diff --git a/windows/deploy/TOC.md b/windows/deploy/TOC.md index 893c06b098..4fed1981ec 100644 --- a/windows/deploy/TOC.md +++ b/windows/deploy/TOC.md @@ -45,6 +45,7 @@ ### [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) ## [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) ## [Upgrade to Windows 10 with System Center Configuration Manager](upgrade-to-windows-10-with-system-center-configuraton-manager.md) +## [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) ## [Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) ## [Windows 10 upgrade paths](windows-10-upgrade-paths.md) ## [Windows 10 edition upgrade](windows-10-edition-upgrades.md) diff --git a/windows/deploy/change-history-for-deploy-windows-10.md b/windows/deploy/change-history-for-deploy-windows-10.md index d09519574f..f7e67993e5 100644 --- a/windows/deploy/change-history-for-deploy-windows-10.md +++ b/windows/deploy/change-history-for-deploy-windows-10.md @@ -11,6 +11,11 @@ author: greg-lindsay # Change history for Deploy Windows 10 This topic lists new and updated topics in the [Deploy Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## October 2016 +| New or changed topic | Description | +|----------------------|-------------| +| [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) | New | + ## September 2016 | New or changed topic | Description | |----------------------|-------------| diff --git a/windows/deploy/index.md b/windows/deploy/index.md index 504b8b4dc8..38c64b3abc 100644 --- a/windows/deploy/index.md +++ b/windows/deploy/index.md @@ -21,6 +21,7 @@ Learn about deploying Windows 10 for IT professionals. |[Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) |If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or, more specifically, MDT 2013 Update 2. | |[Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) |The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Deployment Toolkit (MDT) 2013 Update 2 task sequence to completely automate the process. | |[Upgrade to Windows 10 with System Center Configuration Manager](upgrade-to-windows-10-with-system-center-configuraton-manager.md) |The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a System Center Configuration Manager task sequence to completely automate the process. | +|[Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) |This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. | |[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | |[Windows 10 edition upgrade](windows-10-edition-upgrades.md) |With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. | | [Provision PCs with common settings for initial deployment](provision-pcs-for-initial-deployment.md) | Create a provisioning package to apply commonly used settings to a PC running Windows 10. | diff --git a/windows/deploy/resolve-windows-10-upgrade-errors.md b/windows/deploy/resolve-windows-10-upgrade-errors.md new file mode 100644 index 0000000000..8ce1abe2e0 --- /dev/null +++ b/windows/deploy/resolve-windows-10-upgrade-errors.md @@ -0,0 +1,890 @@ +--- +title: Resolve Windows 10 upgrade errors +description: Resolve Windows 10 upgrade errors +ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502 +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +author: greg-lindsay +localizationpriority: high +--- + +# Resolve Windows 10 upgrade errors + +**Applies to** +- Windows 10 + +This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. + +## In this topic + +The following sections and procedures are provided in this guide: + +- [The Windows 10 upgrade process](#the-windows-10-upgrade-process): An explanation of phases used during the upgrade process.
+- [Quick fixes](#quick-fixes): Steps you can take to eliminate many Windows upgrade errors.
+- [Upgrade error codes](#upgrade-error-codes): The components of an error code are explained. + - [Result codes](#result-codes): Information about result codes. + - [Extend codes](#extend-codes): Information about extend codes. +- [Log files](#log-files): A list and description of log files useful for troubleshooting. + - [Log entry structure](#log-entry-structure): The format of a log entry is described. + - [Analyze log files](#analyze-log-files): General procedures for log file analysis, and an example. +- [Resolution procedures](#resolution-procedures): Causes and mitigation procedures associated with specific error codes. + - [0xC1900101](#0xC1900101): Information about the 0xC1900101 result code. + - [0x800xxxxx](#0x800xxxxx): Information about result codes that start with 0x800. + - [Other result codes](#other-result-codes): Additional causes and mitigation procedures are provided for some result codes. + - [Other error codes](#other-error-codes): Additional causes and mitigation procedures are provided for some error codes. + +## The Windows 10 upgrade process + +The Windows Setup application is used to upgrade a computer to Windows 10, or to perform a clean installation. Windows Setup starts and restarts the computer, gathers information, copies files, and creates or adjusts configuration settings. When performing an operating system upgrade, Windows Setup uses the following phases: + +1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Installation components are gathered. +2. **Safe OS phase**: A recovery partition is configured and updates are installed. An OS rollback is prepared if needed. + - Example error codes: 0x2000C, 0x20017 +3. **First boot phase**: Initial settings are applied. + - Example error codes: 0x30018, 0x3000D +4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**. + - Example error: 0x4000D, 0x40017 +5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful. + - Example error: 0x50000 + +**Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown): + +![Upgrade process](images/upgrade-process.png) + +DU = Driver/device updates.
+OOBE = Out of box experience.
+WIM = Windows image (Microsoft) + +## Quick fixes + +The following steps can resolve many Windows upgrade problems. + +
    +
  1. Check all hard drives for errors and attempt repairs. To automatically repair hard drives, open an elevated command prompt, switch to the drive you wish to repair, and type the following command. You will be required to reboot the computer if the hard drive being repaired is also the system drive. + +
    2. +
  2. Attept to restore and repair system files by typing the following commands at an elevated command prompt. It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/repair-a-windows-image). + +
    3. +
  3. Update Windows so that all available recommended updates are installed.
    4. +
  4. Uninstall non-Microsoft antivirus software. + +
  5. Uninstall all nonessential software.
    6. +
  6. Remove nonessential external hardware, such as docks and USB devices.
    7. +
  7. Update firmware and drivers.
    8. +
  8. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
    9. +
  9. Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. +
+ + + +## Upgrade error codes + +If the upgrade process is not successful, Windows Setup will return two codes: + +1. **A result code**: The result code corresponds to a specific Win32 error. +2. **An extend code**: The extend code contains information about both the *phase* in which an error occurred, and the *operation* that was being performed when the error occurred. + +>For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**. + +Note: If only a result code is returned, this can be because a tool is being used that was not able to capture the extend code. For example, if you are using the [Windows 10 Upgrade Assistant](https://support.microsoft.com/en-us/kb/3159635) then only a result code might be returned. + +### Result codes + +>A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](#resolution-procedures) section later in this topic. + +Result codes can be matched to the type of error encountered. To match a result code to an error: + +1. Identify the error code type, either Win32 or NTSTATUS, using the first hexidecimal digit: +
8 = Win32 error code (ex: 0x**8**0070070) +
C = NTSTATUS value (ex: 0x**C**1900107) +2. Write down the last 4 digits of the error code (ex: 0x8007**0070** = 0070). These digits correspond to the last 16 bits of the [HRESULT](https://msdn.microsoft.com/en-us/library/cc231198.aspx) or the [NTSTATUS](https://msdn.microsoft.com/en-us/library/cc231200.aspx) structure. +3. Based on the type of error code determined in the first step, match the 4 digits derived from the second step to either a [Win32 error code](https://msdn.microsoft.com/en-us/library/cc231199.aspx), or an [NTSTATUS value](https://msdn.microsoft.com/en-us/library/cc704588.aspx). + +For example: +- 0x80070070 = Win32 = 0070 = 0x00000070 = ERROR_DISK_FULL +- 0xC1900107 = NTSTATUS = 0107 = 0x00000107 = STATUS_SOME_NOT_MAPPED + +Some result codes are self-explanatory, whereas others are more generic and require further analysis. In the examples shown above, ERROR_DISK_FULL indicates that the hard drive is full and additional room is needed to complete Windows upgrade. The message STATUS_SOME_NOT_MAPPED is more ambiguous, and means that an action is pending. In this case, the action pending is often the cleanup operation from a previous installation attempt, which can be resolved with a system reboot. + +### Extend codes + +>Important: Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update. + +Extend codes can be matched to the phase and operation when an error occurred. To match an extend code to the phase and operation: + +1. Use the first digit to identify the phase (ex: 0x4000D = 4). +2. Use the last two digits to identify the operation (ex: 0x4000D = 0D). +3. Match the phase and operation to values in the tables provided below. + +The following tables provide the corresponding phase and operation for values of an extend code: + + + +
Extend code: phase
HexPhase +
0SP_EXECUTION_UNKNOWN +
1SP_EXECUTION_DOWNLEVEL +
2SP_EXECUTION_SAFE_OS +
3SP_EXECUTION_FIRST_BOOT +
4SP_EXECUTION_OOBE_BOOT +
5SP_EXECUTION_UNINSTALL +
+ + + + + + +
Extend code: operation
+ +
HexOperation +
0SP_EXECUTION_OP_UNKNOWN +
1SP_EXECUTION_OP_COPY_PAYLOAD +
2SP_EXECUTION_OP_DOWNLOAD_UPDATES +
3SP_EXECUTION_OP_INSTALL_UPDATES +
4SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT +
5SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE +
6SP_EXECUTION_OP_REPLICATE_OC +
7SP_EXECUTION_OP_INSTALL_DRVIERS +
8SP_EXECUTION_OP_PREPARE_SAFE_OS +
9SP_EXECUTION_OP_PREPARE_ROLLBACK +
ASP_EXECUTION_OP_PREPARE_FIRST_BOOT +
BSP_EXECUTION_OP_PREPARE_OOBE_BOOT +
CSP_EXECUTION_OP_APPLY_IMAGE +
DSP_EXECUTION_OP_MIGRATE_DATA +
ESP_EXECUTION_OP_SET_PRODUCT_KEY +
FSP_EXECUTION_OP_ADD_UNATTEND +
+		 + +
HexOperation +
10SP_EXECUTION_OP_ADD_DRIVER +
11SP_EXECUTION_OP_ENABLE_FEATURE +
12SP_EXECUTION_OP_DISABLE_FEATURE +
13SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS +
14SP_EXECUTION_OP_REGISTER_SYNC_PROCESS +
15SP_EXECUTION_OP_CREATE_FILE +
16SP_EXECUTION_OP_CREATE_REGISTRY +
17SP_EXECUTION_OP_BOOT +
18SP_EXECUTION_OP_SYSPREP +
19SP_EXECUTION_OP_OOBE +
1ASP_EXECUTION_OP_BEGIN_FIRST_BOOT +
1BSP_EXECUTION_OP_END_FIRST_BOOT +
1CSP_EXECUTION_OP_BEGIN_OOBE_BOOT +
1DSP_EXECUTION_OP_END_OOBE_BOOT +
1ESP_EXECUTION_OP_PRE_OOBE +
1FSP_EXECUTION_OP_POST_OOBE +
20SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE +
+
+ +For example: An extend code of **0x4000D**, represents a problem during phase 4 (**0x4**) with data migration (**000D**). + +## Log files + +Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code. + +

The following table describes some log files and how to use them for troubleshooting purposes: + + + +
Log filePhase: LocationDescriptionWhen to use + +
setupact.logDown-Level:
$Windows.~BT\Sources\Panther		Contains information about setup actions during the downlevel phase. +All down-level failures and starting point for rollback investigations.
This is the most important log for diagnosing setup issues. +
OOBE:
$Windows.~BT\Sources\Panther\UnattendGC +		Contains information about actions during the OOBE phase.Investigating rollbacks that failed during OOBE phase and operations – 0x4001C, 0x4001D, 0x4001E, 0x4001F. +
Rollback:
$Windows.~BT\Sources\Rollback		Contains information about actions during rollback.Investigating generic rollbacks - 0xC1900101. +
Pre-initialization (prior to downlevel):
Windows		Contains information about initializing setup.If setup fails to launch. +
Post-upgrade (after OOBE):
Windows\Panther		Contains information about setup actions during the installation.Investigate post-upgrade related issues. + +
setuperr.logSame as setupact.logContains information about setup errors during the installation.Review all errors encountered during the installation phase. + +
miglog.xmlPost-upgrade (after OOBE):
Windows\Panther		Contains information about what was migrated during the installation.Identify post upgrade data migration issues. + +
BlueBox.logDown-Level:
Windows\Logs\Mosetup		Contains information communication between setup.exe and Windows Update.Use during WSUS and WU down-level failures or for 0xC1900107. + +
Supplemental rollback logs:
+Setupmem.dmp
+setupapi.dev.log
+Event logs (*.evtx) + + +		$Windows.~BT\Sources\RollbackAdditional logs collected during rollback. + +Setupmem.dmp: If OS bugchecks during upgrade, setup will attempt to extract a mini-dump.
+Setupapi: Device install issues - 0x30018
+Event logs: Generic rollbacks (0xC1900101) or unexpected reboots. + +
+ +### Log entry structure + +A setupact.log or setuperr.log entry includes the following elements: + +

    +
  1. The date and time - 2016-09-08 09:20:05. +
  2. The log level - Info, Warning, Error, Fatal Error. +
  3. The logging component - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS. + +
  4. The message - Operation completed successfully. +
+ +See the following example: + +| Date/Time | Log level | Component | Message | +|------|------------|------------|------------| +|2016-09-08 09:23:50,| Warning | MIG | Could not replace object C:\Users\name\Cookies. Target Object cannot be removed.| + + +### Analyze log files + +

To analyze Windows Setup log files: + +

    +
  1. Determine the Windows Setup error code. +
  2. Based on the [extend code](#extend-codes) portion of the error code, determine the type and location of a [log files](#log-files) to investigate. +
  3. Open the log file in a text editor, such as notepad. +
  4. Using the result code portion of the Windows Setup error code, search for the result code in the file and find the last occurrence of the code. Alternatively search for the "abort" and abandoning" text strings described in step 7 below. +
  5. To find the last occurrence of the result code: +
      +
    1. Scroll to the bottom of the file and click after the last character. +
    2. Click **Edit**. +
    3. Click **Find**. +
    4. Type the result code. +
    5. Under **Direction** select **Up**. +
    6. Click **Find Next**. +
    +
  6. When you have located the last occurrence of the result code, scroll up a few lines from this location in the file and review the processes that failed just prior to generating the result code. +
  7. Search for the following important text strings: + +
  8. Decode Win32 errors that appear in this section. +
  9. Write down the timestamp for the observed errors in this section. +
  10. Search other log files for additional information matching these timestamps or errors. +
+ +For example, assume that the error code for an error is 0x8007042B - 0x2000D. Searching for "8007042B" reveals the following content from the setuperr.log file: + +>Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN." + +

setuperr.log content: + +

+27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
+27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
+27:08, Error                  Gather failed. Last error: 0x00000000
+27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
+27:09, Error           SP     CMigrateFramework: Gather framework failed. Status: 44
+27:09, Error           SP     Operation failed: Migrate framework (Full). Error: 0x8007042B[gle=0x000000b7]
+27:09, Error           SP     Operation execution failed: 13. hr = 0x8007042B[gle=0x000000b7]
+27:09, Error           SP     CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x8007042B[gle=0x000000b7]
+
+ +The first line indicates there was an error **0x00000570** with the file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]** (shown below): + +
+27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
+
+ +The error 0x00000570 is a [Win32 error code](https://msdn.microsoft.com/en-us/library/cc231199.aspx) corresponding to: ERROR_FILE_CORRUPT: The file or directory is corrupted and unreadable. + +Therefore, Windows Setup failed because it was not able to migrate the corrupt file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN]**. This file is a local system certificate and can be safely deleted. Searching the setupact.log file for additional details, the phrase "Shell application requested abort" is found in a location with the same timestamp as the lines in setuperr.log. This confirms our suspicion that this file is the cause of the upgrade failure: + +

setupact.log content: + +

+27:00, Info                   Gather started at 10/5/2016 23:27:00
+27:00, Info [0x080489] MIG    Setting system object filter context (System)
+27:00, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
+27:00, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
+27:00, Info            SP     ExecuteProgress: Elapsed events:1 of 4, Percent: 12
+27:00, Info [0x0802c6] MIG    Processing GATHER for migration unit: \UpgradeFramework (CMXEAgent)
+27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
+27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
+27:08, Info            SP     ExecuteProgress: Elapsed events:2 of 4, Percent: 25
+27:08, Info            SP     ExecuteProgress: Elapsed events:3 of 4, Percent: 37
+27:08, Info [0x080489] MIG    Setting system object filter context (System)
+27:08, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
+27:08, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
+27:08, Info            MIG    COutOfProcPluginFactory::FreeSurrogateHost: Shutdown in progress.
+27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost::CommandLine: -shortened-
+27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost: Successfully launched host and got control object.
+27:08, Error                  Gather failed. Last error: 0x00000000
+27:08, Info                   Gather ended at 10/5/2016 23:27:08 with result 44
+27:08, Info                   Leaving MigGather method
+27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
+
+ +

This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f. + +## Resolution procedures + +### 0xC1900101 + +A frequently observed result code is 0xC1900101. This result code can be thrown at any stage of the upgrade process, with the exception of the downlevel phase. 0xC1900101 is a generic rollback code, and usually indicates that an incompatible driver is present. The incompatible driver can cause blue screens, system hangs, and unexpected reboots. Analysis of supplemental log files is often helpful, such as:
+ +- The minidump file: $Windows.~bt\Sources\Rollback\setupmem.dmp, +- Event logs: $Windows.~bt\Sources\Rollback\*.evtx +- The device install log: $Windows.~bt\Sources\Rollback\setupapi\setupapi.dev.log + +The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). To resolve a rollback due to driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/en-us/kb/929135) before initiating the upgrade process. + +

See the following general troubleshooting procedures associated with a result code of 0xC1900101: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + +
Code +
0xC1900101 - 0x20004 +
+ +

+
Cause +
Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation +
This is generally caused by out-of-date drivers. +
+

 + + +
Mitigation +
Uninstall antivirus applications. +
Remove all unused SATA devices. +
Remove all unused devices and drivers. +
Update drivers and BIOS. +
+
+ + +
Code +
0xC1900101 - 0x2000c +
+ +

+
Cause +
Windows Setup encountered an unspecified error during Wim apply in the WinPE phase. +
This is generally caused by out-of-date drivers. +
+

 + + +
Mitigation +
Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. +
Contact your hardware vendor to obtain updated device drivers. +
Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. +
+
+ + +
Code +
0xC1900101 - 0x20017 + +
+ +

+
Cause +
A driver has caused an illegal operation. +
Windows was not able to migrate the driver, resulting in a rollback of the operating system. +

This is a safeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. +

+

 + + +
Mitigation +
+Ensure that all that drivers are updated.
+Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers. +
For more information, see [Understanding Failures and Log Files](https://technet.microsoft.com/en-us/library/ee851579.aspx). +
Update or uninstall the problem drivers. +
+
+ + +
Code +
0xC1900101 - 0x30018 +
+ +

+
Cause +
A device driver has stopped responding to setup.exe during the upgrade process. +
+

 + + +
Mitigation +
+Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. +
Contact your hardware vendor to obtain updated device drivers. +
Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. +
+
+ + +
Code +
0xC1900101 - 0x3000D +
+ +

+
Cause +
Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation. +
This can occur due to a problem with a display driver. + +
+

 + + +
Mitigation +
+Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. +
Update or uninstall the display driver. +
+
+ + +
Code +
0xC1900101 - 0x4000D +
+ +

+
Cause +
A rollback occurred due to a driver configuration issue. +

Installation failed during the second boot phase while attempting the MIGRATE_DATA operation. + +

This can occur due to incompatible drivers. + +

+

 + + +
Mitigation +
+

Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors. +

Review the rollback log and determine the stop code. +
The rollback log is located in the **C:\$Windows.~BT\Sources\Panther** folder. An example analysis is shown below. This example is not representative of all cases: +

Info SP Crash 0x0000007E detected +
Info SP Module name : +
Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005 +
Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A +
Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728 +
Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40 +
Info SP Cannot recover the system. +
Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows. + + +

Typically there is a a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
+ +1. Make sure you have enough disk space.
+2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
+3. Try changing video adapters.
+4. Check with your hardware vendor for any BIOS updates.
+5. Disable BIOS memory options such as caching or shadowing. +

+
+
+ + +
Code +
0xC1900101 - 0x40017 +
+ +

+
Cause +
Windows 10 upgrade failed after the second reboot. +
This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers. +
+

 + + +
Mitigation +
Clean boot into Windows, and then attempt the upgrade to Windows 10.
+ +For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/en-us/kb/929135). + +

Ensure you select the option to "Download and install updates (recommended)." +

+
+ +### 0x800xxxxx + +Result codes starting with the digits 0x800 are also important to understand. These error codes indicate general operating system errors, and are not unique to the Windows upgrade process. Examples include timeouts, devices not functioning, and a process stopping unexpectedly. + +

See the following general troubleshooting procedures associated with a result code of 0x800xxxxx: + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + +
Code +
+ +8000405 - 0x20007 + +
+ +

+
Cause +
+ +An unspecified error occurred with a driver during the SafeOS phase. + +
+

 + + +
Mitigation +
+ +This error has more than one possible cause. Attempt [quick fixes](#quick-fixes), and if not successful, [analyze log files](#analyze-log-files) in order to determine the problem and solution. + +
+
+ + +
Code +
+ +800704B8 - 0x3001A + +
+ +

+
Cause +
+ +An extended error has occurred during the first boot phase. + +
+

 + + +
Mitigation +
+ +Disable or uninstall non-Microsoft antivirus applications, disconnect all unnecessary devices, and perform a [clean boot](https://support.microsoft.com/en-us/kb/929135). + +
+
+ + +
Code +
+ +8007042B - 0x4000D + +
+ +

+
Cause +
+ +The installation failed during the second boot phase while attempting the MIGRATE_DATA operation. +
This issue can occur due to file system, application, or driver issues. + +
+

 + + +
Mitigation +
+ +[Analyze log files](#analyze-log-files) in order to determine the file, application, or driver that is not able to be migrated. Disconnect, update, remove, or replace the device or object. + +
+
+ + +
Code +
+ +8007001F - 0x4000D + +
+ +

+
Cause +
+ +General failure, a device attached to the system is not functioning. + +
+

 + + +
Mitigation +
+ +[Analyze log files](#analyze-log-files) in order to determine the device that is not functioning properly. Disconnect, update, or replace the device. + +
+
+ + +
Code +
+ +8007042B - 0x4001E + +
+ +

+
Cause +
+ +The installation failed during the second boot phase while attempting the PRE_OOBE operation. + +
+

 + + +
Mitigation +
+ +This error has more than one possible cause. Attempt [quick fixes](#quick-fixes), and if not successful, [analyze log files](#analyze-log-files) in order to determine the problem and solution. + +
+
+ + +### Other result codes + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Error code +Cause +Mitigation +
0xC1900200Setup.exe has detected that the machine does not meet the minimum system requirements.Ensure the system you are trying to upgrade meets the minimum system requirements.

See [Windows 10 specifications](https://www.microsoft.com/en-us/windows/windows-10-specifications) for information.

0x80090011A device driver error occurred during user data migration.Contact your hardware vendor and get all the device drivers updated. It is recommended to have an active internet connection during upgrade process. +

Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.

0xC7700112Failure to complete writing data to the system drive, possibly due to write access failure on the hard disk.This issue is resolved in the latest version of Upgrade Assistant. +

Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.

0x80190001An unexpected error was encountered while attempting to download files required for upgrade.To resolve this issue, download and run the media creation tool. See [Download windows 10](https://www.microsoft.com/en-us/software-download/windows10). +
0x80246007The update was not downloaded successfully.Attempt other methods of upgrading the operatign system.
+Download and run the media creation tool. See [Download windows 10](https://www.microsoft.com/en-us/software-download/windows10). +
Attempt to upgrade using .ISO or USB.
+**Note**: Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the [Volume Licensing Service Center](https://www.microsoft.com/licensing/servicecenter/default.aspx). +
0xC1900201The system did not pass the minimum requirements to install the update.Contact the hardware vendor to get the latest updates.
0x80240017The upgrade is unavailable for this edition of Windows.Administrative policies enforced by your organization might be preventing the upgrade. Contact your IT administrator.
0x80070020The existing process cannot access the file because it is being used by another process.Use the MSCONFIG tool to perform a clean boot on the machine and then try to perform the update again. For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/en-us/kb/929135).
0x80070522The user doesn’t have required privilege or credentials to upgrade.Ensure that you have signed in as a local administrator or have local administrator privileges.
0xC1900107A cleanup operation from a previous installation attempt is still pending and a system reboot is required in order to continue the upgrade. +Reboot the device and run setup again. If restarting device does not resolve the issue, then use the Disk Cleanup utility and cleanup the temporary as well as the System files. For more information, see [Disk cleanup in Windows 10](https://support.microsoft.com/en-us/instantanswers/8fef4121-711b-4be1-996f-99e02c7301c2/disk-cleanup-in-windows-10).
0xC1900209The user has chosen to cancel because the system does not pass the compatibility scan to install the update. Setup.exe will report this error when it can upgrade the machine with user data but cannot migrate installed applications.Incompatible software is blocking the upgrade process. Uninstall the application and try the upgrade again. See [Windows 10 Pre-Upgrade Validation using SETUP.EXE](https://blogs.technet.microsoft.com/mniehaus/2015/08/23/windows-10-pre-upgrade-validation-using-setup-exe/) for more information. + +

You can also download the [Windows Assessment and Deployment Kit (ADK) for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=526740) and install Application Compatibility Tools. +

0x8007002 This error is specific to upgrades using System Center Configuration Manager 2012 R2 SP1 CU3 (5.00.8238.1403)Analyze the SMSTS.log and verify that the upgrade is failing on "Apply Operating system" Phase: Error 80072efe DownloadFileWithRanges() failed. 80072efe. ApplyOperatingSystem (0x0760) + +

The error 80072efe means that the connection with the server was terminated abnormally. + +

To resolve this issue, try the OS Deployment test on a client in same VLAN as the Configuration Manager server. Check the network configuration for random client-server connection issues happening on the remote VLAN. +

+ +### Other error codes + + + + + + + + + + + + + + + +
Error CodesCauseMitigation
0x80070003- 0x20007 +This is a failure during SafeOS phase driver installation. + +[Verify device drivers](https://msdn.microsoft.com/windows/hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](#analyze-log-files) to determine the problem driver. +
0x8007025D - 0x2000C +This error occurs if the ISO file's metadata is corrupt."Re-download the ISO/Media and re-attempt the upgrade. + +Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/en-us/software-download/windows10). + +
0x80070490 - 0x20007An incompatible device driver is present. + +[Verify device drivers](https://msdn.microsoft.com/windows/hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](#analyze-log-files) to determine the problem driver. + +
0xC1900101 - 0x2000c +An unspecified error occurred in the SafeOS phase during WIM apply. This can be caused by an outdated driver or disk corruption. +Run checkdisk to repair the file system. For more information, see the [quick fixes](#quick-fixes) section in this guide. +

Update drivers on the computer, and select "Download and install updates (recommended)" during the upgrade process. Disconnect devices other than the mouse, keyboard and display.

0xC1900200 - 0x20008 + +The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10. + +See [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/windows-10-specifications) and verify the computer meets minimum requirements. + +
Review logs for [compatibility information](https://blogs.technet.microsoft.com/askcore/2016/01/21/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues/).
0x80070004 - 0x3000D +This is a problem with data migration during the first boot phase. There are multiple possible causes. + +[Analyze log files](#analyze-log-files) to determine the issue.
0xC1900101 - 0x4001E +Installation failed in the SECOND_BOOT phase with an error during PRE_OOBE operation. +This is a generic error that occurs during the OOBE phase of setup. See the [0xC1900101](#0xC1900101) section of this guide and review general troubleshooting procedures described in that section.
0x80070005 - 0x4000D +The installation failed in the SECOND_BOOT phase with an error in during MIGRATE_DATA operation. This error indicates that access was denied while attempting to migrate data. +[Analyze log files](#analyze-log-files) to determine the data point that is reporting access denied.
0x80070004 - 0x50012 +Windows Setup failed to open a file. +[Analyze log files](#analyze-log-files) to determine the data point that is reporting access problems.
0xC190020e +
0x80070070 - 0x50011 +
0x80070070 - 0x50012 +
0x80070070 - 0x60000 +		These errors indicate the computer does not have enough free space available to install the upgrade. +To upgrade a computer to Windows 10, it requires 16 GB of free hard drive space for a 32-bit OS, and 20 GB for a 64-bit OS. If there is not enough space, attempt to [free up drive space](https://support.microsoft.com/en-us/help/17421/windows-free-up-drive-space) before proceeding with the upgrade. + +

Note: If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby. +

+ + + + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/en-us/windows/dn798755.aspx) +
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/en-us/windows/dn798752.aspx) +
[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md index 070a9e137c..8307a9bfbf 100644 --- a/windows/deploy/upgrade-analytics-get-started.md +++ b/windows/deploy/upgrade-analytics-get-started.md @@ -101,7 +101,7 @@ IMPORTANT: Restart user computers after you install the compatibility update KBs | **Site discovery** | **KB** | |----------------------|-----------------------------------------------------------------------------| -| [Review site discovery](upgrade-analytics-review-site-discovery.md) | [KB 3170106](https://support.microsoft.com/en-us/kb/3170106)
Site discovery requires July 2016 security update for Internet Explorer. | +| [Review site discovery](upgrade-analytics-review-site-discovery.md) | Site discovery requires the [July 2016 security update for Internet Explorer](https://support.microsoft.com/en-us/kb/3170106) (KB3170106) or later. | ### Automate data collection diff --git a/windows/deploy/upgrade-analytics-review-site-discovery.md b/windows/deploy/upgrade-analytics-review-site-discovery.md index 33b5bdac0e..f236d85945 100644 --- a/windows/deploy/upgrade-analytics-review-site-discovery.md +++ b/windows/deploy/upgrade-analytics-review-site-discovery.md @@ -15,7 +15,7 @@ This section of the Upgrade Analytics workflow provides an inventory of web site Ensure the following prerequisites are met before using site discovery: -1. Install the latest Internet Explorer 11 Cumulative Update. This update provides the capability for site discovery and is available in the [July 2016 cumulative update (KB3170106)](https://support.microsoft.com/kb/3170106) and later. +1. Install the latest Internet Explorer 11 Cumulative Update. This update provides the capability for site discovery and is available in the [July 2016 cumulative update](https://support.microsoft.com/kb/3170106) and later. 2. Install the update for customer experience and diagnostic telemetery ([KB3080149](https://support.microsoft.com/kb/3080149)). 3. Enable Internet Explorer data collection, which is disabled by default. The best way to enable it is to modify the [Upgrade Analytics deployment script](upgrade-analytics-get-started.md#run-the-upgrade-analytics-deployment-script) to allow Internet Explorer data collection before you run it. diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index c43b7b759f..c2f86a7621 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -38,7 +38,15 @@ #### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) ## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) ## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) -## [VPN profile options](vpn-profile-options.md) +## [VPN technical guide](vpn-guide.md) +### [VPN connection types](vpn-connection-type.md) +### [VPN routing decisions](vpn-routing.md) +### [VPN authentication options](vpn-authentication.md) +### [VPN and conditional access](vpn-conditional-access.md) +### [VPN name resolution](vpn-name-resolution.md) +### [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) +### [VPN security features](vpn-security-features.md) +### [VPN profile options](vpn-profile-options.md) ## [Windows security baselines](windows-security-baselines.md) ## [Security technologies](security-technologies.md) ### [Access Control Overview](access-control.md) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index db02131f0c..ee3f4325ff 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -12,6 +12,12 @@ author: brianlic-msft # Change history for Keep Windows 10 secure This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## October 2016 + +| New or changed topic | Description | +| --- | --- | +| [VPN technical guide](vpn-guide.md) | Multiple new topics, replacing previous **VPN profile options** topic | + ## September 2016 | New or changed topic | Description | diff --git a/windows/keep-secure/images/vpn-app-rules.png b/windows/keep-secure/images/vpn-app-rules.png new file mode 100644 index 0000000000..edc4a24209 Binary files /dev/null and b/windows/keep-secure/images/vpn-app-rules.png differ diff --git a/windows/keep-secure/images/vpn-app-trigger.PNG b/windows/keep-secure/images/vpn-app-trigger.PNG new file mode 100644 index 0000000000..aebd913df5 Binary files /dev/null and b/windows/keep-secure/images/vpn-app-trigger.PNG differ diff --git a/windows/keep-secure/images/vpn-conditional-access-intune.png b/windows/keep-secure/images/vpn-conditional-access-intune.png new file mode 100644 index 0000000000..9f4efabc3f Binary files /dev/null and b/windows/keep-secure/images/vpn-conditional-access-intune.png differ diff --git a/windows/keep-secure/images/vpn-connection-intune.png b/windows/keep-secure/images/vpn-connection-intune.png new file mode 100644 index 0000000000..bf551eabb7 Binary files /dev/null and b/windows/keep-secure/images/vpn-connection-intune.png differ diff --git a/windows/keep-secure/images/vpn-connection.png b/windows/keep-secure/images/vpn-connection.png new file mode 100644 index 0000000000..c7d7a0d274 Binary files /dev/null and b/windows/keep-secure/images/vpn-connection.png differ diff --git a/windows/keep-secure/images/vpn-custom-xml-intune.png b/windows/keep-secure/images/vpn-custom-xml-intune.png new file mode 100644 index 0000000000..94cbb2c5cb Binary files /dev/null and b/windows/keep-secure/images/vpn-custom-xml-intune.png differ diff --git a/windows/keep-secure/images/vpn-device-compliance.png b/windows/keep-secure/images/vpn-device-compliance.png new file mode 100644 index 0000000000..d33ccba508 Binary files /dev/null and b/windows/keep-secure/images/vpn-device-compliance.png differ diff --git a/windows/keep-secure/images/vpn-eap-xml.png b/windows/keep-secure/images/vpn-eap-xml.png new file mode 100644 index 0000000000..9a90401c88 Binary files /dev/null and b/windows/keep-secure/images/vpn-eap-xml.png differ diff --git a/windows/keep-secure/images/vpn-intune-policy.png b/windows/keep-secure/images/vpn-intune-policy.png new file mode 100644 index 0000000000..4224979bbd Binary files /dev/null and b/windows/keep-secure/images/vpn-intune-policy.png differ diff --git a/windows/keep-secure/images/vpn-name-intune.png b/windows/keep-secure/images/vpn-name-intune.png new file mode 100644 index 0000000000..a7b3bfe3b4 Binary files /dev/null and b/windows/keep-secure/images/vpn-name-intune.png differ diff --git a/windows/keep-secure/images/vpn-profilexml-intune.png b/windows/keep-secure/images/vpn-profilexml-intune.png new file mode 100644 index 0000000000..7277b7a598 Binary files /dev/null and b/windows/keep-secure/images/vpn-profilexml-intune.png differ diff --git a/windows/keep-secure/images/vpn-split-route.png b/windows/keep-secure/images/vpn-split-route.png new file mode 100644 index 0000000000..12c3fe64d6 Binary files /dev/null and b/windows/keep-secure/images/vpn-split-route.png differ diff --git a/windows/keep-secure/images/vpn-split.png b/windows/keep-secure/images/vpn-split.png new file mode 100644 index 0000000000..b4143ab1e5 Binary files /dev/null and b/windows/keep-secure/images/vpn-split.png differ diff --git a/windows/keep-secure/images/vpn-traffic-rules.png b/windows/keep-secure/images/vpn-traffic-rules.png new file mode 100644 index 0000000000..fa7b526e80 Binary files /dev/null and b/windows/keep-secure/images/vpn-traffic-rules.png differ diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index b9e72308cc..d56e60b02a 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -312,7 +312,6 @@ You’ll need this software to set Windows Hello for Business policies in your e Windows Hello for Business mode Azure AD -Active Directory (AD) on-premises (available with production release of Windows Server 2016) Azure AD/AD hybrid (available with production release of Windows Server 2016) @@ -321,11 +320,6 @@ You’ll need this software to set Windows Hello for Business policies in your e Key-based authentication Azure AD subscription

- - -

One or more Windows Server 2016 Technical Preview domain controllers

-

AD FS of Windows Server 2016 Technical Preview

Certificate-based @@ -326,9 +323,6 @@ Table 1. Deployment requirements for Microsoft Passport
  • AD CS with NDES
  • Configuration Manager (current branch) or Configuration Manager 2016 Technical Preview for domain-joined certificate enrollment, or InTune for non-domain-joined devices, or a non-Microsoft MDM service that supports Passport for Work
    • -

    AD DS Windows Server 2016 Technical Preview schema


    -

    AD FS of Windows Server 2016 Technical Preview

    -

    PKI infrastructure
 System Center 2012 R2 Configuration Manager with SP2 or later

    diff --git a/windows/keep-secure/vpn-authentication.md b/windows/keep-secure/vpn-authentication.md new file mode 100644 index 0000000000..e248b304f6 --- /dev/null +++ b/windows/keep-secure/vpn-authentication.md @@ -0,0 +1,61 @@ +--- +title: VPN authentication options (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, networking +author: jdeckerMS +localizationpriority: high +--- + +# VPN authentication options + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +In addition to older and less-secure password-based authentication methods (which should be avoided), the built-in VPN solution uses Extensible Authentication Protocol (EAP) to provide secure authentication using both user name and password, and certificate-based methods. You can only configure EAP-based authentication if you select a built-in VPN type (IKEv2, L2TP, PPTP or Automatic). + +Windows supports a number of EAP authentication methods. + + + + + + + + +
    MethodDetails
    EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (EAP-MSCHAPv2)
    • User name and password authentication
    • Winlogon credentials - can specify authentication with computer sign-in credentials
    EAP-Transport Layer Security (EAP-TLS)
    • Supports the following types of certificate authentication
      • Certificate with keys in the software Key Storage Provider (KSP)
      • Certificate with keys in Trusted Platform Module (TPM) KSP
      • Smart card certficates
      • Windows Hello for Business certificate
    • Certificate filtering
      • Certificate filtering can be enabled to search for a particular certificate to use to authenticate with
      • Filtering can be Issuer-based or Enhanced Key Usage (EKU)-based
    • Server validation - with TLS, server validation can be toggled on or off
      • Server name - specify the server to validate
      • Server certificate - trusted root certificate to validate the server
      • Notification - specify if the user should get a notification asking whether to trust the server or not
    Protected Extensible Authentication Protocol (PEAP)
    • Server validation - with PEAP, server validation can be toggled on or off
      • Server name - specify the server to validate
      • Server certificate - trusted root certificate to validate the server
      • Notification - specify if the user should get a notification asking whether to trust the server or not
    • Inner method - the outer method creates a secure tunnel inside while the inner method is used to complete the authentication
      • EAP-MSCHAPv2
      • EAP-TLS
    • Fast Reconnect: reduces the delay between an authentication request by a client and the response by the Network Policy Server (NPS) or other Remote Authentication Dial-in User Service (RADIUS) server. This reduces resource requirements for both client and server, and minimizes the number of times that users are prompted for credentials.
    • Cryptobinding: By deriving and exchanging values from the PEAP phase 1 key material (Tunnel Key) and from the PEAP phase 2 inner EAP method key material (Inner Session Key), it is possible to prove that the two authentications terminate at the same two entities (PEAP peer and PEAP server). This process, termed "cryptobinding", is used to protect the PEAP negotiation against "Man in the Middle" attacks.
    Tunneled Transport Layer Security (TTLS)
    • Inner method
      • Non-EAP
        • Password Authentication Protocol (PAP)
        • CHAP
        • MSCHAP
        • MSCHAPv2
      • EAP
        • MSCHAPv2
        • TLS
    • Server validation: in TTLS, the server must be validated. The following can be configured:
      • Server name
      • Trusted root certificate for server certificate
      • Whether there should be a server validation notification
    +
    + +For a UWP VPN plug-in, the app vendor controls the authentication method to be used. The following credential types can be used: + +- Smart card +- Certificate +- Windows Hello for Business +- User name and password +- One-time password +- Custom credential type + +## Configure authentication + +See [EAP configuration](https://msdn.microsoft.com/library/windows/hardware/mt168513.aspx) for EAP XML configuration. + +>[!NOTE] +>To configure Windows Hello for Business authentication, follow the steps in [EAP configuration](https://msdn.microsoft.com/library/windows/hardware/mt168513.aspx) to create a smart card certificate. [Learn more about Windows Hello for Business.](https://technet.microsoft.com/itpro/windows/keep-secure/manage-identity-verification-using-microsoft-passport) + +The following image shows the field for EAP XML in a Microsoft Intune VPN profile. The EAP XML field only appears when you select a built-in connection type (automatic, IKEv2, L2TP, PPTP). + +![EAP XML configuration in Intune profile](images/vpn-eap-xml.png) + +## Related topics + +- [VPN technical guide](vpn-guide.md) +- [VPN connection types](vpn-connection-type.md) +- [VPN routing decisions](vpn-routing.md) +- [VPN and conditional access](vpn-conditional-access.md) +- [VPN name resolution](vpn-name-resolution.md) +- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) +- [VPN security features](vpn-security-features.md) +- [VPN profile options](vpn-profile-options.md) \ No newline at end of file diff --git a/windows/keep-secure/vpn-auto-trigger-profile.md b/windows/keep-secure/vpn-auto-trigger-profile.md new file mode 100644 index 0000000000..3b63ffa494 --- /dev/null +++ b/windows/keep-secure/vpn-auto-trigger-profile.md @@ -0,0 +1,88 @@ +--- +title: VPN auto-triggered profile options (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, networking +author: jdeckerMS +localizationpriority: high +--- + +# VPN auto-triggered profile options + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +In Windows 10, a number of features were added to auto-trigger VPN so users won’t have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules: + +- App trigger +- Name-based trigger +- Always On + +## App trigger + +VPN profiles in Windows 10 can be configured to connect automatically on the launch of a specified set of applications. You can configure desktop or Universal Windows Platform (UWP) apps to trigger a VPN connection. You can also configure per-app VPN and specify traffic rules for each app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details. + +The app identifier for a desktop app is a file path. The app identifier for a UWP app is a package family name. + +[Find a package family name (PFN) for per-app VPN configuration](https://docs.microsoft.com/intune/deploy-use/find-a-pfn-for-per-app-vpn) + + +## Name-based trigger + +You can configure a domain name-based rule so that a specific domain name triggers the VPN connection. + +Name-based auto-trigger can be configured using the VPNv2/*ProfileName*/DomainNameInformationList/dniRowId/AutoTrigger setting in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). + +There are four types of name-based triggers: + +- Short name: for example, if **HRweb** is configured as a trigger and the stack sees a DNS resolution request for **HRweb**, the VPN will be triggered. +- Fully-qualified domain name (FQDN): for example, if **HRweb.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request for **HRweb.corp.contoso.com**, the VPN will be triggered. +- Suffix: for example, if **.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request with a matching suffix (such as **HRweb.corp.contoso.com**), the VPN will be triggered. For any short name resolution, VPN will be triggered and the DNS server will be queried for the *ShortName*.**corp.contoso.com**. +- All: if used, all DNS resolution should trigger VPN. + + +## Always On + +Always On is a feature in Windows 10 which enables the active VPN profile to connect automatically on the following triggers: + +- User sign-in +- Network change +- Device screen on + +When the trigger occurs, VPN tries to connect. If an error occurs or any user input is needed, the user is shown a toast notification for additional interaction. + + +When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. + +## Trusted network detection + +This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffices. The VPN stack will look at the DNS suffix on the physical interface and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered. + +Trusted network detection can be configured using the VPNv2/*ProfileName*/TrustedNetworkDetection setting in the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). + + +## Configure app-triggered VPN + +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. + +The following image shows associating an app to a VPN connection in a VPN Profile configuration policy using Microsoft Intune. + +![Add an app for the VPN connection](images/vpn-app-trigger.png) + +After you add an associated app, if you select the **Only these apps can use this VPN connection (per-app VPN)** checkbox, the app becomes available in **Corporate Boundaries**, where you can configure rules for the app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details. + +![Configure rules for the app](images/vpn-app-rules.png) + +## Related topics + +- [VPN technical guide](vpn-guide.md) +- [VPN connection types](vpn-connection-type.md) +- [VPN routing decisions](vpn-routing.md) +- [VPN authentication options](vpn-authentication.md) +- [VPN and conditional access](vpn-conditional-access.md) +- [VPN name resolution](vpn-name-resolution.md) +- [VPN security features](vpn-security-features.md) +- [VPN profile options](vpn-profile-options.md) \ No newline at end of file diff --git a/windows/keep-secure/vpn-conditional-access.md b/windows/keep-secure/vpn-conditional-access.md new file mode 100644 index 0000000000..4a4f96248d --- /dev/null +++ b/windows/keep-secure/vpn-conditional-access.md @@ -0,0 +1,127 @@ +--- +title: VPN and conditional access (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, networking +author: jdeckerMS +localizationpriority: high +--- + +# VPN and conditional access + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application. + +>[!NOTE] +>Conditional Access is an Azure AD Premium feature. + +Conditional Access Platform components used for Device Compliance include the following cloud-based services: +- [Conditional Access Framework](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/12/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn/) + +- [Azure AD Connect Health](https://azure.microsoft.com/documentation/articles/active-directory-Azure ADconnect-health/) + +- [Windows Health Attestation Service](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices#device-health-attestation) (optional) + +- Azure AD Certificate Authority - It is a requirement that the client certificate used for the cloud-based device compliance solution be issued by an Azure Active Directory-based Certificate Authority (CA). An Azure AD CA is essentially a mini-CA cloud tenant in Azure. The Azure AD CA cannot be configured as part of an on-premises Enterprise CA. + +- Azure AD-issued short-lived certificates - When a VPN connection attempt is made, the Azure AD Token Broker on the local device communicates with Azure Active Directory, which then checks for health based on compliance rules. If compliant, Azure AD sends back a short-lived certificate that is used to authenticate the VPN. Note that certificate authentication methods such as EAP-TLS can be used. + + Additional details regarding the Azure AD issued short-lived certificate: + - The default lifetime is 60 minutes and is configurable + - When that certificate expires, the client will again check with Azure AD so that continued health can be validated before a new certificate is issued allowing continuation of the connection + +- [Microsoft Intune device compliance policies](https://docs.microsoft.com/intune/deploy-use/introduction-to-device-compliance-policies-in-microsoft-intune) - Cloud-based device compliance leverages Microsoft Intune Compliance Policies, which are capable of querying the device state and define compliance rules for the following, among other things. + + - Antivirus status + - Auto-update status and update compliance + - Password policy compliance + - Encryption compliance + - Device health attestation state (validated against attestation service after query) + + +The following client-side components are also required: +- [HealthAttestation Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn934876.aspx) +- [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) DeviceCompliance node settings +- Trusted Platform Module (TPM) + +## VPN device compliance + +Server-side infrastructure requirements to support VPN device compliance include: + +- The VPN server should be configured for certificate authentication. +- The VPN server should trust the tenant-specific Azure AD CA +- Either of the below should be true for Kerberos/NTLM SSO: + - Domain servers trust Azure AD CA + - A domain-trusted certificate is deployed to the client device and is configured to be used for single sign-on (SSO) + +After the server side is set up, VPN admins can add the policy settings for conditional access to the VPN profile using the VPNv2 DeviceCompliance node. + +Two client-side configuration service providers are leveraged for VPN device compliance. + +- VPNv2 CSP DeviceCompliance settings + - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client will attempt to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD. + - **Sso**: nodes under SSO can be used to choose a certificate different from the VPN authentication certificate for Kerberos authentication in the case of device compliance. + - **Sso/Enabled**: if this field is set to **true**, the VPN client will look for a separate certificate for Kerberos authentication. + - **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication. + - **Sso/Eku**: comma-separated list of Enhanced Key Usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication. +- HealthAttestation CSP (not a requirement) - functions performed by the HealthAttestation CSP include: + - Collects TPM data used to verify health states + - Forwards the data to the Health Attestation Service (HAS) + - Provisions the Health Attestation Certificate received from the HAS + - Upon request, forwards the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification + +## Client connection flow + + +The VPN client side connection flow works as follows: + +![Device compliance workflow when VPN client attempts to connect](images/vpn-device-compliance.png) + +When a Device Compliance-enabled VPN connection profile is triggered (either manually or automatically): + +1. The VPN client calls into Windows 10’s AAD Token Broker, identifying itself as a VPN client. +2. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies. +3. If compliant, Azure AD requests a short-lived certificate +4. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing. +5. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server. + + + +## Configure conditional access + +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. + +The following image shows conditional access options in a VPN Profile configuration policy using Microsoft Intune. + +![conditional access in profile](images/vpn-conditional-access-intune.png) + +>[!NOTE] +>In Intune, the certificate selected in **Select a client certificate for client authentication** does not set any VPNv2 CSP nodes. It is simply a way to tie the VPN profile’s successful provisioning to the existence of a certificate. If you are enabling conditional access and using the Azure AD short-lived certificate for both VPN server authentication and domain resource authentication, do not select a certificate since the short-lived certificate is not a certificate that would be on the user’s device yet. + +## Learn more about Conditional Access and Azure AD Health + +- [Azure Active Directory conditional access](https://azure.microsoft.com/documentation/articles/active-directory-conditional-access/) +- [Getting started with Azure Active Directory Conditional Access](https://azure.microsoft.com/documentation/articles/active-directory-conditional-access-azuread-connected-apps/) +- [Control the health of Windows 10-based devices](https://technet.microsoft.com/itpro/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices) +- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 1)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/12/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn/) +- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 2)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/14/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-2/) +- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 3)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/15/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-3/) +- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 4)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/16/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-4/) + + + +## Related topics + +- [VPN technical guide](vpn-guide.md) +- [VPN connection types](vpn-connection-type.md) +- [VPN routing decisions](vpn-routing.md) +- [VPN authentication options](vpn-authentication.md) +- [VPN name resolution](vpn-name-resolution.md) +- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) +- [VPN security features](vpn-security-features.md) +- [VPN profile options](vpn-profile-options.md) \ No newline at end of file diff --git a/windows/keep-secure/vpn-connection-type.md b/windows/keep-secure/vpn-connection-type.md new file mode 100644 index 0000000000..bbf5c689d1 --- /dev/null +++ b/windows/keep-secure/vpn-connection-type.md @@ -0,0 +1,84 @@ +--- +title: VPN connection types (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, networking +author: jdeckerMS +localizationpriority: high +--- + +# VPN connection types + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization’s private network. + +There are many options for VPN clients. In Windows 10, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured. + +![VPN connection types](images/vpn-connection.png) + +## Built-in VPN client + +- Tunneling protocols + + - [Internet Key Exchange version 2 (IKEv2)](https://technet.microsoft.com/library/ff687731.aspx) + + Configure the IPsec/IKE tunnel cryptographic properties using the **Cryptography Suite** setting in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). + + - [L2TP](https://technet.microsoft.com/library/ff687761.aspx) + + L2TP with pre-shared key (PSK) authentication can be configured using the **L2tpPsk** setting in the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). + + - [PPTP](https://technet.microsoft.com/library/ff687676.aspx) + + - [SSTP](https://technet.microsoft.com/library/ff687819.aspx) + + SSTP is supported for Windows desktop editions only. SSTP cannot be configured using mobile device management (MDM), but it is one of the protocols attempted in the **Automatic** option. + +- Automatic + + The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt from most secure to least secure. + + Configure **Automatic** for the **NativeProtocolType** setting in the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). + + + +## Universal Windows Platform VPN plug-in + +The Universal Windows Platform (UWP) VPN plug-ins were introduced in Windows 10, although there were originally separate versions available for the Windows 8.1 Mobile and Windows 8.1 PC platforms. Using the UWP platform, third-party VPN providers can create app-containerized plug-ins using WinRT APIs, eliminating the complexity and problems often associated with writing to system-level drivers. + +There are a number of Universal Windows Platform VPN applications, such as Pulse Secure, Cisco AnyConnect, F5 Access, Sonicwall Mobile Connect, and Check Point Capsule. If you want to use a UWP VPN plug-in, work with your vendor for any custom settings needed to configure your VPN solution. + +## Configure connection type + +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. + +The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune. + +![Available connection types](images/vpn-connection-intune.png) + +In Intune, you can also include custom XML for third-party plug-in profiles. + +![Custom XML](images/vpn-custom-xml-intune.png) + + +## Related topics + +- [VPN technical guide](vpn-guide.md) +- [VPN routing decisions](vpn-routing.md) +- [VPN authentication options](vpn-authentication.md) +- [VPN and conditional access](vpn-conditional-access.md) +- [VPN name resolution](vpn-name-resolution.md) +- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) +- [VPN security features](vpn-security-features.md) +- [VPN profile options](vpn-profile-options.md) + + + + + + diff --git a/windows/keep-secure/vpn-guide.md b/windows/keep-secure/vpn-guide.md new file mode 100644 index 0000000000..d77847b083 --- /dev/null +++ b/windows/keep-secure/vpn-guide.md @@ -0,0 +1,45 @@ +--- +title: Windows 10 VPN technical guide (Windows 10) +description: Use this guide to configure VPN deployment for Windows 10. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Windows 10 VPN technical guide + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +This guide will walk you through the decisions you will make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment. This guide references the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914776.aspx) and provides mobile device management (MDM) configuration instructions using Microsoft Intune and the VPN Profile template for Windows 10. + +![Intune VPN policy template](images/vpn-intune-policy.png) + +>[!NOTE] +>This guide does not explain server deployment. + +## In this guide + +| Topic | Description | +| --- | --- | +| [VPN connection types](vpn-connection-type.md) | Select a VPN client and tunneling protocol | +| [VPN routing decisions](vpn-routing.md) | Choose between split tunnel and force tunnel configuration | +| [VPN authentication options](vpn-authentication.md) | Select a method for Extensible Authentication Protocol (EAP) authentication. | +| [VPN and conditional access](vpn-conditional-access.md) | Use Azure Active Directory policy evaluation to set access policies for VPN connections. | +| [VPN name resolution](vpn-name-resolution.md) | Decide how name resolution should work | +| [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) | Set a VPN profile to connect automatically by app or by name, to be "always on", and to not trigger VPN on trusted networks | +| [VPN security features](vpn-security-features.md) | Set a LockDown VPN profile, configure traffic filtering, and connect VPN profile to Windows Information Protection (WIP) | +| [VPN profile options](vpn-profile-options.md) | Combine settings into single VPN profile using XML | + + +## Learn more + +- [VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune) + + + diff --git a/windows/keep-secure/vpn-name-resolution.md b/windows/keep-secure/vpn-name-resolution.md new file mode 100644 index 0000000000..d9a7d32a58 --- /dev/null +++ b/windows/keep-secure/vpn-name-resolution.md @@ -0,0 +1,82 @@ +--- +title: VPN name resolution (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, networking +author: jdeckerMS +localizationpriority: high +--- + +# VPN name resolution + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +When the VPN client connects to the VPN server, the VPN client receives the client IP address. The client may also receive the IP address of the Domain Name System (DNS) server and the IP address of the Windows Internet Name Service (WINS) server. + +The name resolution setting in the VPN profile configures how name resolution should work on the system when VPN is connected. The networking stack first looks at the Name Resolution Policy table (NRPT) for any matches and tries a resolution in the case of a match. If no match is found, the DNS suffix on the most preferred interface based on the interface metric is appended to the name (in the case of a short name) and a DNS query is sent out on the preferred interface. If the query times out, the DNS suffix search list is used in order and DNS queries are sent on all interfaces. + +## Name Resolution Policy table (NRPT) + +The NRPT is a table of namespaces that determines the DNS client’s havior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache. + +There are 3 types of name matches that can set up for NRPT: + +- Fully qualified domain name (FQDN) that can used for direct matching to a name + +- Suffix match results in either a comparison of suffixes (for FQDN resolution) or the appending of the suffix (in case of a short name) + +- Any resolution should attempt to first resolve with the proxy server/DNS server with this entry + +NRPT is set using the **VPNv2/*ProfileName*/DomainNameInformationList** node of the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). This node also configures Web proxy server or domain name servers. + +[Learn more about NRPT](https://technet.microsoft.com/library/ee649207%28v=ws.10%29.aspx) + + +## DNS suffix + +This setting is used to configure the primary DNS suffix for the VPN interface and the suffix search list after the VPN connection is established. + +Primary DNS suffix is set using the **VPNv2/*ProfileName*/DnsSuffix** node. + + + +[Learn more about primaryDNS suffix](https://technet.microsoft.com/library/cc959611.aspx) + +## Persistent + +You can also configure *persistent* name resolution rules. Name resolution for specified items will only performed over VPN. + +Persistent name resolution is set using the **VPNv2/*ProfileName*/DomainNameInformationList//*dniRowId*/Persistent** node. + + + +## Configure name resolution + +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. + +The following image shows name resolution options in a VPN Profile configuration policy using Microsoft Intune. + +![Add DNS rule](images/vpn-name-intune.png) + +The fields in **Add or edit DNS rule** in the Intune profile correspond to the XML settings shown in the following table. + +| Field | XML | +| --- | --- | +| **Name** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DomainName** | +| **Servers (comma separated)** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DnsServers** | +| **Proxy server** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/WebServers** | + +## Related topics + +- [VPN technical guide](vpn-guide.md) +- [VPN connection types](vpn-connection-type.md) +- [VPN routing decisions](vpn-routing.md) +- [VPN authentication options](vpn-authentication.md) +- [VPN and conditional access](vpn-conditional-access.md) +- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) +- [VPN security features](vpn-security-features.md) +- [VPN profile options](vpn-profile-options.md) \ No newline at end of file diff --git a/windows/keep-secure/vpn-profile-options.md b/windows/keep-secure/vpn-profile-options.md index 90c8e2aa2d..77af3754f6 100644 --- a/windows/keep-secure/vpn-profile-options.md +++ b/windows/keep-secure/vpn-profile-options.md @@ -16,48 +16,288 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile -Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. +Most of the VPN settings in Windows 10 can be configured in VPN profiles using Microsoft Intune or System Center Configuration Manager. All VPN settings in Windows 10 can be configued using the **ProfileXML** node in the [VPNv2 configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). -## Always On +>[!NOTE] +>If you're not familiar with CSPs, read [Introduction to configuration service providers (CSPs)](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers) first. -Always On is a new feature in Windows 10 which enables the active VPN profile to connect automatically on the following triggers: -- User sign-on -- Network change +The following table lists the VPN settings and whether the setting can be configured in Intune and Configuration Manager, or can only be configured using **ProfileXML**. -When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* > **Let apps automatically use this VPN connection**. +| Profile setting | Can be configured in Intune and Configuration Manager | +| --- | --- | +| Connection type | yes | +| Routing: split-tunnel routes | yes, except exclusion routes | +| Routing: forced-tunnel | yes | +| Authentication (EAP) | yes, if connection type is built-in | +| Conditional access | yes | +| Proxy settings | yes, by PAC/WPAD file or server and port | +| Name resolution: NRPT | yes | +| Name resolution: DNS suffix | no | +| Name resolution: persistent | no | +| Auto-trigger: app trigger | yes | +| Auto-trigger: name trigger | yes | +| Auto-trigger: Always On | no | +| Auto-trigger: trusted network detection | no | +| LockDown | no | +| Windows Information Protection (WIP) | no | +| Traffic filters | yes | -## App-triggered VPN +The ProfileXML node was added to the VPNv2 CSP to allow users to deploy VPN profile as a single blob. This is particularly useful for deploying profiles with features that are not yet supported by MDMs. You can get additional examples in the [ProfileXML XSD](https://msdn.microsoft.com/library/windows/hardware/mt755930.aspx) topic. -VPN profiles in Windows 10 can be configured to connect automatically on the launch of a specified set of applications. This feature was included in Windows 8.1 as "On demand VPN". The applications can be defined using the following: -- Package family name for Universal Windows Platform (UWP) apps -- File path for Classic Windows applications -## Traffic filters +## Sample Native VPN profile -Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy . With the ever-increasing landscape of remote threats on the corporate network and lesser IT controls on machines, it becomes essential to control the traffic that is allowed through. While server-side layers of firewalls and proxies help, by adding traffic filters the first layer of filtering can be moved onto the client with more advanced filtering on the server side. There are two types of Traffic Filter rules: +The following is a sample Native VPN profile. This blob would fall under the ProfileXML node. -- **App-based rules**. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface. -- **Traffic-based rules**. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface. +``` + + TestVpnProfile + + testServer.VPN.com + IKEv2 + + + + Eap + Eap + + + + + 25 + 0 + 0 + 0 + + + + 25 + + + true + + d2 d3 8e ba 60 ca a1 c1 20 55 a2 e1 c8 3b 15 ad 45 01 10 c2 + d1 76 97 cc 20 6e d2 6e 1a 51 f5 bb 96 e9 35 6d 6d 61 0b 74 + + true + false + + 13 + + + + true + + + + true + + d2 d3 8e ba 60 ca a1 c1 20 55 a2 e1 c8 3b 15 ad 45 01 10 c2 + d1 76 97 cc 20 6e d2 6e 1a 51 f5 bb 96 e9 35 6d 6d 61 0b 74 + + false + true + false + + + + + AAD Conditional Access + 1.3.6.1.4.1.311.87 + + + + + AAD Conditional Access + + + + + + + false + true + + true + false + + + + + + + + + + + SplitTunnel + true + + +
    192.168.0.0
    + 24 +     + +
    10.10.0.0
    + 16 +     + + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + + + + C:\windows\system32\ping.exe + + + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + 6 + 10,20-50,100-200 + 20-50,100-200,300 + 30.30.0.0/16,10.10.10.10-20.20.20.20 + ForceTunnel + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + 3.3.3.3/32,1.1.1.1-2.2.2.2 + + + + + hrsite.corporate.contoso.com + 1.2.3.4,5.6.7.8 + 5.5.5.5 + true + + + .corp.contoso.com + 10.10.10.10,20.20.20.20 + 100.100.100.100 + + + + corp.contoso.com + true + + + false + corp.contoso.com + contoso.com + + + HelloServer + + Helloworld.Com + + + + + true + + true + This is my Eku + This is my issuer hash + + +     +``` -There can be many sets of rules which are linked by **OR**. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by **AND**. This gives the IT admins a lot of power to craft the perfect policy befitting their use case. +## Sample plug-in VPN profile -## LockDown VPN +The following is a sample plug-in VPN profile. This blob would fall under the ProfileXML node. -A VPN profile configured with LockDown secures the device to only allow network traffic over the VPN interface. It has the following features: -- The system attempts to keep the VPN connected at all times. -- The user cannot disconnect the VPN connection. -- The user cannot delete or modify the VPN profile. -- The VPN LockDown profile uses forced tunnel connection. -- If the VPN connection is not available, outbound network traffic is blocked. -- Only one VPN LockDown profile is allowed on a device. -> **Note:**  For inbox VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) tunnel type. -  -## Learn about VPN and the Conditional Access Framework in Azure Active Directory +``` + + TestVpnProfile + + testserver1.contoso.com;testserver2.contoso..com + JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy + <pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema> + + +
    192.168.0.0
    + 24 +     + +
    10.10.0.0
    + 16 +     + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + 6 + 10,20-50,100-200 + 20-50,100-200,300 + 30.30.0.0/16,10.10.10.10-20.20.20.20 + + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + 3.3.3.3/32,1.1.1.1-2.2.2.2 + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + O:SYG:SYD:(A;;CC;;;AU) + + + + corp.contoso.com + 1.2.3.4,5.6.7.8 + 5.5.5.5 + false + + + corp.contoso.com + 10.10.10.10,20.20.20.20 + 100.100.100.100 + + + true + false + corp.contoso.com + contoso.com,test.corp.contoso.com + + + HelloServer + + Helloworld.Com + +     -- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 1)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/12/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn/) -- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 2)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/14/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-2/) -- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 3)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/15/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-3/) -- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 4)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/16/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-4/) +``` + +## Apply ProfileXML using Intune + +After you configure the settings that you want using ProfileXML, you can apply it using Intune and a **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy. + +The OMS-URI setting to apply ProfileXML is **./user/vendor/MSFT/*VPN profile name*/ProfileXML**. + +![Paste your ProfileXML in OMA-URI Setting value field](images/vpn-profilexml-intune.png) ## Learn more @@ -65,3 +305,13 @@ A VPN profile configured with LockDown secures the device to only allow network - [VPNv2 configuration service provider (CSP) reference](https://go.microsoft.com/fwlink/p/?LinkId=617588) - [How to Create VPN Profiles in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=618028) +## Related topics + +- [VPN technical guide](vpn-guide.md) +- [VPN connection types](vpn-connection-type.md) +- [VPN routing decisions](vpn-routing.md) +- [VPN authentication options](vpn-authentication.md) +- [VPN and conditional access](vpn-conditional-access.md) +- [VPN name resolution](vpn-name-resolution.md) +- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) +- [VPN security features](vpn-security-features.md) diff --git a/windows/keep-secure/vpn-routing.md b/windows/keep-secure/vpn-routing.md new file mode 100644 index 0000000000..5065c6aaa5 --- /dev/null +++ b/windows/keep-secure/vpn-routing.md @@ -0,0 +1,68 @@ +--- +title: VPN routing decisions (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, networking +author: jdeckerMS +localizationpriority: high +--- + +# VPN routing decisions + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +Network routes are required for the stack to understand which interface to use for outbound traffic. One of the most important decision points for VPN configuration is whether you want to send all the data through VPN (*force tunnel*) or only some data through the VPN (*split tunnel*). This decision impacts the configuration and the capacity planning, as well as security expectations from the connection. + +## Split tunnel configuration + +In a split tunnel configuration, routes can be specified to go over VPN and all other traffic will go over the physical interface. + +Routes can be configured using the VPNv2/*ProfileName*/RouteList setting in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). + +For each route item in the list the following can be specified: + +- **Address**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Address +- **Prefix size**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Prefix +- **Exclusion route**: VPNv2/*ProfileName*/RouteList/*routeRowId*/ExclusionRoute + + Windows VPN platform now supports the ability to specify exclusion routes that specifically should not go over the physical interface. + +Routes can also be added at connect time through the server for UWP VPN apps. + +## Force tunnel configuration + +In a force tunnel configuration, all traffic will go over VPN. This is the default configuration and takes effect if no routes are specified. + +The only implication of this setting is the manipulation of routing entries. In the case of a force Tunnel VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower Metric than ones for other interfaces. This sends traffic through the VPN as long as there isn’t a specific route on the Physical Interface itself. + +For built-in VPN, this decision is controlled using the MDM setting **VPNv2/ProfileName/NativeProfile/RoutingPolicyType**. + +For a UWP VPN plug-in, this property is directly controlled by the app. If the VPN plug-in passes only 2 include routes (default route for both v4 and v6), the Windows VPN Platform marks the VPN as force tunnel. + +## Configure routing + +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. + +When you configure a VPN profile in Microsoft Intune, you select a checkbox to enable split tunnel configuration. + +![split tunnel](images/vpn-split.png) + +Next, in **Corporate Boundaries**, you add the routes that should use the VPN connection. + +![add route for split tunnel](images/vpn-split-route.png) + + +## Related topics + +- [VPN technical guide](vpn-guide.md) +- [VPN connection types](vpn-connection-type.md) +- [VPN authentication options](vpn-authentication.md) +- [VPN and conditional access](vpn-conditional-access.md) +- [VPN name resolution](vpn-name-resolution.md) +- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) +- [VPN security features](vpn-security-features.md) +- [VPN profile options](vpn-profile-options.md) \ No newline at end of file diff --git a/windows/keep-secure/vpn-security-features.md b/windows/keep-secure/vpn-security-features.md new file mode 100644 index 0000000000..93238fc9ca --- /dev/null +++ b/windows/keep-secure/vpn-security-features.md @@ -0,0 +1,87 @@ +--- +title: VPN security features (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, networking +author: jdeckerMS +localizationpriority: high +--- + +# VPN security features + +**Applies to** +- Windows 10 +- Windows 10 Mobile + + +## LockDown VPN + +A VPN profile configured with LockDown secures the device to only allow network traffic over the VPN interface. It has the following features: + +- The system attempts to keep the VPN connected at all times. +- The user cannot disconnect the VPN connection. +- The user cannot delete or modify the VPN profile. +- The VPN LockDown profile uses forced tunnel connection. +- If the VPN connection is not available, outbound network traffic is blocked. +- Only one VPN LockDown profile is allowed on a device. + +>[!NOTE] +>For built-in VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. + +Deploy this feature with caution as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. + + + +## Windows Information Protection (WIP) integration with VPN + +Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally. + +The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include: + +- Core functionality: File encryption and file access blocking +- UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations +- WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN +- Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN + +The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app. + +Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect. + +[Learn more about Windows Information Protection](protect-enterprise-data-using-wip.md) + + +## Traffic filters + +Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins to effectively add interface specific firewall rules on the VPN Interface.There are two types of Traffic Filter rules: + +- App-based rules. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface. +- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface. + +There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level. + +For example, an admin could define rules that specify: + +- The Contoso HR App must be allowed to go through the VPN and only access port 4545. +- The Contoso finance apps is allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889. +- All other apps on the device should be able to access only ports 80 or 443. + +## Configure traffic filters + +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. + +The following image shows the interface to configure traffic rules in a VPN Profile configuration policy using Microsoft Intune. + +![Add a traffic rule](images/vpn-traffic-rules.png) + +## Related topics + +- [VPN technical guide](vpn-guide.md) +- [VPN connection types](vpn-connection-type.md) +- [VPN routing decisions](vpn-routing.md) +- [VPN authentication options](vpn-authentication.md) +- [VPN and conditional access](vpn-conditional-access.md) +- [VPN name resolution](vpn-name-resolution.md) +- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) +- [VPN profile options](vpn-profile-options.md) \ No newline at end of file diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index cb46f438f0..dd5ab0c00c 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -12,6 +12,13 @@ author: jdeckerMS This topic lists new and updated topics in the [Manage and update Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## October 2016 + +| New or changed topic | Description | +| --- | --- | +| [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) |Added an important note about Cortana and Office 365 integration. | +| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added link to the Windows Restricted Traffic Limited Functionality Baseline. | + ## September 2016 | New or changed topic | Description | diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 42d9d21bc2..e992a6f40f 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1353,3 +1353,5 @@ You can turn off automatic updates by doing one of the following. This is not re - **5**. Turn off automatic updates. To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx). + +To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887). This baseline was created in the same way as the [Windows security baselines](../keep-secure/windows-security-baselines.md) that are often used to efficiently configure Windows to a known secure state. Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure should you've chosen the right settings configuration for your environment before applying. \ No newline at end of file diff --git a/windows/manage/manage-cortana-in-enterprise.md b/windows/manage/manage-cortana-in-enterprise.md index ff1aec9da2..5fb13a4fac 100644 --- a/windows/manage/manage-cortana-in-enterprise.md +++ b/windows/manage/manage-cortana-in-enterprise.md @@ -24,6 +24,10 @@ Cortana in Windows 10 is already great at letting your employees quickly see wh But Cortana works even harder when she connects to Office 365, helping employees prepare for meetings, learn about co-workers, and receive reminders about where they need to be so they won’t be late. +>**Important**
    +>Before your employees can use Cortana with Office 365, they must sign into Cortana using a Microsoft account (such as, @outlook.com), and then they must go to the **Connected Accounts** section of Cortana’s notebook to turn on and connect to Office 365. + + **More info:** - For specific info about what you need to know as a company administrator, including how to turn off Cortana with Office 365, see the [Cortana integration with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=717378) support topic. diff --git a/windows/manage/waas-overview.md b/windows/manage/waas-overview.md index 22c34f8e05..03729bd0a4 100644 --- a/windows/manage/waas-overview.md +++ b/windows/manage/waas-overview.md @@ -81,7 +81,7 @@ To align with the new method of delivering feature updates and quality updates i The concept of servicing branches is new, but organizations can use the same management tools they used to manage updates and upgrades in previous versions of Windows. For more information about the servicing tool options for Windows 10 and their capabilities, see [Servicing tools](#servicing-tools). >[!NOTE] ->Servicing branches are not the only way to separate groups of machines when consuming updates. Each branch can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing branches, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). +>Servicing branches are not the only way to separate groups of devices when consuming updates. Each branch can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing branches, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). ### Current Branch @@ -110,6 +110,9 @@ Specialized systems—such as PCs that control medical equipment, point-of-sale Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSB. Instead, it typically offers new LTSB releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. +>[!NOTE] +>Windows 10 LTSB will support the currently released silicon at the time of release of the LTSB. As future silicon generations are released, support will be created through future Windows 10 LTSB releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products). + LTSB is available only in the Windows 10 Enterprise LTSB edition. This build of Windows doesn’t contain many in-box applications, such as Microsoft Edge, Windows Store client, Cortana (limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. Therefore, it’s important to remember that Microsoft has positioned the LTSB model primarily for specialized devices. >[!NOTE] diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index 7eb664abab..06d0618b0c 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -57,7 +57,7 @@ Windows 10, version 1607, provides administrators with increased control over up - Quality Updates can be deferred up to 30 days and paused for 35 days - Feature Updates can be deferred up to 180 days and paused for 60 days - Update deferrals can be applied to both Current Branch (CB) and Current Branch for Business (CBB) -- Drivers can be excluded from udpates +- Drivers can be excluded from updates ## Security