Update PDE Docs 6

windows/security/information-protection/personal-data-encryption.md

@@ -1,6 +1,6 @@
 ---
 title: Personal Data Encryption (PDE)
-description: Personal Data Encryption unlocks user encrypted data at user logon instead of at boot
+description: Personal Data Encryption unlocks user encrypted data at user sign in instead of at boot
 ms.reviewer: 
 manager: aaroncz
 ms.author: frankroj
@@ -16,11 +16,11 @@ ms.date: 09/22/2022
 
 Personal data encryption (PDE) is a security feature introduced in Windows 11, version 22H2 that provides encryption of individual user files. PDE occurs in addition to other encryption methods such as BitLocker.
 
-PDE utilizes Windows Hello for Business to link data encryption keys with user credentials. This can minimizes the amount of credentials the user has to remember to gain access to files. For example, when using BitLocker with PIN, a user would need to authenticate twice - once with the BitLocker PIN and a second time with Windows credentials. This requires users to remember two different credentials. With PDE, users only needs to enter one set of credentials via Windows Hello for Business.
+PDE utilizes Windows Hello for Business to link data encryption keys with user credentials. This feature can minimizes the number of credentials the user has to remember to gain access to files. For example, when using BitLocker with PIN, a user would need to authenticate twice - once with the BitLocker PIN and a second time with Windows credentials. This requires users to remember two different credentials. With PDE, users only need to enter one set of credentials via Windows Hello for Business.
 
-PDE is also accessibility friendly. For example, The BitLocker PIN entry screen does not have accessibility options. However, PDE uses Windows Hello for Business which does have accessibility features.
+PDE is also accessibility friendly. For example, The BitLocker PIN entry screen doesn't have accessibility options. PDE however uses Windows Hello for Business, which does have accessibility features.
 
-Unlike BitLocker which releases data encryption keys at boot, PDE does not release data encryption keys until a user logs in via Windows Hello for Business. Users will only be able to access their PDE encrypted files once they have signed into Windows using Windows Hello for Business. Users will not have access to their PDE encrypted files if they have signed into Windows via a password instead of Windows Hello for Business biometric or PIN. Users will also not have access to their PDE encrypted files if they are not signed in locally and are trying to access them through alternate methods such as network UNC paths or a Remote Desktop session. Files will also not be accessible to other users on the device even if they are signed in via Windows Hello for Business and have permissions to navigate to the PDE encrypted files.
+Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user logs in using Windows Hello for Business. Users will only be able to access their PDE encrypted files once they've signed into Windows using Windows Hello for Business. Additionally, PDE has the ability to also discard the encryption keys when the device is locked.
 
 > [!NOTE]
 > PDE is currently only available to developers via [APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager.md). There is no user interface in Windows to encrypt files via PDE. There are also no policies that can be deployed to devices via MDM to encrypt files via PDE.
@@ -41,11 +41,11 @@ Unlike BitLocker which releases data encryption keys at boot, PDE does not relea
   
 - **Highly recommended**
   - [BitLocker Drive Encryption](/security/information-protection/bitlocker/bitlocker-overview.md) enabled
-    - Although PDE will work without BitLocker, it is recommend to also enable BitLocker. PDE is meant to supplement BitLocker, not replace it.
+    - Although PDE will work without BitLocker, it's recommended to also enable BitLocker. PDE is meant to supplement BitLocker and not replace it.
   - Backup solution such as [OneDrive](/onedrive/onedrive)
     - In certain scenarios such as TPM resets or destructive PIN resets, the PDE encryption keys can be lost. In such scenarios, any file encrypted with PDE will no longer be accessible. The only way to recover such files would be from backup.
   - [Windows Hello for Business PIN reset service](/security/identity-protection/hello-for-business/hello-feature-pin-reset.md)
-    - Destructive PIN resets will cause PDE encryption keys to be lost. This will make any file encrypted with PDE no longer accessible after a destructive PIN reset. Files encrypted with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets.
+    - Destructive PIN resets will cause PDE encryption keys to be lost. The destructive PIN reset will make any file encrypted with PDE no longer accessible after a destructive PIN reset. Files encrypted with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets.
   - [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)
     - Provides additional security when authenticating with Windows Hello for Business via biometrics or PIN
   - [Kernel and user mode crash dumps disabled](windows/client-management/mdm/policy-csp-memorydump)
@@ -65,16 +65,26 @@ PDE offers two levels of protection. The level of protection is determined based
 | Data is accessible when device is shut down | No | No |
 | Decryption keys discarded | After user signs out | After user locks device or signs out |
 
+## When will PDE encrypted files be inaccessible
+
+When a file is encrypted with PDE, its icon will show a lock on it. If the user hasn't signed in locally with Windows Hello for Business or an unauthorized user attempts to access a PDE encrypted file, they'll be denied access to the file. Scenarios where a user will be denied access to a PDE encrypted file include:
+
+- User has signed into Windows via a password instead of signing in with Windows Hello for Business biometric or PIN.
+- If specified via level 2 protection, when the device is locked.
+- When trying to access files on the device remotely. For example, UNC network paths.
+- Remote Desktop sessions
+- Other users on the device who aren't owners of the file, even if they're signed in via Windows Hello for Business and have permissions to navigate to the PDE encrypted files.
+
 ## How to enable PDE
 
 To enable PDE on devices, push an MDM policy to the devices with the following parameters:
 
-> Name: **Personal Data Encryption**
-> OMA-URI: **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption**
-> Data type: **Integer**
-> Value: **1**
+- Name: **Personal Data Encryption**
+- OMA-URI: **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption**
+- Data type: **Integer**
+- Value: **1**
 
-There is also a [PDE CSP](/windows/client-management/mdm/personaldataencryption-csp) available for MDM solutions that support it.
+There's also a [PDE CSP](/windows/client-management/mdm/personaldataencryption-csp) available for MDM solutions that support it.
 
 > [!NOTE]
 > Enabling the PDE policy on devices only enables the PDE feature. It does not encrypt any files. To encrypt files, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager.md) to create custom applications and scripts to specify which files to encrypt and at what level to encrypt the files. Additionally, files will not encrypt via the APIs until this policy has been enabled.
@@ -104,33 +114,98 @@ There is also a [PDE CSP](/windows/client-management/mdm/personaldataencryption-
     2. Select the groups that the PDE policy should be deployed to
     3. Select **Select**
     4. Select **Next**
-13. On the **Applicability Rules** tab, configure as necessary and then select **Next**
+13. On the **Applicability Rules** tab, configure if necessary and then select **Next**
 14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create**
 
 ### Configuring required prerequisites in Intune
 
 #### Disabling Winlogon automatic restart sign-on (ARSO)
 
+1. Sign into the Intune admin center
+2. Navigate to **Devices** > **Configuration Profiles**
+3. Select **Create profile**
+4. Under **Platform**, select **Windows 10 and later**
+5. Under **Profile type**, select **Templates**
+6. Under **Template name**, select **Administrative templates**, and then select **Create**
+7. On the ****Basics** tab:
+    1. Next to **Name**, enter **Disable ARSO**
+    2. Next to **Description**, enter a description
+8. Select **Next**
+9. On the **Configuration settings** tab, under **Computer Configuration**, navigate to **Windows Components** > **Windows Logon Options**
+10. Select **Sign-in and lock last interactive user automatically after a restart**
+11. In the **Sign-in and lock last interactive user automatically after a restart** window that opens, select **Disabled**, and then select **OK**
+12. Select **Next**
+13. On the **Scope tags** tab, configure if necessary and then select **Next**
+12. On the **Assignments** tab:
+    1. Under **Included groups**, select **Add groups**
+    2. Select the groups that the ARSO policy should be deployed to
+    3. Select **Select**
+    4. Select **Next**
+13. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create**
+
 ### Configuring recommended prerequisites in Intune
 
 #### Disabling hibernation
 
+1. Sign into the Intune admin center
+2. Navigate to **Devices** > **Configuration Profiles**
+3. Select **Create profile**
+4. Under **Platform**, select **Windows 10 and later**
+5. Under **Profile type**, select **Settings catalog**, and then select **Create**
+6. On the ****Basics** tab:
+    1. Next to **Name**, enter **Disable Hibernation**
+    2. Next to **Description**, enter a description
+7. Select **Next**
+8. On the **Configuration settings** tab, select **Add settings**
+9. In the **Settings picker** windows, select **Power**
+10. When the settings appear in the lower pane, under **Setting name**, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window
+11. Change **Allow Hibernate** to **Block**, and then select **Next**
+12. On the **Scope tags** tab, configure if necessary and then select **Next**
+13. On the **Assignments** tab:
+    1. Under **Included groups**, select **Add groups**
+    2. Select the groups that the ARSO policy should be deployed to
+    3. Select **Select**
+    4. Select **Next**
+14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create**
+
 #### Disabling crash dumps
+
+1. Sign into the Intune admin center
+2. Navigate to **Devices** > **Configuration Profiles**
+3. Select **Create profile**
+4. Under **Platform**, select **Windows 10 and later**
+5. Under **Profile type**, select **Settings catalog**, and then select **Create**
+6. On the ****Basics** tab:
+    1. Next to **Name**, enter **Disable Hibernation**
+    2. Next to **Description**, enter a description
+7. Select **Next**
+8. On the **Configuration settings** tab, select **Add settings**
+9. In the **Settings picker** windows, select **Memory Dump**
+10. When the settings appear in the lower pane, under **Setting name**, select both **Allow Crash Dump** and **Allow Live Dump**, and then select the **X** in the top right corner of the **Settings picker** window to close the window
+11. Change both **Allow Live Dump** and **Allow Crash Dump** to **Block**, and then select **Next**
+12. On the **Scope tags** tab, configure if necessary and then select **Next**
+13. On the **Assignments** tab:
+    1. Under **Included groups**, select **Add groups**
+    2. Select the groups that the ARSO policy should be deployed to
+    3. Select **Select**
+    4. Select **Next**
+14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create**
+
 ## Differences between PDE and BitLocker
 
 | | PDE | BitLocker |
 |--|--|--|
-| Release of encryption keys | At user logon via Windows Hello for Business | At boot |
-| Encryption keys discarded | At user logoff | At reboot |
+| Release of encryption keys | At user sign in via Windows Hello for Business | At boot |
+| Encryption keys discarded | At user sign out | At reboot |
 | Files encrypted | Individual specified files | Entire volume/drive |
-| Authentication to release encryption keys | No additional PIN required - Windows Hello for Business credentials used | When BitLocker with PIN is enabled, additional PIN is required in addition to Windows logon credentials |
-| Accessibility | Windows Hello for Business is accessibility friendly | BitLocker with PIN does not have accessibility features |
+| Authentication to release encryption keys | No additional PIN required - Windows Hello for Business credentials used | When BitLocker with PIN is enabled, additional PIN is required in addition to Windows sign in credentials |
+| Accessibility | Windows Hello for Business is accessibility friendly | BitLocker with PIN doesn't have accessibility features |
 
 ## Differences between PDE and EFS
 
-The main difference between encrypting files with PDE instead of EFS is the method they use to encrypt the file. PDE uses Windows Hello for Business to secure the encryption keys that encrypts the files while EFS uses certificates to secure and encrypt the files.
+The main difference between encrypting files with PDE instead of EFS is the method they use to encrypt the file. PDE uses Windows Hello for Business to secure the encryption keys that encrypts the files. EFS uses certificates to secure and encrypt the files.
 
-To see if a file is encrypted with PDE or EFS, open the properties of the file. Under the **General** tab, click on the **Advanced...** button. In the **Advanced Attributes** windows, click on the **Details** button. For PDE encrypted files, under **Protection status:** there will be an item listed as **Personal Data Encryption is:** and it will have the atrribute of **On**. For EFS encrypted files, under **Users who can access this file:**, there will be a **Certificate thumbprint** next to the users with access to the file. There will also be a section at the bottom labeled **Recovery certificates for this file as defined by recovery policy:**. You can also check the encryption type being used via the **cipher.exe /c** command line.
+To see if a file is encrypted with PDE or EFS, open the properties of the file. Under the **General** tab, select on the **Advanced...** button. In the **Advanced Attributes** windows, select on the **Details** button. For PDE encrypted files, under **Protection status:** there will be an item listed as **Personal Data Encryption is:** and it will have the attribute of **On**. For EFS encrypted files, under **Users who can access this file:**, there will be a **Certificate thumbprint** next to the users with access to the file. There will also be a section at the bottom labeled **Recovery certificates for this file as defined by recovery policy:**. You can also check the encryption type being used via the **cipher.exe /c** command line.