mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 10:53:43 +00:00
Merge branch 'main' of https://github.com/MicrosoftDocs/windows-docs-pr into wua-sec
This commit is contained in:
Meghan Stewart
@ -96,4 +96,4 @@ landingContent:
|
||||
- text: Advanced troubleshooting for Windows start-up and performance
|
||||
url: /troubleshoot/windows-client/performance/performance-overview
|
||||
- text: Advanced troubleshooting for user profiles and logon
|
||||
url: /troubleshoot-windows-startup.md/troubleshoot/windows-client/user-profiles-and-logon/userprofiles-and-logon-overview
|
||||
url: /troubleshoot/windows-client/user-profiles-and-logon/userprofiles-and-logon-overview
|
||||
|
||||
@ -43,6 +43,9 @@ You can use Windows Configuration Designer to create a provisioning package (`.p
|
||||
|
||||
Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards).
|
||||
|
||||
>[!NOTE]
|
||||
>To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems.
|
||||
|
||||
- The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.)
|
||||
|
||||
>[!TIP]
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 423 KiB After Width: | Height: | Size: 388 KiB |
@ -8,7 +8,7 @@ author: mestew
|
||||
ms.author: mstewart
|
||||
ms.collection: M365-analytics
|
||||
ms.topic: article
|
||||
ms.date: 08/10/2022
|
||||
ms.date: 10/24/2022
|
||||
---
|
||||
|
||||
# Update Compliance (preview) workbook
|
||||
@ -67,10 +67,13 @@ The charts displayed in the **Summary** tab give you a general idea of the overa
|
||||
|
||||
The **Quality updates** tab displays generalized data at the top by using tiles. The quality update data becomes more specific as you navigate lower in this tab. The top of the **Quality updates** tab contains tiles with the following information:
|
||||
|
||||
- **Devices count**: Count of devices that have reported at least one security update is or was applicable and offered in the past 30 days, regardless of installation state of the update.
|
||||
- **Latest security update**: Count of devices that have installed the latest security update.
|
||||
- **Security update status**: Count of devices that haven't installed a security update released within the last 60 days.
|
||||
- **Total alerts**: Count of active alerts that are for quality updates.
|
||||
- **Latest security update**: Count of devices that have reported successful installation of the latest security update.
|
||||
- **Missing one security update**: Count of devices that haven't installed the latest security update.
|
||||
- **Missing multiple security updates**: Count of devices that are missing two or more security updates.
|
||||
- **Active alerts**: Count of active update and device alerts for quality updates.
|
||||
|
||||
Selecting **View details** on any of the tiles displays a flyout with a chart that displays the first 250 items. Select `...` from the flyout to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial).
|
||||
|
||||
|
||||
Below the tiles, the **Quality updates** tab is subdivided into **Update status** and **Device status** groups. These different chart groups allow you to easily discover trends in compliance data. For instance, you may remember that about third of your devices were in the installing state yesterday, but this number didn't change as much as you were expecting. That unexpected trend may cause you to investigate and resolve a potential issue before end-users are impacted.
|
||||
|
||||
@ -79,7 +82,6 @@ Below the tiles, the **Quality updates** tab is subdivided into **Update status*
|
||||
The **Update status** group for quality updates contains the following items:
|
||||
|
||||
- **Update states for all security releases**: Chart containing the number of devices in a specific state, such as installing, for security updates.
|
||||
- **Update states for the latest security releases**: Chart containing the number of devices in a specific state for the most recent security update.
|
||||
- **Update alerts for all security releases**: Chart containing the count of active errors and warnings for security updates.
|
||||
|
||||
:::image type="content" source="media/33771278-update-deployment-status-table.png" alt-text="Screenshot of the charts and table in the workbook's quality updates tab" lightbox="media/33771278-update-deployment-status-table.png":::
|
||||
@ -98,6 +100,7 @@ The **Device status** group for quality updates contains the following items:
|
||||
|
||||
- **OS build number**: Chart containing a count of devices by OS build that are getting security updates.
|
||||
- **Target version**: Chart containing how many devices by operating system version that are getting security updates.
|
||||
- **Device alerts**: Chart containing the count of active device errors and warnings for quality updates.
|
||||
- **Device compliance status**: Table containing a list of devices getting security updates and update installation information including active alerts for the devices.
|
||||
- This table is limited to the first 250 rows. Select `...` to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial).
|
||||
|
||||
@ -105,13 +108,12 @@ The **Device status** group for quality updates contains the following items:
|
||||
|
||||
The **Feature updates** tab displays generalized data at the top by using tiles. The feature update data becomes more specific as you navigate lower in this tab. The top of the **Feature updates** tab contains tiles with the following information:
|
||||
|
||||
- **Devices count**: Count of devices that have reported a feature update is or was applicable and offered in the past 30 days, regardless of installation state of the update.
|
||||
- **Feature update status**: Count of the devices that installed a feature update in the past 30 days.
|
||||
- **End Of Service**: Count of devices running an operating system version that no longer receives feature updates. For more information, see the [Windows lifecycle FAQ](/lifecycle/faq/windows).
|
||||
- **In service feature update**: Count of devices that are installed with a supported version of a Windows feature update.
|
||||
- **End of service feature update**: Count of devices that don't have a supported version of a Windows feature update installed. For more information, see the [Windows lifecycle FAQ](/lifecycle/faq/windows).
|
||||
- **Nearing EOS** Count of devices that are within 18 months of their end of service date.
|
||||
- **Total alerts**: Count of active alerts that are for feature updates.
|
||||
- **Active alerts**: Count of active update and device alerts for feature updates.
|
||||
|
||||
Just like the [**Quality updates** tab](#quality-updates-tab), the **Feature updates** tab is also subdivided into **Update status** and **Device status** groups below the tiles.
|
||||
Just like the [**Quality updates** tab](#quality-updates-tab), the **Feature updates** tab is also subdivided into **Update status** and **Device status** groups below the tiles. Selecting **View details** on any of the tiles displays a flyout with a chart that displays the first 250 items. Select `...` from the flyout to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial).
|
||||
|
||||
### <a name="bkmk_update-group-feature"></a> Update status group for feature updates
|
||||
|
||||
@ -134,7 +136,7 @@ The **Update status** group for feature updates contains the following items:
|
||||
The **Device status** group for feature updates contains the following items:
|
||||
|
||||
- **Windows 11 readiness status**: Chart containing how many devices that have a status of capable, not capable, or unknown for Windows 11 readiness.
|
||||
- **Device alerts**: Count of active alerts for feature updates in each alert classification.
|
||||
- **Device alerts**: Count of active device alerts for feature updates in each alert classification.
|
||||
- **Device compliance status**: Table containing a list of devices getting a feature update and installation information including active alerts for the devices.
|
||||
- This table is limited to the first 250 rows. Select `...` to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial).
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Device registration overview
|
||||
description: This article provides an overview on how to register devices in Autopatch
|
||||
ms.date: 09/07/2022
|
||||
ms.date: 10/5/2022
|
||||
ms.prod: w11
|
||||
ms.technology: windows
|
||||
ms.topic: conceptual
|
||||
@ -22,7 +22,8 @@ The overall device registration process is:
|
||||
|
||||
:::image type="content" source="../media/windows-autopatch-device-registration-overview.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-device-registration-overview.png":::
|
||||
|
||||
1. IT admin identifies devices to be managed by Windows Autopatch and adds them into the **Windows Autopatch Device Registration** Azure Active Directory (AD) group.
|
||||
1. IT admin reviews [Windows Autopatch device registration pre-requisites](windows-autopatch-register-devices.md#prerequisites-for-device-registration) prior to register devices with Windows Autopatch.
|
||||
2. IT admin identifies devices to be managed by Windows Autopatch and adds them into the **Windows Autopatch Device Registration** Azure Active Directory (AD) group.
|
||||
1. Windows Autopatch then:
|
||||
1. Performs device readiness prior registration (prerequisite checks).
|
||||
1. Calculates the deployment ring distribution.
|
||||
|
||||
@ -72,8 +72,8 @@ To be eligible for Windows Autopatch management, devices must meet a minimum set
|
||||
- Windows 10 (1809+)/11 Enterprise or Professional editions (only x64 architecture).
|
||||
- Either [Hybrid Azure AD-Joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or [Azure AD-joined only](/azure/active-directory/devices/concept-azure-ad-join-hybrid) (personal devices aren't supported).
|
||||
- Managed by Microsoft Endpoint Manager.
|
||||
- [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune) and/or [Configuration Manager Co-management](/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites#configuration-manager-co-management-requirements).
|
||||
- Must switch the following Microsoft Endpoint Manager-Configuration Manager [Co-management workloads](/mem/configmgr/comanage/how-to-switch-workloads) to Microsoft Endpoint Manager-Intune (either set to Pilot Intune or Intune):
|
||||
- [Already enrollled into Microsoft Intune](/mem/intune/user-help/enroll-windows-10-device) and/or [Configuration Manager co-management](/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites#configuration-manager-co-management-requirements).
|
||||
- Must switch the following Microsoft Endpoint Manager-Configuration Manager [co-management workloads](/mem/configmgr/comanage/how-to-switch-workloads) to Microsoft Endpoint Manager-Intune (either set to Pilot Intune or Intune):
|
||||
- Windows updates policies
|
||||
- Device configuration
|
||||
- Office Click-to-run
|
||||
@ -202,7 +202,7 @@ For ease of deployment, we recommend nesting a dynamic device group in your Auto
|
||||
Support is available either through Windows 365, or the Windows Autopatch Service Engineering team for device registration-related incidents.
|
||||
|
||||
- For Windows 365 support, see [Get support](/mem/get-support).
|
||||
- For Azure Virtual Desktop support, see [Get support](/support/create-ticket/).
|
||||
- For Azure Virtual Desktop support, see [Get support](https://azure.microsoft.com/support/create-ticket/).
|
||||
- For Windows Autopatch support, see [Submit a support request](/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request).
|
||||
|
||||
## Device management lifecycle scenarios
|
||||
|
||||
@ -24,7 +24,7 @@ Getting started with Windows Autopatch has been designed to be easy. This articl
|
||||
| Licensing | Windows Autopatch requires Windows 10/11 Enterprise E3 (or higher) to be assigned to your users. Additionally, Azure Active Directory Premium and Microsoft Intune are required. For details about the specific service plans, see [more about licenses](#more-about-licenses).<p><p>For more information on available licenses, see [Microsoft 365 licensing](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans).<p><p>For more information about licensing terms and conditions for products and services purchased through Microsoft Commercial Volume Licensing Programs, see the [Product Terms site](https://www.microsoft.com/licensing/terms/). |
|
||||
| Connectivity | All Windows Autopatch devices require connectivity to multiple Microsoft service endpoints from the corporate network.<p><p>For the full list of required IPs and URLs, see [Configure your network](../prepare/windows-autopatch-configure-network.md). |
|
||||
| Azure Active Directory | Azure Active Directory must either be the source of authority for all user accounts, or user accounts must be synchronized from on-premises Active Directory using the latest supported version of Azure Active Directory Connect to enable Hybrid Azure Active Directory join.<br><ul><li>For more information, see [Azure Active Directory Connect](/azure/active-directory/hybrid/whatis-azure-ad-connect) and [Hybrid Azure Active Directory join](/azure/active-directory/devices/howto-hybrid-azure-ad-join)</li><li>For more information on supported Azure Active Directory Connect versions, see [Azure AD Connect:Version release history](/azure/active-directory/hybrid/reference-connect-version-history).</li></ul> |
|
||||
| Device management | Windows Autopatch devices must be managed by Microsoft Intune. Intune must be set as the Mobile Device Management (MDM) authority or co-management must be turned on and enabled on the target devices.<p><p>At a minimum, the Windows Update, Device configuration and Office Click-to-Run apps workloads must be set to Pilot Intune or Intune. You must also ensure that the devices you intend on bringing to Windows Autopatch are in the targeted device collection. For more information, see [co-management requirements for Windows Autopatch](#configuration-manager-co-management-requirements).<p>Other device management prerequisites include:<ul><li>Devices must be corporate-owned. Windows bring-your-own-devices (BYOD) are blocked during device registration prerequisite checks.</li><li>Devices must be managed by either Intune or Configuration Manager co-management. Devices only managed by Configuration Manager aren't supported.</li><li>Devices must be in communication with Microsoft Intune in the **last 28 days**. Otherwise, the devices won't be registered with Autopatch.</li><li>Devices must be connected to the internet.</li><li>Devices must have a **Serial number**, **Model** and **Manufacturer**. Device emulators that don't generate this information fail to meet **Intune or Cloud-attached** prerequisite check.</li></ul><p>See [Register your devices](/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices) for more details on device prerequisites and on how the device registration process works.<p>For more information on co-management, see [co-management for Windows devices](/mem/configmgr/comanage/overview).</p> |
|
||||
| Device management | [Devices must be already enrolled with Microsoft Intune](/mem/intune/user-help/enroll-windows-10-device) prior to registering with Windows Autopatch. Intune must be set as the Mobile Device Management (MDM) authority or co-management must be turned on and enabled on the target devices.<p><p>At a minimum, the Windows Update, Device configuration and Office Click-to-Run apps workloads must be set to Pilot Intune or Intune. You must also ensure that the devices you intend on bringing to Windows Autopatch are in the targeted device collection. For more information, see [co-management requirements for Windows Autopatch](#configuration-manager-co-management-requirements).<p>Other device management prerequisites include:<ul><li>Devices must be corporate-owned. Windows bring-your-own-devices (BYOD) are blocked during device registration prerequisite checks.</li><li>Devices must be managed by either Intune or Configuration Manager co-management. Devices only managed by Configuration Manager aren't supported.</li><li>Devices must be in communication with Microsoft Intune in the **last 28 days**. Otherwise, the devices won't be registered with Autopatch.</li><li>Devices must be connected to the internet.</li><li>Devices must have a **Serial number**, **Model** and **Manufacturer**. Device emulators that don't generate this information fail to meet **Intune or Cloud-attached** prerequisite check.</li></ul><p>See [Register your devices](/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices) for more details on device prerequisites and on how the device registration process works with Windows Autopatch.<p>For more information on co-management, see [co-management for Windows devices](/mem/configmgr/comanage/overview).</p> |
|
||||
| Data and privacy | For more information on Windows Autopatch privacy practices, see [Windows Autopatch Privacy](../references/windows-autopatch-privacy.md). |
|
||||
|
||||
## More about licenses
|
||||
|
||||
@ -66,7 +66,7 @@ The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support th
|
||||
> [!NOTE]
|
||||
> TPM 2.0 is not supported in Legacy and Compatibility Support Module (CSM) modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as native UEFI only. The Legacy and CSM options must be disabled. For added security, enable the secure boot feature.
|
||||
|
||||
> Installed Operating System on hardware in Legacy mode stops the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](/windows/deployment/mbr-to-gpt.md) before changing the BIOS mode, which prepares the OS and the disk to support UEFI.
|
||||
> Installed Operating System on hardware in Legacy mode stops the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](/windows/deployment/mbr-to-gpt) before changing the BIOS mode, which prepares the OS and the disk to support UEFI.
|
||||
|
||||
The hard disk must be partitioned with at least two drives:
|
||||
|
||||
|
||||
@ -14,10 +14,7 @@ ms.author: vinpa
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
|
||||
# 4774(S, F): An account was mapped for logon.
|
||||
|
||||
|
||||
Success events do not appear to occur. Failure event [has been reported](http://forum.ultimatewindowssecurity.com/Topic7313-282-1.aspx).
|
||||
# 4774(S, F): An account was mapped for logon
|
||||
|
||||
***Subcategory:*** [Audit Credential Validation](audit-credential-validation.md)
|
||||
|
||||
@ -25,11 +22,11 @@ Success events do not appear to occur. Failure event [has been reported](http://
|
||||
|
||||
*An account was mapped for logon.*
|
||||
|
||||
*Authentication Package:Schannel*
|
||||
*Authentication Package:* `<Authentication package>`
|
||||
|
||||
*Account UPN:*<*Acccount*>@<*Domain*>
|
||||
*Account UPN:* `<Acccount>@<Domain>`
|
||||
|
||||
*Mapped Name:*<*Account*>
|
||||
*Mapped Name:* `<Account>`
|
||||
|
||||
***Required Server Roles:*** no information.
|
||||
|
||||
@ -39,5 +36,4 @@ Success events do not appear to occur. Failure event [has been reported](http://
|
||||
|
||||
## Security Monitoring Recommendations
|
||||
|
||||
- There is no recommendation for this event in this document.
|
||||
|
||||
- There is no recommendation for this event in this document.
|
||||
|
||||
@ -127,7 +127,7 @@ You can see interface’s GUID using the following commands:
|
||||
|
||||
- **Error Code** \[Type = HexInt32\]**:** there's no information about this field in this document.
|
||||
|
||||
- **EAP Reason Code** \[Type = HexInt32\]**:** there's no information about this field in this document. See additional information here: <https://technet.microsoft.com/library/dd197570(v=ws.10).aspx>.
|
||||
- **EAP Reason Code** \[Type = HexInt32\]**:** there's no information about this field in this document. See [EAP Related Error and Information Constants](/windows/win32/eaphost/eap-related-error-and-information-constants) for additional information.
|
||||
|
||||
- **EAP Root Cause String** \[Type = UnicodeString\]**:** there's no information about this field in this document.
|
||||
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
title: Federal Information Processing Standard (FIPS) 140 Validation
|
||||
description: Learn how Microsoft products and cryptographic modules follow the U.S. Federal government standard FIPS 140.
|
||||
ms.prod: m365-security
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: aaroncz
|
||||
ms.author: paoloma
|
||||
author: paolomatarazzo
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
|
||||
@ -186,7 +186,7 @@ Windows 10 supports features to help prevent sophisticated low-level malware lik
|
||||
HVCI uses virtualization-based security to isolate Code Integrity, the only way kernel memory can become executable is through a Code Integrity verification. This dependency on verification means that kernel memory pages can never be Writable and Executable (W+X) and executable code can't be directly modified.
|
||||
|
||||
> [!NOTE]
|
||||
> Device Guard devices that run Kernel Mode Code Integrity with virtualization-based security must have compatible drivers. For additional information, please read the [Driver compatibility with Device Guard in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=691612) blog post.
|
||||
> Device Guard devices that run Kernel Mode Code Integrity with virtualization-based security must have compatible drivers. For additional information, please read the [Driver compatibility with Device Guard in Windows 10](https://techcommunity.microsoft.com/t5/windows-hardware-certification/driver-compatibility-with-device-guard-in-windows-10/ba-p/364865) blog post.
|
||||
|
||||
The Device Guard Code Integrity feature lets organizations control what code is trusted to run into the Windows kernel and what applications are approved to run in user mode. It’s configurable by using a policy.
|
||||
Device Guard Code Integrity policy is a binary file that Microsoft recommends you sign. The signing of the Code Integrity policy aids in the protection against a malicious user with Administrator privileges trying to modify or remove the current Code Integrity policy.
|
||||
@ -248,7 +248,7 @@ The trust decision to execute code is performed by using Hyper-V Code Integrity,
|
||||
Hyper-V Code Integrity is a feature that validates the integrity of a driver or system file each time it's loaded into memory. Code integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with Administrator privileges. On x64-based versions of Windows 10, kernel-mode drivers must be digitally signed.
|
||||
|
||||
> [!NOTE]
|
||||
> Independently of activation of Device Guard Policy, [Windows 10 by default raises the bar for what runs in the kernel](https://go.microsoft.com/fwlink/p/?LinkId=691613). Windows 10 drivers must be signed by Microsoft, and more specifically, by the WHQL (Windows Hardware Quality Labs) portal. Additionally, starting in October 2015, the WHQL portal will only accept driver submissions, including both kernel and user mode driver submissions, that have a valid Extended Validation (“EV”) Code Signing Certificate.
|
||||
> Independently of activation of Device Guard Policy, Windows 10 drivers must be signed by Microsoft, and more specifically, by the WHQL (Windows Hardware Quality Labs) portal. Additionally, starting in October 2015, the WHQL portal will only accept driver submissions, including both kernel and user mode driver submissions, that have a valid Extended Validation (“EV”) Code Signing Certificate.
|
||||
|
||||
With Device Guard in Windows 10, organizations are now able to define their own Code Integrity policy for use on x64 systems running Windows 10 Enterprise. Organizations have the ability to configure the policy that determines what is trusted to run. These include drivers and system files, and traditional desktop applications and scripts. The system is then locked down to only run applications that the organization trusts.
|
||||
|
||||
@ -599,7 +599,7 @@ Today’s access control technology, in most cases, focuses on ensuring that the
|
||||
The remote device health attestation process uses measured boot data to verify the health status of the device. The health of the device is then available for an MDM solution like Intune.
|
||||
|
||||
> [!NOTE]
|
||||
> For the latest information on Intune and Windows 10 features support, see the [Microsoft Intune blog](https://go.microsoft.com/fwlink/p/?LinkId=691614) and [What's new in Microsoft Intune](/mem/intune/fundamentals/whats-new).
|
||||
> For the latest information on Intune and Windows 10 features support, see [What's new in Microsoft Intune](/mem/intune/fundamentals/whats-new).
|
||||
|
||||
The figure below shows how the Health Attestation Service is expected to work with Microsoft’s cloud-based Intune MDM service.
|
||||
|
||||
|
||||
@ -85,7 +85,7 @@ Collecting these events in a central location can help you maintain your AppLock
|
||||
|
||||
As new apps are deployed or existing apps are updated by the software publisher, you'll need to make revisions to your rule collections to ensure that the policy is current.
|
||||
|
||||
You can edit an AppLocker policy by adding, changing, or removing rules. However, you can't specify a version for the policy by importing more rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](https://go.microsoft.com/fwlink/p/?LinkId=145013) (https://go.microsoft.com/fwlink/p/?LinkId=145013).
|
||||
You can edit an AppLocker policy by adding, changing, or removing rules. However, you can't specify a version for the policy by importing more rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](https://go.microsoft.com/fwlink/p/?LinkId=145013).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior.
|
||||
@ -116,7 +116,7 @@ A file could be blocked for three reasons:
|
||||
- There may be an existing rule that was created for the file that is too restrictive.
|
||||
- A deny rule, which can't be overridden, is explicitly blocking the file.
|
||||
|
||||
Before editing the rule collection, first determine what rule is preventing the file from running. You can troubleshoot the problem by using the **Test-AppLockerPolicy** Windows PowerShell cmdlet. For more info about troubleshooting an AppLocker policy, see [Testing and Updating an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791793(v=ws.10)) (https://go.microsoft.com/fwlink/p/?LinkId=160269).
|
||||
Before editing the rule collection, first determine what rule is preventing the file from running. You can troubleshoot the problem by using the **Test-AppLockerPolicy** Windows PowerShell cmdlet. For more info about troubleshooting an AppLocker policy, see [Testing and Updating an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791793(v=ws.10)).
|
||||
|
||||
## Record your findings
|
||||
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
---
|
||||
title: Windows 11 requirements
|
||||
description: Hardware requirements to deploy Windows 11
|
||||
manager: dougeby
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
ms.prod: w11
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
@ -82,7 +82,10 @@ The following configuration requirements apply to VMs running Windows 11.
|
||||
|
||||
- Generation: 2<b> \*</b>
|
||||
- Storage: 64 GB or greater
|
||||
- Security: Secure Boot capable, virtual TPM enabled
|
||||
- Security:
|
||||
- Azure: [Trusted launch](/azure/virtual-machines/trusted-launch) with vTPM and secure boot enabled
|
||||
- Hyper-V: [Secure boot and TPM enabled](/windows-server/virtualization/hyper-v/learn-more/Generation-2-virtual-machine-security-settings-for-Hyper-V#secure-boot-setting-in-hyper-v-manager)
|
||||
- General settings: Secure boot capable, virtual TPM enabled
|
||||
- Memory: 4 GB or greater
|
||||
- Processor: Two or more virtual processors
|
||||
|
||||
@ -91,7 +94,7 @@ The VM host CPU must also meet Windows 11 [processor requirements](/windows-hard
|
||||
<b>\*</b> In-place upgrade of existing generation 1 VMs to Windows 11 isn't possible.
|
||||
|
||||
> [!NOTE]
|
||||
> Procedures to configure required VM settings depend on the VM host type. For VM hosts running Hyper-V, virtualization (VT-x, VT-d) must be enabled in BIOS. Virtual TPM 2.0 is emulated in the guest VM independent of the Hyper-V host TPM presence or version.
|
||||
> Procedures to configure required VM settings depend on the VM host type. For example, VM hosts running Hyper-V, virtualization (VT-x, VT-d) must be enabled in BIOS. Virtual TPM 2.0 is emulated in the guest VM independent of the Hyper-V host TPM presence or version.
|
||||
|
||||
## Next steps
|
||||
|
||||
|
||||
Reference in New Issue
Block a user