directory security groups that align with the deployment rings you use to phase deployment of updates. See [Build deployment rings for Windows client updates](waas-deployment-rings-windows-10-updates.md) to learn more about deployment rings in Windows client.
|
||||
- Allow access to the Windows Update service.
|
||||
|
||||
|
||||
@ -39,7 +40,7 @@ You can control when updates are applied, for example by deferring when an updat
|
||||
|
||||
### Determine which updates you want offered to your devices
|
||||
|
||||
Both Windows 10 feature and quality updates are automatically offered to devices that are connected to Windows Update using Windows Update for Business policies. However, you can choose whether you want the devices to additionally receive other Microsoft Updates or drivers that are applicable to that device.
|
||||
Both feature and quality updates are automatically offered to devices that are connected to Windows Update using Windows Update for Business policies. However, you can choose whether you want the devices to additionally receive other Microsoft Updates or drivers that are applicable to that device.
|
||||
|
||||
To enable Microsoft Updates use [Update/AllwMUUpdateService](/windows/client-management/mdm/policy-csp-update#update-allowmuupdateservice).
|
||||
|
||||
@ -194,22 +195,3 @@ When you disable this setting, users will see **Some settings are managed by you
|
||||
If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use [Update/SetDisableUXWUAccess](/windows/client-management/mdm/policy-csp-update#update-setdisableuxwuaccess).
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
- [Walkthrough: use Intune to configure Windows Update for Business](/intune/windows-update-for-business-configure)
|
||||
- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
|
||||
- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service)
|
||||
- [Manage device restarts after updates](waas-restart.md)
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Walkthrough use Intune to configure Windows Update for Business (Windows 10)
|
||||
title: Walkthrough use Intune to configure Windows Update for Business
|
||||
description: In this article, learn how to configure Windows Update for Business settings using Microsoft Intune.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
|
||||
@ -17,7 +17,10 @@ ms.custom: seo-marvel-apr2020
|
||||
|
||||
# Windows Update error codes by component
|
||||
|
||||
> Applies to: Windows 10
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
|
||||
This section lists the error codes for Microsoft Windows Update.
|
||||
|
||||
@ -7,34 +7,213 @@ audience: itpro
|
||||
itproauthor: jaimeo
|
||||
ms.audience: itpro
|
||||
author: jaimeo
|
||||
ms.reviewer:
|
||||
ms.reviewer: kaushika
|
||||
manager: laurawi
|
||||
ms.topic: article
|
||||
ms.topic: troubleshooting
|
||||
ms.custom: seo-marvel-apr2020
|
||||
---
|
||||
|
||||
# Windows Update common errors and mitigation
|
||||
|
||||
>Applies to: Windows 10
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
The following table provides information about common errors you might run into with Windows Update, as well as steps to help you mitigate them.
|
||||
|
||||
## 0x8024402F
|
||||
|
||||
| Error Code | Message | Description | Mitigation |
|
||||
|------------------------------------------|-----------------------------------|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 0x8024402F | WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS | External cab file processing completed with some errors | One of the reasons we see this issue is due to the design of a software called Lightspeed Rocket for Web filtering. <br>Add the IP addresses of devices you want to get updates to the exceptions list of Lightspeed |
|
||||
| 0x80242006 | WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. | Rename Software Redistribution Folder and attempt to download the updates again: <br>Rename the following folders to \*.BAK: <br>- %systemroot%\system32\catroot2 <br><br>Type the following commands at a command prompt. Press ENTER after you type each command.<br>- Ren %systemroot%\SoftwareDistribution\DataStore \*.bak<br>- Ren %systemroot%\SoftwareDistribution\Download \*.bak<br>Ren %systemroot%\system32\catroot2 \*.bak |
|
||||
| 0x80070BC9 | ERROR_FAIL_REBOOT_REQUIRED | The requested operation failed. A system reboot is required to roll back changes made. | Ensure that you don't have any policies that control the start behavior for the Windows Module Installer. This service should be managed by the operating system. |
|
||||
| 0x80200053 | BG_E_VALIDATION_FAILED | NA | Ensure that there are no firewalls that filter downloads. Such filtering could lead to incorrect responses being received by the Windows Update Client.<br><br>If the issue still persists, run the [Windows Update reset script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc). |
|
||||
| 0x80072EE2 | WININET_E_TIMEOUT | The operation timed out | This error message can be caused if the computer isn't connected to the Internet. To fix this issue, follow these steps: make sure these URLs are not blocked: <br> http://<em>.update.microsoft.com<br>https://</em>.update.microsoft.com <br><http://download.windowsupdate.com> <br><br>You can also take a network trace to check what is timing out. \<Refer to Firewall Troubleshooting scenario> |
|
||||
| 0x80072EFD <br>0x80072EFE <br>0x80D02002 | TIME_OUT_ERRORS | The operation timed out | Make sure there are no firewall rules or proxy to block Microsoft download URLs. <br>Take a network monitor trace to understand better. \<Refer to Firewall Troubleshooting scenario> |
|
||||
| 0X8007000D | ERROR_INVALID_DATA | Indicates invalid data downloaded or corruption occurred. | Attempt to re-download the update and initiate installation. |
|
||||
| 0x8024A10A | USO_E_SERVICE_SHUTTING_DOWN | Indicates that the Windows Update Service is shutting down. | This can occur after a very long period of time of inactivity, the system failing to respond leading to the service being idle and causing the service to shut down. Ensure that the system remains active and the connections remain established to complete the upgrade. |
|
||||
| 0x80240020 | WU_E_NO_INTERACTIVE_USER | Operation did not complete because there is no logged-on interactive user. | Sign in to the device to start the installation and allow the device to restart. |
|
||||
| 0x80242014 | WU_E_UH_POSTREBOOTSTILLPENDING | The post-restart operation for the update is still in progress. | Some Windows Updates require the device to be restarted. Restart the device to complete update installation. |
|
||||
| 0x80246017 | WU_E_DM_UNAUTHORIZED_LOCAL_USER | The download failed because the local user was denied authorization to download the content. | Ensure that the user attempting to download and install updates has been provided with sufficient privileges to install updates (Local Administrator). |
|
||||
| 0x8024000B | WU_E_CALL_CANCELLED | Operation was canceled. | The operation was canceled by the user or service. You might also receive this error when we are unable to filter the results. Run the [Decline Superseded PowerShell script](https://gallery.technet.microsoft.com/scriptcenter/Cleanup-WSUS-server-4424c9d6) to allow the filtering process to complete. |
|
||||
| 0x8024000E | WU_E_XML_INVALID | Windows Update Agent found invalid information in the update's XML data. | Certain drivers contain additional metadata information in the update.xml, which could lead Orchestrator to understand it as invalid data. Ensure that you have the latest Windows Update Agent installed on the machine. |
|
||||
| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file. | You may encounter this error when WSUS is not sending the Self-update to the clients.<br><br>Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue. |
|
||||
| 0x80244007 | WU_E_PT_SOAPCLIENT_SOAPFAULT | SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. | This issue occurs because Windows cannot renew the cookies for Windows Update. <br><br>Review [KB2883975](https://support.microsoft.com/help/2883975/0x80244007-error-when-windows-tries-to-scan-for-updates-on-a-wsus-serv) for instructions to resolve the issue. |
|
||||
| 0x80070422 | | This issue occurs when the Windows Update service stops working or is not running. | Check if the Windows Update service is running.<br> |
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS | External .cab file processing completed with some errors | This can be caused by the Lightspeed Rocket for web filtering software. <br>Add the IP addresses of devices you want to get updates to the exceptions list of Lightspeed Rocket. |
|
||||
|
||||
## 0x80242006
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. | Rename the software redistribution folder and try to download the updates again: <br>Rename the following folders to \*.BAK: <br>- %systemroot%\system32\catroot2 <br><br>Type the following commands at a command prompt. Press ENTER after you type each command.<br>- Ren %systemroot%\SoftwareDistribution\DataStore \*.bak<br>- Ren %systemroot%\SoftwareDistribution\Download \*.bak<br>- Ren %systemroot%\system32\catroot2 \*.bak |
|
||||
|
||||
## 0x80070BC9
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| ERROR_FAIL_REBOOT_REQUIRED | The requested operation failed. Restart the system to roll back changes made. | Ensure that you don't have any policies that control the start behavior for the Windows Module Installer. This service should be managed by the operating system. |
|
||||
|
||||
## 0x80200053
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| BG_E_VALIDATION_FAILED | NA | Ensure that there are no firewalls that filter downloads. Such filtering could lead to incorrect responses being received by the Windows Update client.<br><br>If the issue still persists, run the [Windows Update reset script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc).|
|
||||
|
||||
## 0x80072EFD or 0x80072EFE or 0x80D02002
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| TIME_OUT_ERRORS | The operation timed out | Make sure there are no firewall rules or proxies that block Microsoft download URLs. <br>Take a network monitor trace to understand better. \<Refer to Firewall Troubleshooting scenario> |
|
||||
|
||||
## 0X8007000D
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| ERROR_INVALID_DATA | Indicates data that isn't valid was downloaded or corruption occurred.| Attempt to re-download the update and start installation. |
|
||||
|
||||
## 0x8024A10A
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| USO_E_SERVICE_SHUTTING_DOWN | Indicates that the Windows Update Service is shutting down. | This can occur after a very long period of time of inactivity. The system fails to respond, leading to the service being idle and causing the service to shut down. Ensure that the system remains active and the connections remain established to complete the installation. |
|
||||
|
||||
## 0x80240020
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_NO_INTERACTIVE_USER | Operation did not complete because no interactive user is signed in. | Sign in to the device to start the installation and allow the device to restart. |
|
||||
|
||||
## 0x80242014
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_UH_POSTREBOOTSTILLPENDING | The post-restart operation for the update is still in progress. | Some Windows updates require the device to be restarted. Restart the device to complete update installation. |
|
||||
|
||||
## 0x80246017
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_DM_UNAUTHORIZED_LOCAL_USER | The download failed because the local user was denied authorization to download the content. | Ensure that the user attempting to download and install updates has been provided with sufficient privileges to install updates (Local Administrator).|
|
||||
|
||||
## 0x8024000B
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_CALL_CANCELLED | Operation was canceled. | The operation was canceled by the user or service. You might also receive this error when we're unable to filter the results. Run the [Decline Superseded PowerShell script](https://gallery.technet.microsoft.com/scriptcenter/Cleanup-WSUS-server-4424c9d6) to allow the filtering process to complete. |
|
||||
|
||||
## 0x8024000E
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_XML_INVALID | Windows Update Agent found information in the update's XML data that isn't valid. | Certain drivers contain additional metadata information in Update.xml, which Orchestrator can interpret as data that isn't valid. Ensure that you have the latest Windows Update Agent installed on the device. |
|
||||
|
||||
## 0x8024D009
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the Wuident.cab file. | You might encounter this error when WSUS is not sending the self-update to the clients.<br><br>Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue. |
|
||||
|
||||
## 0x80244007
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_PT_SOAPCLIENT_SOAPFAULT | SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. | This issue occurs because Windows can't renew the cookies for Windows Update. <br><br>Review [KB2883975](https://support.microsoft.com/help/2883975/0x80244007-error-when-windows-tries-to-scan-for-updates-on-a-wsus-serv) for instructions to resolve the issue. |
|
||||
|
||||
## 0x80070422
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| NA | This issue occurs when the Windows Update service stops working or isn't running. | Check if the Windows Update service is running.<br> |
|
||||
|
||||
## 0x800f0821
|
||||
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| CBS_E_ABORT; client abort, IDABORT returned by ICbsUIHandler method except Error() | CBS transaction timeout exceeded. | A servicing operation is taking a long time to complete. The servicing stack watchdog timer expires. Extending the timeout will mitigate the issue. Increase the resources on the device. If a virtual machine, increase virtual CPU and memory to speed up operations. Make sure the has installed the update in KB4493473 or later.|
|
||||
|
||||
## 0x800f0825
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| CBS_E_CANNOT_UNINSTALL; Package cannot be uninstalled. | Typically this is due component store corruption caused when a component is in a partially installed state. | Repair the component store with the **Dism RestoreHealth** command or manually repair with a payload from the partially installed component. From an elevated command prompt, run these commands:<br>*DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*<br>*DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALT*<br>*DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*<br>*Sfc /Scannow*<br> Restart the device. |
|
||||
|
||||
## 0x800F0920
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| CBS_E_HANG_DETECTED; A failure to respond was detected while processing the operation. | Subsequent error logged after getting 0x800f0821 | A servicing operation is taking a long time to complete. The servicing stack watchdog timer expires and assumes the system has stopped responding. Extending the timeout will mitigate the issue. Increase the resources on the device. If a virtual machine, increase virtual CPU and memory to speed up operations. Make sure the device has installed the update in KB4493473 or later.|
|
||||
|
||||
## 0x800f081f
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| CBS_E_SOURCE_MISSING; source for package or file not found, ResolveSource() unsuccessful | Component Store corruption | Repair the component store with the **Dism RestoreHealth** command or manually repair with the payload from the partially installed component. From an elevated command prompt and run these commands:<br>*DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*<br>*DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALT*<br>*DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*<br>*Sfc /Scannow*<br> Restart the device. |
|
||||
|
||||
## 0x800f0831
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| CBS_E_STORE_CORRUPTION; CBS store is corrupted. | Corruption in the Windows Component Store. | Repair the component store with **Dism RestoreHealth** or manually repair with the payload from the partially installed component. From an elevated command prompt and run these commands:<br>*DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*<br>*DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALT*<br>*DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*<br>*Sfc /Scannow*<br> Restart the device. |
|
||||
|
||||
## 0x80070005
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| E_ACCESSDENIED; General access denied error | File system or registry key permissions have been changed and the servicing stack doesn't have the required level of access. | This error generally means an access was denied.<br> Go to %Windir%\logs\CBS, open the last CBS.log and search for “, error” and match with the timestamp. After finding the error, scroll up and try to determine what caused the access denial. It could be acess denied to a file, registry key. Determine what object needs the right permissions and change the permissions as needed. |
|
||||
|
||||
## 0x80070570
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| ERROR_FILE_CORRUPT; The file or directory is corrupted and unreadable. | Component Store corruption | Repair the component store with **Dism RestoreHealth** or manually repair with the payload from the partially installed component. From an elevated command prompt and run these commands:<br>*DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*<br>*DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALT*<br>*DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*<br>*Sfc /Scannow*<br> Restart the device.|
|
||||
|
||||
|
||||
## 0x80070003
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| ERROR_PATH_NOT_FOUND; The system cannot find the path specified. | The servicing stack cannot access a specific path. | Indicates an invalid path to an executable. Go to %Windir%\logs\CBS, open the last CBS.log, and search for “, error” and match with the timestamp. |
|
||||
|
||||
|
||||
## 0x80070020
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| ERROR_SHARING_VIOLATION | Numerous causes. CBS log analysis required. | This error is usually caused by non-Microsoft filter drivers like antivirus. <br> 1. [Perform a clean boot and retry the installation](https://support.microsoft.com/help/929135/) <br> 2. Download the sysinternal tool [Process Monitor](/sysinternals/downloads/procmon). <br> 3. Run Procmon.exe. It will start data capture automatically. <br> 4. Install the update package again <br> 5. With the Process Monitor main window in focus, press CTRL + E or select the magnifying glass to stop data capture. <br> 6. Select **File > Save > All Events > PML**, and choose a path to save the .PML file <br> 7. Go to %windir%\logs\cbs, open the last Cbs.log file, and search for the error. After finding the error line a bit above, you should have the file being accessed during the installation that is giving the sharing violation error <br> 8. In Process Monitor, filter for path and insert the file name (it should be something like “path” “contains” “filename from CBS”). <br> 9. Try to stop it or uninstall the process causing the error. |
|
||||
|
||||
## 0x80073701
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| ERROR_SXS_ASSEMBLY_MISSING; The referenced assembly could not be found. | Typically, a component store corruption caused when a component is in a partially installed state. | Repair the component store with **Dism RestoreHealth command** or manually repair it with the payload from the partially installed component. From an elevated command prompt and run these commands:<br>*DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*<br>*DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALT*<br>*DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*<br>*Sfc /Scannow*<br> Restart the device. |
|
||||
|
||||
## 0x8007371b
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE; One or more required members of the transaction are not present. | Component Store corruption. | Repair the component store with **Dism RestoreHealth command** or manually repair it with the payload from the partially installed component. From an elevated command prompt and run these commands:<br>*DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*<br>*DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALT*<br>*DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*<br>*Sfc /Scannow*<br> Restart the device. |
|
||||
|
||||
## 0x80072EFE
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WININET_E_CONNECTION_ABORTED; The connection with the server was closed abnormally | BITS is unable to transfer the file successfully. | Encountered if BITS is broken or if the file being transferred can't be written to the destination folder on the client. This error is usually caused by connection errors while checking or downloading updates.<br> From a cmd prompt run: *BITSADMIN /LIST /ALLUSERS /VERBOSE* <br> Search for the 0x80072EFE error code. You should see a reference to an HTTP code with a specific file. Using a browser, try to download it manually, making sure you’re using your organization's proxy settings. If the download fails, check with your proxy manager to allow for the communication to be sucesfull. Also check with your network team for this specific URL access. |
|
||||
|
||||
## 0x80072F8F
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WININET_E_DECODING_FAILED; Content decoding has failed | TLS 1.2 is not configured correctly on the client. | This error generally means that the Windows Update Agent was unable to decode the received content. Install and configure TLS 1.2 by installing the update in [KB3140245](https://support.microsoft.com/help/3140245/).
|
||||
|
||||
## 0x80072EE2
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WININET_E_TIMEOUT; The operation timed out | Unable to scan for updates due to a connectivity issue to Windows Update, Configuration Manager, or WSUS. | This error generally means that the Windows Update Agent was unable to connect to the update servers or your own source, such as WSUS, Configuration Manager, or Microsoft Endpoint Manager. <br> Check with your network team to ensure that the device can reach the update sources. For more info, see [Troubleshoot software update scan failures in Configuration Manager](/mem/configmgr/troubleshoot-software-update-scan-failures). <br> If you’re using the public Microsoft update servers, check that your device can access the following Windows Update endpoints: <br> `http://windowsupdate.microsoft.com` <br> https://*.windowsupdate.microsoft.com <br> https://*.windowsupdate.microsoft.com <br> https://*.update.microsoft.com <br> https://*.update.microsoft.com <br> https://*.windowsupdate.com <br> https://download.windowsupdate.com <br> https://download.microsoft.com <br> https://*.download.windowsupdate.com <br> https://wustat.windows.com <br> https://ntservicepack.microsoft.com |
|
||||
|
||||
## 0x80240022
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_ALL_UPDATES_FAILED; Operation failed for all the updates. | Multiple root causes for this error.| Most common issue is that antivirus software is blocking access to certain folders (like SoftwareDistribution). CBS.log analysis needed to determine the file or folder being protected. |
|
||||
|
||||
## 0x8024401B
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ; Same as HTTP status 407 - proxy authentication is required. | Unable to authenticate through a proxy server. | Either the Winhttp proxy or WinInet proxy settings are not configured correctly. This error generally means that the Windows Update Agent was unable to connect to the update servers or your own update source, such as WSUS, Configuration Manager, or Microsoft Endpoint Manager, due to a proxy error. <br> Verify the proxy settings on the client. The Windows Update Agent uses WinHTTP to scan for available updates. When there is a proxy server between the client and the update source, the proxy settings must be configured correctly on the clients to enable them to communicate by using the source's FQDN. <br> Check with your network and proxy teams to confirm that the device can the update source without the proxy requiring user authentication. |
|
||||
|
||||
|
||||
## 0x80244022
|
||||
|
||||
| Message | Description | Mitigation |
|
||||
|---------|-------------|------------|
|
||||
| WU_E_PT_HTTP_STATUS_SERVICE_UNAVAILABLE; Same as HTTP status 503 - the service is temporarily overloaded. | Unable to connect to the configured update source. | Network troubleshooting needed to resolve the connectivity issue. Check with your network and proxy teams to confirm that the device can the update source without the proxy requiring user authentication. |
|
||||
|
||||
@ -18,6 +18,7 @@ author: jaimeo
|
||||
**Applies to**:
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
- Windows Server 2016
|
||||
- Windows Server 2019
|
||||
|
||||
|
||||
@ -15,13 +15,16 @@ ms.custom: seo-marvel-apr2020
|
||||
|
||||
# Windows Update troubleshooting
|
||||
|
||||
>Applies to: Windows 10
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
If you run into problems when using Windows Update, start with the following steps:
|
||||
|
||||
1. Run the built-in Windows Update troubleshooter to fix common issues. Navigate to **Settings > Update & Security > Troubleshoot > Windows Update**.
|
||||
|
||||
2. Install the most recent Servicing Stack Update (SSU) that matches your version of Windows from the Microsoft Update Catalog. See [Servicing stack updates](servicing-stack-updates.md) for more details on servicing stack updates.
|
||||
2. Install the most recent Servicing Stack Update that matches your version of Windows from the Microsoft Update Catalog. See [Servicing stack updates](servicing-stack-updates.md) for more details on servicing stack updates.
|
||||
|
||||
3. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system:
|
||||
|
||||
@ -171,11 +174,11 @@ Ensure that devices can reach necessary Windows Update endpoints through the fir
|
||||
> [!NOTE]
|
||||
> Be sure not to use HTTPS for those endpoints that specify HTTP, and vice versa. The connection will fail.
|
||||
|
||||
The specific endpoints can vary between Windows 10 versions. See, for example, [Windows 10 2004 Enterprise connection endpoints](/windows/privacy/manage-windows-2004-endpoints). Similar articles for other Windows 10 versions are available in the table of contents nearby.
|
||||
The specific endpoints can vary between Windows client versions. See, for example, [Windows 10 2004 Enterprise connection endpoints](/windows/privacy/manage-windows-2004-endpoints). Similar articles for other Windows client versions are available in the table of contents nearby.
|
||||
|
||||
|
||||
## Updates aren't downloading from the intranet endpoint (WSUS or Configuration Manager)
|
||||
Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps:
|
||||
Windows client devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps:
|
||||
|
||||
1. Start Windows PowerShell as an administrator.
|
||||
2. Run \$MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager".
|
||||
@ -186,7 +189,7 @@ Check the output for the Name and OffersWindowsUPdates parameters, which you can
|
||||
|Output|Meaning|
|
||||
|-|-|
|
||||
|- Name: Microsoft Update <br>-OffersWindowsUpdates: True| - The update source is Microsoft Update, which means that updates for other Microsoft products besides the operating system could also be delivered.<br>- Indicates that the client is configured to receive updates for all Microsoft Products (Office, etc.) |
|
||||
|- <a name="BKMK_DCAT"></a>Name: DCat Flighting Prod <br>- OffersWindowsUpdates: True |- Starting with Windows 10 1709, feature updates are always delivered through the DCAT service.<br>- Indicates that the client is configured to receive feature updates from Windows Update. |
|
||||
|- <a name="BKMK_DCAT"></a>Name: DCat Flighting Prod <br>- OffersWindowsUpdates: True |- Starting with Windows 10, version 1709, feature updates are always delivered through the DCAT service.<br>- Indicates that the client is configured to receive feature updates from Windows Update. |
|
||||
|- Name: Windows Store (DCat Prod) <br>- OffersWindowsUpdates: False |-The update source is Insider Updates for Store Apps.<br>- Indicates that the client will not receive or is not configured to receive these updates.|
|
||||
|- Name: Windows Server Update Service <br>- OffersWindowsUpdates: True |- The source is a Windows Server Updates Services server. <br>- The client is configured to receive updates from WSUS. |
|
||||
|- Name: Windows Update<br>- OffersWindowsUpdates: True|- The source is Windows Update. <br>- The client is configured to receive updates from Windows Update Online.|
|
||||
@ -230,8 +233,8 @@ As shown in the following logs, automatic update runs the scan and finds no upda
|
||||
2018-08-06 10:58:47:383 480 5d8 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates Id = 57]
|
||||
```
|
||||
|
||||
## High bandwidth usage on Windows 10 by Windows Update
|
||||
Users might see that Windows 10 is consuming all the bandwidth in the different offices under the system context. This behavior is by design. Components that might consume bandwidth expand beyond Windows Update components.
|
||||
## High bandwidth usage on Windows client by Windows Update
|
||||
Users might see that Windows is consuming all the bandwidth in the different offices under the system context. This behavior is by design. Components that might consume bandwidth expand beyond Windows Update components.
|
||||
|
||||
The following group policies can help mitigate this situation:
|
||||
|
||||
|
||||
@ -71,7 +71,7 @@ Here are some things you can do with Windows SIM:
|
||||
|
||||
For a list of settings you can change, see [Unattended Windows Setup Reference](/windows-hardware/customize/desktop/unattend/) on the MSDN Hardware Dev Center.
|
||||
|
||||
### Create a Windows image using Windows ICD
|
||||
### Create a provisioning package using Windows ICD
|
||||
|
||||
Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](/windows/configuration/provisioning-packages/provisioning-install-icd) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) or Windows 10 IoT Core (IoT Core) image.
|
||||
|
||||
@ -79,7 +79,6 @@ Here are some things you can do with Windows ICD:
|
||||
|
||||
- [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package)
|
||||
- [Export a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package)
|
||||
- [Build and deploy an image for Windows 10 for desktop editions](https://msdn.microsoft.com/library/windows/hardware/dn916105.aspx)
|
||||
|
||||
### IT Pro Windows deployment tools
|
||||
|
||||
@ -90,4 +89,4 @@ There are also a few tools included in the Windows ADK that are specific to IT P
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Active Directory Security Groups (Windows 10)
|
||||
title: Active Directory Security Groups
|
||||
description: Active Directory Security Groups
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -12,14 +12,15 @@ manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 09/21/2021
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Active Directory Security Groups
|
||||
|
||||
**Applies to**
|
||||
- Windows Server 2016
|
||||
- Windows Server 2016 or later
|
||||
- Windows 10 or later
|
||||
|
||||
This reference topic for the IT professional describes the default Active Directory security groups.
|
||||
|
||||
@ -1489,7 +1490,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<domain>-512</p></td>
|
||||
<td><p>S-1-5-21-<domain>-512</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
@ -1885,7 +1886,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-21-<domain>-498</p></td>
|
||||
<td><p>S-1-5-21-<root domain>-498</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
|
||||
@ -15,31 +15,31 @@ localizationpriority: medium
|
||||
ms.date: 02/15/2019
|
||||
ms.reviewer:
|
||||
---
|
||||
# WebAuthn APIs for password-less authentication on Windows 10
|
||||
# WebAuthn APIs for password-less authentication on Windows
|
||||
|
||||
|
||||
### Passwords leave your customers vulnerable. With the new WebAuthn APIs, your sites and apps can leverage password-less authentication.
|
||||
### Passwords leave your customers vulnerable. With the new WebAuthn APIs, your sites and apps can use password-less authentication.
|
||||
|
||||
Microsoft has long been a proponent to do away with passwords.
|
||||
While working towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs!
|
||||
These APIs allow Microsoft developer partners and the developer community to leverage Windows Hello and FIDO2 security keys
|
||||
as a password-less authentication mechanism for their applications on Windows 10 devices.
|
||||
These APIs allow Microsoft developer partners and the developer community to use Windows Hello and FIDO2 security keys
|
||||
as a password-less authentication mechanism for their applications on Windows devices.
|
||||
|
||||
#### What does this mean?
|
||||
This opens opportunities for developers or relying parties (RPs) to enable password-less authentication.
|
||||
They can now leverage [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md)
|
||||
This opens opportunities for developers or relying parties (RPs') to enable password-less authentication.
|
||||
They can now use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md)
|
||||
as a password-less multi-factor credential for authentication.
|
||||
<br>
|
||||
Users of these sites can use any browser that supports WebAuthn Windows 10 APIs for password-less authentication
|
||||
and will have a familiar and consistent experience on Windows 10, no matter which browser they use to get to the RPs site!
|
||||
and will have a familiar and consistent experience on Windows 10, no matter which browser they use to get to the RPs' site!
|
||||
<br> <br>
|
||||
The native Windows 10 WebAuthn APIs are currently supported by Microsoft Edge on Windows 10 1809 or later
|
||||
and latest versions of other browsers.
|
||||
<br> <br>
|
||||
Developers of FIDO2 authentication keys should use the new Windows 10 APIs, to enable these scenarios in a consistent way for users.
|
||||
Moreover, this enables the use of all the transports available per FIDO2 specifications - USB, NFC and BLE
|
||||
Moreover, this enables the use of all the transports available per FIDO2 specifications - USB, NFC, and BLE
|
||||
without having to deal with the interaction and management overhead.
|
||||
This also implies browsers or apps on Windows 10 will no longer have direct access to above transports for FIDO related messaging.
|
||||
This also implies browsers or apps on Windows 10 will no longer have direct access to above transports for FIDO-related messaging.
|
||||
|
||||
#### Where can developers learn more?
|
||||
The new Windows 10 APIs are documented on [GitHub](https://github.com/Microsoft/webauthn)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Multi-factor Unlock
|
||||
description: Learn how Windows 10 offers multifactor device unlock by extending Windows Hello with trusted signals.
|
||||
description: Learn how Windows 10 and Windows 11 offer multi-factor device unlock by extending Windows Hello with trusted signals.
|
||||
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, multi, factor, multifactor, multi-factor
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -19,17 +19,19 @@ ms.reviewer:
|
||||
# Multi-factor Unlock
|
||||
|
||||
**Applies to:**
|
||||
- Windows 10
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
**Requirements:**
|
||||
* Windows Hello for Business deployment (Hybrid or On-premises)
|
||||
* Azure AD, Hybrid Azure AD, or Domain Joined (Cloud, Hybrid, or On-Premises deployments)
|
||||
* Windows 10, version 1709 or newer
|
||||
* Windows 10, version 1709 or newer, or Windows 11
|
||||
* Bluetooth, Bluetooth capable phone - optional
|
||||
|
||||
Windows, today, natively only supports the use of a single credential (password, PIN, fingerprint, face, etc.) for unlocking a device. Therefore, if any of those credentials are compromised (shoulder surfed), an attacker could gain access to the system.
|
||||
|
||||
Windows 10 offers Multi-factor device unlock by extending Windows Hello with trusted signals. Administrators can configure Windows 10 to request a combination of factors and trusted signals to unlock their devices.
|
||||
Windows 10 and Windows 11 offer multi-factor device unlock by extending Windows Hello with trusted signals. Administrators can configure their Windows to request a combination of factors and trusted signals to unlock their devices.
|
||||
|
||||
Which organizations can take advantage of Multi-factor unlock? Those who:
|
||||
* Have expressed that PINs alone do not meet their security needs.
|
||||
@ -92,13 +94,13 @@ You represent signal rules in XML. Each signal rule has an starting and ending
|
||||
```
|
||||
|
||||
### Signal element
|
||||
Each rule element has a **signal** element. All signal elements have a **type** element and value. Windows 10, version 1709 supports the **ipConfig** and **bluetooth** type values.
|
||||
Each rule element has a **signal** element. All signal elements have a **type** element and value. Windows 10, version 1709 or later supports the **ipConfig** and **bluetooth** type values.
|
||||
|
||||
|
||||
|Attribute|Value|
|
||||
|---------|-----|
|
||||
| type| "bluetooth" or "ipConfig" (Windows 10, version 1709)|
|
||||
| type| "wifi" (Windows 10, version 1803)
|
||||
| type| "bluetooth" or "ipConfig" (Windows 10, version 1709) or later|
|
||||
| type| "wifi" (Windows 10, version 1803 or later)
|
||||
|
||||
#### Bluetooth
|
||||
You define the bluetooth signal with additional attributes in the signal element. The bluetooth configuration does not use any other elements. You can end the signal element with short ending tag "\/>".
|
||||
@ -133,7 +135,7 @@ The **classofDevice** attribute defaults to Phone and uses the values from the f
|
||||
|Health|2304|
|
||||
|Uncategorized|7936|
|
||||
|
||||
The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10.
|
||||
The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows to lock the device once the signal strength weakens by more than measurement of 10.
|
||||
|
||||
RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other.
|
||||
|
||||
@ -220,7 +222,7 @@ The fully qualified domain name of your organization's internal DNS suffix where
|
||||
#### Wi-Fi
|
||||
|
||||
**Applies to:**
|
||||
- Windows 10, version 1803
|
||||
- Windows 10, version 1803 or later
|
||||
|
||||
You define Wi-Fi signals using one or more wifi elements. Each element has a string value. Wifi elements do not have attributes or nested elements.
|
||||
|
||||
@ -322,7 +324,7 @@ This example configures the same as example 2 using compounding And elements. T
|
||||
```
|
||||
|
||||
#### Example 4
|
||||
This example configures Wi-Fi as a trusted signal (Windows 10, version 1803)
|
||||
This example configures Wi-Fi as a trusted signal (Windows 10, version 1803 or later)
|
||||
|
||||
```xml
|
||||
<rule schemaVersion="1.0">
|
||||
@ -343,11 +345,10 @@ This example configures Wi-Fi as a trusted signal (Windows 10, version 1803)
|
||||
|
||||
### How to configure Multifactor Unlock policy settings
|
||||
|
||||
You need a Windows 10, version 1709 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes multi-factor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1709.
|
||||
You need at least a Windows 10, version 1709 or later workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes multi-factor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows on a computer running Windows 10, version 1709 or later.
|
||||
|
||||
Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information.
|
||||
|
||||
|
||||
### Create the Multifactor Unlock Group Policy object
|
||||
|
||||
The Group Policy object contains the policy settings needed to trigger Windows Hello for Business provisioning and to ensure Windows Hello for Business authentication certificates are automatically renewed.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Azure Active Directory join cloud only deployment
|
||||
description: Use this deployment guide to successfully use Azure Active Directory to join a Windows 10 device.
|
||||
description: Use this deployment guide to successfully use Azure Active Directory to join a Windows 10 or Windows 11 device.
|
||||
keywords: identity, Hello, Active Directory, cloud,
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -20,7 +20,7 @@ ms.reviewer:
|
||||
|
||||
## Introduction
|
||||
|
||||
When you Azure Active Directory (Azure AD) join a Windows 10 device, the system prompts you to enroll in Windows Hello for Business by default. If you want to use Windows Hello for Business in your cloud only environment, then there's no additional configuration needed.
|
||||
When you Azure Active Directory (Azure AD) join a Windows 10 or Windows 11 device, the system prompts you to enroll in Windows Hello for Business by default. If you want to use Windows Hello for Business in your cloud only environment, then there's no additional configuration needed.
|
||||
|
||||
You may wish to disable the automatic Windows Hello for Business enrollment prompts if you aren't ready to use it in your environment. Instructions on how to disable Windows Hello for Business enrollment in a cloud only environment are included below.
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ ms.reviewer:
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 10, version 1703 or later, or Windows 11
|
||||
- Windows Server, versions 2016 or later
|
||||
- Hybrid or On-Premises deployment
|
||||
- Key trust
|
||||
@ -32,7 +32,7 @@ ms.reviewer:
|
||||
|
||||
How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 and above includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged.
|
||||
|
||||
Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 or later domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers and above. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller.
|
||||
Windows 10 or Windows 11 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 or later domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers and above. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller.
|
||||
|
||||
Determining an adequate number of Windows Server domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding a domain controller that supports public key mapping (in this case Windows Server 2016 or later) to a deployment of existing domain controllers which do not support public key mapping (Windows Server 2008R2, Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario:
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Windows Hello and password changes (Windows 10)
|
||||
title: Windows Hello and password changes (Windows)
|
||||
description: When you change your password on a device, you may need to sign in with a password on other devices to reset Hello.
|
||||
ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55
|
||||
ms.reviewer:
|
||||
@ -19,7 +19,9 @@ ms.date: 07/27/2017
|
||||
# Windows Hello and password changes
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
When you set up Windows Hello, the PIN or biometric gesture that you use is specific to that device. You can set up Hello for the same account on multiple devices. If the PIN or biometric is configured as part of Windows Hello for Business, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Windows Hello for Business is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Hello.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Windows Hello biometrics in the enterprise (Windows 10)
|
||||
title: Windows Hello biometrics in the enterprise (Windows)
|
||||
description: Windows Hello uses biometrics to authenticate users and guard against potential spoofing, through fingerprint matching and facial recognition.
|
||||
ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc
|
||||
ms.reviewer:
|
||||
@ -21,7 +21,9 @@ ms.date: 01/12/2021
|
||||
# Windows Hello biometrics in the enterprise
|
||||
|
||||
**Applies to:**
|
||||
- Windows 10
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Prepare & Deploy Windows AD FS certificate trust (Windows Hello for Business)
|
||||
description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services (AD FS) for Windows Hello for Business, using certificate trust.
|
||||
title: Prepare and Deploy Windows AD FS certificate trust (Windows Hello for Business)
|
||||
description: Learn how to Prepare and Deploy Windows Server 2016 Active Directory Federation Services (AD FS) for Windows Hello for Business, using certificate trust.
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -16,11 +16,12 @@ localizationpriority: medium
|
||||
ms.date: 01/14/2021
|
||||
ms.reviewer:
|
||||
---
|
||||
# Prepare and Deploy Windows Server 2016 Active Directory Federation Services
|
||||
# Prepare and Deploy Windows Server 2016 Active Directory Federation Services - Certificate Trust
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 11
|
||||
- On-premises deployment
|
||||
- Certificate trust
|
||||
|
||||
@ -123,7 +124,7 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials.
|
||||
8. Click **Next** on the **Active Directory Federation Service** page.
|
||||
9. Click **Install** to start the role installation.
|
||||
|
||||
## Review
|
||||
## Review & validate
|
||||
|
||||
Before you continue with the deployment, validate your deployment progress by reviewing the following items:
|
||||
|
||||
@ -265,7 +266,7 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. Th
|
||||
3. In the details pane, click **Configure Device Registration**.
|
||||
4. In the **Configure Device Registration** dialog, click **OK**.
|
||||
|
||||
## Review
|
||||
## Review to validate
|
||||
|
||||
Before you continue with the deployment, validate your deployment progress by reviewing the following items:
|
||||
* Confirm you followed the correct procedures based on the domain controllers used in your deployment.
|
||||
|
||||
@ -16,15 +16,17 @@ localizationpriority: medium
|
||||
ms.date: 08/20/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
# Configure Windows Hello for Business Policy settings
|
||||
# Configure Windows Hello for Business Policy settings - Certificate Trust
|
||||
|
||||
**Applies to**
|
||||
- Windows 10, version 1703 or later
|
||||
- On-premises deployment
|
||||
- Certificate trust
|
||||
|
||||
You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520).
|
||||
Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703.
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 11
|
||||
- On-premises deployment
|
||||
- Certificate trust
|
||||
|
||||
You need at least a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520).
|
||||
Install the Remote Server Administration Tools for Windows on a computer running Windows 10, version 1703 or later.
|
||||
|
||||
On-premises certificate-based deployments of Windows Hello for Business needs three Group Policy settings:
|
||||
* Enable Windows Hello for Business
|
||||
@ -116,9 +118,9 @@ The default Windows Hello for Business enables users to enroll and use biometric
|
||||
|
||||
### PIN Complexity
|
||||
|
||||
PIN complexity is not specific to Windows Hello for Business. Windows 10 enables users to use PINs outside of Windows Hello for Business. PIN Complexity Group Policy settings apply to all uses of PINs, even when Windows Hello for Business is not deployed.
|
||||
PIN complexity is not specific to Windows Hello for Business. Windows enables users to use PINs outside of Windows Hello for Business. PIN Complexity Group Policy settings apply to all uses of PINs, even when Windows Hello for Business is not deployed.
|
||||
|
||||
Windows 10 provides eight PIN Complexity Group Policy settings that give you granular control over PIN creation and management. You can deploy these policy settings to computers, where they affect all users creating PINs on that computer; or, you can deploy these settings to users, where they affect those users creating PINs regardless of the computer they use. If you deploy both computer and user PIN complexity Group Policy settings, the user policy settings have precedence over computer policy settings. Also, this conflict resolution is based on the last applied policy. Windows does not merge the policy settings automatically; however, you can deploy Group Policy to provide to accomplish a variety of configurations. The policy settings included are:
|
||||
Windows provides eight PIN Complexity Group Policy settings that give you granular control over PIN creation and management. You can deploy these policy settings to computers, where they affect all users creating PINs on that computer; or, you can deploy these settings to users, where they affect those users creating PINs regardless of the computer they use. If you deploy both computer and user PIN complexity Group Policy settings, the user policy settings have precedence over computer policy settings. Also, this conflict resolution is based on the last applied policy. Windows does not merge the policy settings automatically; however, you can deploy Group Policy to provide to accomplish a variety of configurations. The policy settings included are:
|
||||
* Require digits
|
||||
* Require lowercase letters
|
||||
* Maximum PIN length
|
||||
|
||||
@ -16,13 +16,14 @@ localizationpriority: medium
|
||||
ms.date: 08/19/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
# Validate Active Directory prerequisites
|
||||
# Validate Active Directory prerequisites for cert-trust deployment
|
||||
|
||||
**Applies to**
|
||||
- Windows 10, version 1703 or later
|
||||
- On-premises deployment
|
||||
- Certificate trust
|
||||
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 11
|
||||
- On-premises deployment
|
||||
- Certificate trust
|
||||
|
||||
The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 or later domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 or later schema. If you already have a Windows Server 2016 or later domain controller in your forest, you can skip the **Updating the Schema** and **Create the KeyCredential Admins Security Global Group** steps.
|
||||
|
||||
|
||||
@ -16,19 +16,20 @@ localizationpriority: medium
|
||||
ms.date: 08/19/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
# Validate and Deploy Multi-factor Authentication (MFA)
|
||||
# Validate and Deploy Multifactor Authentication (MFA)
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 11
|
||||
- On-premises deployment
|
||||
- Certificate trust
|
||||
|
||||
Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option.
|
||||
Windows Hello for Business requires all users perform multifactor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option.
|
||||
|
||||
For information on available third-party authentication methods see [Configure Additional Authentication Methods for AD FS](/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method)
|
||||
|
||||
Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies).
|
||||
Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multifactor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies).
|
||||
|
||||
## Follow the Windows Hello for Business on premises certificate trust deployment guide
|
||||
1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md)
|
||||
|
||||
@ -16,12 +16,14 @@ localizationpriority: medium
|
||||
ms.date: 08/19/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
# Validate and Configure Public Key Infrastructure
|
||||
# Validate and Configure Public Key Infrastructure - Certificate Trust Model
|
||||
|
||||
**Applies to**
|
||||
- Windows 10, version 1703 or later
|
||||
- On-premises deployment
|
||||
- Certificate trust
|
||||
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 11
|
||||
- On-premises deployment
|
||||
- Certificate trust
|
||||
|
||||
|
||||
Windows Hello for Business must have a public key infrastructure regardless of the deployment or trust model. All trust models depend on the domain controllers having a certificate. The certificate serves as a root of trust for clients to ensure they are not communicating with a rogue domain controller. The certificate trust model extends certificate issuance to client computers. During Windows Hello for Business provisioning, the user receives a sign-in certificate.
|
||||
@ -94,7 +96,7 @@ The certificate template is configured to supersede all the certificate template
|
||||
|
||||
### Configure an Internal Web Server Certificate template
|
||||
|
||||
Windows 10 clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate.
|
||||
Windows 10 or Windows 11 clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate.
|
||||
|
||||
Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials.
|
||||
1. Open the **Certificate Authority** management console.
|
||||
|
||||
@ -20,6 +20,7 @@ ms.reviewer:
|
||||
|
||||
**Applies to**
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 11
|
||||
- On-premises deployment
|
||||
- Certificate trust
|
||||
|
||||
|
||||
@ -21,6 +21,7 @@ ms.reviewer:
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 11
|
||||
|
||||
Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on an asymmetric key pair.
|
||||
|
||||
@ -41,7 +42,7 @@ This guide assumes that baseline infrastructure exists which meets the requireme
|
||||
- Proper name resolution, both internal and external names
|
||||
- Active Directory and an adequate number of domain controllers per site to support authentication
|
||||
- Active Directory Certificate Services 2012 or later
|
||||
- One or more workstation computers running Windows 10, version 1703
|
||||
- One or more workstation computers running Windows 10, version 1703 or later
|
||||
|
||||
If you are installing a server role for the first time, ensure the appropriate server operating system is installed, updated with the latest patches, and joined to the domain. This document provides guidance to install and configure the specific roles on that server.
|
||||
|
||||
|
||||
@ -27,16 +27,17 @@ Applies to:
|
||||
|
||||
- Azure AD joined deployments
|
||||
- Windows 10, version 1803 and later
|
||||
- Windows 11
|
||||
|
||||
PIN reset on Azure AD joined devices uses a flow called web sign-in to authenticate the user above lock. Web sign in only allows navigation to specific domains. If it attempts to navigate to a domain that is not allowed it will shows a page with the error message "We can't open that page right now".
|
||||
|
||||
### Identifying Azure AD joined PIN Reset Allowed Domains Issue
|
||||
|
||||
The user can launch the PIN reset flow from above lock using the "I forgot my PIN" link in the PIN credential provider. Selecting this link will launch a full screen UI for the PIN experience on Azure AD Join devices. Typically, this UI will display an Azure authentication server page where the user will authenticate using Azure AD credentials and complete multi-factor authentication.
|
||||
The user can launch the PIN reset flow from above lock using the "I forgot my PIN" link in the PIN credential provider. Selecting this link will launch a full screen UI for the PIN experience on Azure AD Join devices. Typically, this UI will display an Azure authentication server page where the user will authenticate using Azure AD credentials and complete multifactor authentication.
|
||||
|
||||
In federated environments authentication may be configured to route to AD FS or a third party identity provider. If the PIN reset flow is launched and attempts to navigate to a federated identity provider server page, it will fail and display the "We can't open that page right now" error if the domain for the server page is not included in an allow list.
|
||||
In federated environments authentication may be configured to route to AD FS or a third-party identity provider. If the PIN reset flow is launched and attempts to navigate to a federated identity provider server page, it will fail and display the "We can't open that page right now" error if the domain for the server page is not included in an allow list.
|
||||
|
||||
If you are a customer of Azure US Government cloud, PIN reset will also attempt to navigate to a domain that is not included in the default allow list. This results in "We can't open that page right now".
|
||||
If you are a customer of Azure US Government cloud, PIN reset will also attempt to navigate to a domain that is not included in the default allowlist. This results in "We can't open that page right now".
|
||||
|
||||
### Resolving Azure AD joined PIN Reset Allowed Domains Issue
|
||||
|
||||
|
||||
@ -20,6 +20,7 @@ ms.reviewer:
|
||||
|
||||
**Applies to**
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 11
|
||||
- On-premises deployment
|
||||
- Key trust
|
||||
|
||||
|
||||
@ -22,6 +22,7 @@ ms.reviewer:
|
||||
**Applies To**
|
||||
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 11
|
||||
- Hybrid deployment
|
||||
- Key trust
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user