From 870e16f9c201cf4a00afd5e042cef8adbe75d4d3 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Wed, 11 Apr 2018 00:06:12 +0000 Subject: [PATCH 1/9] Merged PR 7060: Fix typo (issue #691) --- windows/configuration/ue-v/uev-getting-started.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/configuration/ue-v/uev-getting-started.md b/windows/configuration/ue-v/uev-getting-started.md index 5ec8571305..301f4a7b07 100644 --- a/windows/configuration/ue-v/uev-getting-started.md +++ b/windows/configuration/ue-v/uev-getting-started.md @@ -16,8 +16,8 @@ ms.date: 03/08/2018 Follow the steps in this topic to deploy User Experience Virtualization (UE-V) for the first time in a test environment. Evaluate UE-V to determine whether it’s the right solution to manage user settings across multiple devices within your enterprise. ->**Note** -The information in this section is explained in greater detail throughout the rest of the documentation. If you’ve already determined that UE-V is the right solution and you don’t need to further evaluate it, see [Prepare a UE-V deployment](uev-prepare-for-deployment.md). +>[!NOTE] +>The information in this section is explained in greater detail throughout the rest of the documentation. If you’ve already determined that UE-V is the right solution and you don’t need to further evaluate it, see [Prepare a UE-V deployment](uev-prepare-for-deployment.md). The standard installation of UE-V synchronizes the default Microsoft Windows and Office settings and many Windows applications settings. For best results, ensure that your test environment includes two or more user computers that share network access. @@ -94,13 +94,13 @@ A storage path must be configured on the client-side to tell where the personali 4. Select **Enabled**, fill in the **Settings storage path**, and click **OK**. - - Ensure that the storage path ends with **%username%** to ensure that eah user gets a unique folder. + - Ensure that the storage path ends with **%username%** to ensure that each user gets a unique folder. **To set the storage path for UE-V with PowerShell** 1. In a PowerShell window, type **Set-uevConfiguration -SettingsStoragePath [StoragePath]** where **[StoragePath]** is the path to the location created in step 2 followed by **\%username%**. - - Ensure that the storage path ends with **%username%** to ensure that eah user gets a unique folder. + - Ensure that the storage path ends with **%username%** to ensure that each user gets a unique folder. With Windows 10, version 1607 and later, the UE-V service is installed on user devices when the operating system is installed. Enable the service to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. From 7c1a333041824869a37c7593246556da4ba25ec5 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 10 Apr 2018 17:31:52 -0700 Subject: [PATCH 2/9] clarified SSO is blocked --- .../credential-guard/credential-guard-considerations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index 01dbef4001..8457313a96 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -24,7 +24,7 @@ Passwords are still weak. We recommend that in addition to deploying Windows Def Windows Defender Credential Guard uses hardware security, so some features such as Windows To Go, are not supported. ## Wi-fi and VPN Considerations -When you enable Windows Defender Credential Guard, you can no longer use NTLM classic deployment model authentication. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. +When you enable Windows Defender Credential Guard, you can no longer use NTLM classic authentication for Single Sign-On. You will be forced to enter your credentials to use these protocols and cannot save the credentials for future use. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. ## Kerberos Considerations From f031d81925bb3e1e2237056670fa840955bcd84c Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 10 Apr 2018 17:40:29 -0700 Subject: [PATCH 3/9] fixed link text --- ...windows-event-forwarding-to-assist-in-intrusion-detection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index 75dda71497..8e5b6d0232 100644 --- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -175,7 +175,7 @@ To gain the most value out of the baseline subscription we recommend to have the - Enable disabled event channels and set the minimum size for modern event files. - Currently, there is no GPO template for enabling or setting the maximum size for the modern event files. This must be done by using a GPO. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). -The annotated event query can be found in the following. For more info, see [Appendix F – Annotated Baseline Subscription Event Query](#bkmk-appendixf). +The annotated event query can be found in the following. For more info, see [Appendix F – Annotated Suspect Subscription Event Query](#bkmk-appendixf). - Anti-malware events from Microsoft Antimalware or Windows Defender. This can be configured for any given anti-malware product easily if it writes to the Windows event log. - Security event log Process Create events. From 75bdad3f0a60f865d0b9918628cefe218fab7d78 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 10 Apr 2018 17:54:55 -0700 Subject: [PATCH 4/9] fixed quotes --- .../bitlocker/bitlocker-management-for-enterprises.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index d5952e711b..961c0d224c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -108,7 +108,7 @@ For Azure AD-joined computers, including virtual machines, the recovery password ``` PS C:\>Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector -PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:” +PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:" PS C:\>BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId ``` @@ -118,7 +118,7 @@ For domain-joined computers, including servers, the recovery password should be ``` PS C:\>Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector -PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:” +PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:" PS C:\>Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId ``` From 3daf38674ff3d5a2cb43ae12b82dfc7c82e447ea Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 11 Apr 2018 17:47:55 +0000 Subject: [PATCH 5/9] Merged PR 7089: Typo Typo --- windows/deployment/upgrade/setupdiag.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index a460f3c8b5..32859c06fe 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy author: greg-lindsay -ms.date: 03/30/2018 +ms.date: 04/11/2018 ms.localizationpriority: high --- @@ -103,7 +103,7 @@ SetupDiag.exe /Output:C:\SetupDiag\Dumpdebug.log /Mode:Offline /LogsPath:D:\Dump ## Known issues -1. Some rules can take a long time to process if the log files involved as large. +1. Some rules can take a long time to process if the log files involved are large. 2. SetupDiag only outputs data in a text format. If another format is desired, please provide this [feedback](#feedback). 3. If the failing computer is opted into the Insider program and getting regular pre-release updates, or an update is already pending on the computer when SetupDiag is run, it can encounter problems trying to open these log files. This will likely cause a failure to determine a root cause. In this case, try gathering the log files and running SetupDiag in offline mode. From 252ec0f18b0bd622432f13a2b05632abe7fae3ad Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Wed, 11 Apr 2018 19:12:45 +0000 Subject: [PATCH 6/9] Merged PR 7093: issue 681 (clarify ports) --- .../prepare-your-environment-for-surface-hub.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md index 077e16a6a5..cef7042de1 100644 --- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md +++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md @@ -36,9 +36,10 @@ Additionally, note that Surface Hub requires the following open ports: - HTTP: 80 - NTP: 123 -Depending on your environment, access to additional ports may be needed: -- For online environments, see [Office 365 IP URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). -- For on-premises installations, see [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx). +If you are using Surface Hub with Skype for Business, you will need to open additional ports. Please follow the guidance below: +- If you use Skype for Business Online, see [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). +- If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx). +- If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx). Microsoft collects diagnostic data to help improve your Surface Hub experience. Add these sites to your allow list: - Diagnostic data client endpoint: `https://vortex.data.microsoft.com/` From 2695f09fa0d2f5135a274b78554d033b7505b92a Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 11 Apr 2018 14:34:14 -0700 Subject: [PATCH 7/9] removed unclear clause about file protection --- .../bitlocker-device-encryption-overview-windows-10.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index bb2ff3ed96..bdeb514ae1 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -18,7 +18,7 @@ This topic explains how BitLocker Device Encryption can help protect data on de For an architectural overview about how BitLocker Device Encryption works with Secure Boot, see [Secure boot and BitLocker Device Encryption overview](https://docs.microsoft.com/windows-hardware/drivers/bringup/secure-boot-and-device-encryption-overview). For a general overview and list of topics about BitLocker, see [BitLocker](bitlocker-overview.md). -When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives; in Windows 10, BitLocker will even protect individual files, with data loss prevention capabilities. Windows consistently improves data protection by improving existing options and by providing new strategies. +When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives. Windows consistently improves data protection by improving existing options and by providing new strategies. Table 2 lists specific data-protection concerns and how they are addressed in Windows 10 and Windows 7. From b0dc7dd5985425668b32220f266669d2c92f5b61 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 11 Apr 2018 14:58:03 -0700 Subject: [PATCH 8/9] cropped image --- .../images/robocopy-s-mode.png | Bin 0 -> 10147 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png diff --git a/windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png b/windows/security/information-protection/windows-information-protection/images/robocopy-s-mode.png new file mode 100644 index 0000000000000000000000000000000000000000..19fd27b480e09310fcba2dc82358573041f70e69 GIT binary patch literal 10147 zcmb_?1yEdFw`IrB27*f<1ozFnag$kNj0e+X(C>HDF(C3INbZ%1Vf;yXzljqB`Tur)`(b zRy4S$7gc*i&T4dan@IaJ#SuP$W2krtp}l-gJYlEqO8E)U(@(7fEvJz_#8nOgyrXZc zqiG`8Lf;*uXUv`kx{Ej-+vq%s-Az>FMd= z;o-g2-8tf+$xJ%tcNH~n4Q2>{QhbQy_?}{iK3(UTD{lhd#QhS<8W856?x1z+%#eP* zWF9`s$eQ~A3>EA0m%#%q%_SXdt4Aj3ECo%<&S>)08UZ5l^UeAgI>gthqIsQVq{6WV z%(aHKwc=lQef84J7AAOr?edOnD`7z7ElCH39C;sm*pIFio1UCMKPH?XrFjtgbPYb} zI&ydBk1n0zgwa8YY8&)>fx*@DsI)kM4dk&AqU&ebDvO%rxJe$fY3$=g?GTy@{sZK< zj}4>ag1%J5b{*h9gj$?TjjsBeT_5rfjw<`uryyGw z==^#RIDr7b+z#$oVKQd2V{+Eku$)`nHNxl1w^buo&|}mVgf}C0X}5=c?Dhr%8+gYT z?3xJn>2dAPxePqNvXheN;!A1|D{PCktaA-)j?}beLBHg(#k>PKYylpJ*4@>QtrrC7Ci!|i`s$B%<7Fm3@zPSQ-@-BX3Z-=Na*Qehr-KL*i$H( zI>;Cnj||2#%q3d2Ntr>dgSoayz5}+{VFYWpDu}cjtG(1g7scvTlqvA->p~TJyM`sz z7br87|3Qdw&p_Hc&j zh>zwgt-ZDnPpGA%7sD&bB}6G$~{Oa7Tx8F^^jF){X@T#`P+|E(>n zAe}6)T8UG0D1fuHMn8yT{QKrXMg)GPev{*0V~Di0pXT+Sf|1N^X5EWh#aiOq^^F*G z4vqus<>#)heqkTypQq;&!or@l@a3ke&j!s0*Y|;4hO{{066Alsx>Hu&Fs?|Igf*j- zxJSeU6P2DxE}zKuvFaIUYpAKDK(AuB6|F{O2r?W}FI4-_&j{n7P5Cl*tNBf+c&1wl zj!i47=`;k<7x(x4l~?)?g)7Gx7zhQv9UOl!T->g8n`chpDMjFz24BbGU6GBaz^HrS z`wLiBmR&Pi#6jnGTKxmuoS6Yx+gBz7C-6v(bj>Q)o5w(yxo$)G&Xw6n%9{SgVfT`q zPR&JqKz9LZYXpo&38Tmi`1Xz9;~PCeAHlY^6~VT{Ly}BA!LHcEtTeBUhYv9%mhE3p za|c69rS9MY&yyyV`i7dyrL2~BX48DQrm=VV9IjX_C6@Zhh~DG|on<#U6K5G^hQzmAsB*MI)>$-$>3y&2ZMs-2`Lxv4tqlBDKI^ zhAi$+-M1LR%MJEx_a9@npYEUcz9GudD5OiM*foUCMOc0wI?Tm|fW6iXJ;7k9X8w_c ztfap~LoyRXa@pxA{E(~2cjsH5=>`qj59*to%(pkUf&;!)R<2r37Y<8OhECPta<;%f zj2!joWYNN<_SRBv15+PLix`Mv?sk%=Jhj?G-iP*|@hQI5`tyi*Bax1afEhNF* zo^HnH{BAGdBbrCrb)`Rk{8?^t8i*#zO9O+`Gk)xnJd4wPN52ljQhUt zZm+r*sbf&@fmBRm{Uek|6ZX%pgtC`Bt|PP8LxTk7poH=7Ep{_$KRJn|`lyw44u%)M zVF;CaZTwn#cGyXn5VErsblnINCCRl7S8A@ zXqwu2{;X-Qgb`+F_`{8bKt}2MYgK++N1<-%N^6tGREf69;YVMZb#5(Jr4eQ=`q|jM z(*-iNncDWesIxpYaJHEPpL~St^XFKGytj-<=Fy^j>Iju*~#Eq+8iqA`jDc95n%@%bwrD z;IL61%dsD~xd)FYlLfBZjHjj2Dxo8dD=(fGteuRSc7B1zQyxUOqM@nM6NLeSH}@5G zvw(-QnRN`%PCr=M2*q$1OsbSr&AzPKRyxz0>-fvN$)oLYb`- z0i}rWZ(9xd7*^Tt5eN>ZLA)|VRpY_)p1I}YUCO~0F2neP=U%p(i|fTNdNyWmSR3p) zn*ZpeQO|~pS~AP;ex%^M(06+AKKnRTI&E549+P$VB>1R%(L+6U?bz=e<9M0H{>mj` zT1fcnQhd!%`7?Rguf?@Cjm+DrNv8;(`MZYHTtbKJU(Hiq7rU5MpK~W>irM@7s3LGG zuC&C!a(;*7;{tl@cAhZm^TEeQ4+HeOz`!?wIlulSF$m_oui&A`e0+r^1-9hM+8G?W zfFA55a59od=<+yTWE|mNXRaG$puH2%F=Xk4K%P9Dwuf(Nu+zP)NniV`4!d>=<3$UOj^afafLIoPjE79_phR68HNbsAR&r(m5)Y(4mD-Ux!PRTj}0t8 z0;SNQN3FhKMa7UJ`2NuwNagU_&2~86s_&n&ghQW9AIbnzbi_cicv#mT5j(p|+E2VE z$DO~Hb)IyQDG68Gh_BinDM#Hv4N<#LlgJ1V9v%45q4UVt>AvH!YN=iCVu(foWUQas8W0F3{A8m2}yKul8k;16WI1B*z8;Le(-C4W2Zpk^B znJEsB59c<0u~)Kpb8DaszPq~@{Kzfo>-E>=eu+=Wrp5IZTo6gEr+I(5(^ED4$g}gMe%ZcWK|b3shd`g zzDF?OA|fKv!1FPH7Z7vPsn$vw%EvRrhUXqPRCYnTD@G>r$+f8hr{|-O$28lX!^xxC z?O*RMppkj_UeA}E!P%>AJUj%s!2A2hrX~+^F93jmupZ7B&qV;7ni<7KM?`pobAs4| zh<+gKaW>M0TJ$>e@LQMY6q_T^i75g1FvOB~UxQJL!wHMf2`2EY)x4Plj}XJ8W8wKE z+x4}V-4bh4zCdVe+MRFCXMu!-VW1kKecHbDgM#Z^MWQSTywjLy_i8qnplr{-y0;P< z+#T1|DH2Ob55+U?SOI48FFiKIBr2sPU+y9vAFrG)ar>Tk7ug@Qdf)gz?_U$^+L2is1 zznPO`SWy?RzK>0)W`IyiKRvyQ8Ig<_6X_IY`6KMxdRSI9o)5Y5d2xI?gdcZ=+myfD zY5K+eMIqsLHhj+d&F%KooO9Ix$q?G%ame3)NE0!@2+QDe09`lA;KL120if21h@`dI zy2BE^X0r&&_HT;PcWVOvWN|^vss3SMhl_-3APTHPx)cU}8vD6&?U4vgoRo*6>Gsv< z)2ZjjF?$0)-|6Rv&AdYGX}#-5c*Dnsqf9u)N{1tyWO26=1X+qEc7I;cbZvcpcID`J zo-1KS*W>Yk(&_Ngp+Zd_b{5ex^J)bI1g`N?qIeDKZPX-Mv;ExyYf&| z8c2Z^g&ei)U%BkJKX<;lW`YX0G;BP?#R#PeKld|a`tUZ%-fF>4Pu5dzV+{5g7GDBg zx0OB0EB>0hu@5QX*#l?Chp~aihQjZ|gn!T2ST2;_mflL>n}*b@RbFM(_eV+34|BmG z0pKM4WGgh`yMOM#XUbo0iDUg1mqQTiErYV!v?f^^i?ZK$E1?mWD0`e2IiK{gbhI)f z`lBXfXO2x1xr9ce3fpXLY=AS5!-|~XHckoyYw(;X?dHrnCUfp-^NLkKAy(-K@$?rSMQHI?(X(U zG%JIa7sqJENp5a>GyERbljc{S3=K9G69!-ckAA-U-Ju`B?0!!Vt;>X&npNS;(m^%f z!W^owz~!?$2t-cGrv7M?H%n>7i!}xo(zd83jDtAMf+HW-Q(2Y_`WpG8&~u2K(M}gr z-B_{FPyaCDd8K8z2Go>NSY0qQ`d7I)TnV)1$?9=c zUc%&hdDMRF7RRf$V`29#kikeCv+r}iAES27=C<(jZAHT>5%BHY#_#g-R?}eVarmhD5iur{$6+@wCYtyux2dem z`U=XMNdF$`1S?+bLZ9lOghfGq0i&X>Ps~xKmJUT>H@@Zzx@OefT+dlSk4CoiHBgk( zhFqggK7B5+hRwT_L;KPQN;&imIi$PMUKHDJo{mN3Cj*4te02FD!r$V9_e!mC-0>-P1o-_ zKLz%h@o@%&Y~i&@huiUW{pr6ej{YJg=l*monkqM}M}wN@ERa8#L12 zp8Dmn*rA$0)NnF%;6G>cjogR?MZPn+#ZW_QG^4z~BBTbKv@qde$?m4TI``gpP zeLl-{OX*BMQAre-?->3+nHHqZje|%YUR|TDz4&C3KE{?iXt{+!;kMxFjVY-RrEK zjMS;J*KDg&9B0vonmcS6%nM$=nOYCSWmga@W zF>|q1-}}QRr|o!w$r8%P;ju9V5NQA402nNWLk%a7qF~BkGaD`drC5BEoszPHy-btC zGM=vwq_Pt~@WeFa&-VgB@F18#9NA({hipdXip#uSzV>vHQZ|<@SVIF3K3+eL6iR1B zA1V<=8JV1nipQwc=E>PKmd3u_yk7}&Vajuee$;_tRM1xM&jis}!r0U9?mW|-;$-4- z3yO*`fWWtbqUkAm?cQm>@T;gi77AWH|(F9!GD`B z`G3o5{432YW@W#&<9U{f^a`LFHHf-~m4mqvv|=GU9=|{V@MooH!e@5Pdk5e_`OoCc zzegKSfZfTZNSU?$Oc%{!Xs8bhJpIugpR`u*Qcz4CY+S1FMZKG%%64jr{{dK`Q)*r9 z&qz%ZzugIf##T;zPEoA_Dig?~ZfoAU&fbO&U=5QCV{7 zoSLtL6R6rqAZsC+oiD~LwBftc21C`QqK)LnuTOF5F-kX9;9vDFJ|k)+bmroer3D2_ z>f9eH54y!lT&s>G=8h{%ii_VPnurWxRUwt6&P}IJ*|zUt1)9R`-Ai-7)iLVZl?X-- zywNTwKeeSxUOePZv8+H*p^Y`E=3xVz}eQyS+B|x5s7i@i{=S8u~{8S}{K3NOSz-6HJ9TOfClb z-U#_V?;5Ewrd3sGbl_sIp{(i5IQ?pkWF+F>ep~TFIzc?g!uKwUi4?AQ@bezQI<+!F zv@EbpmurZrT4@d{b$%szvp^P@p-&3!%LTHDZtfY!rm1Bj2*PEgJ_#YfmeeA^UXY-_ zleVs78PvDxTtLPt0BiBouhq(%je6HUm~% zCt{L?YSfNUQFResL=nfg%UjK8yX@}F)S%8`w=9r8@%lzK$Ejrea4DJ_ zgli3-1!k``d{0kNKi*W*Q_m}bEUo?y2`{>cfgC`J1#wH(R&*bO+UiVv;DuED+%h5C za9{=}WiM>JhRC73hjLiiNsS^&pB&s}b6}tdtwGw?I!{inWQqjquq`-73X7Dj>3$(t zQjfNzk)eW@HTBi5wSwfVhHFE;lZ$2p7Ch-+=LqpdNb1#cse5R9wS5V8*>e(}UN#P` zmXYxpqK7z{5+UZWGK5TN_7K(5C(tPQ?iQrz`@P`0zL!G1vOoHej7p7J;!h?>sjFo% zie@VuPCtis`$b9fYe)TD52d~wgibc1VUVOJ>m9LO!MR2=(^MyRG{Wr%*YHz&L|4y* z@bsKU;LEAB!V9FrJZR!UQ|UQBBb%&uF-z;UFFW{1A_=7pvDEB6%)TM)uLzR_?G9Il zw{5_yKBrh+Kc-@b+g`9!{7q^l@$;42S3G{3A3kX8CSX8bl4CEK#hB&6D|lp|=n zv@noGQA3=xc5(;TcCur&(lI_M+z(NQcp&EgH2Mu;JFYehyRQ^K- zDpkRgbGTLFQc5pr57xuyfylxvXR@Rj3EA*Rpodk7>-iRVXth)30@;6z=nhP@Spp~v zvr%P?(dd&^i>b0BR(vr{c#CO<7>vDo8kP0BF3 zXNgjwX+fR*M~-ET$(%qsM!bbWjWB4qbuRS_hd6O9b#XYCIk=F_nFig)tb!hgUpdQj zxBE8*S6d)ZTRjkKZYe}EAm;Vvt-p8v7;r{wYbe`?jpLH@lyXq}lfWT_mS&DrN4%+Y zv4rX*zu9%MG-tinin67IH&vR@%I*aRCVg-WN0m>FhvbcsYf2HrLo0EZ^egIZ)b-R` zRz*vogL0$=3{sr^jo4DzJMt1J6}fkwR$miVbK&n3j5rD_wvyswYWGT9e#v1XBv8L! zF8#8U`o*R~tKIY2XmSV>aWZmE`V||vV>d%~Zap03blCuAP5Q1llatGlD_Yqr7a<5m zGSb~JlD?3$!DgHQ^U}imb;7czVyZ^W)ejPTUiMJ1Ae#cws}eGZ^9Sh8JUl3ooh3T* z=?4iK?}y>4*PXGJCZvlV)+6u<#8)z}RNa3?d*Aop$<4pyDe|t7%>;h>PypzLdzafC z)H`fn0RXOD#@PRpM2J1B62c?{h?IWg=6wYaVH~=neTjUj-~K13`fp-@_(r9(#%x4_ z_OpV50{L5jj05rg5cQC@SV_&s8-NV%$&fklA*F%MVYMXLbWcJ5Pd|NpFHtIP-1~Dr zAOpjfX?%z%6`pizyO`W?B|cxjOulf=X87f@(IyC z`XrkoDIzvC!IF@-6DqsFIwa0dp;2|5xk?OBty8`{*5dOhxynUjv=iWGws}TJ6dz&&g80 zAexzLtf?psA#=pZ)Vqwl){&{3qo>pc5iq728ce-zf6+_HWQ{^1tF`lPWel!V-OyfF zoo4lra;-I={JjL(C14lCo5wcUwltYa=3&LmPOQ33yNKnWn1BLjUiHIyR!F4Zs-lWI zj4 zd8}CWfR)$Q!_FqTw)=Cbr$*k)Mh__?Uf%vI zSdrsAK`guCE?2V$cgmzsH0&SFPz2O)TS~<`zwIX8d_4Rw&d@eH8PA)y(|PhwRgPOk zgcen`=CiZ`u$ee=_NR;_E`8NyKhWK^`rl-t2~>QcvO+u5rp)9T**sy`C1T9<{gQly zCpC`(pO(SQ3{L43&NdK>DwxRz+#4SA%=Tx&CW-)+?T|Y#1Afxz+Ew)$KtNAPnUQ?c zzqxNxt7UHRop^OR+!`s~JPHfxdxrHe9w1N~LZYvGX! zL#4e5?I@4eE#Gke1qHEiAnA*ug!unEP53W|`v0ug_f=@^o|mP>FDbx8lf9Xe3;Y-N z{y&r-|7Sh?UkvtdQ?7YMBDLq;RwTVL-N!{;%@-Ljsy&9$H&1BE|eTMd#uCXb?oMK#Imb>f;h-j zLjNxQ_d=Ee#$&-Ik-uI`O2`zjQt6_4Kl`o#nzaNB=sWxL$jVb$v9(Za!WE>idmbOj zV_`EvQfCwu69@cbiw))z^c$Dgs|jUS<%@22!7Y8&CWfl@!`G?HSJOp)RBc{|`a_b& zzyq(sOH3r9O-3r-y2n1feb?5j9kJW5fAcy#r953Td^x76p1<3t( z_k_r}Y6AH&Ii@P_CO_Tl38At`TWRAd*Zvje6SMhUl6}{-ozPgtA9F5~D_l;sp8|o3mG8Jllx3vztd7W08Rj;x- zncwH1t(jLSDEDTr>*-cYezU)9q{QrJv`czsPxDZMmhs;FLt<7zFVhqr>hP?RO?+Ox z-ZOBd(ot^y)69^D0*}PxcZg>;+sW7ZXU{NQ z%T@|};``=s;!{IummdRaTE7xFF1buND%!3o{!M5XKf6ezYaup5(CjI8!S?$8(NnaD?Ca~Eskl5*icR>IfMi}hdkJ2Y!AYYthF*c2rVzzx@Z?5&fIEzRlEG26 zGEDvko?lAmqKp@KK$hZwG_=0nni+z(tlxtugN7=K8IiKS?^yppjHL>nI|>X z8BMgH(t~qQjEQ(q{NlAx|F?>-*FuZ(MDCZ!LW>;lvTgdwnzC)g#^Vt-fy{+4@^)z0 zuR4?$#RP!kr0oSN^8T;S|NpACc=3#0N~|g6?(-WU6rrZ%M}XTuEwYk|5|v_x0sjL` CJ)IN) literal 0 HcmV?d00001 From a52412b9e32db9d546cc53fe81d94f716daa4639 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Thu, 12 Apr 2018 16:33:49 +0000 Subject: [PATCH 9/9] Merged PR 7111: Updates for issue #616 --- .../surface-hub/change-history-surface-hub.md | 6 ++++ ...-deployment-surface-hub-device-accounts.md | 28 ++++++++----------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index d0cb5eb932..c3ab437724 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -16,6 +16,12 @@ ms.localizationpriority: medium This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md). +## April 2018 + +New or changed topic | Description +--- | --- +[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated instructions for Skype for Business Hybrid. + ## March 2018 New or changed topic | Description diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md index de3ffd59ee..b464e456dc 100644 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md @@ -9,13 +9,17 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 02/21/2018 +ms.date: 04/12/2018 ms.localizationpriority: medium --- # Hybrid deployment (Surface Hub) A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-prem), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).) +>[!NOTE] +>In an Exchange hybrid environment, follow the steps for [Exchange on-premises](#exchange-on-prem). To move Exchange objects to Office 365, use the [New-MoveRequest](https://docs.microsoft.com/powershell/module/exchange/move-and-migration/new-moverequest?view=exchange-ps) cmdlet. + + ## Exchange on-premises Use this procedure if you use Exchange on-premises. @@ -210,15 +214,10 @@ If your organization has set up [hybrid connectivity between Skype for Business The Surface Hub requires a Skype account of the type `meetingroom`, while a normal user would use a user type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account. -In a hybrid Skype environment, you have to create the user on-premises first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet, unfortunately this will not work between the on-preisesm Skype server and Office 365 - it only works across on-premises Skype pools. +In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet. -To have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. Enable the account on the on-premises Skype server first: - -``` -Enable-CsUser -Identity 'HUB01@contoso.com' -RegistrarPool "registrarpoolfqdn" -SipAddressType UserPrincipalName -``` - -After the Surface Hub account is enabled for Skype for Business on-premises, you can keep the account on-premises or you can move the Surface Hub account to Office 365, using the Move-CsUser cmdlet. [Learn more about moving a Skype user to Office 365.](https://technet.microsoft.com/library/jj204969.aspx) +>[!NOTE] +>To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p). ## Exchange online @@ -406,13 +405,8 @@ If your organization has set up [hybrid connectivity between Skype for Business The Surface Hub requires a Skype account of the type *meetingroom*, while a normal user would use a *user* type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account. -In a hybrid Skype environment, you have to create the user on-premises first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&MSPPError=-2147217396) cmdlet, unfortunately this will not work between the on-premises Skype server and Office 365 - it only works across on-premises Skype pools. - -In order to have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. First follow the Exchange steps - either [online](#exchange-online) or [on-premises](#exchange-on-premises) - and, instead of enabling the user for Skype for Business Online as described, [enable the account](https://technet.microsoft.com/library/gg398711.aspx) on the on-premises Skype server: +In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet. -```PowerShell -Enable-CsUser -Identity 'HUB01@contoso.com' -RegistrarPool "registrarpoolfqdn" -SipAddressType UserPrincipalName -``` - -After the Surface Hub account is enabled for Skype for Business on-premises, you can keep the account on-premises or you can move the Surface Hub account to Office 365, using the Move-CsUser cmdlet. [Learn more about moving a Skype user to Office 365](https://technet.microsoft.com/library/jj204969.aspx). +>[!NOTE] +>To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).