mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 14:27:22 +00:00
Merge pull request #5219 from MicrosoftDocs/master
Publish 05/24/2021, 10:30 AM
This commit is contained in:
Diana Hanson
GitHub
commit
4cfa9ee017
@ -14,7 +14,7 @@ ms.date: 06/26/2017
|
||||
|
||||
# Certificate authentication device enrollment
|
||||
|
||||
This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
|
||||
> [!Note]
|
||||
> To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package).
|
||||
@ -31,7 +31,7 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme
|
||||
|
||||
The following example shows the discovery service request.
|
||||
|
||||
``` syntax
|
||||
```xml
|
||||
POST /EnrollmentServer/Discovery.svc HTTP/1.1
|
||||
Content-Type: application/soap+xml; charset=utf-8
|
||||
User-Agent: Windows Enrollment Client
|
||||
@ -71,7 +71,7 @@ Cache-Control: no-cache
|
||||
|
||||
The following example shows the discovery service response.
|
||||
|
||||
```
|
||||
```xml
|
||||
HTTP/1.1 200 OK
|
||||
Content-Length: 865
|
||||
Content-Type: application/soap+xml; charset=utf-8
|
||||
@ -111,7 +111,7 @@ http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoverySer
|
||||
|
||||
The following example shows the policy web service request.
|
||||
|
||||
```
|
||||
```xml
|
||||
POST /ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC HTTP/1.1
|
||||
Content-Type: application/soap+xml; charset=utf-8
|
||||
User-Agent: Windows Enrollment Client
|
||||
@ -183,7 +183,7 @@ Cache-Control: no-cache
|
||||
|
||||
The following snippet shows the policy web service response.
|
||||
|
||||
```
|
||||
```xml
|
||||
HTTP/1.1 200 OK
|
||||
Date: Fri, 03 Aug 2012 20:00:00 GMT
|
||||
Server: <server name here>
|
||||
@ -261,7 +261,7 @@ Content-Length: xxxx
|
||||
|
||||
The following example shows the enrollment web service request.
|
||||
|
||||
```
|
||||
```xml
|
||||
POST /EnrollmentServer/DeviceEnrollmentWebService.svc HTTP/1.1
|
||||
Content-Type: application/soap+xml; charset=utf-8
|
||||
User-Agent: Windows Enrollment Client
|
||||
@ -369,7 +369,7 @@ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrol
|
||||
|
||||
The following example shows the enrollment web service response.
|
||||
|
||||
```
|
||||
```xml
|
||||
HTTP/1.1 200 OK
|
||||
Cache-Control: private
|
||||
Content-Length: 10231
|
||||
@ -422,7 +422,7 @@ Date: Fri, 03 Aug 2012 00:32:59 GMT
|
||||
|
||||
The following example shows the encoded provisioning XML.
|
||||
|
||||
```
|
||||
```xml
|
||||
<wap-provisioningdoc version="1.1">
|
||||
<characteristic type="CertificateStore">
|
||||
<characteristic type="Root">
|
||||
|
||||
@ -26,9 +26,13 @@ With Windows 10, you can quickly upgrade from one edition of Windows 10 to ano
|
||||
|
||||
For a list of operating systems that qualify for the Windows 10 Pro Upgrade or Windows 10 Enterprise Upgrade through Microsoft Volume Licensing, see [Windows 10 Qualifying Operating Systems](https://download.microsoft.com/download/2/d/1/2d14fe17-66c2-4d4c-af73-e122930b60f6/Windows10-QOS.pdf).
|
||||
|
||||
The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. **Note**: The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607.
|
||||
The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer.
|
||||
|
||||
Note: Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](/configmgr/compliance/deploy-use/upgrade-windows-version) in Microsoft Endpoint Configuration Manager.
|
||||
> [!NOTE]
|
||||
> The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607.
|
||||
|
||||
> [!TIP]
|
||||
> Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](/configmgr/compliance/deploy-use/upgrade-windows-version) in Microsoft Endpoint Configuration Manager.
|
||||
|
||||
 (X) = not supported</br>
|
||||
 (green checkmark) = supported, reboot required</br>
|
||||
@ -83,7 +87,7 @@ Use Windows Configuration Designer to create a provisioning package to upgrade a
|
||||
- To create a provisioning package for upgrading mobile editions of Windows 10, go to **Runtime settings > EditionUpgrade > UpgradeEditionWithLicense** in the **Available customizations** panel in Windows ICD and enter the product key for the upgraded edition.
|
||||
|
||||
For more info about Windows Configuration Designer, see these topics:
|
||||
- [Create a provisioining package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package)
|
||||
- [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package)
|
||||
- [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package)
|
||||
|
||||
|
||||
@ -121,7 +125,8 @@ If you do not have a product key, you can upgrade your edition of Windows 10 th
|
||||
|
||||
3. Follow the on-screen instructions.
|
||||
|
||||
**Note**<br>If you are a Windows 10 Home N or Windows 10 Home KN user and have trouble finding your applicable upgrade in the Microsoft Store, click [here](ms-windows-store://windowsupgrade/).
|
||||
> [!NOTE]
|
||||
> If you are a Windows 10 Home N or Windows 10 Home KN user and have trouble finding your applicable upgrade in the Microsoft Store, click [here](ms-windows-store://windowsupgrade/).
|
||||
|
||||
## License expiration
|
||||
|
||||
@ -129,7 +134,8 @@ Volume license customers whose license has expired will need to change the editi
|
||||
|
||||
Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 by entering a different product key is not supported. You also cannot downgrade from a later version to an earlier version of the same edition (Ex: Windows 10 Pro 1709 to 1703) unless the rollback process is used. This topic does not discuss version downgrades.
|
||||
|
||||
Note: If you are using [Windows 10 Enterprise Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation) and a license expires, devices will automatically revert to the original edition when the grace period expires.
|
||||
> [!NOTE]
|
||||
> If you are using [Windows 10 Enterprise Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation) and a license expires, devices will automatically revert to the original edition when the grace period expires.
|
||||
|
||||
### Scenario example
|
||||
|
||||
@ -149,21 +155,21 @@ You can move directly from Enterprise to any valid destination edition. In this
|
||||
<br>
|
||||
<table border="0" cellpadding="1">
|
||||
<tr>
|
||||
<td colspan="10" align="center">Destination edition</td>
|
||||
<th colspan="10" align="center">Destination edition</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td> </td>
|
||||
<td></td>
|
||||
<td>Home</td>
|
||||
<td>Pro</td>
|
||||
<td>Pro for Workstations</td>
|
||||
<td>Pro Education</td>
|
||||
<td>Education</td>
|
||||
<td>Enterprise LTSC</td>
|
||||
<td>Enterprise</td>
|
||||
<th> </th>
|
||||
<th> </th>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Pro for Workstations</th>
|
||||
<th>Pro Education</th>
|
||||
<th>Education</th>
|
||||
<th>Enterprise LTSC</th>
|
||||
<th>Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="9" nowrap="nowrap" valign="middle">Starting edition</td>
|
||||
<th rowspan="9" nowrap="nowrap" valign="middle">Starting edition</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
|
||||
@ -43,16 +43,17 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
|
||||
<table border="0" cellpadding="1">
|
||||
<tr>
|
||||
<td> </td>
|
||||
<td></td>
|
||||
<td>Windows 10 Home</td>
|
||||
<td>Windows 10 Pro</td>
|
||||
<td>Windows 10 Pro Education</td>
|
||||
<td>Windows 10 Education</td>
|
||||
<td>Windows 10 Enterprise</td>
|
||||
<td>Windows 10 Mobile</td>
|
||||
<td> </td>
|
||||
<th>Windows 10 Home</th>
|
||||
<th>Windows 10 Pro</th>
|
||||
<th>Windows 10 Pro Education</th>
|
||||
<th>Windows 10 Education</th>
|
||||
<th>Windows 10 Enterprise</th>
|
||||
<th>Windows 10 Mobile</th>
|
||||
<th>Windows 10 Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="7" nowrap="nowrap">Windows 7</td>
|
||||
<th rowspan="7" nowrap="nowrap">Windows 7</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Starter</td>
|
||||
@ -115,7 +116,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="10" nowrap="nowrap">Windows 8.1</td>
|
||||
<th rowspan="10" nowrap="nowrap">Windows 8.1</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>(Core)</td>
|
||||
@ -208,7 +209,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
|
||||
<td>✔</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="8" nowrap="nowrap">Windows 10</td>
|
||||
<th rowspan="8" nowrap="nowrap">Windows 10</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
|
||||
@ -8,7 +8,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 05/06/2021
|
||||
ms.date: 05/24/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -27,7 +27,7 @@ Application Guard uses both network isolation and application-specific settings.
|
||||
|
||||
## Network isolation settings
|
||||
|
||||
These settings, located at **Computer Configuration\Administrative Templates\Network\Network Isolation**, help you define and manage your organization's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container.
|
||||
These settings, located at `Computer Configuration\Administrative Templates\Network\Network Isolation`, help you define and manage your organization's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container.
|
||||
|
||||
> [!NOTE]
|
||||
> You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the "Domains categorized as both work and personal" policy.
|
||||
@ -48,11 +48,11 @@ These settings, located at **Computer Configuration\Administrative Templates\Net
|
||||
|`..contoso.com`|2|Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include `shop.contoso.com`, `us.shop.contoso.com`, `www.us.shop.contoso.com`, but NOT `contoso.com` itself.|
|
||||
|
||||
## Application-specific settings
|
||||
These settings, located at **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard**, can help you to manage your company's implementation of Application Guard.
|
||||
These settings, located at `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard`, can help you to manage your company's implementation of Application Guard.
|
||||
|
||||
|Name|Supported versions|Description|Options|
|
||||
|-----------|------------------|-----------|-------|
|
||||
|Configure Microsoft Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher<p>Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:<br/>-Disable the clipboard functionality completely when Virtualization Security is enabled.<br/>- Enable copying of certain content from Application Guard into Microsoft Edge.<br/>- Enable copying of certain content from Microsoft Edge into Application Guard. **Important:** Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.<p>**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.|
|
||||
|Configure Microsoft Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher<p>Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:<br/>- Disable the clipboard functionality completely when Virtualization Security is enabled.<br/>- Enable copying of certain content from Application Guard into Microsoft Edge.<br/>- Enable copying of certain content from Microsoft Edge into Application Guard. **Important:** Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.<p>**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.|
|
||||
|Configure Microsoft Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher<p>Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:<br/>- Enable Application Guard to print into the XPS format.<br/>- Enable Application Guard to print into the PDF format.<br/>- Enable Application Guard to print to locally attached printers.<br/>- Enable Application Guard to print from previously connected network printers. Employees can't search for additional printers.<br/><br/>**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.|
|
||||
|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container. <p>**NOTE**: This action might also block assets cached by CDNs and references to analytics sites. Add them to the trusted enterprise resources to avoid broken pages.<p>**Disabled or not configured.** Prevents Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. |
|
||||
|Allow Persistence|Windows 10 Enterprise, 1709 or higher<br><br>Windows 10 Pro, 1803 or higher|Determines whether data persists across different sessions in Microsoft Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.<p>**Disabled or not configured.** All user data within Application Guard is reset between sessions.<p>**NOTE**: If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.<p>**To reset the container:**<br/>1. Open a command-line program and navigate to `Windows/System32`.<br/>2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.<br/>3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data.|
|
||||
@ -61,6 +61,3 @@ These settings, located at **Computer Configuration\Administrative Templates\Win
|
||||
|Allow hardware-accelerated rendering for Microsoft Defender Application Guard|Windows 10 Enterprise, 1803 or higher<br><br>Windows 10 Pro, 1803 or higher|Determines whether Microsoft Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** Microsoft Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Microsoft Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Microsoft Defender Application Guard will automatically revert to software-based (CPU) rendering. **Important:** Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.<br><br>**Disabled or not configured.** Microsoft Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.|
|
||||
|Allow camera and microphone access in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher<br><br>Windows 10 Pro, 1809 or higher|Determines whether to allow camera and microphone access inside Microsoft Defender Application Guard.|**Enabled.** Applications inside Microsoft Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.<p>**Disabled or not configured.** Applications inside Microsoft Defender Application Guard are unable to access the camera and microphone on the user's device.|
|
||||
|Allow Microsoft Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise, 1809 or higher<br><br>Windows 10 Pro, 1809 or higher|Determines whether Root Certificates are shared with Microsoft Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.<p>**Disabled or not configured.** Certificates are not shared with Microsoft Defender Application Guard.|
|
||||
|Allow users to trust files that open in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher|Determines whether users are able to manually trust untrusted files to open them on the host.|**Enabled.** Users are able to manually trust files or trust files after an antivirus check.<p>**Disabled or not configured.** Users are unable to manually trust files and files continue to open in Microsoft Defender Application Guard.|
|
||||
|Allow extensions in the container|Windows 10 Enterprise, 1709 or higher<p>Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use extensions.|**Enabled.** Favorites are able to sync from the host browser to the container. Note that this doesn’t work the other way around. The favorites sync to the user’s work profile by default.<p>**Disabled.** Users are not able to access their favorites from within the Application Guard container.|
|
||||
|Allow favorites sync|Windows 10 Enterprise, 1709 or higher<p>Windows 10 Pro, 1803 or higher|Determines whether favorites can be accessible from Application Guard container.|**Enabled.** Favorites are able to sync from the host browser to the container, but it doesn’t work the other way around. The favorites sync to the user’s work profile by default.<p>**Disabled.** Users are not able to access their favorites from within the Application Guard container.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user