-Supported web standards include:
-
-- Web Graphics Library (WebGL)
-
-- Canvas 2D L2 extensions, including image smoothing using the nearest neighbor, dashed lines, and fill rules
-
-- Fullscreen API
-
-- Encrypted media extensions
-
-- Media source extensions
-
-- CSS flexible box layout module
-
-- And mutation observers like DOM4 and 5.3
-
-For more information about specific changes and additions, see the [IE11 guide for developers](/previous-versions/windows/internet-explorer/ie-developer/dev-guides/bg182636(v=vs.85)).
-
-**Q: What test tools exist to test for potential application compatibility issues?**
-The Compat Inspector tool supports Windows Internet Explorer 9 through IE11. For more information, see [Compat Inspector User Guide](https://go.microsoft.com/fwlink/p/?LinkId=313189). In addition, you can use the new [F12 Developer Tools](/previous-versions/windows/internet-explorer/ie-developer/dev-guides/bg182632(v=vs.85)) that are included with IE11, or the [modern.ie](https://go.microsoft.com/fwlink/p/?linkid=308902) website for Microsoft Edge.
-
-**Q: Why am I having problems launching my legacy apps with Internet Explorer 11**?
-It’s most likely because IE no longer starts apps that use managed browser hosting controls, like in the .NET Framework 1.1 and 2.0. You can get IE11 to use managed browser hosting controls again, by:
-
-- **For x86 systems or for 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
-
-- **For x64 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
-
-For more information, see the [Web Applications](/dotnet/framework/migration-guide/application-compatibility) section of the Application Compatibility in the .NET Framework 4.5 page.
-
-**Q: Is there a compatibility list for IE?**
-Yes. You can review the XML-based [compatibility version list](https://go.microsoft.com/fwlink/p/?LinkId=403864).
-
-**Q: What is Enterprise Mode?**
-Enterprise Mode is a compatibility mode designed for Enterprises. This mode lets websites render using a modified browser configuration that’s designed to avoid the common compatibility problems associated with web apps written and tested on older versions of IE, like Windows Internet Explorer 7 or Windows Internet Explorer 8.
-For more information, see [Turn on Enterprise Mode and use a site list](../ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md).
-
-**Q: What is the Enterprise Mode Site List Manager tool?**
-Enterprise Mode Site List Manager tool gives you a way to add websites to your Enterprise Mode site list, without having to manually code XML.
-For more information, see all of the topics in [Use the Enterprise Mode Site List Manager](../ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md).
-
-**Q: Are browser plug-ins supported in IE11?**
-The immersive version of IE11 provides an add-on–free experience, so browser plugins won't load and dependent content won't be displayed. This doesn't apply to Internet Explorer for the desktop. For more information, see [Browsing Without Plug-ins](https://go.microsoft.com/fwlink/p/?LinkId=242587). However, Internet Explorer for the desktop and IE11 on Windows 7 with SP1 do support browser plugins, including ActiveX controls such as Adobe Flash and Microsoft Silverlight.
-
-**Q: Is Adobe Flash supported on IE11?**
-Adobe Flash is included as a platform feature and is available out of the box for Windows 8.1, running on both IE and Internet Explorer for the desktop. Users can turn this feature on or off using the **Manage Add-ons** dialog box, while administrators can turn this feature on or off using the Group Policy setting, **Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects**.
-**Important**
-The preinstalled version of Adobe Flash isn't supported on IE11 running on either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. However, you can still download and install the separate Adobe Flash plug-in.
-
-**Q: Can I replace IE11 on Windows 8.1 with an earlier version?**
-No. Windows 8.1 doesn't support any of the previous versions of IE.
-
-**Q: Are there any new Group Policy settings in IE11?**
-IE11 includes all of the previous Group Policy settings you've used to manage and control web browser configuration since Internet Explorer 9. It also includes the following new Group Policy settings, supporting new features:
-
-- Turn off Page Prediction
-
-- Turn on the swiping motion for Internet Explorer for the desktop
-
-- Allow Microsoft services to provide more relevant and personalized search results
-
-- Turn off phone number detection
-
-- Allow IE to use the SPDY/3 network protocol
-
-- Let users turn on and use Enterprise Mode from the **Tools** menu
-
-- Use the Enterprise Mode IE website list
-
-For more information, see [New group policy settings for IE11](../ie11-deploy-guide/new-group-policy-settings-for-ie11.md).
-
-
-**Q: Where can I get more information about IE11 for IT pros?**
-Visit the [Springboard Series for Microsoft Browsers](https://go.microsoft.com/fwlink/p/?LinkId=313191) webpage on TechNet.
-
-
-
-**Q: Can I customize settings for IE on Windows 8.1?**
-Settings can be customized in the following ways:
-
-- IE11 **Settings** charm.
-
-- IE11-related Group Policy settings.
-
-- IEAK 11 for settings shared by both IE and Internet Explorer for the desktop.
-
-**Q: Can I make Internet Explorer for the desktop my default browsing experience?**
-Group Policy settings can be set to open either IE or Internet Explorer for the desktop as the default browser experience. Individual users can configure their own settings in the **Programs** tab of **Internet Options**. The following table shows the settings and results:
- -|Setting |Result | -|--------|-------| -|Let IE decide |Links open in the same type of experience from where they're launched. For example, clicking a link from a Microsoft Store app, opens IE. However, clicking a link from a desktop app, opens Internet Explorer for the desktop. | -|Always in IE11 |Links always open in IE. | -|Always in Internet Explorer for the desktop |Links always open in Internet Explorer for the desktop. | - - -**Q. Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?** -Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. - -IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center: - -| | | | -|---------|---------|---------| -|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | -|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) | -|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) | -|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) | -|[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) | -|[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | -|[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | -|[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | - - - - -**Q. What are the different modes available for the Internet Explorer Customization Wizard?** -The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [Determine the licensing version and features to use in IEAK 11](../ie11-ieak/licensing-version-and-features-ieak11.md). - -The following table displays which pages are available in IEAK 11, based on the licensing mode: - -| **Wizard Pages** | **External** | **Internal** | -|-------------------------------------------|--------------|--------------| -| Welcome to the IEAK | Yes | Yes | -| File Locations | Yes | Yes | -| Platform Selection | Yes | Yes | -| Language Selection | Yes | Yes | -| Package Type Selection | Yes | Yes | -| Feature Selection | Yes | Yes | -| Automatic Version Synchronization | Yes | Yes | -| Custom Components | Yes | Yes | -| Corporate Install | No | Yes | -| User Experience | No | Yes | -| Browser User Interface | Yes | Yes | -| Search Providers | Yes | Yes | -| Important URLs - Home page and Support | Yes | Yes | -| Accelerators | Yes | Yes | -| Favorites, Favorites Bar, and Feeds | Yes | Yes | -| Browsing Options | No | Yes | -| First Run Wizard and Welcome Page Options | Yes | Yes | -| Compatibility View | Yes | Yes | -| Connection Manager | Yes | Yes | -| Connection Settings | Yes | Yes | -| Automatic Configuration | No | Yes | -| Proxy Settings | Yes | Yes | -| Security and Privacy Settings | No | Yes | -| Add a Root Certificate | Yes | No | -| Programs | Yes | Yes | -| Additional Settings | No | Yes | -| Wizard Complete | Yes | Yes | - - -## Related topics -- [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/) -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml new file mode 100644 index 0000000000..b025aa3409 --- /dev/null +++ b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml @@ -0,0 +1,253 @@ +### YamlMime:FAQ +metadata: + ms.localizationpriority: medium + ms.mktglfcycl: explore + description: Frequently asked questions about Internet Explorer 11 for IT Pros + author: dansimp + ms.prod: ie11 + ms.assetid: 140e7d33-584a-44da-8c68-6c1d568e1de3 + ms.reviewer: + audience: itpro + manager: dansimp + ms.author: dansimp + title: Internet Explorer 11 - FAQ for IT Pros (Internet Explorer 11 for IT Pros) + ms.sitesec: library + ms.date: 10/16/2017 + +title: Internet Explorer 11 - FAQ for IT Pros +summary: | + [!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + Answering frequently asked questions about Internet Explorer 11 (IE11) features, operating system support, integration with the Windows operating system, Group Policy, and general configuration. + + +sections: + - name: Ignored + questions: + - question: | + Frequently Asked Questions + answer: | + - question: | + What operating system does IE11 run on? + answer: | + - Windows 10 + + - Windows 8.1 + + - Windows Server 2012 R2 + + - Windows 7 with Service Pack 1 (SP1) + + - Windows Server 2008 R2 with Service Pack 1 (SP1) + + + - question: | + How do I install IE11 on Windows 10, Windows 8.1, or Windows Server 2012 R2? + answer: | + IE11 is preinstalled with Windows 8.1 and Windows Server 2012 R2. No additional action is required. + + - question: | + How do I install IE11 on Windows 7 with SP1 or Windows Server 2008 R2 with SP1? + answer: | + You can install IE11 on computers running either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. To download IE11, see the IE11 [home page](https://go.microsoft.com/fwlink/p/?LinkId=290956). + + - question: | + How does IE11 integrate with Windows 8.1? + answer: | + IE11 is the default handler for the HTTP and HTTPS protocols and the default browser for Windows 8.1. There are two experiences in Windows 8.1: Internet Explorer and Internet Explorer for the desktop. IE is the default browser for touch-first, immersive experiences. Internet Explorer for the desktop provides a more traditional window and tab management experience. The underlying platform of IE11 is fully interoperable across both IE and the familiar Internet Explorer for the desktop, letting developers write the same markup for both experiences. + + - question: | + What are the new or improved security features? + answer: | + IE11 offers improvements to Enhanced Protected Mode, password manager, and other security features. IE11 also turns on Transport Layer Security (TLS) 1.2 by default. + + - question: | + How is Microsoft supporting modern web standards, such as WebGL? + answer: | + Microsoft is committed to providing an interoperable web by supporting modern web standards. Doing this lets developers use the same markup across web browsers, helping to reduce development and support costs.
+ Supported web standards include: + + - Web Graphics Library (WebGL) + + - Canvas 2D L2 extensions, including image smoothing using the nearest neighbor, dashed lines, and fill rules + + - Fullscreen API + + - Encrypted media extensions + + - Media source extensions + + - CSS flexible box layout module + + - And mutation observers like DOM4 and 5.3 + + For more information about specific changes and additions, see the [IE11 guide for developers](/previous-versions/windows/internet-explorer/ie-developer/dev-guides/bg182636(v=vs.85)). + + - question: | + What test tools exist to test for potential application compatibility issues? + answer: | + The Compat Inspector tool supports Windows Internet Explorer 9 through IE11. For more information, see [Compat Inspector User Guide](https://go.microsoft.com/fwlink/p/?LinkId=313189). In addition, you can use the new [F12 Developer Tools](/previous-versions/windows/internet-explorer/ie-developer/dev-guides/bg182632(v=vs.85)) that are included with IE11, or the [modern.ie](https://go.microsoft.com/fwlink/p/?linkid=308902) website for Microsoft Edge. + + - question: | + Why am I having problems launching my legacy apps with Internet Explorer 11? + answer: | + It’s most likely because IE no longer starts apps that use managed browser hosting controls, like in the .NET Framework 1.1 and 2.0. You can get IE11 to use managed browser hosting controls again, by: + + - **For x86 systems or for 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. + + - **For x64 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. + + For more information, see the [Web Applications](/dotnet/framework/migration-guide/application-compatibility) section of the Application Compatibility in the .NET Framework 4.5 page. + + - question: | + Is there a compatibility list for IE? + answer: | + Yes. You can review the XML-based [compatibility version list](https://go.microsoft.com/fwlink/p/?LinkId=403864). + + - question: | + What is Enterprise Mode? + answer: | + Enterprise Mode is a compatibility mode designed for Enterprises. This mode lets websites render using a modified browser configuration that’s designed to avoid the common compatibility problems associated with web apps written and tested on older versions of IE, like Windows Internet Explorer 7 or Windows Internet Explorer 8.
+ For more information, see [Turn on Enterprise Mode and use a site list](../ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md). + + - question: | + What is the Enterprise Mode Site List Manager tool? + answer: | + Enterprise Mode Site List Manager tool gives you a way to add websites to your Enterprise Mode site list, without having to manually code XML.
+ For more information, see all of the topics in [Use the Enterprise Mode Site List Manager](../ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md). + + - question: | + Are browser plug-ins supported in IE11? + answer: | + The immersive version of IE11 provides an add-on–free experience, so browser plugins won't load and dependent content won't be displayed. This doesn't apply to Internet Explorer for the desktop. For more information, see [Browsing Without Plug-ins](https://go.microsoft.com/fwlink/p/?LinkId=242587). However, Internet Explorer for the desktop and IE11 on Windows 7 with SP1 do support browser plugins, including ActiveX controls such as Adobe Flash and Microsoft Silverlight. + + - question: | + Is Adobe Flash supported on IE11? + answer: | + Adobe Flash is included as a platform feature and is available out of the box for Windows 8.1, running on both IE and Internet Explorer for the desktop. Users can turn this feature on or off using the **Manage Add-ons** dialog box, while administrators can turn this feature on or off using the Group Policy setting, **Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects**.
+ **Important**
+ The preinstalled version of Adobe Flash isn't supported on IE11 running on either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. However, you can still download and install the separate Adobe Flash plug-in.
+
+ - question: |
+ Can I replace IE11 on Windows 8.1 with an earlier version?
+ answer: |
+ No. Windows 8.1 doesn't support any of the previous versions of IE.
+
+ - question: |
+ Are there any new Group Policy settings in IE11?
+ answer: |
+ IE11 includes all of the previous Group Policy settings you've used to manage and control web browser configuration since Internet Explorer 9. It also includes the following new Group Policy settings, supporting new features:
+
+ - Turn off Page Prediction
+
+ - Turn on the swiping motion for Internet Explorer for the desktop
+
+ - Allow Microsoft services to provide more relevant and personalized search results
+
+ - Turn off phone number detection
+
+ - Allow IE to use the SPDY/3 network protocol
+
+ - Let users turn on and use Enterprise Mode from the **Tools** menu
+
+ - Use the Enterprise Mode IE website list
+
+ For more information, see [New group policy settings for IE11](../ie11-deploy-guide/new-group-policy-settings-for-ie11.md).
+
+
+ - question: |
+ Where can I get more information about IE11 for IT pros?
+ answer: |
+ Visit the [Springboard Series for Microsoft Browsers](https://go.microsoft.com/fwlink/p/?LinkId=313191) webpage on TechNet.
+
+
+
+ - question: |
+ Can I customize settings for IE on Windows 8.1?
+ answer: |
+ Settings can be customized in the following ways:
+
+ - IE11 **Settings** charm.
+
+ - IE11-related Group Policy settings.
+
+ - IEAK 11 for settings shared by both IE and Internet Explorer for the desktop.
+
+ - question: |
+ Can I make Internet Explorer for the desktop my default browsing experience?
+ answer: |
+ Group Policy settings can be set to open either IE or Internet Explorer for the desktop as the default browser experience. Individual users can configure their own settings in the **Programs** tab of **Internet Options**. The following table shows the settings and results:
+
+ |Setting |Result |
+ |--------|-------|
+ |Let IE decide |Links open in the same type of experience from where they're launched. For example, clicking a link from a Microsoft Store app, opens IE. However, clicking a link from a desktop app, opens Internet Explorer for the desktop. |
+ |Always in IE11 |Links always open in IE. |
+ |Always in Internet Explorer for the desktop |Links always open in Internet Explorer for the desktop. |
+
+
+ - question: |
+ Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?
+ answer: |
+ Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
+
+ IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center:
+
+ | | | |
+ |---------|---------|---------|
+ |[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) |
+ |[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |
+ |[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |
+ |[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |
+ |[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |
+ |[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) |
+ |[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) |
+ |[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) |
+
+
+
+
+ - question: |
+ What are the different modes available for the Internet Explorer Customization Wizard?
+ answer: |
+ The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [Determine the licensing version and features to use in IEAK 11](../ie11-ieak/licensing-version-and-features-ieak11.md).
+
+ The following table displays which pages are available in IEAK 11, based on the licensing mode:
+
+ | **Wizard Pages** | **External** | **Internal** |
+ |-------------------------------------------|--------------|--------------|
+ | Welcome to the IEAK | Yes | Yes |
+ | File Locations | Yes | Yes |
+ | Platform Selection | Yes | Yes |
+ | Language Selection | Yes | Yes |
+ | Package Type Selection | Yes | Yes |
+ | Feature Selection | Yes | Yes |
+ | Automatic Version Synchronization | Yes | Yes |
+ | Custom Components | Yes | Yes |
+ | Corporate Install | No | Yes |
+ | User Experience | No | Yes |
+ | Browser User Interface | Yes | Yes |
+ | Search Providers | Yes | Yes |
+ | Important URLs - Home page and Support | Yes | Yes |
+ | Accelerators | Yes | Yes |
+ | Favorites, Favorites Bar, and Feeds | Yes | Yes |
+ | Browsing Options | No | Yes |
+ | First Run Wizard and Welcome Page Options | Yes | Yes |
+ | Compatibility View | Yes | Yes |
+ | Connection Manager | Yes | Yes |
+ | Connection Settings | Yes | Yes |
+ | Automatic Configuration | No | Yes |
+ | Proxy Settings | Yes | Yes |
+ | Security and Privacy Settings | No | Yes |
+ | Add a Root Certificate | Yes | No |
+ | Programs | Yes | Yes |
+ | Additional Settings | No | Yes |
+ | Wizard Complete | Yes | Yes |
+
+
+additionalContent: |
+
+ ## Related topics
+
+ - [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/)
+ - [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)
+ - [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md)
\ No newline at end of file
diff --git a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md
deleted file mode 100644
index 551959c31f..0000000000
--- a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md
+++ /dev/null
@@ -1,124 +0,0 @@
----
-ms.localizationpriority: medium
-ms.mktglfcycl: explore
-description: Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit.
-author: dansimp
-ms.author: dansimp
-ms.prod: ie11
-ms.assetid:
-ms.reviewer:
-audience: itpro
-manager: dansimp
-title: Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions
-ms.sitesec: library
-ms.date: 05/10/2018
----
-
-# Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions
-
-[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)]
-
-
-Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit.
-
-> [!Important]
-> If you administer your company’s environment using an update management solution, such as Windows Server Update Services (WSUS) or System Center 2012 Configuration Manager, you don’t need to use the Internet Explorer 11 Blocker Toolkit. Update management solutions let you completely manage your Windows Updates and Microsoft Updates, including your Internet Explorer 11 deployment.
-
-- [Automatic updates delivery process](#automatic-updates-delivery-process)
-
-- [How the Internet Explorer 11 Blocker Toolkit works](#how-the-internet-explorer-11-blocker-toolkit-works)
-
-- [Internet Explorer 11 Blocker Toolkit and other update services](#internet-explorer-11-blocker-toolkit-and-other-update-services)
-
-## Automatic Updates delivery process
-
-
-**Q. Which users will receive Internet Explorer 11 as an important update?**
-A. Users running either Windows 7 with Service Pack 1 (SP1) or the 64-bit version of Windows Server 2008 R2 with Service Pack 1 (SP1) will receive Internet Explorer 11 as an important update, if Automatic Updates are turned on. Windows Update is manually run. Automatic Updates will automatically download and install the Internet Explorer 11 files if it’s turned on. For more information about how Internet Explorer works with Automatic Updates and information about other deployment blocking options, see [Internet Explorer 11 Delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md).
-
-**Q. When is the Blocker Toolkit available?**
-A. The Blocker Toolkit is currently available from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722).
-
-**Q. What tools can I use to manage Windows Updates and Microsoft Updates in my company?**
-A. We encourage anyone who wants full control over their company’s deployment of Windows Updates and Microsoft Updates, to use [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), a free tool for users of Windows Server. You can also use the more advanced configuration management tool, [System Center 2012 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682041(v=technet.10)).
-
-**Q. How long does the blocker mechanism work?**
-A. The Internet Explorer 11 Blocker Toolkit uses a registry key value to permanently turn off the automatic delivery of Internet Explorer 11. This behavior lasts as long as the registry key value isn’t removed or changed.
-
-**Q. Why should I use the Internet Explorer 11 Blocker Toolkit to stop delivery of Internet Explorer 11? Why can’t I just disable all of Automatic Updates?**
-A. Automatic Updates provide you with ongoing critical security and reliability updates. Turning this feature off can leave your computers more vulnerable. Instead, we suggest that you use an update management solution, such as WSUS, to fully control your environment while leaving this feature running, managing how and when the updates get to your user’s computers.
-
-The Internet Explorer 11 Blocker Toolkit safely allows Internet Explorer 11 to download and install in companies that can’t use WSUS, Configuration Manager, or
-other update management solution.
-
-**Q. Why don’t we just block URL access to Windows Update or Microsoft Update?**
-A. Blocking the Windows Update or Microsoft Update URLs also stops delivery of critical security and reliability updates for all of the supported versions of the Windows operating system; leaving your computers more vulnerable.
-
-## How the Internet Explorer 11 Blocker Toolkit works
-
-**Q. How should I test the Internet Explorer 11 Blocker Toolkit in my company?**
-A. Because the toolkit only sets a registry key to turn on and off the delivery of Internet Explorer 11, there should be no additional impact or side effects to your environment. No additional testing should be necessary.
-
-**Q. What’s the registry key used to block delivery of Internet Explorer 11?**
-A. HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\11.0
-
-**Q. What’s the registry key name and values?**
-The registry key name is **DoNotAllowIE11**, where:
-
-- A value of **1** turns off the automatic delivery of Internet Explorer 11 using Automatic Updates and turns off the Express install option.
-
-- Not providing a registry key, or using a value of anything other than **1**, lets the user install Internet Explorer 11 through Automatic Updates or a
- manual update.
-
-**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from manually installing Internet Explorer 11?**
-A. No. The Internet Explorer 11 Blocker Toolkit only stops computers from automatically installing Internet Explorer 11 through Automatic Updates. Users can still download and install Internet Explorer 11 from the Microsoft Download Center or from external media.
-
-**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from automatically upgrading to Internet Explorer 11?**
-A. Yes. The Internet Explorer 11 Blocker Toolkit also prevents Automatic Updates from automatically upgrading a computer from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11.
-
-**Q. How does the provided script work?**
-A. The script accepts one of two command line options:
-
-- **Block:** Creates the registry key that stops Internet Explorer 11 from installing through Automatic Updates.
-
-- **Unblock:** Removes the registry key that stops Internet Explorer 11 from installing through Automatic Updates.
-
-**Q. What’s the ADM template file used for?**
-A. The Administrative Template (.adm file) lets you import the new Group Policy environment and use Group Policy Objects to centrally manage all of the computers in your company.
-
-**Q. Is the tool localized?**
-A. No. The tool isn’t localized, it’s only available in English (en-us). However, it does work, without any modifications, on any language edition of the supported operating systems.
-
-## Internet Explorer 11 Blocker Toolkit and other update services
-
-**Q: Is there a version of the Internet Explorer Blocker Toolkit that will prevent automatic installation of IE11?**
-Yes. The IE11 Blocker Toolkit is available for download. For more information, see [Toolkit to Disable Automatic Delivery of IE11](https://go.microsoft.com/fwlink/p/?LinkId=328195) on the Microsoft Download Center.
-
-**Q. Does the Internet Explorer 11 blocking mechanism also block delivery of Internet Explorer 11 through update management solutions, like WSUS?**
-A. No. You can still deploy Internet Explorer 11 using one of the upgrade management solutions, even if the blocking mechanism is activated. The Internet Explorer 11 Blocker Toolkit is only intended for companies that don’t use upgrade management solutions.
-
-**Q. If WSUS is set to 'auto-approve' Update Rollup packages (this is not the default configuration), how do I stop Internet Explorer 11 from automatically installing throughout my company?**
-A. You only need to change your settings if:
-
-- You use WSUS to manage updates and allow auto-approvals for Update Rollup installation.
-
- -and-
-
-- You have computers running either Windows 7 SP1 or Windows Server 2008 R2 (SP1) with Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 installed.
-
- -and-
-
-- You don’t want to upgrade your older versions of Internet Explorer to Internet Explorer 11 right now.
-
-If these scenarios apply to your company, see [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) for more information on how to prevent automatic installation.
-
-
-## Additional resources
-
-- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722)
-
-- [Internet Explorer 11 FAQ for IT pros](./faq-for-it-pros-ie11.md)
-
-- [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md)
-
-- [Internet Explorer 11 deployment guide](../ie11-deploy-guide/index.md)
\ No newline at end of file
diff --git a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.yml b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.yml
new file mode 100644
index 0000000000..217b48f990
--- /dev/null
+++ b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.yml
@@ -0,0 +1,161 @@
+### YamlMime:FAQ
+metadata:
+ ms.localizationpriority: medium
+ ms.mktglfcycl: explore
+ description: Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit.
+ author: dansimp
+ ms.author: dansimp
+ ms.prod: ie11
+ ms.assetid:
+ ms.reviewer:
+ audience: itpro
+ manager: dansimp
+ title: Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions
+ ms.sitesec: library
+ ms.date: 05/10/2018
+
+title: Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions
+summary: |
+ [!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)]
+
+
+ Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit.
+
+ > [!Important]
+ > If you administer your company’s environment using an update management solution, such as Windows Server Update Services (WSUS) or System Center 2012 Configuration Manager, you don’t need to use the Internet Explorer 11 Blocker Toolkit. Update management solutions let you completely manage your Windows Updates and Microsoft Updates, including your Internet Explorer 11 deployment.
+
+ - [Automatic updates delivery process](/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit#automatic-updates-delivery-process)
+
+ - [How the Internet Explorer 11 Blocker Toolkit works](/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit#how-the-internet-explorer-11-blocker-toolkit-works)
+
+ - [Internet Explorer 11 Blocker Toolkit and other update services](/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit#internet-explorer-11-blocker-toolkit-and-other-update-services)
+
+
+sections:
+ - name: Automatic Updates delivery process
+ questions:
+ - question: |
+ Which users will receive Internet Explorer 11 important update?
+ answer: |
+ Users running either Windows 7 with Service Pack 1 (SP1) or the 64-bit version of Windows Server 2008 R2 with Service Pack 1 (SP1) will receive Internet Explorer 11 important update, if Automatic Updates are turned on. Windows Update is manually run. Automatic Updates will automatically downloand install the Internet Explorer 11 files if it’s turned on. For more information about how Internet Explorer works with Automatic Updates and information about other deployment blocking options, see [Internet Explorer 11 Delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md).
+
+ - question: |
+ When is the Blocker Toolkit available?
+ answer: |
+ The Blocker Toolkit is currently available from the [Microsoft DownloCenter](https://www.microsoft.com/download/details.aspx?id=40722).
+
+ - question: |
+ Whtools cI use to manage Windows Updates and Microsoft Updates in my company?
+ answer: |
+ We encourage anyone who wants full control over their company’s deployment of Windows Updates and Microsoft Updates, to use [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), a free tool for users of Windows Server. You calso use the more advanced configuration management tool, [System Center 2012 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682041(v=technet.10)).
+
+ - question: |
+ How long does the blocker mechanism work?
+ answer: |
+ The Internet Explorer 11 Blocker Toolkit uses a registry key value to permanently turn off the automatic delivery of Internet Explorer 11. This behavior lasts long the registry key value isn’t removed or changed.
+
+ - question: |
+ Why should I use the Internet Explorer 11 Blocker Toolkit to stop delivery of Internet Explorer 11? Why can’t I just disable all of Automatic Updates?
+ answer: |
+ Automatic Updates provide you with ongoing criticsecurity and reliability updates. Turning this feature off cleave your computers more vulnerable. Instead, we suggest thyou use update management solution, such WSUS, to fully control your environment while leaving this feature running, managing how and when the updates get to your user’s computers.
+
+ The Internet Explorer 11 Blocker Toolkit safely allows Internet Explorer 11 to downloand install in companies thcan’t use WSUS, Configuration Manager, or
+ other update management solution.
+
+ - question: |
+ Why don’t we just block URL access to Windows Update or Microsoft Update?
+ answer: |
+ Blocking the Windows Update or Microsoft Update URLs also stops delivery of criticsecurity and reliability updates for all of the supported versions of the Windows operating system; leaving your computers more vulnerable.
+
+ - name: How the Internet Explorer 11 Blocker Toolkit works
+ questions:
+ - question: |
+ How should I test the Internet Explorer 11 Blocker Toolkit in my company?
+ answer: |
+ Because the toolkit only sets a registry key to turn on and off the delivery of Internet Explorer 11, there should be no additionimpact or side effects to your environment. No additiontesting should be necessary.
+
+ - question: |
+ What’s the registry key used to block delivery of Internet Explorer 11?
+ answer: |
+ HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\11.0
+
+ - question: |
+ What’s the registry key name and values?
+ answer: |
+ The registry key name is **DoNotAllowIE11**, where:
+
+ - A value of **1** turns off the automatic delivery of Internet Explorer 11 using Automatic Updates and turns off the Express install option.
+
+ - Not providing a registry key, or using a value of anything other th**1**, lets the user install Internet Explorer 11 through Automatic Updates or a
+ manuupdate.
+
+ - question: |
+ Does the Internet Explorer 11 Blocker Toolkit stop users from manually installing Internet Explorer 11?
+ answer: |
+ No. The Internet Explorer 11 Blocker Toolkit only stops computers from automatically installing Internet Explorer 11 through Automatic Updates. Users cstill downloand install Internet Explorer 11 from the Microsoft DownloCenter or from externmedia.
+
+ - question: |
+ Does the Internet Explorer 11 Blocker Toolkit stop users from automatically upgrading to Internet Explorer 11?
+ answer: |
+ Yes. The Internet Explorer 11 Blocker Toolkit also prevents Automatic Updates from automatically upgrading a computer from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11.
+
+ - question: |
+ How does the provided script work?
+ answer: |
+ The script accepts one of two command line options:
+
+ - **Block:** Creates the registry key thstops Internet Explorer 11 from installing through Automatic Updates.
+
+ - **Unblock:** Removes the registry key thstops Internet Explorer 11 from installing through Automatic Updates.
+
+ - question: |
+ What’s the ADM template file used for?
+ answer: |
+ The Administrative Template (.adm file) lets you import the new Group Policy environment and use Group Policy Objects to centrally manage all of the computers in your company.
+
+ - question: |
+ Is the tool localized?
+ answer: |
+ No. The tool isn’t localized, it’s only available in English (en-us). However, it does work, without any modifications, on any language edition of the supported operating systems.
+
+ - name: Internet Explorer 11 Blocker Toolkit and other update services
+ questions:
+ - question: |
+ Is there a version of the Internet Explorer Blocker Toolkit thwill prevent automatic installation of IE11?
+ answer: |
+ Yes. The IE11 Blocker Toolkit is available for download. For more information, see [Toolkit to Disable Automatic Delivery of IE11](https://go.microsoft.com/fwlink/p/?LinkId=328195) on the Microsoft DownloCenter.
+
+ - question: |
+ Does the Internet Explorer 11 blocking mechanism also block delivery of Internet Explorer 11 through update management solutions, like WSUS?
+ answer: |
+ No. You cstill deploy Internet Explorer 11 using one of the upgrade management solutions, even if the blocking mechanism is activated. The Internet Explorer 11 Blocker Toolkit is only intended for companies thdon’t use upgrade management solutions.
+
+ - question: |
+ If WSUS is set to 'auto-approve' Update Rollup packages (this is not the default configuration), how do I stop Internet Explorer 11 from automatically installing throughout my company?
+ answer: |
+ You only need to change your settings if:
+
+ - You use WSUS to manage updates and allow auto-approvals for Update Rollup installation.
+
+ -and-
+
+ - You have computers running either Windows 7 SP1 or Windows Server 2008 R2 (SP1) with Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 installed.
+
+ -and-
+
+ - You don’t want to upgrade your older versions of Internet Explorer to Internet Explorer 11 right now.
+
+ If these scenarios apply to your company, see [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) for more information on how to prevent automatic installation.
+
+
+additionalContent: |
+
+ ## Additionresources
+
+ - [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722)
+
+ - [Internet Explorer 11 Ffor IT pros](./faq-for-it-pros-ie11.yml)
+
+ - [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md)
+
+ - [Internet Explorer 11 deployment guide](../ie11-deploy-guide/index.md)
diff --git a/browsers/internet-explorer/ie11-faq/faq-ieak11.md b/browsers/internet-explorer/ie11-faq/faq-ieak11.md
deleted file mode 100644
index 674c2a1600..0000000000
--- a/browsers/internet-explorer/ie11-faq/faq-ieak11.md
+++ /dev/null
@@ -1,124 +0,0 @@
----
-ms.localizationpriority: medium
-ms.mktglfcycl: support
-ms.pagetype: security
-description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions.
-author: dansimp
-ms.author: dansimp
-ms.manager: elizapo
-ms.prod: ie11
-ms.assetid:
-ms.reviewer:
-audience: itpro
-manager: dansimp
-title: IEAK 11 - Frequently Asked Questions
-ms.sitesec: library
-ms.date: 05/10/2018
----
-
-# IEAK 11 - Frequently Asked Questions
-
-[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)]
-
-
-Get answers to commonly asked questions about the Internet Explorer Administration Kit 11 (IEAK 11), and find links to additional material you might find helpful.
-
-**What is IEAK 11?**
-
-IEAK 11 enables you to customize, brand, and distribute customized Internet Explorer 11 browser packages across an organization. Download the kit from the [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md).
-
-**What are the supported operating systems?**
-
-You can customize and install IEAK 11 on the following supported operating systems:
-
-- Windows 8
-
-- Windows Server 2012
-
-- Windows 7 Service Pack 1 (SP1)
-
-- Windows Server 2008 R2 Service Pack 1 (SP1)
-
-> [!NOTE]
-> IEAK 11 does not support building custom packages for Windows RT.
-
-
-**What can I customize with IEAK 11?**
-
-The IEAK 11 enables you to customize branding and settings for Internet Explorer 11. For PCs running Windows 7, the custom package also includes the Internet Explorer executable.
-
-> [!NOTE]
-> Internet Explorer 11 is preinstalled on PCs running Windows 8. Therefore, the executable is not included in the customized package.
-
-**Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?**
-Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
-
-> [!NOTE]
-> IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. To download IEAK 11, see [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md).
-
-**Q: Is there a version of the Internet Explorer Administration Kit (IEAK) supporting IE11?**
-Yes. The Internet Explorer Administration Kit 11 (IEAK 11) is available for download. IEAK 11 lets you create custom versions of IE11 for use in your organization. For more information, see the following resources:
-
-- [Internet Explorer Administration Kit Information and Downloads](../ie11-ieak/ieak-information-and-downloads.md) on the Internet Explorer TechCenter.
-
-- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md)
-
-**What are the different modes available for the Internet Explorer Customization Wizard?**
-The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [What IEAK can do for you](../ie11-ieak/what-ieak-can-do-for-you.md).
-
-The following table displays which pages are available in IEAK 11, based on the licensing mode:
-
-| **Wizard Pages** | **External** | **Internal** |
-|-------------------------------------------|--------------|--------------|
-| Welcome to the IEAK | Yes | Yes |
-| File Locations | Yes | Yes |
-| Platform Selection | Yes | Yes |
-| Language Selection | Yes | Yes |
-| Package Type Selection | Yes | Yes |
-| Feature Selection | Yes | Yes |
-| Automatic Version Synchronization | Yes | Yes |
-| Custom Components | Yes | Yes |
-| Corporate Install | No | Yes |
-| User Experience | No | Yes |
-| Browser User Interface | Yes | Yes |
-| Search Providers | Yes | Yes |
-| Important URLs - Home page and Support | Yes | Yes |
-| Accelerators | Yes | Yes |
-| Favorites, Favorites Bar, and Feeds | Yes | Yes |
-| Browsing Options | No | Yes |
-| First Run Wizard and Welcome Page Options | Yes | Yes |
-| Compatibility View | Yes | Yes |
-| Connection Manager | Yes | Yes |
-| Connection Settings | Yes | Yes |
-| Automatic Configuration | No | Yes |
-| Proxy Settings | Yes | Yes |
-| Security and Privacy Settings | No | Yes |
-| Add a Root Certificate | Yes | No |
-| Programs | Yes | Yes |
-| Additional Settings | No | Yes |
-| Wizard Complete | Yes | Yes |
-
-
-**Q. Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?**
-Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
-
-IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center:
-
-| | | |
-|---------|---------|---------|
-|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) |
-|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |
-|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |
-|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |
-|[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |
-|[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) |
-|[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) |
-|[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) |
-
-
-## Additional resources
-
-[Download IEAK 11](../ie11-ieak/ieak-information-and-downloads.md)
-[IEAK 11 overview](../ie11-ieak/index.md)
-[IEAK 11 product documentation](../ie11-ieak/index.md)
-[IEAK 11 licensing guidelines](../ie11-ieak/licensing-version-and-features-ieak11.md)
\ No newline at end of file
diff --git a/browsers/internet-explorer/ie11-faq/faq-ieak11.yml b/browsers/internet-explorer/ie11-faq/faq-ieak11.yml
new file mode 100644
index 0000000000..e2400b19af
--- /dev/null
+++ b/browsers/internet-explorer/ie11-faq/faq-ieak11.yml
@@ -0,0 +1,140 @@
+### YamlMime:FAQ
+metadata:
+ ms.localizationpriority: medium
+ ms.mktglfcycl: support
+ ms.pagetype: security
+ description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions.
+ author: dansimp
+ ms.author: dansimp
+ ms.manager: elizapo
+ ms.prod: ie11
+ ms.assetid:
+ ms.reviewer:
+ audience: itpro
+ manager: dansimp
+ title: IEAK 11 - Frequently Asked Questions
+ ms.sitesec: library
+ ms.date: 05/10/2018
+
+title: IEAK 11 - Frequently Asked Questions
+summary: |
+ [!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)]
+
+
+ Get answers to commonly asked questions about the Internet Explorer Administration Kit 11 (IEAK 11), and find links to additional material you might find helpful.
+
+
+sections:
+ - name: Ignored
+ questions:
+ - question: |
+ What is IEAK 11?
+ answer: |
+ IEAK 11 enables you to customize, brand, and distribute customized Internet Explorer 11 browser packages across an organization. Download the kit from the [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md).
+
+ - question: |
+ What are the supported operating systems?
+ answer: |
+ You can customize and install IEAK 11 on the following supported operating systems:
+
+ - Windows 8
+
+ - Windows Server 2012
+
+ - Windows 7 Service Pack 1 (SP1)
+
+ - Windows Server 2008 R2 Service Pack 1 (SP1)
+
+ > [!NOTE]
+ > IEAK 11 does not support building custom packages for Windows RT.
+
+
+ - question: |
+ What can I customize with IEAK 11?
+ answer: |
+ The IEAK 11 enables you to customize branding and settings for Internet Explorer 11. For PCs running Windows 7, the custom package also includes the Internet Explorer executable.
+
+ > [!NOTE]
+ > Internet Explorer 11 is preinstalled on PCs running Windows 8. Therefore, the executable is not included in the customized package.
+
+ - question: |
+ Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?
+ answer: |
+ Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
+
+ > [!NOTE]
+ > IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. To download IEAK 11, see [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md).
+
+ - question: |
+ Is there a version of the Internet Explorer Administration Kit (IEAK) supporting IE11?
+ answer: |
+ Yes. The Internet Explorer Administration Kit 11 (IEAK 11) is available for download. IEAK 11 lets you create custom versions of IE11 for use in your organization. For more information, see the following resources:
+
+ - [Internet Explorer Administration Kit Information and Downloads](../ie11-ieak/ieak-information-and-downloads.md) on the Internet Explorer TechCenter.
+
+ - [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md)
+
+ - question: |
+ What are the different modes available for the Internet Explorer Customization Wizard?
+ answer: |
+ The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [What IEAK can do for you](../ie11-ieak/what-ieak-can-do-for-you.md).
+
+ The following table displays which pages are available in IEAK 11, based on the licensing mode:
+
+ | **Wizard Pages** | **External** | **Internal** |
+ |-------------------------------------------|--------------|--------------|
+ | Welcome to the IEAK | Yes | Yes |
+ | File Locations | Yes | Yes |
+ | Platform Selection | Yes | Yes |
+ | Language Selection | Yes | Yes |
+ | Package Type Selection | Yes | Yes |
+ | Feature Selection | Yes | Yes |
+ | Automatic Version Synchronization | Yes | Yes |
+ | Custom Components | Yes | Yes |
+ | Corporate Install | No | Yes |
+ | User Experience | No | Yes |
+ | Browser User Interface | Yes | Yes |
+ | Search Providers | Yes | Yes |
+ | Important URLs - Home page and Support | Yes | Yes |
+ | Accelerators | Yes | Yes |
+ | Favorites, Favorites Bar, and Feeds | Yes | Yes |
+ | Browsing Options | No | Yes |
+ | First Run Wizard and Welcome Page Options | Yes | Yes |
+ | Compatibility View | Yes | Yes |
+ | Connection Manager | Yes | Yes |
+ | Connection Settings | Yes | Yes |
+ | Automatic Configuration | No | Yes |
+ | Proxy Settings | Yes | Yes |
+ | Security and Privacy Settings | No | Yes |
+ | Add a Root Certificate | Yes | No |
+ | Programs | Yes | Yes |
+ | Additional Settings | No | Yes |
+ | Wizard Complete | Yes | Yes |
+
+
+ - question: |
+ Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?
+ answer: |
+ Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
+
+ IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center:
+
+ | | | |
+ |---------|---------|---------|
+ |[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) |
+ |[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |
+ |[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |
+ |[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |
+ |[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |
+ |[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) |
+ |[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) |
+ |[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) |
+
+additionalContent: |
+
+ ## Additional resources
+
+ -[Download IEAK 11](../ie11-ieak/ieak-information-and-downloads.md)
+ -[IEAK 11 overview](../ie11-ieak/index.md)
+ -[IEAK 11 product documentation](../ie11-ieak/index.md)
+ -[IEAK 11 licensing guidelines](../ie11-ieak/licensing-version-and-features-ieak11.md)
\ No newline at end of file
diff --git a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md
index 1d8b34786a..69b71a1820 100644
--- a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md
+++ b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md
@@ -32,7 +32,7 @@ The Internet Explorer Administration Kit (IEAK) simplifies the creation, deploym
[IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md)
-[IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md)
+[IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.yml)
[Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](before-you-create-custom-pkgs-ieak11.md)
diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md
index 30d5fd6b52..5b662eeca6 100644
--- a/browsers/internet-explorer/ie11-ieak/index.md
+++ b/browsers/internet-explorer/ie11-ieak/index.md
@@ -43,10 +43,10 @@ IE11 and IEAK 11 offers differing experiences between Windows 7 and Windows 8.1
|Internet Explorer Customization Wizard 11 |Step-by-step wizard screens that help you create custom IE11 installation packages. |
## Related topics
-- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md)
+- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.yml)
- [Download IEAK 11](ieak-information-and-downloads.md)
- [IEAK 11 administrators guide]()
- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md)
-- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md)
+- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.yml)
- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)
- [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/)
\ No newline at end of file
diff --git a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md b/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md
index 2428cba980..b6c2cc7087 100644
--- a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md
+++ b/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md
@@ -62,11 +62,11 @@ ISVs install IEAK using External mode (for Internet Explorer 10 or newer) or Int
## Additional resources
-- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md)
+- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.yml)
- [Download IEAK 11](ieak-information-and-downloads.md)
- [IEAK 11 overview](index.md)
- [IEAK 11 administrators guide](./index.md)
- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md)
-- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md)
+- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.yml)
- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)
- [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/)
\ No newline at end of file
diff --git a/browsers/internet-explorer/index.md b/browsers/internet-explorer/index.md
index 6c3085d888..cba6e52972 100644
--- a/browsers/internet-explorer/index.md
+++ b/browsers/internet-explorer/index.md
@@ -15,7 +15,7 @@ ms.date: 07/27/2017
# Internet Explorer 11 (IE11)
Find info about Internet Explorer 11 that's important to IT Pros.
-- [Internet Explorer 11 - FAQ for IT Pros](ie11-faq/faq-for-it-pros-ie11.md)
+- [Internet Explorer 11 - FAQ for IT Pros](ie11-faq/faq-for-it-pros-ie11.yml)
- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](ie11-deploy-guide/index.md)
diff --git a/browsers/internet-explorer/internet-explorer.yml b/browsers/internet-explorer/internet-explorer.yml
index 1d1950f20d..6aa0242523 100644
--- a/browsers/internet-explorer/internet-explorer.yml
+++ b/browsers/internet-explorer/internet-explorer.yml
@@ -25,7 +25,7 @@ landingContent:
- text: System requirements and language support
url: ./ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md
- text: Frequently asked questions
- url: ./ie11-faq/faq-for-it-pros-ie11.md
+ url: ./ie11-faq/faq-for-it-pros-ie11.yml
- text: Internet Explorer 11 deployment guide
url: ./ie11-deploy-guide/index.md
- text: Use Enterprise Mode to improve compatibility
@@ -89,7 +89,7 @@ landingContent:
- text: Download IEAK 11
url: ./ie11-ieak/ieak-information-and-downloads.md
- text: Frequently asked questions about IEAK 11
- url: ./ie11-faq/faq-ieak11.md
+ url: ./ie11-faq/faq-ieak11.yml
- text: Customization and distribution guidelines
url: ./ie11-ieak/licensing-version-and-features-ieak11.md#customization-guidelines
- linkListType: deploy
@@ -147,7 +147,7 @@ landingContent:
- text: Disable VBScript execution in Internet Explorer for Internet Zone and Restricted Sites Zone
url: https://support.microsoft.com/help/4012494/option-to-disable-vbscript-execution-in-internet-explorer-for-internet
- text: Frequently asked questions about IEAK 11
- url: ./ie11-faq/faq-ieak11.md
+ url: ./ie11-faq/faq-ieak11.yml
- text: Internet Explorer 8, 9, 10, 11 forum
url: https://social.technet.microsoft.com/forums/ie/home?forum=ieitprocurrentver
- text: Contact a Microsoft support professional
diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md
index 3e6aea0068..1faba01072 100644
--- a/windows/deployment/windows-10-poc-sc-config-mgr.md
+++ b/windows/deployment/windows-10-poc-sc-config-mgr.md
@@ -854,7 +854,7 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF
6. When a popup dialog box asks if you want to run full discovery, click **Yes**.
7. In the Assets and Compliance workspace, click **Devices** and verify that the computer account names for SRV1 and PC1 are displayed. See the following example (GREGLIN-PC1 is the computer account name of PC1 in this example):
- 
+ 
>If you do not see the computer account for PC1, try clicking the **Refresh** button in the upper right corner of the console.
diff --git a/windows/security/information-protection/TOC.yml b/windows/security/information-protection/TOC.yml
index 2b6ed2739b..9965f322db 100644
--- a/windows/security/information-protection/TOC.yml
+++ b/windows/security/information-protection/TOC.yml
@@ -7,26 +7,26 @@
- name: Overview of BitLocker Device Encryption in Windows 10
href: bitlocker\bitlocker-device-encryption-overview-windows-10.md
- name: BitLocker frequently asked questions (FAQ)
- href: bitlocker\bitlocker-frequently-asked-questions.md
+ href: bitlocker\bitlocker-frequently-asked-questions.yml
items:
- name: Overview and requirements
href: bitlocker\bitlocker-overview-and-requirements-faq.yml
- name: Upgrading
- href: bitlocker\bitlocker-upgrading-faq.md
+ href: bitlocker\bitlocker-upgrading-faq.yml
- name: Deployment and administration
href: bitlocker\bitlocker-deployment-and-administration-faq.yml
- name: Key management
- href: bitlocker\bitlocker-key-management-faq.md
+ href: bitlocker\bitlocker-key-management-faq.yml
- name: BitLocker To Go
href: bitlocker\bitlocker-to-go-faq.yml
- name: Active Directory Domain Services
href: bitlocker\bitlocker-and-adds-faq.yml
- name: Security
- href: bitlocker\bitlocker-security-faq.md
+ href: bitlocker\bitlocker-security-faq.yml
- name: BitLocker Network Unlock
- href: bitlocker\bitlocker-network-unlock-faq.md
+ href: bitlocker\bitlocker-network-unlock-faq.yml
- name: General
- href: bitlocker\bitlocker-using-with-other-programs-faq.md
+ href: bitlocker\bitlocker-using-with-other-programs-faq.yml
- name: "Prepare your organization for BitLocker: Planning and policies"
href: bitlocker\prepare-your-organization-for-bitlocker-planning-and-policies.md
- name: BitLocker basic deployment
diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md
deleted file mode 100644
index ff365150c9..0000000000
--- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: BitLocker FAQ (Windows 10)
-description: Find the answers you need by exploring this brief hub page listing FAQ pages for various aspects of BitLocker.
-ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
-ms.reviewer:
-ms.prod: w10
-ms.mktglfcycl: explore
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-manager: dansimp
-audience: ITPro
-ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 02/28/2019
-ms.custom: bitlocker
----
-
-# BitLocker frequently asked questions (FAQ) resources
-
-**Applies to**
-- Windows 10
-
-This topic links to frequently asked questions about BitLocker. BitLocker is a data protection feature that encrypts drives on your computer to help prevent data theft or exposure. BitLocker-protected computers can also delete data more securely when they are decommissioned because it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive.
-
-- [Overview and requirements](bitlocker-overview-and-requirements-faq.yml)
-- [Upgrading](bitlocker-upgrading-faq.md)
-- [Deployment and administration](bitlocker-deployment-and-administration-faq.yml)
-- [Key management](bitlocker-key-management-faq.md)
-- [BitLocker To Go](bitlocker-to-go-faq.yml)
-- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.yml)
-- [Security](bitlocker-security-faq.md)
-- [BitLocker Network Unlock](bitlocker-network-unlock-faq.md)
-- [Using BitLocker with other programs and general questions](bitlocker-using-with-other-programs-faq.md)
-
-
-## More information
-
-- [Prepare your organization for BitLocker: Planning and Policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)
-- [BitLocker Group Policy settings](bitlocker-group-policy-settings.md)
-- [BCD settings and BitLocker](bcd-settings-and-bitlocker.md)
-- [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md)
-- [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md)
-- [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)
-- [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md)
-- [BitLocker Cmdlets in Windows PowerShell](/powershell/module/bitlocker/index?view=win10-ps&preserve-view=true)
\ No newline at end of file
diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml
new file mode 100644
index 0000000000..ce3ad7185a
--- /dev/null
+++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml
@@ -0,0 +1,53 @@
+### YamlMime:FAQ
+metadata:
+ title: BitLocker FAQ (Windows 10)
+ description: Find the answers you need by exploring this brief hub page listing FAQ pages for various aspects of BitLocker.
+ ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
+ ms.reviewer:
+ ms.prod: w10
+ ms.mktglfcycl: explore
+ ms.sitesec: library
+ ms.pagetype: security
+ ms.localizationpriority: medium
+ author: dansimp
+ ms.author: dansimp
+ manager: dansimp
+ audience: ITPro
+ ms.collection: M365-security-compliance
+ ms.topic: conceptual
+ ms.date: 02/28/2019
+ ms.custom: bitlocker
+
+title: BitLocker frequently asked questions (FAQ) resources
+summary: |
+ **Applies to**
+ - Windows 10
+
+ This topic links to frequently asked questions about BitLocker. BitLocker is a data protection feature that encrypts drives on your computer to help prevent data theft or exposure. BitLocker-protected computers can also delete data more securely when they are decommissioned because it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive.
+
+ - [Overview and requirements](bitlocker-overview-and-requirements-faq.yml)
+ - [Upgrading](bitlocker-upgrading-faq.yml)
+ - [Deployment and administration](bitlocker-deployment-and-administration-faq.yml)
+ - [Key management](bitlocker-key-management-faq.yml)
+ - [BitLocker To Go](bitlocker-to-go-faq.yml)
+ - [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.yml)
+ - [Security](bitlocker-security-faq.yml)
+ - [BitLocker Network Unlock](bitlocker-network-unlock-faq.yml)
+ - [Using BitLocker with other programs and general questions](bitlocker-using-with-other-programs-faq.yml)
+
+
+
+sections:
+ - name: Ignored
+ questions:
+ - question: |
+ More information
+ answer: |
+ - [Prepare your organization for BitLocker: Planning and Policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)
+ - [BitLocker Group Policy settings](bitlocker-group-policy-settings.md)
+ - [BCD settings and BitLocker](bcd-settings-and-bitlocker.md)
+ - [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md)
+ - [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md)
+ - [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)
+ - [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md)
+ - [BitLocker Cmdlets in Windows PowerShell](/powershell/module/bitlocker/index?view=win10-ps&preserve-view=true)
\ No newline at end of file
diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md
index 8406b92de0..b07187e9c4 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md
@@ -211,7 +211,7 @@ This policy setting permits the use of enhanced PINs when you use an unlock meth
Enhanced startup PINs permit the use of characters (including uppercase and lowercase letters, symbols, numbers, and spaces). This policy setting is applied when you turn on BitLocker.
-> [!IMPORANT]
+> [!IMPORTANT]
> Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used.
### Configure minimum PIN length for startup
@@ -1341,6 +1341,6 @@ PCR 7 measurements are a mandatory logo requirement for systems that support Mod
- [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview)
- [TPM Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings)
-- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md)
+- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml)
- [BitLocker overview](bitlocker-overview.md)
-- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)
\ No newline at end of file
+- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)
diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
index 4ba7629cc0..5a619e7a83 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
@@ -106,6 +106,6 @@ Enable-WindowsOptionalFeature -Online -FeatureName BitLocker, BitLocker-Utilitie
## More information
- [BitLocker overview](bitlocker-overview.md)
-- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md)
+- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml)
- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)
- [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md)
diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md
index b69e88d45f..0327b8ec18 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md
@@ -387,5 +387,5 @@ Follow these steps to configure Network Unlock on these older systems.
## See also
- [BitLocker overview](bitlocker-overview.md)
-- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md)
+- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml)
- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)
diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md
deleted file mode 100644
index 2845de6cfb..0000000000
--- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md
+++ /dev/null
@@ -1,124 +0,0 @@
----
-title: BitLocker Key Management FAQ (Windows 10)
-description: Browse frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
-ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
-ms.reviewer:
-ms.prod: w10
-ms.mktglfcycl: explore
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-manager: dansimp
-audience: ITPro
-ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 02/28/2019
-ms.custom: bitlocker
----
-
-# BitLocker Key Management FAQ
-
-**Applies to**
-- Windows 10
-
-## How can I authenticate or unlock my removable data drive?
-
-You can unlock removable data drives by using a password, a smart card, or you can configure a SID protector to unlock a drive by using your domain credentials. After you've started encryption, the drive can also be automatically unlocked on a specific computer for a specific user account. System administrators can configure which options are available for users, as well as password complexity and minimum length requirements. To unlock by using a SID protector, use Manage-bde:
-
-Manage-bde -protectors -add e: -sid domain\username
-
-## What is the difference between a recovery password, recovery key, PIN, enhanced PIN, and startup key?
-
-For tables that list and describe elements such as a recovery password, recovery key, and PIN, see [BitLocker key protectors](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-key-protectors) and [BitLocker authentication methods](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-authentication-methods).
-
-## How can the recovery password and recovery key be stored?
-
-The recovery password and recovery key for an operating system drive or a fixed data drive can be saved to a folder, saved to one or more USB devices, saved to your Microsoft Account, or printed.
-
-For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft Account, or printed. By default, you cannot store a recovery key for a removable drive on a removable drive.
-
-A domain administrator can additionally configure Group Policy to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) for any BitLocker-protected drive.
-
-## Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled?
-
-You can use the Manage-bde.exe command-line tool to replace your TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and you want to add PIN authentication, use the following commands from an elevated command prompt, replacing *4-20 digit numeric PIN* with the numeric PIN you want to use:
-
-manage-bde –protectors –delete %systemdrive% -type tpm
-
-manage-bde –protectors –add %systemdrive% -tpmandpin 4-20 digit numeric PIN
-
-
-## When should an additional method of authentication be considered?
-
-New hardware that meets [Windows Hardware Compatibility Program](/windows-hardware/design/compatibility/) requirements make a PIN less critical as a mitigation, and having a TPM-only protector is likely sufficient when combined with policies like device lockout. For example, Surface Pro and Surface Book do not have external DMA ports to attack.
-For older hardware, where a PIN may be needed, it’s recommended to enable [enhanced PINs](bitlocker-group-policy-settings.md#bkmk-unlockpol2) that allow non-numeric characters such as letters and punctuation marks, and to set the PIN length based on your risk tolerance and the hardware anti-hammering capabilities available to the TPMs in your computers.
-
-## If I lose my recovery information, will the BitLocker-protected data be unrecoverable?
-
-BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive.
-
-> [!IMPORTANT]
-> Store the recovery information in AD DS, along with your Microsoft Account, or another safe location.
-
-## Can the USB flash drive that is used as the startup key also be used to store the recovery key?
-
-While this is technically possible, it is not a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains your startup key is lost or stolen, you also lose access to your recovery key. In addition, inserting this key would cause your computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check.
-
-## Can I save the startup key on multiple USB flash drives?
-
-Yes, you can save a computer's startup key on multiple USB flash drives. Right-clicking a BitLocker-protected drive and selecting **Manage BitLocker** will provide you the options to duplicate the recovery keys as needed.
-
-## Can I save multiple (different) startup keys on the same USB flash drive?
-
-Yes, you can save BitLocker startup keys for different computers on the same USB flash drive.
-
-## Can I generate multiple (different) startup keys for the same computer?
-
-You can generate different startup keys for the same computer through scripting. However, for computers that have a TPM, creating different startup keys prevents BitLocker from using the TPM's system integrity check.
-
-## Can I generate multiple PIN combinations?
-
-You cannot generate multiple PIN combinations.
-
-## What encryption keys are used in BitLocker? How do they work together?
-
-Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios.
-
-## Where are the encryption keys stored?
-
-The full volume encryption key is encrypted by the volume master key and stored in the encrypted drive. The volume master key is encrypted by the appropriate key protector and stored in the encrypted drive. If BitLocker has been suspended, the clear key that is used to encrypt the volume master key is also stored in the encrypted drive, along with the encrypted volume master key.
-
-This storage process ensures that the volume master key is never stored unencrypted and is protected unless you disable BitLocker. The keys are also saved to two additional locations on the drive for redundancy. The keys can be read and processed by the boot manager.
-
-## Why do I have to use the function keys to enter the PIN or the 48-character recovery password?
-
-The F1 through F10 keys are universally mapped scan codes available in the pre-boot environment on all computers and in all languages. The numeric keys 0 through 9 are not usable in the pre-boot environment on all keyboards.
-
-When using an enhanced PIN, users should run the optional system check during the BitLocker setup process to ensure that the PIN can be entered correctly in the pre-boot environment.
-
-## How does BitLocker help prevent an attacker from discovering the PIN that unlocks my operating system drive?
-
-It is possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker have physical access to the computer.
-
-The TPM has the built-in ability to detect and react to these types of attacks. Because different manufacturers' TPMs may support different PIN and attack mitigations, contact your TPM's manufacturer to determine how your computer's TPM mitigates PIN brute force attacks.
-After you have determined your TPM's manufacturer, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset.
-
-## How can I determine the manufacturer of my TPM?
-
-You can determine your TPM manufacturer in **Windows Defender Security Center** > **Device Security** > **Security processor details**.
-
-## How can I evaluate a TPM's dictionary attack mitigation mechanism?
-
-The following questions can assist you when asking a TPM manufacturer about the design of a dictionary attack mitigation mechanism:
-
-- How many failed authorization attempts can occur before lockout?
-- What is the algorithm for determining the duration of a lockout based on the number of failed attempts and any other relevant parameters?
-- What actions can cause the failure count and lockout duration to be decreased or reset?
-
-## Can PIN length and complexity be managed with Group Policy?
-
-Yes and No. You can configure the minimum personal identification number (PIN) length by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** Group Policy setting. However, you cannot require PIN complexity by Group Policy.
-
-For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
\ No newline at end of file
diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml
new file mode 100644
index 0000000000..4413577e0b
--- /dev/null
+++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml
@@ -0,0 +1,121 @@
+### YamlMime:FAQ
+metadata:
+ title: BitLocker Key Management FAQ (Windows 10)
+ description: Browse frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
+ ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
+ ms.reviewer:
+ ms.prod: w10
+ ms.mktglfcycl: explore
+ ms.sitesec: library
+ ms.pagetype: security
+ ms.localizationpriority: medium
+ author: dansimp
+ ms.author: dansimp
+ manager: dansimp
+ audience: ITPro
+ ms.collection: M365-security-compliance
+ ms.topic: conceptual
+ ms.date: 02/28/2019
+ ms.custom: bitlocker
+
+title: BitLocker Key Management FAQ
+summary: |
+ **Applies to**
+ - Windows 10
+
+
+sections:
+ - name: Ignored
+ questions:
+ - question: How can I authenticate or unlock my removable data drive?
+ answer: |
+ You can unlock removable data drives by using a password, a smart card, or you can configure a SID protector to unlock a drive by using your domain credentials. After you've started encryption, the drive can also be automatically unlocked on a specific computer for a specific user account. System administrators can configure which options are available for users, as well as password complexity and minimum length requirements. To unlock by using a SID protector, use Manage-bde:
+
+ Manage-bde -protectors -add e: -sid domain\username
+
+ - question: What is the difference between a recovery password, recovery key, PIN, enhanced PIN, and startup key?
+ answer: |
+ For tables that list and describe elements such as a recovery password, recovery key, and PIN, see [BitLocker key protectors](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-key-protectors) and [BitLocker authentication methods](prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-authentication-methods).
+
+ - question: How can the recovery password and recovery key be stored?
+ answer: |
+ The recovery password and recovery key for an operating system drive or a fixed data drive can be saved to a folder, saved to one or more USB devices, saved to your Microsoft Account, or printed.
+
+ For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft Account, or printed. By default, you cannot store a recovery key for a removable drive on a removable drive.
+
+ A domain administrator can additionally configure Group Policy to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) for any BitLocker-protected drive.
+
+ - question: Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled?
+ answer: |
+ You can use the Manage-bde.exe command-line tool to replace your TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and you want to add PIN authentication, use the following commands from an elevated command prompt, replacing *4-20 digit numeric PIN* with the numeric PIN you want to use:
+
+ manage-bde –protectors –delete %systemdrive% -type tpm
+
+ manage-bde –protectors –add %systemdrive% -tpmandpin 4-20 digit numeric PIN
+
+
+ - question: When should an additional method of authentication be considered?
+ answer: |
+ New hardware that meets [Windows Hardware Compatibility Program](/windows-hardware/design/compatibility/) requirements make a PIN less critical as a mitigation, and having a TPM-only protector is likely sufficient when combined with policies like device lockout. For example, Surface Pro and Surface Book do not have external DMA ports to attack.
+ For older hardware, where a PIN may be needed, it’s recommended to enable [enhanced PINs](bitlocker-group-policy-settings.md#bkmk-unlockpol2) that allow non-numeric characters such as letters and punctuation marks, and to set the PIN length based on your risk tolerance and the hardware anti-hammering capabilities available to the TPMs in your computers.
+
+ - question: If I lose my recovery information, will the BitLocker-protected data be unrecoverable?
+ answer: |
+ BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive.
+
+ > [!IMPORTANT]
+ > Store the recovery information in AD DS, along with your Microsoft Account, or another safe location.
+
+ - question: Can the USB flash drive that is used as the startup key also be used to store the recovery key?
+ answer: While this is technically possible, it is not a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains your startup key is lost or stolen, you also lose access to your recovery key. In addition, inserting this key would cause your computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check.
+
+ - question: Can I save the startup key on multiple USB flash drives?
+ answer: Yes, you can save a computer's startup key on multiple USB flash drives. Right-clicking a BitLocker-protected drive and selecting **Manage BitLocker** will provide you the options to duplicate the recovery keys as needed.
+
+ - question: Can I save multiple (different) startup keys on the same USB flash drive?
+ answer: Yes, you can save BitLocker startup keys for different computers on the same USB flash drive.
+
+ - question: Can I generate multiple (different) startup keys for the same computer?
+ answer: You can generate different startup keys for the same computer through scripting. However, for computers that have a TPM, creating different startup keys prevents BitLocker from using the TPM's system integrity check.
+
+ - question: Can I generate multiple PIN combinations?
+ answer: You cannot generate multiple PIN combinations.
+
+ - question: What encryption keys are used in BitLocker? How do they work together?
+ answer: Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios.
+
+ - question: Where are the encryption keys stored?
+ answer: |
+ The full volume encryption key is encrypted by the volume master key and stored in the encrypted drive. The volume master key is encrypted by the appropriate key protector and stored in the encrypted drive. If BitLocker has been suspended, the clear key that is used to encrypt the volume master key is also stored in the encrypted drive, along with the encrypted volume master key.
+
+ This storage process ensures that the volume master key is never stored unencrypted and is protected unless you disable BitLocker. The keys are also saved to two additional locations on the drive for redundancy. The keys can be read and processed by the boot manager.
+
+ - question: Why do I have to use the function keys to enter the PIN or the 48-character recovery password?
+ answer: |
+ The F1 through F10 keys are universally mapped scan codes available in the pre-boot environment on all computers and in all languages. The numeric keys 0 through 9 are not usable in the pre-boot environment on all keyboards.
+
+ When using an enhanced PIN, users should run the optional system check during the BitLocker setup process to ensure that the PIN can be entered correctly in the pre-boot environment.
+
+ - question: How does BitLocker help prevent an attacker from discovering the PIN that unlocks my operating system drive?
+ answer: |
+ It is possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker have physical access to the computer.
+
+ The TPM has the built-in ability to detect and react to these types of attacks. Because different manufacturers' TPMs may support different PIN and attack mitigations, contact your TPM's manufacturer to determine how your computer's TPM mitigates PIN brute force attacks.
+ After you have determined your TPM's manufacturer, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset.
+
+ - question: How can I determine the manufacturer of my TPM?
+ answer: You can determine your TPM manufacturer in **Windows Defender Security Center** > **Device Security** > **Security processor details**.
+
+ - question: How can I evaluate a TPM's dictionary attack mitigation mechanism?
+ answer: |
+ The following questions can assist you when asking a TPM manufacturer about the design of a dictionary attack mitigation mechanism:
+
+ - How many failed authorization attempts can occur before lockout?
+ - What is the algorithm for determining the duration of a lockout based on the number of failed attempts and any other relevant parameters?
+ - What actions can cause the failure count and lockout duration to be decreased or reset?
+
+ - question: Can PIN length and complexity be managed with Group Policy?
+ answer: |
+ Yes and No. You can configure the minimum personal identification number (PIN) length by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** Group Policy setting. However, you cannot require PIN complexity by Group Policy.
+
+ For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md
index 50b744ed8a..54f967207f 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md
@@ -101,7 +101,7 @@ Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -Pi
## Related Articles
-[BitLocker: FAQs](bitlocker-frequently-asked-questions.md)
+[BitLocker: FAQs](bitlocker-frequently-asked-questions.yml)
[Microsoft BitLocker Administration and Management (MBAM)](/microsoft-desktop-optimization-pack/mbam-v25/)
diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md
deleted file mode 100644
index 264ee0242a..0000000000
--- a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-title: BitLocker Network Unlock FAQ (Windows 10)
-description: Familiarize yourself with BitLocker Network Unlock. Learn how it can make desktop and server management easier within domain environments.
-ms.prod: w10
-ms.mktglfcycl: explore
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-manager: dansimp
-audience: ITPro
-ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 02/28/2019
-ms.reviewer:
-ms.custom: bitlocker
----
-
-# BitLocker Network Unlock FAQ
-
-**Applies to**
-- Windows 10
-
-BitLocker Network Unlock enables easier management for BitLocker-enabled desktops and servers that use the TPM+PIN protection method in a domain environment. When a computer that is connected to a wired corporate network is rebooted, Network Unlock allows the PIN entry prompt to be bypassed. It automatically unlocks BitLocker-protected operating system volumes by using a trusted key that is provided by the Windows Deployment Services server as its secondary authentication method.
-
-To use Network Unlock you must also have a PIN configured for your computer. When your computer is not connected to the network you will need to provide the PIN to unlock it.
-
-BitLocker Network Unlock has software and hardware requirements for both client computers, Windows Deployment services, and domain controllers that must be met before you can use it.
-
-Network Unlock uses two protectors, the TPM protector and the one provided by the network or by your PIN, whereas automatic unlock uses a single protector, the one stored in the TPM. If the computer is joined to a network without the key protector it will prompt you to enter your PIN. If the PIN is
-not available you will need to use the recovery key to unlock the computer if it can ot be connected to the network.
-
-For more info, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md).
-
-
diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml
new file mode 100644
index 0000000000..17c1035e0b
--- /dev/null
+++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml
@@ -0,0 +1,40 @@
+### YamlMime:FAQ
+metadata:
+ title: BitLocker Network Unlock FAQ (Windows 10)
+ description: Familiarize yourself with BitLocker Network Unlock. Learn how it can make desktop and server management easier within domain environments.
+ ms.prod: w10
+ ms.mktglfcycl: explore
+ ms.sitesec: library
+ ms.pagetype: security
+ ms.localizationpriority: medium
+ author: dansimp
+ ms.author: dansimp
+ manager: dansimp
+ audience: ITPro
+ ms.collection: M365-security-compliance
+ ms.topic: conceptual
+ ms.date: 02/28/2019
+ ms.reviewer:
+ ms.custom: bitlocker
+
+title: BitLocker Network Unlock FAQ
+summary: |
+ **Applies to**
+ - Windows 10
+
+sections:
+ - name: Ignored
+ questions:
+ - question: |
+ BitLocker Network Unlock FAQ
+ answer: |
+ BitLocker Network Unlock enables easier management for BitLocker-enabled desktops and servers that use the TPM+PIN protection method in a domain environment. When a computer that is connected to a wired corporate network is rebooted, Network Unlock allows the PIN entry prompt to be bypassed. It automatically unlocks BitLocker-protected operating system volumes by using a trusted key that is provided by the Windows Deployment Services server as its secondary authentication method.
+
+ To use Network Unlock you must also have a PIN configured for your computer. When your computer is not connected to the network you will need to provide the PIN to unlock it.
+
+ BitLocker Network Unlock has software and hardware requirements for both client computers, Windows Deployment services, and domain controllers that must be met before you can use it.
+
+ Network Unlock uses two protectors, the TPM protector and the one provided by the network or by your PIN, whereas automatic unlock uses a single protector, the one stored in the TPM. If the computer is joined to a network without the key protector it will prompt you to enter your PIN. If the PIN is
+ not available you will need to use the recovery key to unlock the computer if it can ot be connected to the network.
+
+ For more info, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md).
diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md
index fbd06cf9c0..60ab1074cd 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-overview.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md
@@ -85,7 +85,7 @@ When installing the BitLocker optional component on a server you will also need
| Topic | Description |
| - | - |
| [Overview of BitLocker Device Encryption in Windows 10](bitlocker-device-encryption-overview-windows-10.md) | This topic for the IT professional provides an overview of the ways that BitLocker Device Encryption can help protect data on devices running Windows 10. |
-| [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) | This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.|
+| [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml) | This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.|
| [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)| This topic for the IT professional explains how can you plan your BitLocker deployment. |
| [BitLocker basic deployment](bitlocker-basic-deployment.md) | This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. |
| [BitLocker: How to deploy on Windows Server](bitlocker-how-to-deploy-on-windows-server.md)| This topic for the IT professional explains how to deploy BitLocker on Windows Server.|
diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md
deleted file mode 100644
index 18684bd289..0000000000
--- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-title: BitLocker Security FAQ (Windows 10)
-description: Learn more about how BitLocker security works. Browse frequently asked questions, such as, "What form of encryption does BitLocker use?"
-ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
-ms.reviewer:
-ms.prod: w10
-ms.mktglfcycl: explore
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-manager: dansimp
-audience: ITPro
-ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 02/28/2019
-ms.custom: bitlocker
----
-
-# BitLocker Security FAQ
-
-**Applies to**
-- Windows 10
-
-
-## What form of encryption does BitLocker use? Is it configurable?
-
-BitLocker uses Advanced Encryption Standard (AES) as its encryption algorithm with configurable key lengths of 128 bits or 256 bits. The default encryption setting is AES-128, but the options are configurable by using Group Policy.
-
-## What is the best practice for using BitLocker on an operating system drive?
-
-The recommended practice for BitLocker configuration on an operating system drive is to implement BitLocker on a computer with a TPM version 1.2 or higher, and a Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware implementation, along with a PIN. By requiring a PIN that was set by the user in addition to the TPM validation, a malicious user that has physical access to the computer cannot simply start the computer.
-
-## What are the implications of using the sleep or hibernate power management options?
-
-BitLocker on operating system drives in its basic configuration (with a TPM but without other startup authentication) provides extra security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an another startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For improved security, we recommend disabling sleep mode and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](./bitlocker-group-policy-settings.md) or Mobile Device Management with the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp).
-
-## What are the advantages of a TPM?
-
-Most operating systems use a shared memory space and rely on the operating system to manage physical memory. A TPM is a hardware component that uses its own internal firmware and logic circuits for processing instructions, thus shielding it from external software vulnerabilities. Attacking the TPM requires physical access to the computer. Additionally, the tools and skills necessary to attack hardware are often more expensive, and usually are not as available as the ones used to attack software. And because each TPM is unique to the computer that contains it, attacking multiple TPM computers would be difficult and time-consuming.
-
-> [!NOTE]
-> Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks.
diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml
new file mode 100644
index 0000000000..bb50bfcba5
--- /dev/null
+++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml
@@ -0,0 +1,53 @@
+### YamlMime:FAQ
+metadata:
+ title: BitLocker Security FAQ (Windows 10)
+ description: Learn more about how BitLocker security works. Browse frequently asked questions, such as, "What form of encryption does BitLocker use?"
+ ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
+ ms.reviewer:
+ ms.prod: w10
+ ms.mktglfcycl: explore
+ ms.sitesec: library
+ ms.pagetype: security
+ ms.localizationpriority: medium
+ author: dansimp
+ ms.author: dansimp
+ manager: dansimp
+ audience: ITPro
+ ms.collection: M365-security-compliance
+ ms.topic: conceptual
+ ms.date: 02/28/2019
+ ms.custom: bitlocker
+
+title: BitLocker Security FAQ
+summary: |
+ **Applies to**
+ - Windows 10
+
+
+
+sections:
+ - name: Ignored
+ questions:
+ - question: |
+ What form of encryption does BitLocker use? Is it configurable?
+ answer: |
+ BitLocker uses Advanced Encryption Standard (AES) as its encryption algorithm with configurable key lengths of 128 bits or 256 bits. The default encryption setting is AES-128, but the options are configurable by using Group Policy.
+
+ - question: |
+ What is the best practice for using BitLocker on an operating system drive?
+ answer: |
+ The recommended practice for BitLocker configuration on an operating system drive is to implement BitLocker on a computer with a TPM version 1.2 or higher, and a Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware implementation, along with a PIN. By requiring a PIN that was set by the user in addition to the TPM validation, a malicious user that has physical access to the computer cannot simply start the computer.
+
+ - question: |
+ What are the implications of using the sleep or hibernate power management options?
+ answer: |
+ BitLocker on operating system drives in its basic configuration (with a TPM but without other startup authentication) provides extra security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an another startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For improved security, we recommend disabling sleep mode and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](./bitlocker-group-policy-settings.md) or Mobile Device Management with the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp).
+
+ - question: |
+ What are the advantages of a TPM?
+ answer: |
+ Most operating systems use a shared memory space and rely on the operating system to manage physical memory. A TPM is a hardware component that uses its own internal firmware and logic circuits for processing instructions, thus shielding it from external software vulnerabilities. Attacking the TPM requires physical access to the computer. Additionally, the tools and skills necessary to attack hardware are often more expensive, and usually are not as available as the ones used to attack software. And because each TPM is unique to the computer that contains it, attacking multiple TPM computers would be difficult and time-consuming.
+
+ > [!NOTE]
+ > Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks.
+
\ No newline at end of file
diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md
deleted file mode 100644
index 320a07d296..0000000000
--- a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: BitLocker Upgrading FAQ (Windows 10)
-description: Learn more about upgrading systems that have BitLocker enabled. Find frequently asked questions, such as, "Can I upgrade to Windows 10 with BitLocker enabled?"
-ms.prod: w10
-ms.mktglfcycl: explore
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-manager: dansimp
-audience: ITPro
-ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 02/28/2019
-ms.reviewer:
-ms.custom: bitlocker
----
-
-# BitLocker Upgrading FAQ
-
-**Applies to**
-- Windows 10
-
-## Can I upgrade to Windows 10 with BitLocker enabled?
-
-Yes.
-
-## What is the difference between suspending and decrypting BitLocker?
-
-**Decrypt** completely removes BitLocker protection and fully decrypts the drive.
-
-**Suspend** keeps the data encrypted but encrypts the BitLocker volume master key with a clear key. The clear key is a cryptographic key stored unencrypted and unprotected on the disk drive. By storing this key unencrypted, the **Suspend** option allows for changes or upgrades to the computer without the time and cost of decrypting and re-encrypting the entire drive. After the changes are made and BitLocker is again enabled, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade, the volume master key is changed, the protectors are updated to match and the clear key is erased.
-
-## Do I have to suspend BitLocker protection to download and install system updates and upgrades?
-
-No user action is required for BitLocker in order to apply updates from Microsoft, including [Windows quality updates and feature updates](/windows/deployment/update/waas-quick-start).
-Users need to suspend BitLocker for Non-Microsoft software updates, such as:
-
-- Some TPM firmware updates if these updates clear the TPM outside of the Windows API. Not every TPM firmware update will clear the TPM and this happens if a known vulnerability has been discovered in the TPM firmware. Users don’t have to suspend BitLocker if the TPM firmware update uses Windows API to clear the TPM because in this case, BitLocker will be automatically suspended. We recommend users testing their TPM firmware updates if they don’t want to suspend BitLocker protection.
-- Non-Microsoft application updates that modify the UEFI\BIOS configuration.
-- Manual or third-party updates to secure boot databases (only if BitLocker uses Secure Boot for integrity validation).
-- Updates to UEFI\BIOS firmware, installation of additional UEFI drivers, or UEFI applications without using the Windows update mechanism (only if you update and BitLocker does not use Secure Boot for integrity validation).
- - You can check if BitLocker uses Secure Boot for integrity validation with manage-bde -protectors -get C: (and see if "Uses Secure Boot for integrity validation" is reported).
-
-
-> [!NOTE]
-> If you have suspended BitLocker, you can resume BitLocker protection after you have installed the upgrade or update. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, your computer will enter recovery mode when restarting and will require a recovery key or password to access the computer.
diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml
new file mode 100644
index 0000000000..6cb7eaa23e
--- /dev/null
+++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml
@@ -0,0 +1,55 @@
+### YamlMime:FAQ
+metadata:
+ title: BitLocker Upgrading FAQ (Windows 10)
+ description: Learn more about upgrading systems that have BitLocker enabled. Find frequently asked questions, such as, "Can I upgrade to Windows 10 with BitLocker enabled?"
+ ms.prod: w10
+ ms.mktglfcycl: explore
+ ms.sitesec: library
+ ms.pagetype: security
+ ms.localizationpriority: medium
+ author: dansimp
+ ms.author: dansimp
+ manager: dansimp
+ audience: ITPro
+ ms.collection: M365-security-compliance
+ ms.topic: conceptual
+ ms.date: 02/28/2019
+ ms.reviewer:
+ ms.custom: bitlocker
+
+title: BitLocker Upgrading FAQ
+summary: |
+ **Applies to**
+ - Windows 10
+
+
+sections:
+ - name: Ignored
+ questions:
+ - question: |
+ Can I upgrade to Windows 10 with BitLocker enabled?
+ answer: |
+ Yes.
+
+ - question: |
+ What is the difference between suspending and decrypting BitLocker?
+ answer: |
+ **Decrypt** completely removes BitLocker protection and fully decrypts the drive.
+
+ **Suspend** keeps the data encrypted but encrypts the BitLocker volume master key with a clear key. The clear key is a cryptographic key stored unencrypted and unprotected on the disk drive. By storing this key unencrypted, the **Suspend** option allows for changes or upgrades to the computer without the time and cost of decrypting and re-encrypting the entire drive. After the changes are made and BitLocker is again enabled, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade, the volume master key is changed, the protectors are updated to match and the clear key is erased.
+
+ - question: |
+ Do I have to suspend BitLocker protection to download and install system updates and upgrades?
+ answer: |
+ No user action is required for BitLocker in order to apply updates from Microsoft, including [Windows quality updates and feature updates](/windows/deployment/update/waas-quick-start).
+ Users need to suspend BitLocker for Non-Microsoft software updates, such as:
+
+ - Some TPM firmware updates if these updates clear the TPM outside of the Windows API. Not every TPM firmware update will clear the TPM and this happens if a known vulnerability has been discovered in the TPM firmware. Users don’t have to suspend BitLocker if the TPM firmware update uses Windows API to clear the TPM because in this case, BitLocker will be automatically suspended. We recommend users testing their TPM firmware updates if they don’t want to suspend BitLocker protection.
+ - Non-Microsoft application updates that modify the UEFI\BIOS configuration.
+ - Manual or third-party updates to secure boot databases (only if BitLocker uses Secure Boot for integrity validation).
+ - Updates to UEFI\BIOS firmware, installation of additional UEFI drivers, or UEFI applications without using the Windows update mechanism (only if you update and BitLocker does not use Secure Boot for integrity validation).
+ - You can check if BitLocker uses Secure Boot for integrity validation with manage-bde -protectors -get C: (and see if "Uses Secure Boot for integrity validation" is reported).
+
+
+ > [!NOTE]
+ > If you have suspended BitLocker, you can resume BitLocker protection after you have installed the upgrade or update. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, your computer will enter recovery mode when restarting and will require a recovery key or password to access the computer.
\ No newline at end of file
diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
index 61ab5efe80..c6483a8057 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
@@ -332,7 +332,7 @@ Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup S-1-5-
## More information
- [BitLocker overview](bitlocker-overview.md)
-- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md)
+- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml)
- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)
- [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md)
- [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md)
\ No newline at end of file
diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
index 1bc4358ba0..ce88a53275 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
@@ -58,7 +58,7 @@ By completing the procedures in this scenario, you have viewed and copied the re
## More information
- [BitLocker Overview](bitlocker-overview.md)
-- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md)
+- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml)
- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)
- [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md)
- [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)
diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md
deleted file mode 100644
index 10c1964f58..0000000000
--- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: Using BitLocker with other programs FAQ (Windows 10)
-description: Learn how to integrate BitLocker with other software on your device.
-ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
-ms.reviewer:
-ms.prod: w10
-ms.mktglfcycl: explore
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-manager: dansimp
-audience: ITPro
-ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 02/28/2019
-ms.custom: bitlocker
----
-
-# Using BitLocker with other programs FAQ
-
-**Applies to**
-- Windows 10
-
-## Can I use EFS with BitLocker?
-
-Yes, you can use Encrypting File System (EFS) to encrypt files on a BitLocker-protected drive. BitLocker helps protect the entire operating system drive against offline attacks, whereas EFS can provide additional user-based file level encryption for security separation between multiple users of the same computer. You can also use EFS in Windows to encrypt files on other drives that are not encrypted by BitLocker. The root secrets of EFS are stored by default on the operating system drive; therefore, if BitLocker is enabled for the operating system drive, data that is encrypted by EFS on other drives is also indirectly protected by BitLocker.
-
-## Can I run a kernel debugger with BitLocker?
-
-Yes. However, the debugger should be turned on before enabling BitLocker. Turning on the debugger ensures that the correct measurements are calculated when sealing to the TPM, allowing the computer to start properly. If you need to turn debugging on or off when using BitLocker, be sure to suspend BitLocker first to avoid putting your computer into recovery mode.
-
-## How does BitLocker handle memory dumps?
-
-BitLocker has a storage driver stack that ensures memory dumps are encrypted when BitLocker is enabled.
-
-## Can BitLocker support smart cards for pre-boot authentication?
-
-BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them difficult.
-
-## Can I use a non-Microsoft TPM driver?
-
-Microsoft does not support non-Microsoft TPM drivers and strongly recommends against using them with BitLocker. Attempting to use a non-Microsoft TPM driver with BitLocker may cause BitLocker to report that a TPM is not present on the computer and not allow the TPM to be used with BitLocker.
-
-## Can other tools that manage or modify the master boot record work with BitLocker?
-
-We do not recommend modifying the master boot record on computers whose operating system drives are BitLocker-protected for a number of security, reliability, and product support reasons. Changes to the master boot record (MBR) could change the security environment and prevent the computer from starting normally, as well as complicate any efforts to recover from a corrupted MBR. Changes made to the MBR by anything other than Windows might force the computer into recovery mode or prevent it from booting entirely.
-
-## Why is the system check failing when I am encrypting my operating system drive?
-
-The system check is designed to ensure your computer's BIOS or UEFI firmware is compatible with BitLocker and that the TPM is working correctly. The system check can fail for several reasons:
-
-- The computer's BIOS or UEFI firmware cannot read USB flash drives.
-- The computer's BIOS, uEFI firmware, or boot menu does not have reading USB flash drives enabled.
-- There are multiple USB flash drives inserted into the computer.
-- The PIN was not entered correctly.
-- The computer's BIOS or UEFI firmware only supports using the function keys (F1–F10) to enter numerals in the pre-boot environment.
-- The startup key was removed before the computer finished rebooting.
-- The TPM has malfunctioned and fails to unseal the keys.
-
-## What can I do if the recovery key on my USB flash drive cannot be read?
-
-Some computers cannot read USB flash drives in the pre-boot environment. First, check your BIOS or UEFI firmware and boot settings to ensure that the use of USB drives is enabled. If it is not enabled, enable the use of USB drives in the BIOS or UEFI firmware and boot settings and then try to read the recovery key from the USB flash drive again. If it still cannot be read, you will have to mount the hard drive as a data drive on another computer so that there is an operating system to attempt to read the recovery key from the USB flash drive. If the USB flash drive has been corrupted or damaged, you may need to supply a recovery password or use the recovery information that was backed up to AD DS. Also, if you are using the recovery key in the pre-boot environment, ensure that the drive is formatted by using the NTFS, FAT16, or FAT32 file system.
-
-## Why am I unable to save my recovery key to my USB flash drive?
-
-The **Save to USB** option is not shown by default for removable drives. If the option is unavailable, it means that a system administrator has disallowed the use of recovery keys.
-
-## Why am I unable to automatically unlock my drive?
-
-Automatic unlocking for fixed data drives requires the operating system drive to also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers.
-
-## Can I use BitLocker in Safe Mode?
-
-Limited BitLocker functionality is available in Safe Mode. BitLocker-protected drives can be unlocked and decrypted by using the **BitLocker Drive Encryption** Control Panel item. Right-clicking to access BitLocker options from Windows Explorer is not available in Safe Mode.
-
-## How do I "lock" a data drive?
-
-Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the –lock command.
-
-> [!NOTE]
-> Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible.
-
-The syntax of this command is:
-
-manage-bde driveletter -lock
-
-Outside of using this command, data drives will be locked on shutdown and restart of the operating system. A removable data drive will also be locked automatically when the drive is removed from the computer.
-
-## Can I use BitLocker with the Volume Shadow Copy Service?
-
-Yes. However, shadow copies made prior to enabling BitLocker will be automatically deleted when BitLocker is enabled on software-encrypted drives. If you are using a hardware encrypted drive, the shadow copies are retained.
-
-## Does BitLocker support virtual hard disks (VHDs)?
-
-BitLocker should work like any specific physical machine within its hardware limitations as long as the environment (physical or virtual) meets Windows Operating System requirements to run.
-- With TPM: Yes, it is supported.
-- Without TPM: Yes, it is supported (with password protector).
-
-BitLocker is also supported on data volume VHDs, such as those used by clusters, if you are running Windows 10, Windows 8.1, Windows 8, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012.
-
-## Can I use BitLocker with virtual machines (VMs)?
-
-Yes. Password protectors and virtual TPMs can be used with BitLocker to protect virtual machines. VMs can be domain joined, Azure AD-joined, or workplace-joined (via **Settings** > **Accounts** > **Access work or school** > **Connect**) to receive policy. You can enable encryption either while creating the VM or by using other existing management tools such as the BitLocker CSP, or even by using a startup script or logon script delivered by Group Policy. Windows Server 2016 also supports [Shielded VMs and guarded fabric](/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms-top-node) to protect VMs from malicious administrators.
\ No newline at end of file
diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml
new file mode 100644
index 0000000000..1a02bc65c8
--- /dev/null
+++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml
@@ -0,0 +1,124 @@
+### YamlMime:FAQ
+metadata:
+ title: Using BitLocker with other programs FAQ (Windows 10)
+ description: Learn how to integrate BitLocker with other software on your device.
+ ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
+ ms.reviewer:
+ ms.prod: w10
+ ms.mktglfcycl: explore
+ ms.sitesec: library
+ ms.pagetype: security
+ ms.localizationpriority: medium
+ author: dansimp
+ ms.author: dansimp
+ manager: dansimp
+ audience: ITPro
+ ms.collection: M365-security-compliance
+ ms.topic: conceptual
+ ms.date: 02/28/2019
+ ms.custom: bitlocker
+
+title: Using BitLocker with other programs FAQ
+summary: |
+ **Applies to**
+ - Windows 10
+
+
+sections:
+ - name: Ignored
+ questions:
+ - question: |
+ Can I use EFS with BitLocker?
+ answer: |
+ Yes, you can use Encrypting File System (EFS) to encrypt files on a BitLocker-protected drive. BitLocker helps protect the entire operating system drive against offline attacks, whereas EFS can provide additional user-based file level encryption for security separation between multiple users of the same computer. You can also use EFS in Windows to encrypt files on other drives that are not encrypted by BitLocker. The root secrets of EFS are stored by default on the operating system drive; therefore, if BitLocker is enabled for the operating system drive, data that is encrypted by EFS on other drives is also indirectly protected by BitLocker.
+
+ - question: |
+ Can I run a kernel debugger with BitLocker?
+ answer: |
+ Yes. However, the debugger should be turned on before enabling BitLocker. Turning on the debugger ensures that the correct measurements are calculated when sealing to the TPM, allowing the computer to start properly. If you need to turn debugging on or off when using BitLocker, be sure to suspend BitLocker first to avoid putting your computer into recovery mode.
+
+ - question: |
+ How does BitLocker handle memory dumps?
+ answer: |
+ BitLocker has a storage driver stack that ensures memory dumps are encrypted when BitLocker is enabled.
+
+ - question: |
+ Can BitLocker support smart cards for pre-boot authentication?
+ answer: |
+ BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them difficult.
+
+ - question: |
+ Can I use a non-Microsoft TPM driver?
+ answer: |
+ Microsoft does not support non-Microsoft TPM drivers and strongly recommends against using them with BitLocker. Attempting to use a non-Microsoft TPM driver with BitLocker may cause BitLocker to report that a TPM is not present on the computer and not allow the TPM to be used with BitLocker.
+
+ - question: |
+ Can other tools that manage or modify the master boot record work with BitLocker?
+ answer: |
+ We do not recommend modifying the master boot record on computers whose operating system drives are BitLocker-protected for a number of security, reliability, and product support reasons. Changes to the master boot record (MBR) could change the security environment and prevent the computer from starting normally, as well as complicate any efforts to recover from a corrupted MBR. Changes made to the MBR by anything other than Windows might force the computer into recovery mode or prevent it from booting entirely.
+
+ - question: |
+ Why is the system check failing when I am encrypting my operating system drive?
+ answer: |
+ The system check is designed to ensure your computer's BIOS or UEFI firmware is compatible with BitLocker and that the TPM is working correctly. The system check can fail for several reasons:
+
+ - The computer's BIOS or UEFI firmware cannot read USB flash drives.
+ - The computer's BIOS, uEFI firmware, or boot menu does not have reading USB flash drives enabled.
+ - There are multiple USB flash drives inserted into the computer.
+ - The PIN was not entered correctly.
+ - The computer's BIOS or UEFI firmware only supports using the function keys (F1–F10) to enter numerals in the pre-boot environment.
+ - The startup key was removed before the computer finished rebooting.
+ - The TPM has malfunctioned and fails to unseal the keys.
+
+ - question: |
+ What can I do if the recovery key on my USB flash drive cannot be read?
+ answer: |
+ Some computers cannot read USB flash drives in the pre-boot environment. First, check your BIOS or UEFI firmware and boot settings to ensure that the use of USB drives is enabled. If it is not enabled, enable the use of USB drives in the BIOS or UEFI firmware and boot settings and then try to read the recovery key from the USB flash drive again. If it still cannot be read, you will have to mount the hard drive as a data drive on another computer so that there is an operating system to attempt to read the recovery key from the USB flash drive. If the USB flash drive has been corrupted or damaged, you may need to supply a recovery password or use the recovery information that was backed up to AD DS. Also, if you are using the recovery key in the pre-boot environment, ensure that the drive is formatted by using the NTFS, FAT16, or FAT32 file system.
+
+ - question: |
+ Why am I unable to save my recovery key to my USB flash drive?
+ answer: |
+ The **Save to USB** option is not shown by default for removable drives. If the option is unavailable, it means that a system administrator has disallowed the use of recovery keys.
+
+ - question: |
+ Why am I unable to automatically unlock my drive?
+ answer: |
+ Automatic unlocking for fixed data drives requires the operating system drive to also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers.
+
+ - question: |
+ Can I use BitLocker in Safe Mode?
+ answer: |
+ Limited BitLocker functionality is available in Safe Mode. BitLocker-protected drives can be unlocked and decrypted by using the **BitLocker Drive Encryption** Control Panel item. Right-clicking to access BitLocker options from Windows Explorer is not available in Safe Mode.
+
+ - question: |
+ How do I "lock" a data drive?
+ answer: |
+ Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the –lock command.
+
+ > [!NOTE]
+ > Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible.
+
+ The syntax of this command is:
+
+ manage-bde driveletter -lock
+
+ Outside of using this command, data drives will be locked on shutdown and restart of the operating system. A removable data drive will also be locked automatically when the drive is removed from the computer.
+
+ - question: |
+ Can I use BitLocker with the Volume Shadow Copy Service?
+ answer: |
+ Yes. However, shadow copies made prior to enabling BitLocker will be automatically deleted when BitLocker is enabled on software-encrypted drives. If you are using a hardware encrypted drive, the shadow copies are retained.
+
+ - question: |
+ Does BitLocker support virtual hard disks (VHDs)?
+ answer: |
+ BitLocker should work like any specific physical machine within its hardware limitations as long as the environment (physical or virtual) meets Windows Operating System requirements to run.
+ - With TPM: Yes, it is supported.
+ - Without TPM: Yes, it is supported (with password protector).
+
+ BitLocker is also supported on data volume VHDs, such as those used by clusters, if you are running Windows 10, Windows 8.1, Windows 8, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012.
+
+ - question: |
+ Can I use BitLocker with virtual machines (VMs)?
+ answer: |
+ Yes. Password protectors and virtual TPMs can be used with BitLocker to protect virtual machines. VMs can be domain joined, Azure AD-joined, or workplace-joined (via **Settings** > **Accounts** > **Access work or school** > **Connect**) to receive policy. You can enable encryption either while creating the VM or by using other existing management tools such as the BitLocker CSP, or even by using a startup script or logon script delivered by Group Policy. Windows Server 2016 also supports [Shielded VMs and guarded fabric](/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms-top-node) to protect VMs from malicious administrators.
diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
index b35fc616de..b3b6894cac 100644
--- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
+++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
@@ -196,7 +196,7 @@ However, you cannot use recovery passwords generated on a system in FIPS mode fo
- [Trusted Platform Module](../tpm/trusted-platform-module-top-node.md)
- [TPM Group Policy settings](../tpm/trusted-platform-module-services-group-policy-settings.md)
-- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md)
+- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml)
- [BitLocker](bitlocker-overview.md)
- [BitLocker Group Policy settings](bitlocker-group-policy-settings.md)
- [BitLocker basic deployment](bitlocker-basic-deployment.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/TOC.yml b/windows/security/threat-protection/TOC.yml
index 9e2e05229f..3c8e12e04c 100644
--- a/windows/security/threat-protection/TOC.yml
+++ b/windows/security/threat-protection/TOC.yml
@@ -324,7 +324,7 @@
- name: Planning and deploying advanced security audit policies
href: auditing/planning-and-deploying-advanced-security-audit-policies.md
- name: Advanced security auditing FAQ
- href: auditing/advanced-security-auditing-faq.md
+ href: auditing/advanced-security-auditing-faq.yml
items:
- name: Which editions of Windows support advanced audit policy configuration
href: auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md
diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md
deleted file mode 100644
index 86a39fc1b7..0000000000
--- a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md
+++ /dev/null
@@ -1,195 +0,0 @@
----
-title: Advanced security auditing FAQ (Windows 10)
-description: This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies.
-ms.assetid: 80f8f187-0916-43c2-a7e8-ea712b115a06
-ms.reviewer:
-ms.author: dansimp
-ms.prod: m365-security
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: none
-author: dansimp
-manager: dansimp
-audience: ITPro
-ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 04/19/2017
-ms.technology: mde
----
-
-# Advanced security auditing FAQ
-
-**Applies to**
-- Windows 10
-
-This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies.
-
-- [What is Windows security auditing and why might I want to use it?](#bkmk-1)
-- [What is the difference between audit policies located in Local Policies\\Audit Policy and audit policies located in Advanced Audit Policy Configuration?](#bkmk-2)
-- [What is the interaction between basic audit policy settings and advanced audit policy settings?](#bkmk-3)
-- [How are audit settings merged by Group Policy?](#bkmk-4)
-- [What is the difference between an object DACL and an object SACL?](#bkmk-14)
-- [Why are audit policies applied on a per-computer basis rather than per user?](#bkmk-13)
-- [What are the differences in auditing functionality between versions of Windows?](#bkmk-12)
-- [Can I use advanced audit policy from a domain controller running Windows Server 2003 or Windows 2000 Server?](#bkmk-15)
-- [What is the difference between success and failure events? Is something wrong if I get a failure audit?](#bkmk-5)
-- [How can I set an audit policy that affects all objects on a computer?](#bkmk-6)
-- [How do I figure out why someone was able to access a resource?](#bkmk-7)
-- [How do I know when changes are made to access control settings, by whom, and what the changes were?](#bkmk-8)
-- [How can I roll back security audit policies from the advanced audit policy to the basic audit policy?](#bkmk-19)
-- [How can I monitor if changes are made to audit policy settings?](#bkmk-10)
-- [How can I minimize the number of events that are generated?](#bkmk-16)
-- [What are the best tools to model and manage audit policy?](#bkmk-17)
-- [Where can I find information about all the possible events that I might receive?](#bkmk-11)
-- [Where can I find more detailed information?](#bkmk-18)
-
-## What is Windows security auditing and why might I want to use it?
-
-Security auditing is a methodical examination and review of activities that may affect the security of a system. In the Windows operating systems, security auditing is more narrowly defined as the features and services that enable an administrator to log and review events for specified security-related activities.
-
-Hundreds of events occur as the Windows operating system and the applications that run on it perform their tasks. Monitoring these events can provide valuable information to help administrators troubleshoot and investigate security-related activities.
-
-## What is the difference between audit policies located in Local Policies\\Audit Policy and audit policies located in Advanced Audit Policy Configuration?
-
-The basic security audit policy settings in **Security Settings\\Local Policies\\Audit Policy** and the advanced security audit policy settings in **Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies** appear to overlap, but they are recorded and applied differently. When you apply basic audit policy settings to the local computer by using the Local Security Policy snap-in (secpol.msc), you are editing the effective audit policy, so changes made to basic audit policy settings will appear exactly as configured in Auditpol.exe.
-
-There are a number of additional differences between the security audit policy settings in these two locations.
-
-There are nine basic audit policy settings under **Security Settings\\Local Policies\\Audit Policy** and settings under **Advanced Audit Policy Configuration**. The settings available in **Security Settings\\Advanced Audit Policy
-Configuration** address similar issues as the nine basic settings in **Local Policies\\Audit Policy**, but they allow administrators to be more selective in the number and types of events to audit. For example, the basic audit policy provides a single setting for account logon, and the advanced audit policy provides four. Enabling the single basic account logon setting would be the equivalent of setting all four advanced account logon settings. In comparison, setting a single advanced audit policy setting does not generate audit events for activities that you are not interested in tracking.
-
-In addition, if you enable success auditing for the basic **Audit account logon events** setting, only success events will be logged for all account logon–related behaviors. In comparison, depending on the needs of your organization, you can configure success auditing for one advanced account logon setting, failure auditing for a second advanced account logon setting, success and failure auditing for a third advanced account logon setting, or no auditing.
-
-The nine basic settings under **Security Settings\\Local Policies\\Audit Policy** were introduced in Windows 2000. Therefore, they are available in all versions of Windows released since then. The advanced audit policy settings were introduced in Windows Vista and Windows Server 2008. The advanced settings can only be used on computers running Windows 7, Windows Server 2008, and later.
-
-## What is the interaction between basic audit policy settings and advanced audit policy settings?
-
-Basic audit policy settings are not compatible with advanced audit policy settings that are applied by using Group Policy. When advanced audit policy settings are applied by using Group Policy, the current computer's audit policy settings are cleared before the resulting advanced audit policy settings are applied. After you apply advanced audit policy settings by using Group Policy, you can only reliably set system audit policy for the computer by using the advanced audit policy settings.
-
-Editing and applying the advanced audit policy settings in Local Security Policy modifies the local Group Policy Object (GPO), so changes made here may not be exactly reflected in Auditpol.exe if there are policies from other domain GPOs or logon scripts. Both types of policies can be edited and applied by using domain GPOs, and these settings will override any conflicting local audit policy settings. However, because the basic audit policy is recorded in the effective audit policy, that audit policy must be explicitly removed when a change is desired, or it will remain in the effective audit policy. Policy changes that are applied by using local or domain Group Policy settings are reflected as soon as the new policy is applied.
-
-> **Important** Whether you apply advanced audit policies by using Group Policy or by using logon scripts, do not use both the basic audit policy settings under **Local Policies\\Audit Policy** and the advanced settings under **Security Settings\\Advanced Audit Policy Configuration**. Using both advanced and basic audit policy settings can cause unexpected results in audit reporting.
-
-If you use Advanced Audit Policy Configuration settings or use logon scripts to apply advanced audit policies, be sure to enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.
-
-## How are audit settings merged by Group Policy?
-
-By default, policy options that are set in GPOs and linked to higher levels of Active Directory sites, domains, and OUs are inherited by all OUs at lower levels. However, an inherited policy can be overridden by a GPO that is linked at a lower level.
-
-For example, you might use a domain GPO to assign an organization-wide group of audit settings, but want a certain OU to get a defined group of additional settings. To accomplish this, you can link a second GPO to that specific lower-level OU. Therefore, a logon audit setting that is applied at the OU level will override a conflicting logon audit setting that is applied at the domain level (unless you have taken special steps to apply Group Policy loopback processing).
-
-The rules that govern how Group Policy settings are applied propagate to the subcategory level of audit policy settings. This means that audit policy settings configured in different GPOs will be merged if no policy settings configured at a lower level exist. The following table illustrates this behavior.
-
-
-| Auditing subcategory | Setting configured in an OU GPO (higher priority) | Setting configured in a domain GPO (lower priority) | Resulting policy for the target computer |
-| - | - | - | -|
-| Detailed File Share Auditing | Success | Failure | Success |
-| Process Creation Auditing | Disabled | Success | Disabled |
-| Logon Auditing | Failure | Success | Failure |
-
-## What is the difference between an object DACL and an object SACL?
-
-All objects in Active Directory Domain Services (AD DS), and all securable objects on a local computer or on the network, have security descriptors to help control access to the objects. Security descriptors include information about who owns an object, who can access it and in what way, and what types of access are audited. Security descriptors contain the access control list (ACL) of an object, which includes all of the security permissions that apply to that object. An object's security descriptor can contain two types of ACLs:
-
-- A discretionary access control list (DACL) that identifies the users and groups who are allowed or denied access
-- A system access control list (SACL) that controls how access is audited
-
-The access control model that is used in Windows is administered at the object level by setting different levels of access, or permissions, to objects. If permissions are configured for an object, its security descriptor contains a DACL with security identifiers (SIDs) for the users and groups that are allowed or denied access.
-
-If auditing is configured for the object, its security descriptor also contains a SACL that controls how the security subsystem audits attempts to access the object. However, auditing is not completely configured unless a SACL has been configured for an object and a corresponding **Object Access** audit policy setting has been configured and applied.
-
-## Why are audit policies applied on a per-computer basis rather than per user?
-
-In security auditing in Windows, the computer, objects on the computer, and related resources are the primary recipients of actions by clients including applications, other computers, and users. In a security breach, malicious users can use alternate credentials to hide their identity, or malicious applications can impersonate legitimate users to perform undesired tasks. Therefore, the most consistent way to apply an audit policy is to focus on the computer and the objects and resources on that computer.
-
-In addition, because audit policy capabilities can vary between computers running different versions of Windows, the best way to ensure that the audit policy is applied correctly is to base these settings on the computer instead of the user.
-
-However, in cases where you want audit settings to apply only to specified groups of users, you can accomplish this by configuring SACLs on the relevant objects to enable auditing for a security group that contains only the users you specify. For example, you can configure a SACL for a folder called Payroll Data on Accounting Server 1. This can audit attempts by members of the Payroll Processors OU to delete objects from this folder. The **Object Access\\Audit File System** audit policy setting applies to Accounting Server 1, but because it requires a corresponding resource SACL, only actions by members of the Payroll Processors OU on the Payroll Data folder generates audit events.
-
-## What are the differences in auditing functionality between versions of Windows?
-
-Basic audit policy settings are available in all versions of Windows since Windows 2000, and they can be applied locally or by using Group Policy. Advanced audit policy settings were introduced in Windows Vista and Windows Server 2008, but the settings can only be applied by using logon scripts in those versions. Advanced audit policy settings, which were introduced in Windows 7 and Windows Server 2008 R2, can be configured and applied by using local and domain Group Policy settings.
-
-## Can I use advanced audit policies from a domain controller running Windows Server 2003 or Windows 2000 Server?
-
-To use advanced audit policy settings, your domain controller must be installed on a computer running Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 with Service Pack 2 (SP2). Windows 2000 Server is not supported.
-
-## What is the difference between success and failure events? Is something wrong if I get a failure audit?
-
-A success audit event is triggered when a defined action, such as accessing a file share, is completed successfully.
-
-A failure audit event is triggered when a defined action, such as a user logon, is not completed successfully.
-
-The appearance of failure audit events in the event log does not necessarily mean that something is wrong with your system. For example, if you configure Audit Logon events, a failure event may simply mean that a user mistyped his or her password.
-
-## How can I set an audit policy that affects all objects on a computer?
-
-System administrators and auditors increasingly want to verify that an auditing policy is applied to all objects on a system. This has been difficult to accomplish because the system access control lists (SACLs) that govern auditing are applied on a per-object basis. Thus, to verify that an audit policy has been applied to all objects, you would have to check every object to be sure that no changes have been made—even temporarily to a single SACL.
-Introduced in Windows Server 2008 R2 and Windows 7, security auditing allows administrators to define global object access auditing policies for the entire file system or for the registry on a computer. The specified SACL is then automatically applied to every object of that type. This can be useful for verifying that all critical files, folders, and registry settings on a computer are protected, and for identifying when an issue with a system resource occurs. If a file or folder SACL and a global object access auditing policy (or a single registry setting SACL and a global object access auditing policy) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the global object access auditing policy. This means that an audit event is generated if an activity matches either the file or folder SACL or the global object access auditing policy.
-
-## How do I figure out why someone was able to access a resource?
-
-Often it is not enough to know simply that an object such as a file or folder was accessed. You may also want to know why the user was able to access this resource. You can obtain this forensic data by configuring the **Audit Handle Manipulation** setting with the **Audit File System** or with the **Audit Registry** audit setting.
-
-## How do I know when changes are made to access control settings, by whom, and what the changes were?
-
-To track access control changes on computers running Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008, you need to enable the following settings, which track changes to DACLs:
-- **Audit File System** subcategory: Enable for success, failure, or success and failure
-- **Audit Authorization Policy Change** setting: Enable for success, failure, or success and failure
-- A SACL with **Write** and **Take ownership** permissions: Apply to the object that you want to monitor
-
-In Windows XP and Windows Server 2003, you need to use the **Audit policy change** subcategory.
-
-## How can I roll back security audit policies from the advanced audit policy to the basic audit policy?
-
-Applying advanced audit policy settings replaces any comparable basic security audit policy settings. If you subsequently change the advanced audit policy setting to **Not configured**, you need to complete the following steps to restore the original basic security audit policy settings:
-
-1. Set all Advanced Audit Policy subcategories to **Not configured**.
-2. Delete all audit.csv files from the %SYSVOL% folder on the domain controller.
-3. Reconfigure and apply the basic audit policy settings.
-
-Unless you complete all of these steps, the basic audit policy settings will not be restored.
-
-## How can I monitor if changes are made to audit policy settings?
-
-Changes to security audit policies are critical security events. You can use the **Audit Audit Policy Change** setting to determine if the operating system generates audit events when the following types of activities take place:
-
-- Permissions and audit settings on the audit policy object are changed
-- The system audit policy is changed
-- Security event sources are registered or unregistered
-- Per-user audit settings are changed
-- The value of **CrashOnAuditFail** is modified
-- Audit settings on a file or registry key are changed
-- A Special Groups list is changed
-
-## How can I minimize the number of events that are generated?
-
-Finding the right balance between auditing enough network and computer activity and auditing too little network and computer activity can be challenging. You can achieve this balance by identifying the most important resources, critical activities, and users or groups of users. Then design a security audit policy that targets these resources, activities, and users. Useful guidelines and recommendations for developing an effective security auditing strategy can be found in [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md).
-
-## What are the best tools to model and manage audit policies?
-
-The integration of advanced audit policy settings with domain Group Policy, introduced in Windows 7 and Windows Server 2008 R2, is designed to simplify the management and implementation of security audit policies in an organization's network. As such, tools used to plan and deploy Group Policy Objects for a domain can also be used to plan and deploy security audit policies.
-On an individual computer, the Auditpol command-line tool can be used to complete a number of important audit policy–related management tasks.
-
-In addition, there are a number of computer management products, such as the Audit Collection Services in the Microsoft System Center Operations Manager products, which can be used to collect and filter event data.
-
-## Where can I find information about all the possible events that I might receive?
-
-Users who examine the security event log for the first time can be a bit overwhelmed by the number of audit events that are stored there (which can quickly number in the thousands) and by the structured information that is included for each audit event. Additional information about these events, and the settings used to generate them, can be obtained from the following resources:
-
-- [Windows 8 and Windows Server 2012 Security Event Details](https://www.microsoft.com/download/details.aspx?id=35753)
-- [Security Audit Events for Windows 7 and Windows Server 2008 R2](https://go.microsoft.com/fwlink/p/?linkid=157780)
-- [Security Audit Events for Windows Server 2008 and Windows Vista](https://go.microsoft.com/fwlink/p/?linkid=121868)
-- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)
-
-## Where can I find more detailed information?
-
-To learn more about security audit policies, see the following resources:
-
-- [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md)
-- [Security Monitoring and Attack Detection Planning Guide](https://social.technet.microsoft.com/wiki/contents/articles/325.advanced-security-auditing-in-windows-7-and-windows-server-2008-r2.aspx)
-- [Security Audit Events for Windows 7 and Windows Server 2008 R2](https://go.microsoft.com/fwlink/p/?linkid=157780)
-- [Security Audit Events for Windows Server 2008 and Windows Vista](https://go.microsoft.com/fwlink/p/?LinkId=121868)
-
-
diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.yml b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.yml
new file mode 100644
index 0000000000..61dfe3d07c
--- /dev/null
+++ b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.yml
@@ -0,0 +1,215 @@
+### YamlMime:FAQ
+metadata:
+ title: Advanced security auditing FAQ (Windows 10)
+ description: This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies.
+ ms.assetid: 80f8f187-0916-43c2-a7e8-ea712b115a06
+ ms.reviewer:
+ ms.author: dansimp
+ ms.prod: m365-security
+ ms.mktglfcycl: deploy
+ ms.sitesec: library
+ ms.pagetype: security
+ ms.localizationpriority: none
+ author: dansimp
+ manager: dansimp
+ audience: ITPro
+ ms.collection: M365-security-compliance
+ ms.topic: conceptual
+ ms.date: 04/19/2017
+ ms.technology: mde
+
+title: Advanced security auditing FAQ
+summary: |
+ **Applies to**
+ - Windows 10
+
+ This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies.
+
+ - [What is Windows security auditing and why might I want to use it?](#what-is-windows-security-auditing-and-why-might-i-want-to-use-it-)
+ - [What is the difference between audit policies located in Local Policies\\Audit Policy and audit policies located in Advanced Audit Policy Configuration?](#what-is-the-difference-between-audit-policies-located-in-local-policies--audit-policy-and-audit-policies-located-in-advanced-audit-policy-configuration-)
+ - [What is the interaction between basic audit policy settings and advanced audit policy settings?](#what-is-the-interaction-between-basic-audit-policy-settings-and-advanced-audit-policy-settings-)
+ - [How are audit settings merged by Group Policy?](#how-are-audit-settings-merged-by-group-policy-)
+ - [What is the difference between an object DACL and an object SACL?](#what-is-the-difference-between-an-object-dacl-and-an-object-sacl-)
+ - [Why are audit policies applied on a per-computer basis rather than per user?](#why-are-audit-policies-applied-on-a-per-computer-basis-rather-than-per-user-)
+ - [What are the differences in auditing functionality between versions of Windows?](#what-are-the-differences-in-auditing-functionality-between-versions-of-windows-)
+ - [Can I use advanced audit policy from a domain controller running Windows Server 2003 or Windows 2000 Server?](#can-i-use-advanced-audit-policies-from-a-domain-controller-running-windows-server-2003-or-windows-2000-server-)
+ - [What is the difference between success and failure events? Is something wrong if I get a failure audit?](#what-is-the-difference-between-success-and-failure-events--is-something-wrong-if-i-get-a-failure-audit-)
+ - [How can I set an audit policy that affects all objects on a computer?](#how-can-i-set-an-audit-policy-that-affects-all-objects-on-a-computer-)
+ - [How do I figure out why someone was able to access a resource?](#how-do-i-figure-out-why-someone-was-able-to-access-a-resource-)
+ - [How do I know when changes are made to access control settings, by whom, and what the changes were?](#how-do-i-know-when-changes-are-made-to-access-control-settings--by-whom--and-what-the-changes-were-)
+ - [How can I roll back security audit policies from the advanced audit policy to the basic audit policy?](#how-can-i-roll-back-security-audit-policies-from-the-advanced-audit-policy-to-the-basic-audit-policy-)
+ - [How can I monitor if changes are made to audit policy settings?](#how-can-i-monitor-if-changes-are-made-to-audit-policy-settings-)
+ - [How can I minimize the number of events that are generated?](#how-can-i-minimize-the-number-of-events-that-are-generated-)
+ - [What are the best tools to model and manage audit policy?](#what-are-the-best-tools-to-model-and-manage-audit-policies-)
+ - [Where can I find information about all the possible events that I might receive?](#where-can-i-find-information-about-all-the-possible-events-that-i-might-receive-)
+ - [Where can I find more detailed information?](#where-can-i-find-more-detailed-information-)
+
+
+sections:
+ - name: Ignored
+ questions:
+ - question: |
+ What is Windows security auditing and why might I want to use it?
+ answer: |
+ Security auditing is a methodical examination and review of activities that may affect the security of a system. In the Windows operating systems, security auditing is more narrowly defined as the features and services that enable an administrator to log and review events for specified security-related activities.
+
+ Hundreds of events occur as the Windows operating system and the applications that run on it perform their tasks. Monitoring these events can provide valuable information to help administrators troubleshoot and investigate security-related activities.
+
+ - question: |
+ What is the difference between audit policies located in Local Policies\\Audit Policy and audit policies located in Advanced Audit Policy Configuration?
+ answer: |
+ The basic security audit policy settings in **Security Settings\\Local Policies\\Audit Policy** and the advanced security audit policy settings in **Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies** appear to overlap, but they are recorded and applied differently. When you apply basic audit policy settings to the local computer by using the Local Security Policy snap-in (secpol.msc), you are editing the effective audit policy, so changes made to basic audit policy settings will appear exactly as configured in Auditpol.exe.
+
+ There are a number of additional differences between the security audit policy settings in these two locations.
+
+ There are nine basic audit policy settings under **Security Settings\\Local Policies\\Audit Policy** and settings under **Advanced Audit Policy Configuration**. The settings available in **Security Settings\\Advanced Audit Policy
+ Configuration** address similar issues as the nine basic settings in **Local Policies\\Audit Policy**, but they allow administrators to be more selective in the number and types of events to audit. For example, the basic audit policy provides a single setting for account logon, and the advanced audit policy provides four. Enabling the single basic account logon setting would be the equivalent of setting all four advanced account logon settings. In comparison, setting a single advanced audit policy setting does not generate audit events for activities that you are not interested in tracking.
+
+ In addition, if you enable success auditing for the basic **Audit account logon events** setting, only success events will be logged for all account logon–related behaviors. In comparison, depending on the needs of your organization, you can configure success auditing for one advanced account logon setting, failure auditing for a second advanced account logon setting, success and failure auditing for a third advanced account logon setting, or no auditing.
+
+ The nine basic settings under **Security Settings\\Local Policies\\Audit Policy** were introduced in Windows 2000. Therefore, they are available in all versions of Windows released since then. The advanced audit policy settings were introduced in Windows Vista and Windows Server 2008. The advanced settings can only be used on computers running Windows 7, Windows Server 2008, and later.
+
+ - question: |
+ What is the interaction between basic audit policy settings and advanced audit policy settings?
+ answer: |
+ Basic audit policy settings are not compatible with advanced audit policy settings that are applied by using Group Policy. When advanced audit policy settings are applied by using Group Policy, the current computer's audit policy settings are cleared before the resulting advanced audit policy settings are applied. After you apply advanced audit policy settings by using Group Policy, you can only reliably set system audit policy for the computer by using the advanced audit policy settings.
+
+ Editing and applying the advanced audit policy settings in Local Security Policy modifies the local Group Policy Object (GPO), so changes made here may not be exactly reflected in Auditpol.exe if there are policies from other domain GPOs or logon scripts. Both types of policies can be edited and applied by using domain GPOs, and these settings will override any conflicting local audit policy settings. However, because the basic audit policy is recorded in the effective audit policy, that audit policy must be explicitly removed when a change is desired, or it will remain in the effective audit policy. Policy changes that are applied by using local or domain Group Policy settings are reflected as soon as the new policy is applied.
+
+ > **Important** Whether you apply advanced audit policies by using Group Policy or by using logon scripts, do not use both the basic audit policy settings under **Local Policies\\Audit Policy** and the advanced settings under **Security Settings\\Advanced Audit Policy Configuration**. Using both advanced and basic audit policy settings can cause unexpected results in audit reporting.
+
+ If you use Advanced Audit Policy Configuration settings or use logon scripts to apply advanced audit policies, be sure to enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.
+
+ - question: |
+ How are audit settings merged by Group Policy?
+ answer: |
+ By default, policy options that are set in GPOs and linked to higher levels of Active Directory sites, domains, and OUs are inherited by all OUs at lower levels. However, an inherited policy can be overridden by a GPO that is linked at a lower level.
+
+ For example, you might use a domain GPO to assign an organization-wide group of audit settings, but want a certain OU to get a defined group of additional settings. To accomplish this, you can link a second GPO to that specific lower-level OU. Therefore, a logon audit setting that is applied at the OU level will override a conflicting logon audit setting that is applied at the domain level (unless you have taken special steps to apply Group Policy loopback processing).
+
+ The rules that govern how Group Policy settings are applied propagate to the subcategory level of audit policy settings. This means that audit policy settings configured in different GPOs will be merged if no policy settings configured at a lower level exist. The following table illustrates this behavior.
+
+
+ | Auditing subcategory | Setting configured in an OU GPO (higher priority) | Setting configured in a domain GPO (lower priority) | Resulting policy for the target computer |
+ | - | - | - | -|
+ | Detailed File Share Auditing | Success | Failure | Success |
+ | Process Creation Auditing | Disabled | Success | Disabled |
+ | Logon Auditing | Failure | Success | Failure |
+
+ - question: |
+ What is the difference between an object DACL and an object SACL?
+ answer: |
+ All objects in Active Directory Domain Services (AD DS), and all securable objects on a local computer or on the network, have security descriptors to help control access to the objects. Security descriptors include information about who owns an object, who can access it and in what way, and what types of access are audited. Security descriptors contain the access control list (ACL) of an object, which includes all of the security permissions that apply to that object. An object's security descriptor can contain two types of ACLs:
+
+ - A discretionary access control list (DACL) that identifies the users and groups who are allowed or denied access
+ - A system access control list (SACL) that controls how access is audited
+
+ The access control model that is used in Windows is administered at the object level by setting different levels of access, or permissions, to objects. If permissions are configured for an object, its security descriptor contains a DACL with security identifiers (SIDs) for the users and groups that are allowed or denied access.
+
+ If auditing is configured for the object, its security descriptor also contains a SACL that controls how the security subsystem audits attempts to access the object. However, auditing is not completely configured unless a SACL has been configured for an object and a corresponding **Object Access** audit policy setting has been configured and applied.
+
+ - question: |
+ Why are audit policies applied on a per-computer basis rather than per user?
+ answer: |
+ In security auditing in Windows, the computer, objects on the computer, and related resources are the primary recipients of actions by clients including applications, other computers, and users. In a security breach, malicious users can use alternate credentials to hide their identity, or malicious applications can impersonate legitimate users to perform undesired tasks. Therefore, the most consistent way to apply an audit policy is to focus on the computer and the objects and resources on that computer.
+
+ In addition, because audit policy capabilities can vary between computers running different versions of Windows, the best way to ensure that the audit policy is applied correctly is to base these settings on the computer instead of the user.
+
+ However, in cases where you want audit settings to apply only to specified groups of users, you can accomplish this by configuring SACLs on the relevant objects to enable auditing for a security group that contains only the users you specify. For example, you can configure a SACL for a folder called Payroll Data on Accounting Server 1. This can audit attempts by members of the Payroll Processors OU to delete objects from this folder. The **Object Access\\Audit File System** audit policy setting applies to Accounting Server 1, but because it requires a corresponding resource SACL, only actions by members of the Payroll Processors OU on the Payroll Data folder generates audit events.
+
+ - question: |
+ What are the differences in auditing functionality between versions of Windows?
+ answer: |
+ Basic audit policy settings are available in all versions of Windows since Windows 2000, and they can be applied locally or by using Group Policy. Advanced audit policy settings were introduced in Windows Vista and Windows Server 2008, but the settings can only be applied by using logon scripts in those versions. Advanced audit policy settings, which were introduced in Windows 7 and Windows Server 2008 R2, can be configured and applied by using local and domain Group Policy settings.
+
+ - question: |
+ Can I use advanced audit policies from a domain controller running Windows Server 2003 or Windows 2000 Server?
+ answer: |
+ To use advanced audit policy settings, your domain controller must be installed on a computer running Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 with Service Pack 2 (SP2). Windows 2000 Server is not supported.
+
+ - question: |
+ What is the difference between success and failure events? Is something wrong if I get a failure audit?
+ answer: |
+ A success audit event is triggered when a defined action, such as accessing a file share, is completed successfully.
+
+ A failure audit event is triggered when a defined action, such as a user logon, is not completed successfully.
+
+ The appearance of failure audit events in the event log does not necessarily mean that something is wrong with your system. For example, if you configure Audit Logon events, a failure event may simply mean that a user mistyped his or her password.
+
+ - question: |
+ How can I set an audit policy that affects all objects on a computer?
+ answer: |
+ System administrators and auditors increasingly want to verify that an auditing policy is applied to all objects on a system. This has been difficult to accomplish because the system access control lists (SACLs) that govern auditing are applied on a per-object basis. Thus, to verify that an audit policy has been applied to all objects, you would have to check every object to be sure that no changes have been made—even temporarily to a single SACL.
+ Introduced in Windows Server 2008 R2 and Windows 7, security auditing allows administrators to define global object access auditing policies for the entire file system or for the registry on a computer. The specified SACL is then automatically applied to every object of that type. This can be useful for verifying that all critical files, folders, and registry settings on a computer are protected, and for identifying when an issue with a system resource occurs. If a file or folder SACL and a global object access auditing policy (or a single registry setting SACL and a global object access auditing policy) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the global object access auditing policy. This means that an audit event is generated if an activity matches either the file or folder SACL or the global object access auditing policy.
+
+ - question: |
+ How do I figure out why someone was able to access a resource?
+ answer: |
+ Often it is not enough to know simply that an object such as a file or folder was accessed. You may also want to know why the user was able to access this resource. You can obtain this forensic data by configuring the **Audit Handle Manipulation** setting with the **Audit File System** or with the **Audit Registry** audit setting.
+
+ - question: |
+ How do I know when changes are made to access control settings, by whom, and what the changes were?
+ answer: |
+ To track access control changes on computers running Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008, you need to enable the following settings, which track changes to DACLs:
+ - **Audit File System** subcategory: Enable for success, failure, or success and failure
+ - **Audit Authorization Policy Change** setting: Enable for success, failure, or success and failure
+ - A SACL with **Write** and **Take ownership** permissions: Apply to the object that you want to monitor
+
+ In Windows XP and Windows Server 2003, you need to use the **Audit policy change** subcategory.
+
+ - question: |
+ How can I roll back security audit policies from the advanced audit policy to the basic audit policy?
+ answer: |
+ Applying advanced audit policy settings replaces any comparable basic security audit policy settings. If you subsequently change the advanced audit policy setting to **Not configured**, you need to complete the following steps to restore the original basic security audit policy settings:
+
+ 1. Set all Advanced Audit Policy subcategories to **Not configured**.
+ 2. Delete all audit.csv files from the %SYSVOL% folder on the domain controller.
+ 3. Reconfigure and apply the basic audit policy settings.
+
+ Unless you complete all of these steps, the basic audit policy settings will not be restored.
+
+ - question: |
+ How can I monitor if changes are made to audit policy settings?
+ answer: |
+ Changes to security audit policies are critical security events. You can use the **Audit Audit Policy Change** setting to determine if the operating system generates audit events when the following types of activities take place:
+
+ - Permissions and audit settings on the audit policy object are changed
+ - The system audit policy is changed
+ - Security event sources are registered or unregistered
+ - Per-user audit settings are changed
+ - The value of **CrashOnAuditFail** is modified
+ - Audit settings on a file or registry key are changed
+ - A Special Groups list is changed
+
+ - question: |
+ How can I minimize the number of events that are generated?
+ answer: |
+ Finding the right balance between auditing enough network and computer activity and auditing too little network and computer activity can be challenging. You can achieve this balance by identifying the most important resources, critical activities, and users or groups of users. Then design a security audit policy that targets these resources, activities, and users. Useful guidelines and recommendations for developing an effective security auditing strategy can be found in [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md).
+
+ - question: |
+ What are the best tools to model and manage audit policies?
+ answer: |
+ The integration of advanced audit policy settings with domain Group Policy, introduced in Windows 7 and Windows Server 2008 R2, is designed to simplify the management and implementation of security audit policies in an organization's network. As such, tools used to plan and deploy Group Policy Objects for a domain can also be used to plan and deploy security audit policies.
+ On an individual computer, the Auditpol command-line tool can be used to complete a number of important audit policy–related management tasks.
+
+ In addition, there are a number of computer management products, such as the Audit Collection Services in the Microsoft System Center Operations Manager products, which can be used to collect and filter event data.
+
+ - question: |
+ Where can I find information about all the possible events that I might receive?
+ answer: |
+ Users who examine the security event log for the first time can be a bit overwhelmed by the number of audit events that are stored there (which can quickly number in the thousands) and by the structured information that is included for each audit event. Additional information about these events, and the settings used to generate them, can be obtained from the following resources:
+
+ - [Windows 8 and Windows Server 2012 Security Event Details](https://www.microsoft.com/download/details.aspx?id=35753)
+ - [Security Audit Events for Windows 7 and Windows Server 2008 R2](https://go.microsoft.com/fwlink/p/?linkid=157780)
+ - [Security Audit Events for Windows Server 2008 and Windows Vista](https://go.microsoft.com/fwlink/p/?linkid=121868)
+ - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)
+
+ - question: |
+ Where can I find more detailed information?
+ answer: |
+ To learn more about security audit policies, see the following resources:
+
+ - [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md)
+ - [Security Monitoring and Attack Detection Planning Guide](https://social.technet.microsoft.com/wiki/contents/articles/325.advanced-security-auditing-in-windows-7-and-windows-server-2008-r2.aspx)
+ - [Security Audit Events for Windows 7 and Windows Server 2008 R2](https://go.microsoft.com/fwlink/p/?linkid=157780)
+ - [Security Audit Events for Windows Server 2008 and Windows Vista](https://go.microsoft.com/fwlink/p/?LinkId=121868)
diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md
index 4a3608816f..691956d81c 100644
--- a/windows/security/threat-protection/auditing/advanced-security-auditing.md
+++ b/windows/security/threat-protection/auditing/advanced-security-auditing.md
@@ -21,7 +21,7 @@ ms.technology: mde
# Advanced security audit policies
**Applies to**
-- Windows 10
+- Windows 10
Advanced security audit policy settings are found in **Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies** and appear to overlap with basic security audit policies, but they are recorded and applied differently.
When you apply basic audit policy settings to the local computer by using the Local Security Policy snap-in, you are editing the effective audit policy, so changes made to basic audit policy settings will appear exactly as configured in Auditpol.exe. In Windows 7 and later, advanced security audit policies can be controlled by using Group Policy.
@@ -31,6 +31,6 @@ When you apply basic audit policy settings to the local computer by using the Lo
| Topic | Description |
| - | - |
| [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md) | This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies |
-| [Advanced security auditing FAQ](advanced-security-auditing-faq.md) | This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies.
+| [Advanced security auditing FAQ](./advanced-security-auditing-faq.yml) | This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies.
| [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) | This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012.
-| [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) | This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate.
+| [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) | This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate.
\ No newline at end of file
diff --git a/windows/security/threat-protection/auditing/security-auditing-overview.md b/windows/security/threat-protection/auditing/security-auditing-overview.md
index ba71110680..ec89d5ef53 100644
--- a/windows/security/threat-protection/auditing/security-auditing-overview.md
+++ b/windows/security/threat-protection/auditing/security-auditing-overview.md
@@ -34,7 +34,7 @@ Security auditing is one of the most powerful tools that you can use to maintain
| Topic | Description |
| - | - |
|[Basic security audit policies](basic-security-audit-policies.md) |Before you implement auditing, you must decide on an auditing policy. A basic audit policy specifies categories of security-related events that you want to audit. When this version of Windows is first installed, all auditing categories are disabled. By enabling various auditing event categories, you can implement an auditing policy that suits the security needs of your organization. |
-|[Advanced security audit policies](advanced-security-auditing.md) |Advanced security audit policy settings are found in **Security Settings\Advanced Audit Policy Configuration\System Audit Policies** and appear to overlap with basic security audit policies, but they are recorded and applied differently. |
+|[Advanced security audit policies](./advanced-security-auditing.md) |Advanced security audit policy settings are found in **Security Settings\Advanced Audit Policy Configuration\System Audit Policies** and appear to overlap with basic security audit policies, but they are recorded and applied differently. |