mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 06:17:22 +00:00
Merge branch 'master' into bl-10743059
This commit is contained in:
Brian Lich
commit
50a2097b26
File diff suppressed because it is too large
Load Diff
@ -15,7 +15,7 @@ For a detailed feature list of what's in the current Microsoft Edge releases, th
|
||||
## February 2017
|
||||
|New or changed topic | Description |
|
||||
|----------------------|-------------|
|
||||
|[Available Group Policy and Mobile Data Management (MDM) settings for Microsoft Edge](available-policies.md) |Added new Group Policy and MDM settings for the Windows Insider Program. |
|
||||
|[Available Group Policy and Mobile Data Management (MDM) settings for Microsoft Edge](available-policies.md) |Added new Group Policy and MDM settings for the Windows Insider Program. Reformatted for easier readability outside of scrolling table. |
|
||||
|
||||
## November 2016
|
||||
|New or changed topic | Description |
|
||||
|
||||
@ -17,7 +17,7 @@ New releases of the Surface Hub operating system are published through Windows U
|
||||
- **Windows Update for Business** - New in Windows 10, Windows Update for Business is a set of features designed to provide enterprises additional control over how and when Windows Update installs releases, while reducing device management costs. Using this method, Surface Hubs are directly connected to Microsoft’s Windows Update service.
|
||||
- **Windows Server Update Services (WSUS)** - Set of services that enable IT administrators to obtain the updates that Windows Update determines are applicable to the devices in their enterprise, perform additional testing and evaluation on the updates, and select the updates they want to install. Using this method, Surface Hubs will receive updates from WSUS rather than Windows Update.
|
||||
|
||||
You can also configure Surface Hub to receive updates from both Windows Update for Business and WSUS. See [Integrate Windows Update for Business with Windows Server Update Services](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-integrate-wufb#integrate-windows-update-for-business-with-windows-server-update-services) for details.
|
||||
You can also configure Surface Hub to receive updates from both Windows Update for Business and WSUS. See [Integrate Windows Update for Business with Windows Server Update Services](https://technet.microsoft.com/itpro/windows/manage/waas-integrate-wufb#integrate-windows-update-for-business-with-windows-server-update-services) for details.
|
||||
|
||||
| Capabilities | Windows Update for Business | Windows Server Update Services (WSUS) |
|
||||
| ------------ | --------------------------- | ------------------------------------- |
|
||||
@ -27,7 +27,7 @@ You can also configure Surface Hub to receive updates from both Windows Update f
|
||||
| Define maintenance windows for installing updates. | Yes | Yes |
|
||||
|
||||
> [!TIP]
|
||||
> Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Optimize update delivery for Windows 10 updates](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-optimize-windows-10-updates) for details.
|
||||
> Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Optimize update delivery for Windows 10 updates](https://technet.microsoft.com/itpro/windows/manage/waas-optimize-windows-10-updates) for details.
|
||||
|
||||
> [!NOTE]
|
||||
> Surface Hub does not currently support rolling back updates.
|
||||
@ -45,11 +45,11 @@ In order to improve release quality and simplify deployments, all new releases t
|
||||
|
||||
The Surface Hub operating system is available on **Current Branch (CB)** and **Current Branch for Business (CBB)**. Like other editions of Windows 10, the servicing lifetime of CB or CBB is finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates.
|
||||
|
||||
For more information on Windows as a Service, see [Overview of Windows as a service](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview).
|
||||
For more information on Windows as a Service, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview).
|
||||
|
||||
|
||||
## Use Windows Update for Business
|
||||
Surface Hubs, like all Windows 10 devices, include **Windows Update for Business (WUfB)** to enable you to control how your devices are being updated. Windows Update for Business helps reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. For more information, see [Manage updates using Windows Update for Business](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-manage-updates-wufb).
|
||||
Surface Hubs, like all Windows 10 devices, include **Windows Update for Business (WUfB)** to enable you to control how your devices are being updated. Windows Update for Business helps reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. For more information, see [Manage updates using Windows Update for Business](https://technet.microsoft.com/itpro/windows/manage/waas-manage-updates-wufb).
|
||||
|
||||
**To set up Windows Update for Business:**
|
||||
1. [Group Surface Hub into deployment rings](#group-surface-hub-into-deployment-rings)
|
||||
@ -58,11 +58,11 @@ Surface Hubs, like all Windows 10 devices, include **Windows Update for Business
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
> You can use Microsoft Intune, System Center Configuration Manager, or a supported third-party MDM provider to set up WUfB. [Walkthrough: use Microsoft Intune to configure Windows Update for Business.](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-wufb-intune)
|
||||
> You can use Microsoft Intune, System Center Configuration Manager, or a supported third-party MDM provider to set up WUfB. [Walkthrough: use Microsoft Intune to configure Windows Update for Business.](https://technet.microsoft.com/itpro/windows/manage/waas-wufb-intune)
|
||||
|
||||
|
||||
### Group Surface Hub into deployment rings
|
||||
Use deployment rings to control when updates roll out to your Surface Hubs, giving you time to validate them. For example, you can update a small pool of devices first to verify quality before a broader roll-out to your organization. Depending on who manages Surface Hub in your organization, consider incorporating Surface Hub into the deployment rings that you've built for your other Windows 10 devices. For more information about deployment rings, see [Build deployment rings for Windows 10 updates](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-deployment-rings-windows-10-updates).
|
||||
Use deployment rings to control when updates roll out to your Surface Hubs, giving you time to validate them. For example, you can update a small pool of devices first to verify quality before a broader roll-out to your organization. Depending on who manages Surface Hub in your organization, consider incorporating Surface Hub into the deployment rings that you've built for your other Windows 10 devices. For more information about deployment rings, see [Build deployment rings for Windows 10 updates](https://technet.microsoft.com/itpro/windows/manage/waas-deployment-rings-windows-10-updates).
|
||||
|
||||
This table gives examples of deployment rings.
|
||||
|
||||
@ -75,22 +75,22 @@ This table gives examples of deployment rings.
|
||||
|
||||
|
||||
### Configure Surface Hub to use Current Branch or Current Branch for Business
|
||||
By default, Surface Hubs are configured to receive updates from Current Branch (CB). CB receives feature updates as soon as they are released by Microsoft. Current Branch for Business (CBB), on the other hand, receives feature updates at least four months after they have been initially offered to CB devices, and includes all of the quality updates that have been released in the interim. For more information on the differences between CB and CBB, see [Servicing branches](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview#servicing-branches).
|
||||
By default, Surface Hubs are configured to receive updates from Current Branch (CB). CB receives feature updates as soon as they are released by Microsoft. Current Branch for Business (CBB), on the other hand, receives feature updates at least four months after they have been initially offered to CB devices, and includes all of the quality updates that have been released in the interim. For more information on the differences between CB and CBB, see [Servicing branches](https://technet.microsoft.com/itpro/windows/manage/waas-overview#servicing-branches).
|
||||
|
||||
**To manually configure Surface Hub to use CB or CBB:**
|
||||
1. Open **Settings** > **Update & Security** > **Windows Update**, and then select **Advanced Options**.
|
||||
2. Select **Defer feature updates**.
|
||||
|
||||
To configure Surface Hub to use CB or CBB remotely using MDM, set an appropriate [Update/BranchReadinessLevel](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) policy.
|
||||
To configure Surface Hub to use CB or CBB remotely using MDM, set an appropriate [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) policy.
|
||||
|
||||
|
||||
### Configure when Surface Hub receives updates
|
||||
Once you've determined deployment rings for your Surface Hubs, configure update deferral policies for each ring:
|
||||
- To defer feature updates, set an appropriate [Update/DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) policy for each ring.
|
||||
- To defer quality updates, set an appropriate [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) policy for each ring.
|
||||
- To defer feature updates, set an appropriate [Update/DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) policy for each ring.
|
||||
- To defer quality updates, set an appropriate [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) policy for each ring.
|
||||
|
||||
> [!NOTE]
|
||||
> If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) and [Update/PauseQualityUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates).
|
||||
> If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) and [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates).
|
||||
|
||||
|
||||
## Use Windows Server Update Services
|
||||
@ -103,7 +103,7 @@ You can connect Surface Hub to your Windows Server Update Services (WSUS) server
|
||||
3. Navigate to **Update & security** > **Windows Update** > **Advanced options** > **Configure Windows Server Update Services (WSUS) server**.
|
||||
4. Click **Use WSUS Server to download updates** and type the URL of your WSUS server.
|
||||
|
||||
To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/UpdateServiceUrl](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) policy.
|
||||
To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) policy.
|
||||
|
||||
**If you use a proxy server or other method to block URLs**
|
||||
|
||||
@ -135,7 +135,7 @@ A default maintenance window is set for all new Surface Hubs:
|
||||
2. Navigate to **Update & security** > **Windows Update** > **Advanced options**.
|
||||
3. Under **Maintenance hours**, select **Change**.
|
||||
|
||||
To change the maintenance window using MDM, set the **MOMAgent** node in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/en-us/library/windows/hardware/mt608323.aspx). See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for more details.
|
||||
To change the maintenance window using MDM, set the **MOMAgent** node in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for more details.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -25,7 +25,7 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
```PowerShell
|
||||
Set-ExecutionPolicy Unrestricted
|
||||
$org='contoso.microsoft.com'
|
||||
$cred=Get-Credential $admin@$org
|
||||
$cred=Get-Credential admin@$org
|
||||
$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
|
||||
Import-PSSession $sess
|
||||
```
|
||||
@ -51,7 +51,7 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
|
||||
|
||||
```PowerShell
|
||||
$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
|
||||
$easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false -AllowNonProvisionableDevices $True
|
||||
```
|
||||
|
||||
Once you have a compatible policy, then you will need to apply the policy to the device account.
|
||||
@ -112,6 +112,7 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
Get-CsOnlineUser -Identity ‘alice@contoso.com’| fl *registrarpool*
|
||||
```
|
||||
OR by setting a variable
|
||||
|
||||
```PowerShell
|
||||
$strRegistrarPool = (Get-CsOnlineUser -Identity ‘alice@contoso.com’).RegistrarPool
|
||||
```
|
||||
@ -120,7 +121,11 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool yourRegistrarPool -SipAddressType EmailAddress
|
||||
```
|
||||
|
||||
OR using the $strRegistarPool variable from above
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool $strRegistrarPool -SipAddressType EmailAddress
|
||||
```
|
||||
|
||||
|
||||
@ -267,6 +267,9 @@ The current volume level is a range from 0 to 100.
|
||||
|
||||
Changes to volume levels can be sent by a room control system, or other system.
|
||||
|
||||
>[!NOTE]
|
||||
>The Volume command will only control the volume for embedded or Replacement PC mode, not from [Guest sources](connect-and-display-with-surface-hub.md).
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
|
||||
@ -6,6 +6,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: edu
|
||||
localizationpriority: high
|
||||
author: CelesteDG
|
||||
---
|
||||
|
||||
@ -29,8 +30,7 @@ author: CelesteDG
|
||||
<li><a href="https://technet.microsoft.com/en-us/windows/mt723345" target="_blank">Automate common Windows 10 deployment and configuration tasks</a></li>
|
||||
<li><a href="https://technet.microsoft.com/en-us/windows/mt723346" target="_blank">Deploy a custom Windows 10 Start menu</a></li>
|
||||
<li><a href="https://technet.microsoft.com/en-us/windows/mt723347" target="_blank">Manage Windows 10 updates and upgrades</a></li>
|
||||
<li><a href="https://technet.microsoft.com/en-us/windows/mt723344" target="_blank">Reprovision devices at the end of the school year</a></li>
|
||||
<li><a href="https://technet.microsoft.com/en-us/windows/mt723343" target="_blank">Use MDT to deploy Windows 10</a></li>
|
||||
<li><a href="https://technet.microsoft.com/en-us/windows/mt723344" target="_blank">Reprovision devices at the end of the school year</a></li> <li><a href="https://technet.microsoft.com/en-us/windows/mt723343" target="_blank">Use MDT to deploy Windows 10</a></li>
|
||||
<li><a href="https://technet.microsoft.com/en-us/windows/mt723348" target="_blank">Use Windows Store for Business</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
@ -57,20 +57,16 @@ author: CelesteDG
|
||||
<div class="side-by-side-content-right">
|
||||
<p><b><a href="https://technet.microsoft.com/en-us/windows/mt574244" target="_blank">Try it out: Windows 10 deployment (for education)</a></b><br />Learn how to upgrade devices running the Windows 7 operating system to Windows 10 Anniversary Update, and how to manage devices, apps, and users in Windows 10 Anniversary Update.<br /><br />For the best experience, use this guide in tandem with the <a href="https://vlabs.holsystems.com/vlabs/technet?eng=VLabs&auth=none&src=vlabs&altadd=true&labid=20949&lod=true" target="_blank">TechNet Virtual Lab: IT Pro Try-It-Out</a>.</p>
|
||||
</div>
|
||||
</div></div>
|
||||
</div></div>
|
||||
|
||||
###  Upgrade
|
||||
###  Upgrade
|
||||
|
||||
<div class="side-by-side"> <div class="side-by-side-content">
|
||||
<div class="side-by-side-content-left"><p><b>[Upgrade Windows 10 Pro to Pro Education from Windows Store for Business](windows-10-pro-to-pro-edu-upgrade.md)</b><br />If you have an education tenant and use Windows 10 Pro in your schools now, find out how you can opt-in to a free upgrade to Windows 10 Pro Education.</p></div>
|
||||
<<<<<<< HEAD
|
||||
<div class="side-by-side-content-right">
|
||||
<p></p>
|
||||
=======
|
||||
|
||||
<div class="side-by-side-content-right"><p></p>
|
||||
>>>>>>> e04a8c5905ed4bcb1df7b6b60d48146df9095a12
|
||||
</div>
|
||||
</div>
|
||||
</div></div>
|
||||
|
||||
## Windows 8.1
|
||||
Follow these links to find step-by-step guidance on how to deploy Windows 8.1 in an academic environment.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Create a provisioning package with multivariant settings (Windows 10)
|
||||
description: Create a provisioning package with multivariant settings to customize the provisioned settings.
|
||||
description: Create a provisioning package with multivariant settings to customize the provisioned settings for defined conditions.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -16,37 +16,31 @@ localizationpriority: high
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
Multivariant provisioning packages enable you to create a single provisioning package that can work for multiple locales.
|
||||
|
||||
To provision multivariant settings, you must create a provisioning package with defined **Conditions** and **Settings** that are tied to these conditions. When you install this package on a Windows 10 device, the provisioning engine applies the matching condition settings at every event and triggers provisioning.
|
||||
In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that will apply to devices set up for French and a different set of customization settings for devices set up for Japanese.
|
||||
|
||||
The following events trigger provisioning on Windows 10 devices:
|
||||
To provision multivariant settings, you use Windows Imaging and Configuration Designer (ICD) to create a provisioning package that contains all of the customization settings that you want to apply to any of your devices. Next, you manually edit the .XML file for that project to define each set of devices (a **Target**). For each **Target**, you specify at least one **Condition** with a value, which identifies the devices to receive the configuration. Finally, for each **Target**, you provide the customization settings to be applied to those devices.
|
||||
|
||||
| Event | Windows 10 Mobile | Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) |
|
||||
| --- | --- | --- |
|
||||
| System boot | Supported | Supported |
|
||||
| Operating system update | Supported | Planned |
|
||||
| Package installation during device first run experience | Supported | Supported |
|
||||
| Detection of SIM presence or update | Supported | Not supported |
|
||||
| Package installation at runtime | Supported | Supported |
|
||||
| Roaming detected | Supported | Not supported |
|
||||
Let's begin by learning how to define a **Target**.
|
||||
|
||||
## Target, TargetState, Condition, and priorities
|
||||
|
||||
Targets describe keying for a variant and must be described or pre-declared before being referenced by the variant.
|
||||
## Define a target
|
||||
|
||||
- You can define multiple **Target** child elements for each **Id** that you need for the customization setting.
|
||||
In the XML file, you provide an **Id**, or friendly name, for each **Target**. Each **Target** is defined by at least one **TargetState** which contains at least one **Condition**. A **Condition** element defines the matching type between the condition and the specified value.
|
||||
|
||||
- Within a **Target** you can define multiple **TargetState** elements.
|
||||
A **Target** can have more than one **TargetState**, and a **TargetState** can have more than one **Condition**.
|
||||
|
||||
- Within a **TargetState** element you can create multiple **Condition** elements.
|
||||
|
||||
|
||||
- A **Condition** element defines the matching type between the condition and the specified value.
|
||||
The following table describes the logic for the target definition.
|
||||
|
||||
The following table shows the conditions supported in Windows 10 provisioning:
|
||||
<table><tr><td>When all **Condition** elements are TRUE, **TargetState** is TRUE.</td><td></td></tr>
|
||||
<tr><td>If any of the **TargetState** elements is TRUE, **Target** is TRUE, and the **Id** can be used for setting customizations.</td><td></td></tr></table>
|
||||
|
||||
### Conditions
|
||||
|
||||
The following table shows the conditions supported in Windows 10 provisioning for a **TargetState**:
|
||||
|
||||
>[!NOTE]
|
||||
>You can use any of these supported conditions when defining your **TargetState**.
|
||||
|
||||
| Condition Name | Condition priority | Windows 10 Mobile | Windows 10 for desktop editions | Value type | Value description |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
@ -57,54 +51,47 @@ The following table shows the conditions supported in Windows 10 provisioning:
|
||||
| GID1 | P0 | Supported | N/A | Digit string | Use to target settings based on the Group Identifier (level 1) value. |
|
||||
| ICCID | P0 | Supported | N/A | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. |
|
||||
| Roaming | P0 | Supported | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (non-roaming). |
|
||||
| UICC | P0 | Supported | N/A | Enumeration | Use to specify the UICC state. Set the value to one of the following:</br></br></br>- 0 - Empty</br>- 1 - Ready</br>- 2 - Locked |
|
||||
| UICC | P0 | Supported | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of the following:</br></br></br>- 0 - Empty</br>- 1 - Ready</br>- 2 - Locked |
|
||||
| UICCSLOT | P0 | Supported | N/A | Digit string | Use to specify the UICC slot. Set the value one of the following:</br></br></br>- 0 - Slot 0</br>- 1 - Slot 1 |
|
||||
| ProcessorType | P1 | Supported | Supported | String | Use to target settings based on the processor type. |
|
||||
| ProcessorName | P1 | Supported | Supported | String | Use to target settings based on the processor name. |
|
||||
| AoAc | P1 | Supported | Supported | Boolean | Set the value to 0 or 1. |
|
||||
| PowerPlatformRole | P1 | Supported | Supported | Enumeration | Indicates the preferred power management profile. Set the value based on the POWER_PLATFORM_ROLE enumeration. |
|
||||
| AoAc ("Always On, Always Connected") | P1 | Supported | Supported | Boolean | Set the value to **0** (false) or **1** (true). If this condition is TRUE, the system supports the S0 low power idle model. |
|
||||
| PowerPlatformRole | P1 | Supported | Supported | Enumeration | Indicates the preferred power management profile. Set the value based on the [POWER_PLATFORM_ROLE enumeration](https://msdn.microsoft.com/library/windows/desktop/aa373174.aspx). |
|
||||
| Architecture | P1 | Supported | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. |
|
||||
| Server | P1 | Supported | Supported | Boolean | Set the value to 0 or 1. |
|
||||
| Region | P1 | Supported | Supported | Enumeration | Use to target settings based on country/region. |
|
||||
| Lang | P1 | Supported | Supported | Enumeration | Use to target settings based on language code. |
|
||||
| ROMLANG | P1 | Supported | N/A | Digit string | Use to specify the PhoneROMLanguage that's set for DeviceTargeting. This condition is used primarily to detect variants for China. For example, you can use this condition and set the value to "0804". |
|
||||
| Server | P1 | Supported | Supported | Boolean | Set the value to **0** (false) or **1** (true) to identify a server. |
|
||||
| Region | P1 | Supported | Supported | Enumeration | Use to target settings based on country/region, using the 2-digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). |
|
||||
| Lang | P1 | Supported | Supported | Enumeration | Use to target settings based on language code, using the 2-digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). |
|
||||
|
||||
|
||||
The matching types supported in Windows 10 are:
|
||||
|
||||
| Matching type | Syntax | Example |
|
||||
| --- | --- | --- |
|
||||
| Straight match | Matching type is specified as-is | <Condition Name="ProcessorName" Value="Barton" /> |
|
||||
| Regex match | Matching type is prefixed by "Pattern:" | <Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /> |
|
||||
| Regular expression (Regex) match | Matching type is prefixed by "Pattern:" | <Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /> |
|
||||
| Numeric range match | Matching type is prefixed by "!Range:" | <Condition Name="MNC" Value="!Range:400, 550" /> |
|
||||
|
||||
|
||||
- When all **Condition** elements are TRUE, **TargetState** is TRUE (**AND** logic).
|
||||
### TargetState priorities
|
||||
|
||||
- If any of the **TargetState** elements is TRUE, **Target** is TRUE (**OR** logic), and **Id** can be used for the setting customization.
|
||||
You can define more than one **TargetState** within a provisioning package to apply settings to devices that match device conditions. When the provisioning engine evalues each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the settings are applied, the system assigns a priority to every **TargetState**.
|
||||
|
||||
A setting that matches a **TargetState** with a lower priority is applied before the setting that matches a **TargetState** with a higher priority. This means that a setting for the **TargetState** with the higher priority can overwrite a setting for the **TargetState** with the lower priority.
|
||||
|
||||
You can define more than one **TargetState** within a provisioning package to apply variant settings that match device conditions. When the provisioning engine evalues each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the variant settings are applied, the system assigns a priority to every **TargetState**.
|
||||
Settings that match more than one **TargetState** with equal priority are applied according to the order that each **TargetState** is defined in the provisioning package.
|
||||
|
||||
A variant setting that matches a **TargetState** with a lower priority is applied before the variant that matches a **TargetState** with a higher priority. Variant settings that match more than one **TargetState** with equal priority are applied according to the order that each **TargetState** is defined in the provisioning package.
|
||||
The **TargetState** priority is assigned based on the condition's priority (see the [Conditions table](#conditions) for priorities). The priority evaluation rules are as followed:
|
||||
|
||||
The **TargetState** priority is assigned based on the conditions priority and the priority evaluation rules are as followed:
|
||||
1. A **TargetState** with P0 conditions is higher than a **TargetState** without P0 conditions.
|
||||
|
||||
1. **TargetState** with P0 conditions is higher than **TargetState** without P0 conditions.
|
||||
2. A **TargetState** with both P0 and P1 conditions is higher than a **TargetState** with only P0 conditions.
|
||||
|
||||
2. A **TargetState** with a greater number of matched P0 conditions is higher than **TargetState** with fewer matched P0 conditions, regardless of the number of P1 conditions matched.
|
||||
|
||||
2. **TargetState** with P1 conditions is higher than **TargetState** without P0 and P1 conditions.
|
||||
2. If the number of P0 conditions matched are equivalent, then the **TargetState** with the most matched P1 conditions has higher priority.
|
||||
|
||||
3. If both P0 and P1 conditions are equally matched, then the **TargetState** with the greatest total number of matched conditions has highest priority.
|
||||
|
||||
3. If N₁>N₂>0, the **TargetState** priority with N₁ P0 conditions is higher than the **TargetState** with N₂ P1 conditions.
|
||||
|
||||
|
||||
4. For **TargetState** without P0 conditions, if N₁>N₂>0 **TargetState** with N₁ P1 conditions is higher than the **TargetState** with N₂ P1 conditions.
|
||||
|
||||
|
||||
5. For **TargetState** without P0 and P1 conditions, if N₁>N₂>0 **TargetState** priority with N₁ P2 conditions is higher than the **TargetState** with N₂ P2 conditions.
|
||||
|
||||
|
||||
6. For rules 3, 4, and 5, if N₁=N₂, **TargetState** priorities are considered equal.
|
||||
|
||||
|
||||
## Create a provisioning package with multivariant settings
|
||||
@ -112,17 +99,15 @@ The **TargetState** priority is assigned based on the conditions priority and th
|
||||
Follow these steps to create a provisioning package with multivariant capabilities.
|
||||
|
||||
|
||||
1. Build a provisioning package and configure the customizations you need to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md).
|
||||
|
||||
1. Build a provisioning package and configure the customizations you want to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md).
|
||||
|
||||
2. After you've [configured the settings](provisioning-create-package.md#configure-settings), save the project.
|
||||
|
||||
|
||||
3. Open the project folder and copy the customizations.xml file.
|
||||
3. Open the project folder and copy the customizations.xml file to any local location.
|
||||
|
||||
4. Use an XML or text editor to open the customizations.xml file.
|
||||
|
||||
The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The Customizations node contains a Common section, which contains the customization settings.
|
||||
The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The **Customizations** node of the file contains a **Common** section, which contains the customization settings.
|
||||
|
||||
The following example shows the contents of a sample customizations.xml file.
|
||||
|
||||
@ -153,7 +138,7 @@ Follow these steps to create a provisioning package with multivariant capabiliti
|
||||
</WindowsCustomizatons>
|
||||
```
|
||||
|
||||
4. Edit the customizations.xml file and create a **Targets** section to describe the conditions that will handle your multivariant settings.
|
||||
4. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings.
|
||||
|
||||
The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**.
|
||||
|
||||
@ -210,10 +195,10 @@ Follow these steps to create a provisioning package with multivariant capabiliti
|
||||
|
||||
c. Move compliant settings from the **Common** section to the **Variant** section.
|
||||
|
||||
If any of the TargetRef elements matches the Target, all settings in the Variant are applied (OR logic).
|
||||
If any of the **TargetRef** elements matches the **Target**, all settings in the **Variant** are applied.
|
||||
|
||||
>[!NOTE]
|
||||
>You can define multiple Variant sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event.
|
||||
>You can define multiple **Variant** sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event.
|
||||
|
||||
The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met.
|
||||
|
||||
@ -289,7 +274,20 @@ In this example, the **StoreFile** corresponds to the location of the settings s
|
||||
|
||||
|
||||
|
||||
## Events that trigger provisioning
|
||||
|
||||
When you install the multivariant provisioning package on a Windows 10 device, the provisioning engine applies the matching condition settings at every event and triggers provisioning.
|
||||
|
||||
The following events trigger provisioning on Windows 10 devices:
|
||||
|
||||
| Event | Windows 10 Mobile | Windows 10 for desktop editions |
|
||||
| --- | --- | --- |
|
||||
| System boot | Supported | Supported |
|
||||
| Operating system update | Supported | Planned |
|
||||
| Package installation during device first run experience | Supported | Supported |
|
||||
| Detection of SIM presence or update | Supported | Supported |
|
||||
| Package installation at runtime | Supported | Supported |
|
||||
| Roaming detected | Supported | Not supported |
|
||||
|
||||
|
||||
|
||||
|
||||
@ -572,7 +572,7 @@
|
||||
###### [Domain member: Maximum machine account password age](domain-member-maximum-machine-account-password-age.md)
|
||||
###### [Domain member: Require strong (Windows 2000 or later) session key](domain-member-require-strong-windows-2000-or-later-session-key.md)
|
||||
###### [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md)
|
||||
###### [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md)
|
||||
###### [Interactive logon: Don\'t display last signed-in](interactive-logon-do-not-display-last-user-name.md)
|
||||
###### [Interactive logon: Do not require CTRL+ALT+DEL](interactive-logon-do-not-require-ctrl-alt-del.md)
|
||||
###### [Interactive logon: Machine account lockout threshold](interactive-logon-machine-account-lockout-threshold.md)
|
||||
###### [Interactive logon: Machine inactivity limit](interactive-logon-machine-inactivity-limit.md)
|
||||
@ -772,6 +772,13 @@
|
||||
##### [Configure an Azure Active Directory application for SIEM integration](configure-aad-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure Splunk to consume Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure HP ArcSight to consume Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
#### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md)
|
||||
##### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md)
|
||||
##### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
##### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
#### [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md)
|
||||
##### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
###### [Inactive machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
|
||||
|
||||
@ -13,6 +13,13 @@ author: brianlic-msft
|
||||
This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
|
||||
|
||||
|
||||
## March 2017
|
||||
|New or changed topic |Description |
|
||||
|---------------------|------------|
|
||||
|[Protect derived domain credentials with Credential Guard](credential-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.|
|
||||
|[Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.|
|
||||
|
||||
|
||||
## January 2017
|
||||
|New or changed topic |Description |
|
||||
|---------------------|------------|
|
||||
|
||||
@ -24,7 +24,7 @@ $alertDefinitions =
|
||||
(Invoke-RestMethod ("{0}AlertDefinitions" -f $apiBaseUrl) -Method Get -Headers $headers).value
|
||||
|
||||
$alertDefinitionPayload = @{
|
||||
"Name"= "The Alert's Name"
|
||||
"Name"= "The alert's name"
|
||||
"Severity"= "Low"
|
||||
"InternalDescription"= "An internal description of the Alert"
|
||||
"Title"= "The Title"
|
||||
|
||||
@ -45,9 +45,7 @@ You can use System Center Configuration Manager’s existing functionality to cr
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOnboardingScript.cmd*.
|
||||
|
||||
3. Onboard your devices using SCCM by following the steps in the [Onboard devices to Windows Defender ATP](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/windows-defender-advanced-threat-protection#onboard-devices-for-windows-defender-atp) topic.
|
||||
|
||||
4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic.
|
||||
3. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic.
|
||||
|
||||
a. Choose a predefined device collection to deploy the package to.
|
||||
|
||||
|
||||
@ -46,6 +46,7 @@ For Credential Guard to provide protections, the computers you are protecting mu
|
||||
|
||||
To provide basic protection against OS level attempts to read Credential Manager domain credentials, NTLM and Kerberos derived credentials, Credential Manager uses:
|
||||
- Support for Virtualization-based security (required)
|
||||
- Secure boot (required)
|
||||
- TPM 2.0 either discrete or firmware (preferred - provides binding to hardware)
|
||||
- UEFI lock (preferred - prevents attacker from disabling with a simple registry key change)
|
||||
|
||||
@ -85,7 +86,7 @@ Computers that meet additional qualifications can provide additional protections
|
||||
The following tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017.
|
||||
|
||||
> [!NOTE]
|
||||
> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new computers. <br>
|
||||
> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new shipping computers. <br>
|
||||
> If you are an OEM, see [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).<br>
|
||||
|
||||
#### Baseline protections
|
||||
@ -94,7 +95,7 @@ The following tables describe baseline protections, plus protections for improve
|
||||
|---------------------------------------------|----------------------------------------------------|
|
||||
| Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. |
|
||||
| Hardware: **CPU virtualization extensions**,<br>plus **extended page tables** | **Requirements**: These hardware features are required for VBS:<br>One of the following virtualization extensions:<br>• VT-x (Intel) or<br>• AMD-V<br>And:<br>• Extended page tables, also called Second Level Address Translation (SLAT).<br><br>**Security benefits**: VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. |
|
||||
| Hardware: **Trusted Platform Module (TPM)** | **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.<br><br>**Security benefits**: A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. |
|
||||
| Hardware: **Trusted Platform Module (TPM)** | **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.<br>[TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations)<br><br>**Security benefits**: A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. |
|
||||
| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)<br><br>**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
|
||||
| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).<br><br>**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise<br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.</p></blockquote><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. |
|
||||
|
||||
@ -11,7 +11,7 @@ author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# Create custom alerts using the threat intelligence (TI) Application program interface (API)
|
||||
# Create custom alerts using the threat intelligence (TI) application program interface (API)
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -23,12 +23,12 @@ localizationpriority: high
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
|
||||
You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to create specific alerts that are applicable to your organization.
|
||||
You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to generate specific alerts that are applicable to your organization.
|
||||
|
||||
## Before you begin
|
||||
Before creating custom alerts, you'll need to enable the threat intelligence application in Azure Active Directory and generate access tokens. For more information, see [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
### Use the threat intelligence REST APIs to create custom threat intelligence alerts
|
||||
### Use the threat intelligence REST API to create custom threat intelligence alerts
|
||||
You can call and specify the resource URLs using one of the following operations to access and manipulate a threat intelligence resource, you call and specify the resource URLs using one of the following operations:
|
||||
|
||||
- GET
|
||||
|
||||
@ -60,7 +60,7 @@ If you took corrective actions and the machine status is still misconfigured, [o
|
||||
|
||||
### No sensor data
|
||||
A misconfigured machine with status ‘No sensor data’ has communication with the service but can only report partial sensor data.
|
||||
Follow theses actions to correct known issues related to a misconfigured machine with status ‘Impaired communication’:
|
||||
Follow theses actions to correct known issues related to a misconfigured machine with status ‘No sensor data’:
|
||||
|
||||
- [Ensure the endpoint has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-endpoint-has-an-internet-connection)</br>
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
@ -14,7 +14,7 @@ localizationpriority: high
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
TWindows Hello for Business requires a registered device. When the device is set up, its user can use the device to authenticate to services. This topic explains how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process.
|
||||
Windows Hello for Business requires a registered device. When the device is set up, its user can use the device to authenticate to services. This topic explains how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process.
|
||||
|
||||
## Register a new user or device
|
||||
|
||||
|
||||
Binary file not shown.
Binary file not shown.
|
After Width: | Height: | Size: 4.9 KiB |
@ -17,31 +17,80 @@ author: brianlic-msft
|
||||
Describes the best practices, location, values, and security considerations for the **Interactive logon: Display user information when the session is locked** security policy setting.
|
||||
|
||||
## Reference
|
||||
When a session is locked in a Windows operating system (meaning the user at the computer pressed CTRL+ALT+DEL and the Secure Desktop is displayed), user information is displayed. By default, this information is in the form of **<user name> is logged on**. The displayed user name is the user’s full name as set on the Properties page for that user. These settings do not apply to the logon tiles, which are displayed on the desktop after using the **Switch User** feature. The information that is displayed can be changed to meet your security requirements using the following possible values.
|
||||
This security setting controls whether details such as email address or domain\username appear with the username on the sign-in screen.
|
||||
For clients that run Windows 10 version 1511 and 1507 (RTM), this setting works similarly to previous versions of Windows.
|
||||
However, because of a new **Privacy** setting introduced in Windows 10 version 1607, this security setting affects those clients differently.
|
||||
|
||||
### Possible values
|
||||
### Changes in Windows 10 version 1607
|
||||
|
||||
Beginning with Windows 10 version 1607, new functionality was added to Windows 10 to hide username details such as email address by default, with the ability to change the default to show the details.
|
||||
This functionality is controlled by a new **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**.
|
||||
The Privacy setting is off by default, which hides the details.
|
||||
|
||||
|
||||
|
||||
The **Interactive logon: Display user information when the session is locked** Group Policy setting controls the same functionality.
|
||||
|
||||
This setting has these possible values:
|
||||
|
||||
- **User display name, domain and user names**
|
||||
|
||||
If this is a local logon, the user’s full name is displayed on the Secure Desktop. If it is a domain logon, the user’s domain and user’s account name is displayed.
|
||||
For a local logon, the user's full name is displayed.
|
||||
If the user signed in using a Microsoft account, the user's email address is displayed.
|
||||
For a domain logon, the domain\username is displayed.
|
||||
This has the same effect as turning on the **Privacy** setting.
|
||||
|
||||
- **User display name only**
|
||||
|
||||
The name of the user who locked the session is displayed on the Secure Desktop as the user’s full name.
|
||||
The full name of the user who locked the session is displayed.
|
||||
This has the same effect as turning off the **Privacy** setting.
|
||||
|
||||
- **Do not display user information**
|
||||
|
||||
No names are displayed on the Secure Desktop, but user’s full names will be displayed on the **Switch user** desktop.
|
||||
No names are displayed.
|
||||
Beginning with Windows 10 version 1607, this option is not supported.
|
||||
If this option is chosen, the full name of the user who locked the session is displayed instead.
|
||||
This change makes this setting consistent with the functionality of the new **Privacy** setting.
|
||||
To display no user information, enable the Group Policy setting **Interactive logon: Don't display last signed-in**.
|
||||
|
||||
- Blank.
|
||||
|
||||
Default setting. This translates to “Not defined,” but it will display the user’s full name in the same manner as the **User display name** option. When an option is set, you cannot reset this policy to blank, or not defined.
|
||||
Default setting.
|
||||
This translates to “Not defined,” but it will display the user’s full name in the same manner as the option **User display name only**.
|
||||
When an option is set, you cannot reset this policy to blank, or not defined.
|
||||
|
||||
### Hotfix for Windows 10 version 1607
|
||||
|
||||
Clients that run Windows 10 version 1607 will not show details on the sign-in screen even if the **User display name, domain and user names** option is chosen because the **Privacy** setting is off.
|
||||
If the **Privacy** setting is turned on, details will show.
|
||||
|
||||
The **Privacy** setting cannot be changed for clients in bulk.
|
||||
Instead, apply KB 4013429 to clients that run Windows 10 version 1607 so they behave similarly to previous versions of Windows.
|
||||
|
||||
There are related Group Policy settings:
|
||||
|
||||
- **Computer Configuration\Policies\Administrative Templates\System\Logon\Block user from showing account details on sign-in** prevents users from showing account details on the sign-in screen.
|
||||
- **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Don’t display last signed-in** prevents the username of the last user to sign in from being shown.
|
||||
- **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Don’t display username at sign-in** prevents the username from being shown at Windows sign-in and immediately after credentials are entered and before the desktop appears.
|
||||
|
||||
### Interaction with related Group Policy settings
|
||||
|
||||
For all versions of Windows 10, only the user display name is shown by default.
|
||||
|
||||
If **Block user from showing account details on sign-in** is enabled, then only the user display name is shown regardless of any other Group Policy settings.
|
||||
Users will not be able to show details.
|
||||
|
||||
If **Block user from showing account details on sign-in** is not enabled, then you can set **Interactive logon: Display user information when the session is locked** to **User display name, domain and user names** to show additional details such as domain\username.
|
||||
In this case, clients that run Windows 10 version 1607 need KB 4013429 applied.
|
||||
Users will not be able to hide additional details.
|
||||
|
||||
If **Block user from showing account details on sign-in** is not enabled and **Don’t display last signed-in** is enabled, the username will not be shown.
|
||||
|
||||
### Best practices
|
||||
|
||||
Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have computers with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy.
|
||||
Your implementation of this policy depends on your security requirements for displayed logon information. If you run computers that store sensitive data, with monitors displayed in unsecured locations, or if you have computers with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy.
|
||||
|
||||
Depending on your security policy, you might also want to enable the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy, which will prevent the Windows operating system from displaying the logon name and logon tile of the last user to logon.
|
||||
Depending on your security policy, you might also want to enable the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy.
|
||||
|
||||
### Location
|
||||
|
||||
@ -86,13 +135,7 @@ When a computer displays the Secure Desktop in an unsecured area, certain user i
|
||||
|
||||
Enabling this policy setting allows the operating system to hide certain user information from being displayed on the Secure Desktop (after the device has been booted or when the session has been locked by using CTRL+ALT+DEL). However, user information is displayed if the **Switch user** feature is used so that the logon tiles are displayed for each logged on user.
|
||||
|
||||
You might also want to enable the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy, which will prevent the Windows operating system from displaying the logon name and logon tile of the last user to logon.
|
||||
|
||||
### Potential impact
|
||||
|
||||
If you do not enable this policy, the effect will be the same as enabling the policy and selecting the **User display name, domain and user names** option.
|
||||
|
||||
If the policy is enabled and set to **Do not display user information**, an observer cannot see who is logged onto the Secure Desktop, but the logon tile is still present if the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy is not enabled. Depending on how the logon tiles are configured, they could provide visual clues as to who is logged on. In addition, if the Interactive logon: Do not display last user name policy is not enabled, then the **Switch user** feature will show user information.
|
||||
You might also want to enable the [Interactive logon: Do not display last signed-in](interactive-logon-do-not-display-last-user-name.md) policy, which will prevent the Windows operating system from displaying the logon name and logon tile of the last user to logon.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Interactive logon Do not display last user name (Windows 10)
|
||||
title: Interactive logon Don't display last signed-in (Windows 10)
|
||||
description: Describes the best practices, location, values, and security considerations for the Interactive logon Do not display last user name security policy setting.
|
||||
ms.assetid: 98b24b03-95fe-4edc-8e97-cbdaa8e314fd
|
||||
ms.prod: w10
|
||||
@ -9,12 +9,12 @@ ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Interactive logon: Do not display last user name
|
||||
# Interactive logon: Don't display last signed-in
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
Describes the best practices, location, values, and security considerations for the **Interactive logon: Do not display last user name** security policy setting.
|
||||
Describes the best practices, location, values, and security considerations for the **Interactive logon: Don't display last signed-in** security policy setting. Before Windows 10 version 1703, this policy setting was named **Interactive logon:Do not display last user name.**
|
||||
|
||||
## Reference
|
||||
|
||||
|
||||
@ -47,5 +47,7 @@ The following features are included in the preview release:
|
||||
- [Check sensor health state](check-sensor-status-windows-defender-advanced-threat-protection.md) - Check an endpoint's ability to provide sensor data and communicate with the Windows Defender ATP service and fix known issues.
|
||||
- [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
- [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) - Create custom threat intelligence alerts using the threat intelligence API to generate alerts that are applicable to your organization.
|
||||
|
||||
>[!NOTE]
|
||||
> All response actions require machines to be on the latest Windows 10 Insider Preview build.
|
||||
|
||||
@ -71,7 +71,7 @@ You can now use the alert ID obtained from creating a new alert definition to cr
|
||||
## Complete code
|
||||
You can use the complete code to create calls to the API.
|
||||
|
||||
[!code[CustomTIAPI](./code/example.py#L1-L51)]
|
||||
[!code[CustomTIAPI](./code/example.py#L1-L53)]
|
||||
|
||||
## Related topics
|
||||
- [Understand threat intelligence](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -38,6 +38,7 @@ For encrypting Remote Desktop Services network communication, this policy settin
|
||||
|
||||
For BitLocker, this policy setting needs to be enabled before any encryption key is generated.
|
||||
Recovery passwords created on Windows Server 2012 R2 and Windows 8.1 and later when this policy is enabled are incompatible with BitLocker on operating systems prior to Windows Server 2012 R2 and Windows 8.1; BitLocker will prevent the creation or use of recovery passwords on these systems, so recovery keys should be used instead.
|
||||
Additionally, if a data drive is password-protected, it can be accessed by a FIPS-compliant computer after the password is supplied, but the drive will be read-only.
|
||||
|
||||
### Possible values
|
||||
|
||||
|
||||
@ -47,7 +47,7 @@ Here is an example of an IOC:
|
||||
|
||||
IOCs have a many-to-one relationship with alert definitions such that an alert definition can have many IOCs that correspond to it.
|
||||
|
||||
## Related topic
|
||||
## Related topics
|
||||
- [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
- [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md)
|
||||
- [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
---
|
||||
title: Use the threat intelligence API in Windows Defender Advanced Threat Protection to create custom alerts
|
||||
description: Use the custom threat intelligence API to create custom alerts for your organization.
|
||||
keywords: threat intelligence, alert definitions, indicators of compromise
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# Use the threat intelligence API to create custom alerts
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10 Enterprise
|
||||
- Windows 10 Education
|
||||
- Windows 10 Pro
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
|
||||
Understand threat intelligence concepts, then enable the custom threat intelligence application so that you can proceed to create custom threat intelligence alerts that are specific to your organization.
|
||||
|
||||
You can use the code examples to guide you in creating calls to the custom threat intelligence API.
|
||||
|
||||
## In this section
|
||||
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) | Understand the concepts around threat intelligence so that you can effectively create custom intelligence for your organization.
|
||||
[Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) | Set up the custom threat intelligence application through the Windows Defender ATP portal so that you can create custom threat intelligence (TI) using REST API.
|
||||
[Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) | Create custom threat intelligence alerts so that you can generate specific alerts that are applicable to your organization.
|
||||
[PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) | Use the PowerShell code examples to guide you in using the custom threat intelligence API.
|
||||
[Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) | Use the Python code examples to guide you in using the custom threat intelligence API.
|
||||
[Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) | Learn how to address possible issues you might encounter while using the threat intelligence API.
|
||||
@ -3,11 +3,12 @@
|
||||
## [Cortana integration in your business or enterprise](cortana-at-work-overview.md)
|
||||
### [Testing scenarios using Cortana in your business or organization](cortana-at-work-testing-scenarios.md)
|
||||
#### [Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook](cortana-at-work-scenario-1.md)
|
||||
#### [Test scenario 2 - Test scenario 2 - Perform a quick search with Cortana at work](cortana-at-work-scenario-2.md)
|
||||
#### [Test scenario 2 - Perform a quick search with Cortana at work](cortana-at-work-scenario-2.md)
|
||||
#### [Test scenario 3 - Set a reminder for a specific location using Cortana at work](cortana-at-work-scenario-3.md)
|
||||
#### [Test scenario 4 - Use Cortana at work to find your upcoming meetings](cortana-at-work-scenario-4.md)
|
||||
#### [Test scenario 5 - Use Cortana to send email to a co-worker](cortana-at-work-scenario-5.md)
|
||||
#### [Test scenario 6 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device](cortana-at-work-scenario-6.md)
|
||||
#### [Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email](cortana-at-work-scenario-6.md)
|
||||
#### [Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device](cortana-at-work-scenario-7.md)
|
||||
### [Set up and test Cortana with Office 365 in your organization](cortana-at-work-o365.md)
|
||||
### [Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization](cortana-at-work-crm.md)
|
||||
### [Set up and test Cortana for Power BI in your organization](cortana-at-work-powerbi.md)
|
||||
|
||||
@ -14,6 +14,12 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in
|
||||
|
||||
>If you're looking for **update history** for Windows 10, see [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/help/12387/windows-10-update-history).
|
||||
|
||||
## March 2017
|
||||
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
|[Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email](cortana-at-work-scenario-6.md) |New |
|
||||
|
||||
## February 2017
|
||||
|
||||
| New or changed topic | Description |
|
||||
@ -26,11 +32,12 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in
|
||||
| [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | Added Express updates. |
|
||||
| [Distribute offline apps](distribute-offline-apps.md) | General updates to topic. Added links to supporting content for System Center Configuration Manager and Microsoft Intune. |
|
||||
|
||||
|
||||
## January 2017
|
||||
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
| [Cortana integration in your business or enterprise](cortana-at-work-overview.md) | New |
|
||||
| [Cortana integration in your business or enterprise and sub-topics](cortana-at-work-overview.md) |New |
|
||||
| [Start layout XML for desktop editions of Windows 10](start-layout-xml-desktop.md) | New (previously published in Hardware Dev Center on MSDN) |
|
||||
| [Start layout XML for mobile editions of Windows 10](start-layout-xml-mobile.md) | New (previously published in Hardware Dev Center on MSDN) |
|
||||
| [Quick guide to Windows as a service](waas-quick-start.md) | Added video that explains how Windows as a service works. |
|
||||
|
||||
@ -98,17 +98,17 @@ Windows telemetry also helps Microsoft better understand how customers use (or d
|
||||
|
||||
### Insights into your own organization
|
||||
|
||||
Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better, as well. Microsoft is in the process of developing a set of analytics customized for your internal use. The first of these, called [Windows 10 Upgrade Analytics](../deploy/manage-windows-upgrades-with-upgrade-analytics.md).
|
||||
Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better, as well. Microsoft is in the process of developing a set of analytics customized for your internal use. The first of these, called [Upgrade Readiness](../deploy/manage-windows-upgrades-with-upgrade-readiness.md).
|
||||
|
||||
#### Windows 10 Upgrade Analytics
|
||||
#### Upgrade Readiness
|
||||
|
||||
Upgrading to new operating system versions has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points.
|
||||
|
||||
To better help customers through this difficult process, Microsoft developed Upgrade Analytics to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis.
|
||||
To better help customers through this difficult process, Microsoft developed Upgrade Readiness to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis.
|
||||
|
||||
With Windows telemetry enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft.
|
||||
|
||||
Use Upgrade Analytics to get:
|
||||
Use Upgrade Readiness to get:
|
||||
|
||||
- A visual workflow that guides you from pilot to production
|
||||
- Detailed computer, driver, and application inventory
|
||||
@ -118,7 +118,7 @@ Use Upgrade Analytics to get:
|
||||
- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
|
||||
- Data export to commonly used software deployment tools
|
||||
|
||||
The Upgrade Analytics workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
|
||||
The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
|
||||
|
||||
## How is telemetry data handled by Microsoft?
|
||||
|
||||
@ -179,7 +179,7 @@ The levels are cumulative and are illustrated in the following diagram. Also, th
|
||||
|
||||
### Security level
|
||||
|
||||
The Security level gathers only the telemetry info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windos IoT Core editions.
|
||||
The Security level gathers only the telemetry info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions.
|
||||
|
||||
> [!NOTE]
|
||||
> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.
|
||||
@ -216,6 +216,8 @@ No user content, such as user files or communications, is gathered at the **Secu
|
||||
|
||||
The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a particular hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. The Connected User Experience and Telemetry component does not gather telemetry data about System Center, but it can transmit telemetry for other non-Windows applications if they have user consent.
|
||||
|
||||
The normal upload range for the Basic telemetry level is between 109 KB - 159 KB per day, per device.
|
||||
|
||||
The data gathered at this level includes:
|
||||
|
||||
- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Server 2016 in the ecosystem. Examples include:
|
||||
@ -256,12 +258,15 @@ The data gathered at this level includes:
|
||||
|
||||
- **Windows Store**. Provides information about how the Windows Store performs, including app downloads, installations, and updates. It also includes Windows Store launches, page views, suspend and resumes, and obtaining licenses.
|
||||
|
||||
|
||||
### Enhanced level
|
||||
|
||||
The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements.
|
||||
|
||||
This is the default level for Windows 10 Enterprise and Windows 10 Education editions, and the minimum level needed to quickly identify and address Windows, Windows Server, and System Center quality issues.
|
||||
|
||||
The normal upload range for the Enhanced telemetry level is between 239 KB - 348 KB per day, per device.
|
||||
|
||||
The data gathered at this level includes:
|
||||
|
||||
- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components.
|
||||
|
||||
@ -1,13 +1,14 @@
|
||||
---
|
||||
title: Test scenario 6 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device (Windows 10)
|
||||
description: An optional test scenario about how to use Cortana at work with Windows Information Protection (WIP).
|
||||
title: Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email (Windows 10)
|
||||
description: A test scenario about how to use Cortana with the Suggested reminders feature.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# Test scenario 6 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device
|
||||
# Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email
|
||||
|
||||
- Windows 10, Windows Insider Program
|
||||
- Windows 10 Mobile, Windows Insider Program
|
||||
@ -16,22 +17,32 @@ localizationpriority: high
|
||||
>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering.
|
||||
>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement).
|
||||
|
||||
This optional scenario helps you to protect your organization’s data on a device, based on an inspection by Cortana.
|
||||
Cortana automatically finds patterns in your email, suggesting reminders based things that you said you would do so you don’t forget about them. For example, Cortana recognizes that if you include the text, _I’ll get this to you by the end of the week_ in an email, you're making a commitment to provide something by a specific date. Cortana can now suggest that you be reminded about this event, letting you decide whether to keep it or to cancel it.
|
||||
|
||||
## Use Cortana and WIP to protect your organization’s data
|
||||
>[!NOTE]
|
||||
>The Suggested reminders feature is currently only available in English (en-us).
|
||||
|
||||
1. Create and deploy an WIP policy to your organization. For info about how to do this, see [Protect your enterprise data using Windows Information Protection (WIP)](../keep-secure/protect-enterprise-data-using-wip.md).
|
||||
**To use Cortana to create Suggested reminders for you**
|
||||
|
||||
2. Create a new email from a non-protected or personal mailbox, including the text _I’ll send you that presentation tomorrow_.
|
||||
1. Make sure that you've connected Cortana to Office 365. For the steps to connect, see [Set up and test Cortana with Office 365 in your organization](cortana-at-work-o365.md).
|
||||
|
||||
3. Wait up to 2 hours to make sure everything has updated, click the **Cortana** icon in the taskbar, and then click in the **Search** bar.
|
||||
2. Click on the **Cortana** search box in the taskbar, click the **Notebook** icon, and then click **Permissions**.
|
||||
|
||||
Cortana automatically pulls your commitment to sending the presentation out of your email, showing it to you.
|
||||
3. Make sure the **Contacts, email, calendar, and communication history** option is turned on.
|
||||
|
||||
4. Create a new email from a protected mailbox, including the same text as above, _I’ll send you that presentation tomorrow_.
|
||||
|
||||
|
||||
5. Wait until everything has updated again, click the **Cortana** icon in the taskbar, and then click in the **Search** bar.
|
||||
4. Click the **Notebook** icon again, click the **Suggested reminders** option, click to turn on the **All reminder suggestions cards** option, click the **Notify me when something I mentioned doing is coming up** box, and then click **Save**.
|
||||
|
||||
|
||||
|
||||
5. Create and send an email to yourself (so you can see the Suggested reminder), including the text, _I’ll finish this project by end of day today_.
|
||||
|
||||
6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events.
|
||||
|
||||
If the reminder has a specific date or time associated with it, like end of day, Cortana notifies you at the appropriate time and puts the reminder into the Action Center. Also from the Home screen, you can view the email where you made the promise, set aside time on your calendar, officially set the reminder, or mark the reminder as completed.
|
||||
|
||||
|
||||
|
||||
Because it was in an WIP-protected email, the presentation info isn’t pulled out and it isn’t shown to you.
|
||||
|
||||
38
windows/manage/cortana-at-work-scenario-7.md
Normal file
38
windows/manage/cortana-at-work-scenario-7.md
Normal file
@ -0,0 +1,38 @@
|
||||
---
|
||||
title: Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device (Windows 10)
|
||||
description: An optional test scenario about how to use Cortana at work with Windows Information Protection (WIP).
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device
|
||||
|
||||
- Windows 10, Windows Insider Program
|
||||
- Windows 10 Mobile, Windows Insider Program
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering.
|
||||
|
||||
This optional scenario helps you to protect your organization’s data on a device, based on an inspection by Cortana.
|
||||
|
||||
## Use Cortana and WIP to protect your organization’s data
|
||||
|
||||
1. Create and deploy an WIP policy to your organization. For info about how to do this, see [Protect your enterprise data using Windows Information Protection (WIP)](../keep-secure/protect-enterprise-data-using-wip.md).
|
||||
|
||||
2. Create a new email from a non-protected or personal mailbox, including the text _I’ll send you that presentation tomorrow_.
|
||||
|
||||
3. Wait up to 2 hours to make sure everything has updated, click the **Cortana** icon in the taskbar, and then click in the **Search** bar.
|
||||
|
||||
Cortana automatically pulls your commitment to sending the presentation out of your email, showing it to you.
|
||||
|
||||
4. Create a new email from a protected mailbox, including the same text as above, _I’ll send you that presentation tomorrow_.
|
||||
|
||||
5. Wait until everything has updated again, click the **Cortana** icon in the taskbar, and then click in the **Search** bar.
|
||||
|
||||
Because it was in an WIP-protected email, the presentation info isn’t pulled out and it isn’t shown to you.
|
||||
@ -18,15 +18,19 @@ localizationpriority: high
|
||||
|
||||
We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to:
|
||||
|
||||
- Sign-in to Cortana using Azure AD, manage entries in the notebook, and search for content across your device, Bing, and the cloud, using Cortana.
|
||||
- [Sign-in to Cortana using Azure AD, manage entries in the notebook, and search for content across your device, Bing, and the cloud, using Cortana](cortana-at-work-scenario-1.md)
|
||||
|
||||
- Set a reminder and have it remind you when you’ve reached a specific location.
|
||||
- [Perform a quick search with Cortana at work](cortana-at-work-scenario-2.md)
|
||||
|
||||
- Search for your upcoming meetings on your work calendar.
|
||||
- [Set a reminder and have it remind you when you’ve reached a specific location](cortana-at-work-scenario-3.md)
|
||||
|
||||
- Send an email to a co-worker from your work email app.
|
||||
- [Search for your upcoming meetings on your work calendar](cortana-at-work-scenario-4.md)
|
||||
|
||||
- Use WIP to secure content on a device and then try to manage your organization’s entries in the notebook.
|
||||
- [Send an email to a co-worker from your work email app](cortana-at-work-scenario-5.md)
|
||||
|
||||
- [Review a reminder suggested by Cortana based on what you’ve promised in email](cortana-at-work-scenario-6.md)
|
||||
|
||||
- [Use Windows Information Protection (WIP) to secure content on a device and then try to manage your organization’s entries in the notebook](cortana-at-work-scenario-7.md)
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering.
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 46 KiB |
BIN
windows/manage/images/cortana-suggested-reminder-settings.png
Normal file
BIN
windows/manage/images/cortana-suggested-reminder-settings.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 55 KiB |
BIN
windows/manage/images/cortana-suggested-reminder.png
Normal file
BIN
windows/manage/images/cortana-suggested-reminder.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 21 KiB |
@ -224,7 +224,7 @@ The following example shows how to create a tile of the Web site's URL using the
|
||||
Column="4"/>
|
||||
```
|
||||
|
||||
The following table describes the other attributes that you can use with the **start:SecondaryTile** tag in addition to *8Size**, **Row**, and *8Column**.
|
||||
The following table describes the other attributes that you can use with the **start:SecondaryTile** tag in addition to **Size**, **Row**, and **Column**.
|
||||
|
||||
| Attribute | Required/optional | Description |
|
||||
| --- | --- | --- |
|
||||
|
||||
@ -99,6 +99,8 @@ Download mode dictates which download sources clients are allowed to use when do
|
||||
By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and AD DS site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or AD DS site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to peer. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group.
|
||||
|
||||
>[!NOTE]
|
||||
>To generate a GUID using Powershell, use [```[guid]::NewGuid()```](https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/)
|
||||
>
|
||||
>This configuration is optional and not required for most implementations of Delivery Optimization.
|
||||
|
||||
### Max Cache Age
|
||||
|
||||
@ -61,7 +61,7 @@ For OS updates that support Express, there are two versions of the file payload
|
||||
1. **Full-file version** - essentially replacing the local versions of the update binaries.
|
||||
2. **Express version** - containing the deltas needed to patch the existing binaries on the device.
|
||||
|
||||
Both the full-file version and the Express version are referenced in the udpate's metadata, which has been downloaded to the client as part of the scan phase.
|
||||
Both the full-file version and the Express version are referenced in the update's metadata, which has been downloaded to the client as part of the scan phase.
|
||||
|
||||
**Express download works as follows:**
|
||||
|
||||
|
||||
@ -10,10 +10,10 @@ author: jasongerend
|
||||
ms.date: 2/6/2017
|
||||
description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures.
|
||||
---
|
||||
> Applies to: Windows 10, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2
|
||||
|
||||
# Windows Libraries
|
||||
|
||||
> Applies to: Windows 10, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2
|
||||
|
||||
Libraries are virtual containers for users’ content. A library can contain files and folders stored on the local computer or in a remote storage location. In Windows Explorer, users interact with libraries in ways similar to how they would interact with other folders. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with, and these known folders are automatically included in the default libraries and set as the default save location.
|
||||
|
||||
## Features for Users
|
||||
|
||||
@ -89,49 +89,11 @@ For more information, see [Sign up for the Store for Business](../manage/sign-up
|
||||
|
||||
After your admin signs up for the Store for Business, they can assign roles to other employees in your company. The admin needs Azure AD User Admin permissions to assign WSFB roles. These are the roles and their permissions.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Permission</th>
|
||||
<th align="left">Account settings</th>
|
||||
<th align="left">Acquire apps</th>
|
||||
<th align="left">Distribute apps</th>
|
||||
<th align="left">Device Guard signing</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Admin</p></td>
|
||||
<td align="left"><p>X</p></td>
|
||||
<td align="left"><p>X</p></td>
|
||||
<td align="left"><p>X</p></td>
|
||||
<td align="left"></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Purchaser</p></td>
|
||||
<td align="left"></td>
|
||||
<td align="left"><p>X</p></td>
|
||||
<td align="left"><p>X</p></td>
|
||||
<td align="left"></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Device Guard signer</p></td>
|
||||
<td align="left"></td>
|
||||
<td align="left"></td>
|
||||
<td align="left"></td>
|
||||
<td align="left"><p>X</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
| Permission | Account settings | Acquire apps | Distribute apps | Device Guard signing |
|
||||
| ---------- | ---------------- | ------------ | --------------- | -------------------- |
|
||||
| Admin | X | X | X | |
|
||||
| Purchaser | | X | X | |
|
||||
| Device Guard signer | | | | X |
|
||||
|
||||
In some cases, admins will need to add Azure Active Directory (AD) accounts for their employees. For more information, see [Manage user accounts and groups](../manage/manage-users-and-groups-windows-store-for-business.md).
|
||||
|
||||
@ -367,6 +329,18 @@ Store for Business is currently available in these markets.
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
## Privacy notice
|
||||
|
||||
Microsoft Store for Business services get names and email addresses of people in your organization from Azure Active Directory. This information is needed for these admin functions:
|
||||
- Granting and managing permissions
|
||||
- Managing app licenses
|
||||
- Distributing apps to people (names appear in a list that admins can select from)
|
||||
|
||||
Store for Business does not save names, or email addresses.
|
||||
|
||||
Your use of Store for Business is also governed by the Store for Business Terms of Use.
|
||||
|
||||
Information sent to Store for Business is subject to the [Store for Business Privacy Statement](https://privacy.microsoft.com/privacystatement/).
|
||||
|
||||
## <a href="" id="isv-wsfb"></a>ISVs and the Store for Business
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user