From 0d1cefddef9c88ddedcc7993e3b22756e9d10c66 Mon Sep 17 00:00:00 2001 From: v-pegao Date: Thu, 26 Dec 2019 15:12:21 +0800 Subject: [PATCH 001/149] Remove double quote --- windows/deployment/index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 9530728934..33f5976173 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -28,7 +28,7 @@ sections: - href: windows-10-deployment-scenarios html:

Understand the different ways that Windows 10 can be deployed

image: - src: https://docs.microsoft.com/media/common/i_deploy.svg" + src: https://docs.microsoft.com/media/common/i_deploy.svg title: Windows 10 deployment scenarios - href: update html:

Update Windows 10 in the enterprise

From 730a43cdcbc2f923db9f9845f79b80994ed1f5bf Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Wed, 11 Mar 2020 17:50:28 -0700 Subject: [PATCH 002/149] HoloLens Kiosk, serious overhaul MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is a LARGE change to this page. I've been wanting to do this for some time now. I've discussed with Yannis and Sarah and how it needed it. So I took the time to finally go about doing the work and making the changes. @yannisle @scooley As subject matter experts I'd like to review any information I've added and verify it's correct. @Teresa-Motiv I'm sure I've got several rough edges here. Would you please help me with consistency? I'm sure my information is correct but I need to learn to phrase and present it uniformly. • Redo the SAK vs MAK chart. • Create a chart or paragraph detailing when each deployment method should be used, it’s benefits, and limitations. • Add some examples for clarity • Move the Start layout XML stuff to the bottom as it’s optional now for MDM. Pointing to it as needed. • ACTUAL instructions for Kiosk Mode via Intune. • Reduce “Windows 10, version 1803” terminology. And make it less prominent in headers. • Reduce provisioning section and instead update the page we linked to. • Update the recommendations at the bottom. • Get rid of Bloom references. --- devices/hololens/hololens-kiosk.md | 275 ++++++++++++++++++++--------- 1 file changed, 194 insertions(+), 81 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index aab93e1b8a..5c23e398b7 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -20,97 +20,162 @@ appliesto: # Set up HoloLens as a kiosk for specific applications -In Windows 10, version 1803, you can configure your HoloLens devices to run as multi-app or single-app kiosks. You can also configure guest access for a HoloLens kiosk device by [designating a SpecialGroup account in your XML file.](#add-guest-access-to-the-kiosk-configuration-optional) +A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. +- All HoloLens 2 devices are Kiosk mode capable. +- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. +# Picking a Kiosk Mode +When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. - -The following table lists the device capabilities in the different kiosk modes. - -Kiosk mode | Voice and Bloom commands | Quick actions menu | Camera and video | Miracast ---- | --- | --- | --- | --- -Single-app kiosk | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) -Multi-app kiosk | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) with **Home** and **Volume** (default)

Photo and video buttons shown in Quick actions menu if the Camera app is enabled in the kiosk configuration.

Miracast is shown if the Camera app and device picker app are enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app is enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app and device picker app are enabled in the kiosk configuration. - -> [!NOTE] -> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. - -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. +Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. > > Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. -For HoloLens devices running Windows 10, version 1803, there are three methods that you can use to configure the device as a kiosk: -- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. -For HoloLens devices running Windows 10, version 1607, you can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. +The following table lists the device capabilities in the different kiosk modes. -## Start layout for HoloLens +| | Start Gesture / Pins Panel | Quick Actions Menu | Camera and Video | Miracast | Supported User Types | Auto Login | Can distinguish different users to use Kiosk mode or full access | +|------------------|----------------------------|--------------------|------------------|----------|----------------------|------------|------------------------------------------------------------------| +| Single-app kiosk | No | No | No* | No | MSA or Local | Yes | No | +| Multi-app kiosk | Yes | Yes* | Yes* | Yes* | AAD | No | Yes | -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +While camera and video voice commands and UI are disabled by default the button commands can still be used. +To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. > [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. +> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. -### Start layout file for MDM (Intune and others) +The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). +One Device can easily be set up to have one Kiosk set up for it. If you opt for Multi-app Kiosk then not you don’t need to require all users to use the Kiosk. +Examples scenarios of when to use which Kiosk: +- A device dedicated to Guides to help new hires: Single-app kiosk +- A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk +- You have a custom app and only allow access to it: Single-app kiosk +- You want a device the majority of your users can only use custom App, but that one user group can use your custom app, Remote Assist, Feedback Hub, and Settings if needed: Multi-app Kiosk mode (With only your custom app in the Kiosk, and the one user group has full access to Windows Holographic.) -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). +# Picking a Deployment Method -```xml - - - - - - - - - -``` +There are three methods that you can use to configure the device as a kiosk: +- You can use [Microsoft Intune or other mobile device management (MDM) service](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. +- You can [use a provisioning package](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. -### Start layout for a provisioning package +| | Device Portal | Provisioning Package | MDM | +|------------------------------|---------------|----------------------|------| +| Single-app kiosk available | Yes | Yes | Yes | +| Multi-app kiosk available | No | Yes | Yes | +| Need device locally to apply | Yes | Yes | No | +| Need developer mode | Yes | No | No | +| Need AAD | No | No | Yes | +| Automatically deploy | No | No | Yes | +| Speed | Fastest | Fast | Slow | +| Recommended for scale | No | No | Yes | -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. -```xml - - - - - - - - - - - - - - - ]]> - - -``` +## Set up kiosk mode using Microsoft Intune or MDM -## Set up kiosk mode using Microsoft Intune or MDM (Windows 10, version 1803) +Process: +1. Create a Device Configuration Policy +1. Select the settings you want to see in your Kiosk +1. Assign the Policy to the group to receive the policy +1. Set up the device + 1. Single app Kiosk + 1. Multi app Kiosk + +## Create a Device configuration policy + +Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +Select **Microsoft Intune > Device configuration - Profiles > + Create profile** +Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. +Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. +For full details creating a device profile for Kiosk mode check out [Kiosk settings]( https://docs.microsoft.com/intune/configuration/kiosk-settings). + +## Select the settings you want to see in your Kiosk. + +### Single-app kiosk +Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. +For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). + +### Multi App Kiosk +**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. +For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are : **Azure AD user or group** or **HoloLens visitor**. + +It’s important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. + +Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. + +To choose an app you’ve uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it’s **Application user model ID** by selecting **Add by AUMID**. +Some common in-box apps you may wish to use are: + +| App Name | AUMID | +|---------------|----------------------------------------------------------------------| +| Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +| Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | +| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | + +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/en-us/intune/configuration/kiosk-settings-holographic). + +## Assign the Policy to the group to receive the policy +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + + +> [! IMPORTANT] +> If two more or more different Kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. + +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign). + +There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. + +Examples: +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk. + +- You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. + +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area’s device would allow kiosks for both sets of users. + + +## Set up the device +Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. + +### Single-app kiosk + +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](https://docs.microsoft.com/hololens/hololens-enroll-mdm ), but sign in will be easy and can be automatic. + +During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. +Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy’s **assignment**. +Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. + +If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/intune/configuration/device-profile-monitor). + +### Multi app Kiosk +For multi app Kiosk you’ll be using a device that you Azure AD join to your tenant during OOBE. + +If you’re targeting a user group. you’ll want to sign in to an account that is a member of a group that’s also a group that the Kiosk is assigned to. + +Once you’ve completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. + +To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) + +If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/en-us/intune/configuration/device-profile-monitor). + + +Additional information: For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. -## Set up kiosk mode using a provisioning package (Windows 10, version 1803) +## Set up kiosk mode using a provisioning package + +As part of creating your Provisioning package, you’ll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). Process: 1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) @@ -170,25 +235,16 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -1. Connect HoloLens via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box). +You can intially [apply a provisioning package to HoloLens during setup](https://docs.microsoft.com/hololens/hololens-provisioning#apply-a-provisioning-package-to-hololens-during-setup). -3. HoloLens will show up as a device in File Explorer on the PC. +You can also [apply a provisioning package to HoloLens after setup](https://docs.microsoft.com/hololens/hololens-provisioning#4-apply-a-provisioning-package-to-hololens-after-setup). -4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. - -6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package. - -7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE. - - -## Set up kiosk mode using the Windows Device Portal (Windows 10, version 1607 and version 1803) +## Set up kiosk mode using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) + > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) 2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). @@ -202,16 +258,73 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ![Kiosk Mode](images/kiosk.png) > [!NOTE] - > The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has a [license to upgrade to Windows Holographic for Business](hololens1-upgrade-enterprise.md). + > The kiosk mode option will be available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md). 5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**. +6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** + +## Start layout for HoloLens + +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. + +> [!NOTE] +> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. + +### Start layout file for MDM (Intune and others) + +Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). + +> [!NOTE] +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). + +```xml + + + + + + + + + +``` + +### Start layout for a provisioning package + +You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. + +```xml + + + + + + + + + + + + + + + ]]> + + +``` + ## Kiosk app recommendations -- You cannot select Microsoft Edge, Microsoft Store, or the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app and the File Explorer app as a kiosk app. +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information From a223b23afca71e6d3e026f5ec1bb57ce7689c188 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Thu, 12 Mar 2020 13:26:10 -0700 Subject: [PATCH 003/149] Prelim cleanup --- devices/hololens/hololens-kiosk.md | 75 ++++++++++++++++-------------- 1 file changed, 41 insertions(+), 34 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 5c23e398b7..c9585b911c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -7,8 +7,9 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 11/13/2018 +ms.date: 03/12/2020 ms.custom: +- CI 115262 - CI 111456 - CSSTroubleshooting ms.reviewer: @@ -20,46 +21,50 @@ appliesto: # Set up HoloLens as a kiosk for specific applications -A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. -- All HoloLens 2 devices are Kiosk mode capable. -- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. -# Picking a Kiosk Mode +- All HoloLens 2 devices are Kiosk mode capable. +- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. + +## Select a kiosk mode When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. -> [!WARNING] +> [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. -> +> > Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. The following table lists the device capabilities in the different kiosk modes. -| | Start Gesture / Pins Panel | Quick Actions Menu | Camera and Video | Miracast | Supported User Types | Auto Login | Can distinguish different users to use Kiosk mode or full access | -|------------------|----------------------------|--------------------|------------------|----------|----------------------|------------|------------------------------------------------------------------| -| Single-app kiosk | No | No | No* | No | MSA or Local | Yes | No | -| Multi-app kiosk | Yes | Yes* | Yes* | Yes* | AAD | No | Yes | +|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Auto sign-in | Can distinguish different users to use Kiosk mode or full access | +| --- | --- | --- | --- | --- | --- | --- | --- | +|Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | +|Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | While camera and video voice commands and UI are disabled by default the button commands can still be used. To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. -> [!NOTE] +> [!NOTE] > Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. One Device can easily be set up to have one Kiosk set up for it. If you opt for Multi-app Kiosk then not you don’t need to require all users to use the Kiosk. + Examples scenarios of when to use which Kiosk: + - A device dedicated to Guides to help new hires: Single-app kiosk - A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk - You have a custom app and only allow access to it: Single-app kiosk - You want a device the majority of your users can only use custom App, but that one user group can use your custom app, Remote Assist, Feedback Hub, and Settings if needed: Multi-app Kiosk mode (With only your custom app in the Kiosk, and the one user group has full access to Windows Holographic.) -# Picking a Deployment Method +## Select a deployment method There are three methods that you can use to configure the device as a kiosk: + - You can use [Microsoft Intune or other mobile device management (MDM) service](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. - You can [use a provisioning package](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. - You can [use the Windows Device Portal](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. @@ -75,33 +80,36 @@ There are three methods that you can use to configure the device as a kiosk: | Speed | Fastest | Fast | Slow | | Recommended for scale | No | No | Yes | +## Set up kiosk mode by using Microsoft Intune or MDM -## Set up kiosk mode using Microsoft Intune or MDM +Process: -Process: -1. Create a Device Configuration Policy -1. Select the settings you want to see in your Kiosk -1. Assign the Policy to the group to receive the policy -1. Set up the device - 1. Single app Kiosk - 1. Multi app Kiosk +1. [Create a Device Configuration Policy](#create-a-device-configuration-policy). +1. [Select the settings that you want to see in your kiosk](#select-the-settings-that-you-want-to-see-in-your-kiosk). +1. Assign the Policy to the group to receive the policy. +1. Set up the device. + - Single app Kiosk. + - Multi app Kiosk. -## Create a Device configuration policy +### Create a device configuration policy + +1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** +1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. -Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. -Select **Microsoft Intune > Device configuration - Profiles > + Create profile** -Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. + For full details creating a device profile for Kiosk mode check out [Kiosk settings]( https://docs.microsoft.com/intune/configuration/kiosk-settings). -## Select the settings you want to see in your Kiosk. +### Select the settings that you want to see in your kiosk + +#### Configure a single-app kiosk -### Single-app kiosk Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). -### Multi App Kiosk +#### Configure a multi-app kiosk **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are : **Azure AD user or group** or **HoloLens visitor**. @@ -122,26 +130,25 @@ Some common in-box apps you may wish to use are: For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/en-us/intune/configuration/kiosk-settings-holographic). -## Assign the Policy to the group to receive the policy +## Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. - -> [! IMPORTANT] -> If two more or more different Kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> [!IMPORTANT] +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign). There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. -Examples: +**Examples:** + - You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk. - You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area’s device would allow kiosks for both sets of users. - ## Set up the device Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. From 05cf6869e87006ecfaa3f6c4a063fce4aa4e6336 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Thu, 12 Mar 2020 14:00:17 -0700 Subject: [PATCH 004/149] Prelim cleanup --- devices/hololens/hololens-kiosk.md | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c9585b911c..e388f7b9bc 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -84,12 +84,14 @@ There are three methods that you can use to configure the device as a kiosk: Process: -1. [Create a Device Configuration Policy](#create-a-device-configuration-policy). -1. [Select the settings that you want to see in your kiosk](#select-the-settings-that-you-want-to-see-in-your-kiosk). -1. Assign the Policy to the group to receive the policy. +1. [Create a device configuration policy](#create-a-device-configuration-policy). +1. Select the settings that you want to see in your kiosk. + - [Configure the settings for a single-app kiosk](#configure-the-settings-for-a-single-app-kiosk). + - [Configure the settings for a multi-app kiosk](#configure-the-settings-for-a-multi-app-kiosk). +1. [Assign the policy to the group to receive the policy](#assign-the-policy-to-the-group-to-receive-the-policy). 1. Set up the device. - - Single app Kiosk. - - Multi app Kiosk. + - [Set up a single-app kiosk](#set-up-a-single-app-kiosk). + - [Set up a multi-app kiosk](#set-up-a-multi-app-kiosk). ### Create a device configuration policy @@ -103,15 +105,15 @@ For full details creating a device profile for Kiosk mode check out [Kiosk setti ### Select the settings that you want to see in your kiosk -#### Configure a single-app kiosk +#### Configure the settings for a single-app kiosk Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). -#### Configure a multi-app kiosk +#### Configure the settings for a multi-app kiosk **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. -For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are : **Azure AD user or group** or **HoloLens visitor**. +For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. It’s important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. @@ -152,9 +154,9 @@ There is an important distinction between the **User logon type** and the **Assi ## Set up the device Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. -### Single-app kiosk +### Set up a single-app kiosk -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](https://docs.microsoft.com/hololens/hololens-enroll-mdm ), but sign in will be easy and can be automatic. +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy’s **assignment**. @@ -162,7 +164,8 @@ Give your store app a short amount time to download as well as policy to be appl If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/intune/configuration/device-profile-monitor). -### Multi app Kiosk +### Set up a multi-app kiosk + For multi app Kiosk you’ll be using a device that you Azure AD join to your tenant during OOBE. If you’re targeting a user group. you’ll want to sign in to an account that is a member of a group that’s also a group that the Kiosk is assigned to. @@ -180,11 +183,12 @@ For HoloLens devices that are managed by Microsoft Intune, directions can be fou For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. -## Set up kiosk mode using a provisioning package +## Set up kiosk mode by using a provisioning package As part of creating your Provisioning package, you’ll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). Process: + 1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) From d6377d6d51c5d23fddb2c162dd65b996ac281584 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 09:54:46 -0700 Subject: [PATCH 005/149] Cleanup --- devices/hololens/hololens-kiosk.md | 90 ++++++++++++++++-------------- 1 file changed, 47 insertions(+), 43 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index e388f7b9bc..e0157408b0 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -23,19 +23,19 @@ appliesto: A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. -- All HoloLens 2 devices are Kiosk mode capable. -- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +- All HoloLens 2 devices are Kiosk-mode capable. +- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. ## Select a kiosk mode -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. + +Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. > -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. - +> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. The following table lists the device capabilities in the different kiosk modes. @@ -44,17 +44,18 @@ The following table lists the device capabilities in the different kiosk modes. |Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | |Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | -While camera and video voice commands and UI are disabled by default the button commands can still be used. +While camera and video voice commands and UI are disabled by default the button commands can still be used. + To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. > [!NOTE] > Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. +The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. -One Device can easily be set up to have one Kiosk set up for it. If you opt for Multi-app Kiosk then not you don’t need to require all users to use the Kiosk. +One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. -Examples scenarios of when to use which Kiosk: +Examples scenarios of when to use which kiosk: - A device dedicated to Guides to help new hires: Single-app kiosk - A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk @@ -65,9 +66,9 @@ Examples scenarios of when to use which Kiosk: There are three methods that you can use to configure the device as a kiosk: -- You can use [Microsoft Intune or other mobile device management (MDM) service](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. +- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -107,19 +108,20 @@ For full details creating a device profile for Kiosk mode check out [Kiosk setti #### Configure the settings for a single-app kiosk -Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. +Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). #### Configure the settings for a multi-app kiosk + **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. -It’s important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. +It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you’ve uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it’s **Application user model ID** by selecting **Add by AUMID**. +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. Some common in-box apps you may wish to use are: | App Name | AUMID | @@ -130,16 +132,17 @@ Some common in-box apps you may wish to use are: | Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/en-us/intune/configuration/kiosk-settings-holographic). +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). ## Assign the policy to the group to receive the policy + Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] > If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign). +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. @@ -149,33 +152,35 @@ There is an important distinction between the **User logon type** and the **Assi - You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area’s device would allow kiosks for both sets of users. +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. ## Set up the device -Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. + +Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. ### Set up a single-app kiosk Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. -During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. -Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy’s **assignment**. -Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. +During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. -If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/intune/configuration/device-profile-monitor). +Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. + +Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. + +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). ### Set up a multi-app kiosk -For multi app Kiosk you’ll be using a device that you Azure AD join to your tenant during OOBE. +For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. -If you’re targeting a user group. you’ll want to sign in to an account that is a member of a group that’s also a group that the Kiosk is assigned to. +If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. -Once you’ve completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. +Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) -If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/en-us/intune/configuration/device-profile-monitor). - +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). Additional information: @@ -185,7 +190,7 @@ For other MDM services, check your provider's documentation for instructions. If ## Set up kiosk mode by using a provisioning package -As part of creating your Provisioning package, you’ll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). +As part of creating your Provisioning package, you'll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). Process: @@ -208,11 +213,11 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ```xml - - - - - + + + + + ``` ### Add the kiosk configuration XML file to a provisioning package @@ -227,7 +232,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. +8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. 9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. 10. On the **File** menu, select **Save.** 11. On the **Export** menu, select **Provisioning package**. @@ -243,14 +248,13 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* 16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - ### Apply the provisioning package to HoloLens -You can intially [apply a provisioning package to HoloLens during setup](https://docs.microsoft.com/hololens/hololens-provisioning#apply-a-provisioning-package-to-hololens-during-setup). +You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). -You can also [apply a provisioning package to HoloLens after setup](https://docs.microsoft.com/hololens/hololens-provisioning#4-apply-a-provisioning-package-to-hololens-after-setup). +You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode using the Windows Device Portal +## Set up kiosk mode using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. @@ -262,7 +266,7 @@ You can also [apply a provisioning package to HoloLens after setup](https://docs 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). + > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). 4. In the Windows Device Portal, click **Kiosk Mode**. @@ -277,7 +281,7 @@ You can also [apply a provisioning package to HoloLens after setup](https://docs ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. From abf352a841b22c34a399eedaddec32959b250922 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 11:06:37 -0700 Subject: [PATCH 006/149] link fixes --- devices/hololens/hololens-kiosk.md | 14 +++++++------- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index e0157408b0..975a5898f3 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -24,7 +24,7 @@ appliesto: A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. - All HoloLens 2 devices are Kiosk-mode capable. -- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. ## Select a kiosk mode @@ -250,7 +250,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). @@ -260,7 +260,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro > [!IMPORTANT] > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) - + 2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml @@ -335,11 +335,11 @@ You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-wi ## Kiosk app recommendations -- You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index c350d951eb..bba98361ac 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). +- Configure kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cfcb281b0..7a97637124 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From ef57582e23f68e30018d79e03809fe7424864a29 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 11:10:35 -0700 Subject: [PATCH 007/149] Cleanup --- devices/hololens/hololens-kiosk.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 975a5898f3..cb145ac7c3 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -121,7 +121,8 @@ It's important that the group or groups you choose includes users you want to us Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. + Some common in-box apps you may wish to use are: | App Name | AUMID | @@ -140,7 +141,7 @@ Once you have created and saved your Kiosk mode policy you must assign it to the Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). @@ -281,7 +282,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. @@ -303,7 +304,7 @@ Save the following sample as an XML file. You can use this file when you configu - + From a46ad93ffde37318e0843e6b5f67792df0ea1fc7 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 11:36:33 -0700 Subject: [PATCH 008/149] link fixes --- devices/hololens/hololens-kiosk.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index cb145ac7c3..5c214f7da2 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -67,8 +67,8 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -255,7 +255,7 @@ You can initially [apply a provisioning package to HoloLens during setup](holole You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode using the Windows Device Portal +## Set up kiosk mode by using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. @@ -282,7 +282,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. From 7ec55541a967447ecb162c9dfcae28a4fad09db1 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 11:58:11 -0700 Subject: [PATCH 009/149] Revert "HW-update" --- devices/hololens/hololens-kiosk.md | 29 +++++++++++------------ devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 17 insertions(+), 18 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 5c214f7da2..e0157408b0 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -24,7 +24,7 @@ appliesto: A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. - All HoloLens 2 devices are Kiosk-mode capable. -- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. ## Select a kiosk mode @@ -67,8 +67,8 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -121,8 +121,7 @@ It's important that the group or groups you choose includes users you want to us Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. - +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. Some common in-box apps you may wish to use are: | App Name | AUMID | @@ -141,7 +140,7 @@ Once you have created and saved your Kiosk mode policy you must assign it to the Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). @@ -251,17 +250,17 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode by using the Windows Device Portal +## Set up kiosk mode using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) - + 2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. @@ -282,7 +281,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. @@ -304,7 +303,7 @@ Save the following sample as an XML file. You can use this file when you configu - + @@ -312,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml @@ -336,11 +335,11 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ## Kiosk app recommendations -- You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index bba98361ac..c350d951eb 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7a97637124..6cfcb281b0 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From daabd2e4ef36aea51bf586205ef2ccacc344e259 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 12:33:21 -0700 Subject: [PATCH 010/149] Link fixes --- devices/hololens/hololens-kiosk.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index e0157408b0..316597854b 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -67,8 +67,8 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -254,7 +254,7 @@ You can intially [apply a provisioning package to HoloLens during setup](hololen You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode using the Windows Device Portal +## Set up kiosk mode by using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. @@ -281,7 +281,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. From 111324075aeb6897dbae38838446a35eef69f174 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 12:55:19 -0700 Subject: [PATCH 011/149] Link fixes --- .../hololens/hololens-commercial-infrastructure.md | 14 +++++++------- devices/hololens/hololens-kiosk.md | 2 +- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 98ec5c6e06..69cc524581 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your ### Remote Assist Specific Network Requirements 1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** +**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** 1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). ### Guides Specific Network Requirements @@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a 1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) -1. Ensure that your company’s users are in Azure Active Directory (Azure AD). +1. Ensure that your company's users are in Azure Active Directory (Azure AD). Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). 1. We suggest that users who need similar licenses are added to the same group. 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) -1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. +1. Ensure that your company's users (or group of users) are assigned the necessary licenses. Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). 1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company’s users (or a group of users) can add devices. +These steps ensure that your company's users (or a group of users) can add devices. 1. **Option 1:** Give all users permission to join devices to Azure AD. **Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > **Set Users may join devices to Azure AD to *All*** @@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. Check your app settings 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** + 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"** >[!NOTE] >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. @@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) > [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. +> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) ## Certificates and Authentication diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 316597854b..7f34527d0d 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index c350d951eb..a0978a7caa 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cfcb281b0..7a97637124 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From 796aa4f928ea4ef103925af43e3e7642dd727d95 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 14:49:56 -0700 Subject: [PATCH 012/149] Smallcommit --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 7f34527d0d..ce33c8bcb8 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -275,7 +275,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro > [!NOTE] > The kiosk mode option will be available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md). -5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**. +5. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**. 6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** From 5a90807964ea482711bd72ac353012bebd387fba Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 14:58:21 -0700 Subject: [PATCH 013/149] Revert "HW-update" --- .../hololens/hololens-commercial-infrastructure.md | 14 +++++++------- devices/hololens/hololens-kiosk.md | 2 +- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 69cc524581..98ec5c6e06 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your ### Remote Assist Specific Network Requirements 1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** +**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** 1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). ### Guides Specific Network Requirements @@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a 1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) -1. Ensure that your company's users are in Azure Active Directory (Azure AD). +1. Ensure that your company’s users are in Azure Active Directory (Azure AD). Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). 1. We suggest that users who need similar licenses are added to the same group. 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) -1. Ensure that your company's users (or group of users) are assigned the necessary licenses. +1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). 1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company's users (or a group of users) can add devices. +These steps ensure that your company’s users (or a group of users) can add devices. 1. **Option 1:** Give all users permission to join devices to Azure AD. **Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > **Set Users may join devices to Azure AD to *All*** @@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. Check your app settings 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"** + 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** >[!NOTE] >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. @@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) > [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. +> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) ## Certificates and Authentication diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ce33c8bcb8..eabcdbfb87 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index a0978a7caa..c350d951eb 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7a97637124..6cfcb281b0 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From 7b3ae68a4564ab3f16e90e35c9513f58f7fcc96f Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 15:46:57 -0700 Subject: [PATCH 014/149] Link fixes --- .../hololens/hololens-commercial-infrastructure.md | 14 +++++++------- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 98ec5c6e06..69cc524581 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your ### Remote Assist Specific Network Requirements 1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** +**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** 1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). ### Guides Specific Network Requirements @@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a 1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) -1. Ensure that your company’s users are in Azure Active Directory (Azure AD). +1. Ensure that your company's users are in Azure Active Directory (Azure AD). Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). 1. We suggest that users who need similar licenses are added to the same group. 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) -1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. +1. Ensure that your company's users (or group of users) are assigned the necessary licenses. Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). 1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company’s users (or a group of users) can add devices. +These steps ensure that your company's users (or a group of users) can add devices. 1. **Option 1:** Give all users permission to join devices to Azure AD. **Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > **Set Users may join devices to Azure AD to *All*** @@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. Check your app settings 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** + 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"** >[!NOTE] >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. @@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) > [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. +> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) ## Certificates and Authentication diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index dc85d351a4..f91fb8a234 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -33,7 +33,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). ## Provisioning package HoloLens wizard @@ -49,7 +49,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll the device in Azure Active Directory, or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cfcb281b0..7a97637124 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From c6ecd83fe207649decc6a65d7fffc5a90e061661 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 16:01:48 -0700 Subject: [PATCH 015/149] Link fixes & checks --- devices/hololens/hololens-kiosk.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index eabcdbfb87..adc9a6f657 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -190,7 +190,7 @@ For other MDM services, check your provider's documentation for instructions. If ## Set up kiosk mode by using a provisioning package -As part of creating your Provisioning package, you'll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). +As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). Process: @@ -259,14 +259,14 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) + > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). +2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi){broken} or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb){broken}. -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password){broken} if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). + > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate){broken}. 4. In the Windows Device Portal, click **Kiosk Mode**. @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml From f10bf86869eb491adfd468a6dad492dbe252897e Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 16:47:53 -0700 Subject: [PATCH 016/149] edits --- devices/hololens/hololens-kiosk.md | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index adc9a6f657..9e311d3bc1 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -21,10 +21,13 @@ appliesto: # Set up HoloLens as a kiosk for specific applications -A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. +Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can choose one of three processes to set up and deploy the kiosk configuration. -- All HoloLens 2 devices are Kiosk-mode capable. -- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +## Kiosk mode requirements + +You can configure any HoloLens 2 device to use kiosk mode. + +To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready. ## Select a kiosk mode @@ -83,7 +86,7 @@ There are three methods that you can use to configure the device as a kiosk: ## Set up kiosk mode by using Microsoft Intune or MDM -Process: +To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. 1. [Create a device configuration policy](#create-a-device-configuration-policy). 1. Select the settings that you want to see in your kiosk. @@ -134,7 +137,7 @@ Some common in-box apps you may wish to use are: For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -## Assign the policy to the group to receive the policy +### Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. @@ -154,11 +157,11 @@ There is an important distinction between the **User logon type** and the **Assi - You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. -## Set up the device +### Set up the device Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. -### Set up a single-app kiosk +#### Set up a single-app kiosk Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. @@ -170,7 +173,7 @@ Give your store app a short amount time to download as well as policy to be appl If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -### Set up a multi-app kiosk +#### Set up a multi-app kiosk For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. @@ -192,7 +195,7 @@ For other MDM services, check your provider's documentation for instructions. If As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). -Process: +To set up kiosk mode by using a provisioning package, follow these steps. 1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) @@ -256,6 +259,8 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Set up kiosk mode by using the Windows Device Portal +To set up kiosk mode by using the Windows Device Portal, follow these steps. + 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] @@ -303,7 +308,7 @@ Save the following sample as an XML file. You can use this file when you configu - + @@ -333,10 +338,10 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ``` -## Kiosk app recommendations +## Recommendations for selecting kiosk apps - You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. From bced257a566dd019b37f54e56b49101e1dbb9b59 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Sun, 15 Mar 2020 18:00:35 -0700 Subject: [PATCH 017/149] Revisions --- devices/hololens/hololens-kiosk.md | 43 +++++++++++++++++++----------- 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 9e311d3bc1..81b7cd49f2 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -19,9 +19,11 @@ appliesto: - HoloLens 2 --- -# Set up HoloLens as a kiosk for specific applications +# Set up HoloLens as a kiosk -Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can choose one of three processes to set up and deploy the kiosk configuration. +Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. + +This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/en-us/windows/configuration/kiosk-methods). ## Kiosk mode requirements @@ -52,7 +54,11 @@ While camera and video voice commands and UI are disabled by default the button To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. > [!NOTE] -> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. +> When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): +> +> - **Camera app AUMID**: `HoloCamera_cw5n1h2txyewy!HoloCamera` +> - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow` +> For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. @@ -70,19 +76,26 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. -| | Device Portal | Provisioning Package | MDM | -|------------------------------|---------------|----------------------|------| -| Single-app kiosk available | Yes | Yes | Yes | -| Multi-app kiosk available | No | Yes | Yes | -| Need device locally to apply | Yes | Yes | No | -| Need developer mode | Yes | No | No | -| Need AAD | No | No | Yes | -| Automatically deploy | No | No | Yes | -| Speed | Fastest | Fast | Slow | -| Recommended for scale | No | No | Yes | +- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. + +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. + + > [!NOTE] + > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. + +The following table lists the capabilities and benefits of each of the three deployment methods. + +|   |Deploy by using Windows Device Portal |Deploy by using a provisioning package |Deploy by using MDM | +| --------------------------- | ------------- | -------------------- | ---- | +|Deploy single-app kiosks | Yes | Yes | Yes | +|Deploy multi-app kiosks | No | Yes | Yes | +|Deploy to local devices only | Yes | Yes | No | +|Deploy by using developer mode |Required | Not required | Not required | +|Deploy by using Azure Active Directory (AAD) | Not required | Not required | Required | +|Deploy automatically | No | No | Yes | +|Deployment speed | Fastest | Fast | Slow | +|Deploy at scale | Not recommended | Not recommended | Recommended | ## Set up kiosk mode by using Microsoft Intune or MDM From be13b6ac1ace4d4878f3d70c5bb08422a12af3c2 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 24 Mar 2020 14:26:12 +0500 Subject: [PATCH 018/149] Update wip-azure-add-user-groups.png --- .../images/wip-azure-add-user-groups.png | Bin 21512 -> 33671 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/information-protection/windows-information-protection/images/wip-azure-add-user-groups.png b/windows/security/information-protection/windows-information-protection/images/wip-azure-add-user-groups.png index f45343107002197066b9041bc5c7019424f0e16d..34c89b37a9da52d2b5df37e95fa53ae28a60e4de 100644 GIT binary patch literal 33671 zcmcHhXHb)G_%4d7fFKA2ks>V=Y0^RI5J6B71hLSIfHdhunm|yBfHaZb6%|Bk=)FrX zqDV_1)F37Fo&fuazx7}1oS8j)e>iiTahNv=FUiyHtKErssB@2+l7;fzxpUN-8fuTu zox6ZOckX;J#YON4b86Qp_;DWo=$`7i;z71$a6xLP@<8R>Ibhn6qS4WP(_dKs$N9S*8PW<=R#TZ z;%Ckus^LLT@BoKx5$%*A15N@E`$>Z?Cz-&@$cB+qlQ5TO-m+^-}dx zeZu%a#MR$sPt6Pt)(ES(>H@8&MaG`lbgC3wArRFsp^yH2e;Pl-`0tYYLBen-8YEv|jC|vw`k!Z18C{6KPQmpn{C~e%Ey(2GJ;QHW1=MII-e6ec zNXzh^_O+dE@U>n3^;Jdtl`NsbPdl*_*Z(0-CJkEUN@+z)vqFB>4DilF`=W zx$>jB`_x)iPhTlB?cm{yp599}vvTcw~=^ z_VHe{W3lN?Kyr!k>1Jghaj`*OzszMEZV2q+EzXV&N|U7o;Q;fV*VEfuhJ&5# z{th1R@62p(I8LNEihjWNkZn=`j6Vd8-)DGcbGzcsKJ?h>D6t&M;~kN$MV$}eqnV4Q zJ9HSC4fnphRXKT3`pFkV`=A^(ee-GTsoo&so0HaG(>g@W_LLzUtykS>d1KVkVa1!n zD(!UT*5h1{q=BX5^G@{STfH8K)=#c3?T$5{RyzFoo>+S@?KjX)3uEhGfgenHqh9;C zTjA_r_|#M>yBMX5<7eA_Vgny|wF;l2f9z;B&9;Z3ZeGA$P%ddYe(|^&5wP=1ODy%% zov=wCXiT1>cVQp>)Aa0Fr;h0$qV9)!z24*lwOwoE|ARF`6B z_{|uutkM-2?fCYNylqc7YyUBAR=MTr&&LC8U4t?vOik(KXAc$19Z#%GIuWW%l798Q z!|VfCG4pDh`khkmF58`fd8U-if~8ajdVH$u86sk$-ubiAVD9XqPP|xX01Y(LU+nv{J8<| z6R95G$~D7HR+g{xF61>9i$qadt3ku4S#9~RemTLMon#v|_#lo5YLSq-L zdksH?>2CkD^~TjoJl7^{dF)Ygg$T$FH&5oQ<#wyak9R6E z$ou{pOspwSdfA@2O}wXuS-I4E{NA_4e-|q!!wS?l@1;9T<78xWc_x+t4tIskXPX;qbk}vC2yr$gRNIQkOxOU#w(p`ucko2qqg*IIL#in@qB&eN$3qS8~7AJrt4 ze%SerL1^vEg;^t{mHOjq7qfIm+J8%cuB{@X)NUxt6oF=waU3l)L|tQ@)X5@Da@ZcM zPuY%q)02iaoF1=YH`{5ebABe?vh8P1zsoj<8Pc6fn4Mf2WUV12Tw)7O={(COupLx4 zpA6*cbrn@lzo?d*PCW0Dy`Sy3UW@%>U=dvzAz=uPr$WT`k#&1W=q1%Bn0DV2_lCK5 zLThrKOXJb=`FU9{4$RWqP;9HvdlLtkz~%?uW85~sZ4JbhQf?Nf+Vmy;a4vzUhA#-> zPBr*h&#kV{1)AA45zOWd4_}Q>=x5lT9aURmvT(KsoxI3-#CX#%hk6J@C`*k_kj*iWcehJh0erL-6r( zcYNVy(L{0B#6Avhd+_Rbv2qN7CHyo{oRckg98j&tg{_^Hoh>T!l}Jn`h&;)UJe?bi z<7wDY?o3==>Ar+ty-Z%Zj0{kQAFF)iSm9CTcb&Guci~YXXd8wTIrWE}A)kMlx>*fi zu=Fxyq>Q8YmFZ9&p|Pzw$0rAvCHYZZTJjLuwp0%~gdyC__)s?F=7r&}p})rpjjZP( zdag}JxgxP;`RzkXs!y(oa-!*Scf(%)S@U{HP@$NP_R>+W4?J`NEQHjJK~DMe^(h{PKyr18FCRqnoT4S922{%+U3R z#o5_qDHQGoU9eG1F8l1f>E_P7^n7QC<5w@-WUf)Ut^POodhMXQ%BNyCIZEQc2=atS zZ%Tg&)xQ>(+nNac8I1e2Sg=@Tn3SJjBQjqvBQg|0vE3P7oo&XXKPN_hv!6ja;N^_S zijQgF$=>L%o6eIJoP4exD+Bp~CSFspwQ1WIS%~<2k0<2imbQZ)FT5_JWkafjM&$VH z6r#rNDetg;ej2|~9Wa$9(y(=+vyfuy{ARN$EP8;)Rp*sX`jnUX5gZrxYi(3TF%OD3 z{8X92efx9x@rRn%Zt7o-&L>}h#kNPVP~;u`jCn&sK1nVs7;A$nb*Zy%>ym#H{x#lb zW$V-B!uZ>$@vbYV=D@R>(WlM+^%=V2#(iUAlgqk(JfGdh8GOl3)XW_`6-B z{JjcKdlQO`yVj+6%g>gvP)i=h~>$jm4hSRE!5ocoiRYj@a)#u8%(RoZ8vw znf5q3>d(aBpi%JSJlILk^j)ara}Ckq0g?n#el<21sKxX}YL$RULDpA>Vv2m5Pr< zXsKq(dwP&9VJ@?ULCab1B^iIox+Z12fZ7+QFeD6}cf2u|6}Ff0Z5MS2;1de2!LfaT z7JuX!wqq@^K2`4xDTj8x^ZMoWF;iFh=*tvM^8CI7J$J%sO%t4^l%^gT>s<(4;uM{h zl{C+=_MRHHKpPPpTN0PSJbey0>CH4In^PfhaXNAq4LmPHYe#?BU*_fI~4F;jkJC=Foj>hPn{Jrx-54?0X zOeaNLVR_=)%qFMD2Vv4;;okOK?_Q#PCwkO&g{sVH;r_j8@U=N-0)}Zd- zx3RF(nns*X%hMp<&6bEO78#tA5G%tIv_v-I*g-qw(3joiEYZLmiSkzlTSR*B&8D4_ z+ZZEsyUpA*dd?>$JXdZ{6oV zsjcue>tz;T`R-!|!fiDOKaSc`Y84qOPi`N;uxjG%G4q);(u0G&gp4tR%bY zXbj@=py7HCbbhl2tKQ(gaD2FGamG@={#Ptur{sKCGrMw(VDHf|n!=RH)q`$ikam%;|o$7g?luI5&qIylNLf`xVAl3o{f%nPbEOG2yo43lu!1v`}p7m-`I6$6Md4K?NZBkup$b2rl^7cNO= zZ#?W>!>=n}#cdY6opNmW(>5M{{c>OdPJ;^`g8vb6?&$6|u=K$1tFgrW4=az>aHIOi zw&U(zuL=E+kMn#jZp3~MP`r`4s_9z=uiEAO`tJ!y=9vT?(V|>dISG&_qu{6 za(ti$(1G{)@2~%V(E96(t8T8f%c0L!Z+}+`D4Ha40u0)7_Rf%cLK@5+rF+9QQ?;TY9$|=YL_K}@!yFys&>gVYDP2~HNL7m z0;h&Gtiw`A`RMshax>uvfe2}jh-;+d-Af|n`Y|{JW)cFfq@J~$g9D74#&zc{5yoFc zhA}3azsmOoAa)?&U@CdD@@q2*7&J=N2zs>At6g!ihRvW8q!QQ_{nL$p1EWPIMV`$% zney1bpJQn}u(mtc0o(b`Xd)yVT}c*oshPbfq_En_{dP(N=2EsoKraYC=~!~>1b-kC21V3>5+7aZa?5eF|EAOU&kC2R$%gG- zp?&gOl!ddf5OKDmW_`3 ze8In(sq1KN(It6bVZ+T*8E?WKlDgom*LQ@Z12|pDKu7vK)bW zOA3R|YeY?8m3#dHd}%P69V{FrDHpVC`SYF+rq#y*-FU###@^}m=4qRfxHRsKa)wC& z{w5`4P+Vbi07Q=dv|D}H_O>CfYL}^?j9QfDHH(0~!~w1BTnY#Xy!{^j?5JpRXKT!&w{^b{ zVcok~>I{5loV4>&24R*qu=HpyuHW$3H?Ba#-4>Jlx(HhLvO#%3{?ZrNn#4AAeoYEcYF$hdzsN=J? zkW012wPaL`DX`P6*xJEJ1^z%h3bS?)>^K#@1F9YS!aKfH_qS@OtDVgp-+s3qo}6q1 z#s=sL#+Q*(vpoN8h9NYQh`Y_SjC=Ear(QlC1k0=2^nTQg^6BCH1F%jC{o2T({*Vqv znhxm;ON5=F>Ld?D!;z)(%D2z`8-Ztj@T0|A1LN5+f{dQ@GQfVPz9M7prZ8aY`b-R zqFI@fpEc#8Xg=9D*#Sz>c!U66dtATBn1L;m_4qBslU_`JbC&S4+Qg;y2j#waxF(+_ zp!;P*_r(XbrQ62ru0}+`RVEXdTrLFsU@#beB^W7TP1w1zL9E)DY;FVYqO#r#&C9vz zPJWSd3Ot~A!8L1VY?qsT&i57`a!W?He0beb7O1xz(k6PT#%_p1Nb%A6w!by=G3BDP z&Zw$ecA1_@)Y$?1sV8)e3m>$CGUT2BfGY~SYkuLVH$l+48hM*LY1(&*J)KD}^sjnp z!&WD&wCLr%IllQ7EICx->F2xDLVN+?Jg~M@g5fU2&rk<>ihs}4=hv4cLR2!X-U8(y z;9IO5mRTqvyuhToIN%!%l}8v2yHo1moUtK<|4`I=xbs5zSGwWoLzSN)cr0hM#7B`` zdZ=0N-*Ke1sE`P^4}Kq4g~`kGN~@g-qFM_H-D$rQ;(JL*!&bPK26A?oCG%pW+r`3r z%Cm~PB36-kqw7!V6&s!^vRkGoc@9FF1 z(DwOUJS1@C+EP%3pqRZ7#-TWtDAbh+kbJ`A>1J~pxG;A`iq>@-&!kqwWqWP1TV3f$ zIbGm~X|8(T1y$WP-lKIu9_6>n&UEdW#ZhmZLkRT6ttwx{H!q(-#J=6)3WL+;JSE9o z@Ow(1nW!>|7<#44V_+$QKg<4iKmngW&=dFXF=wc=-Ow+zhsBd=u?109Um=|Yy0X1U zR)wG`pK4f`YUYr9AGZ~?8idVvAx?U*6&DzYv+4cu>z#($T4{9UhZCY6zCS9Tq{4SG z!N{=mk&N@?h)z_g6G;y17OoIS@lm{R;SGxH=g^o%;1p%vi$C8dyc8f-6h7M|&bF87 z!on5#uKI!l%Sz5xIGH`$5rSrsl_C0?~EKpSxW% zs3vn8Zj(w~>Wq%4r;cdZ(@>&#vEsQj-^uD)5#UMNkh}A5@t1?ekNql*5?zO0n+Y?1 z!2O#-L8o4nU$@F0^Z3B$@z*vNc>9cwbm;>&2eLO%3sQ#ah@&^!WCU@NHflWvnnC&H z+x}c^>}YN=0fOOUa@tqi%1Eaj)oW_^uNtbi7Yl|D3xs#gt$!S-m}*s4jnxf-B05I~ zNIBPFrVztSQX#2PbC-67^Yi9Oci3m^$zSh{hcVbetSxJ3+N|Hy#P+hPOIr6FZFYTd zyx7Y8^kOj=g$u{k0j>9Sk^LL)Cad>OV~1ppQm-TZw5{gSdlIOF@Vi|x#oDc|3lJp=+2g;uqB&sOPQ+eG z-Q`-VkEE5sEwatY$59x1wU4p8FgCSxwxxa7~dbV@{IrH1+EaUx+Wd#YyRGt{wHskxSGXmU%wyAh?rJ!VTccR=5wa++e9M&vk!&z1P zRo8^jB1cMax@HIUubgUsnW0NS(v=zt1qeyG*UZ&uGIc$BdT(I|!s`Md?z6Y8zaq}5 zU7jk-RTz7$ zxGA&LdT+9&rq2ChXOP6K{BBom>4MDQvOWEnOuQ)H%Vxr&Snznm>>w#nXGN6JG@a?> z(W#KU|2Ec64@E2Wz3fMroAUeNrrZks*v!>_T0BCW;d{a@>X;$P2Pi(f(78{NF0DL| z=w#21$C?ZOq}$X%WNU<<^*p%he_xJcww+eUiW1o=@|?q}!zxYqP*+Ou_DosZ1)=Y1 zO1q&L{-lS=v9IW!>Li4!d@=Q!u)%(gRW8Fd03ErgGTY;B6f@mI@A*|Oo48m);rQ)Z zVUw;eq=EK?&@GjvPtx0#wV!F0lFc8MYR}yd(#TyCcd5K0oLP7{6Wn6?CuR9}o{3(2 z$GfoenUSF+1^jK%iVL1v%dX@8im80m{~7#13- zkU+Si9GRC`LU_kT$d+!0l(CrrI^&EooTd?yL(C{g@zVxL@(CA&k3YX`*c3f>x^z#{ z`Wo5TWk-b6V8WY94z37R3atr=ICuxB%RjUcko0xMhm87<&sz1+Os7Xffs_6eu$8ux zwj%)^L%J{8)8R`QQd|*1NJ~xFWJJyLU%hIt5kH~ke2Mq}8_A8EN%kw2Iqg1f(YG5G zuUxZRnN?_$rqz|4m}jxE+QFu~=HiHTA;;(84SbiAMX9r^5L1$f%nv4E;nl7ie2Rw4 zkB|0XDR0hX1;-U2g_EmQBGuWJrwGq=lMQYeZBd`COR)9Bc=8_8EYov%UC&ZZos}k?c;A zFj=|x+GlRNt@guzv|JCZ0czFat*r|Q=GBMbskt~xgDd~hZW=~GCbWX?Y3hXM{g>y= zP3dD|4kqW?q)8f8I?uOT+)=k;di15v!^yrBVJkn-$b z_0_50F-;Dlht2caC-aV^$YIVZe#OmHqk4f2ChQ@nj#x9n<1ui)0Fv7v9snrW4$+c7 z9LoMR0nt(y{C|E_k&ZSHH7L*@Xi7S&95a_%%Jj|((Be`}Z86#O36Kh67m_Q9Y(6{1 zKL8PgH3_GkcS~-{ZtlQckqCokl?!vb`s|Xy7+uVTqIol_Hs9?5N}eiWQZ-&Jz5jQ( zeN?@+;R3#}e6Z}~a3AG5fUCy1G~w43Oiqau@w-8Z%g**_Q}YSVRsTzU)gz7otn9y8 zi!<(hQfRn!`b>d0sD75cV);ybxT(tl`5p1qLCf3XubQDz(F z8_h}EA+yb`mjG$YG4SlFSWCnY>@^iyUF?Jn!EOa0GnaKXxtQQ-2HIW zXK`u;k_ApHqeYIBRnCqUhGzmZ{)9`HFZj_+6e;zJURd zd;pN!et_!>{}w&Yi^)7EE3s}r@-2?25ICcbma<*Th7xN5Nq1IsMw}ik;r3sjC+P>Q z6t_CwQ|~^1SEygcb=qllc^vuKnPku0qlee)@?ShCpD#of8dTGp+zbCxw?wYh-tSQe zw16y&ZsWpM`%@6`4~!^fq9JzSAWCXb{6X4H2`WZmibwnLiHSBpq!=Bufwg2L?D_FOd8INezi8yGAKHAy8c*j}3`AJ`kSaD~x*vJ7t@AoYGP(6;Pf zrmMKlLX`EJ=DOJ6+Gzjf*JbXJ=Se-ypE*P2Jia&!efs7<_HXCjXSpU+b6!hYHU0Hp z9foZG?TAX|ooi${{)EG=(IFNpaiNGOV8LoAiL+b0K&wDTYFr>;hXM1^GTb}v4Yb8< zX7yeVUWHy=f}a3Z{AcuJ+Hb?i@s_7t^QKS3W*gP0MP@@tkYdGuah+}cMcN0zR3#4P ze*EzNWOd#t{67kP|0lo0-TFToq@XA6mI2OM;&u{gln7O~*I-f-<<)>?K%xJP)@Cy(D!P7vPo+5-;D(FbQ?6ZO_`2%PiY)Rs=wCV~^Z z)$sn@C;IxMP0vsXH=f=YzrhSUS=J2}0UrQp%2uU`9HJ-7ytagnv7pA_;BtzhRLK#< zyAStL-`&!VH|b1c7gClHvN$P{^J=*u)YAUG1Tl86ym~+ND-R-zUQq4r$7UOD?OrnP zI`uaY-ng7Y7frWF?T;!|;i8!$xydm#t?ToTuJG2dFJS5e%8ibU&p7XHD!n^!Y?428 z;r(#$D%*(&z2!gk_D8r-Ny9H;!_t=B)v=-Vp%jVsw|CAH$_m&6kw(h729Wr9^AAjh zt>u%ZHXxqD(D8-5({HgiQMv{xb~&NdcfmiGMA$*EmH$TOdzW8R-dvJIjkkmA5)7-A zBrLHyR#N>2_vEaF=Vez6JL?)d+hnz?Yx}3$MN$X{ksv>BCrYdBu!hxKn8ORtLv;v! zHVFRQ^irz1ZOZ*}9X*k?QRlgu)*4Jsj!eB|%`7IH^UG8tA?GkA@#P_Y&Y~ngZIibb z#IBsNgPG}@2WlPnKuFBJyEV3*URTi)98Y#HMhhKC@IYL3cz@@*YOTj&P!U0s&sFip zsH;ttXa>g`?_iP`A8$k5K!fj&)mX>RPj?2?namPOHB9SXI+XJ6vJ1)Q>SVI8&d-U@ z(hn1*@^@E5hUqeo@4mh9V5pSqM)dpeZ>ox1IgrPVuW;TEX6~(|ITje-HW&=J(f(ZG{JcwkESsF9i+OWKL!q&yP<+@ zijyw`F`E)w_G4Ai4kO}ciwE6zrrX+Tmn?gp&!%`7^@!2S1{}XEx9Ma2U1%g#KP2~( z(L@G&TDuMe@u^dwKDrEH6gC>HcjQ+s8sHlicPxd(FWg#5X?uOzCPH7l% z=7&2rOKBE~Dmbg&YCM>h;<+0o4s_K>GyExrE{=`-ft!rOuMT1o1q(E>>e*2f*IQ4& zKe_ZMk~W&l2 zDRb{evy57eeAQyY&x4pB96n)_JR$1_>*mjJ3%VxlloGwv6{biySLrnI%UBDkyrsl; z>&26-#gKgcqBMueiu{3lrywEIwf#sZUD{cDC`-v%e(&J#Fi)~TM9}=nG3;o8eg_nm zbfUEBe!ll(F<2=*>q|fSjmpb^*vBiX%Q!4>xw?OL94p>8o-tO@xXdihX^Zr_e{hrS2g->fCq10? zbvg-uy@WR2^FRHkG{rlnIOYOKfQ`GyfpiZ&Ld~5yE6ztrtsNE_BDuYAy6MsbSo$9L zLsIX0FI+!^fvIH{Ft$==5J39HG5rNe4O$Og^1u!VuF>zH>P@6DeZC~ zpwPm`(RE}^!Rw60<>7bZEaWT&x=wC?$exEdRbvqKBIL76A=maw%<852(msDY1$z?( zy=wq-hRV8qRAQW^NN7E*Dci9kW=f9zHo6$5be!VD8bWPWt2Y?BDZ3>U^!uszw=b$- z3;lq;7#%?oLiJBtds~FD)PTn)H4G|Qk-4vQV!E0yng-|{ec)ZGpAX`>F%YWOy{dri z{1u@(gYVokdXHfVQ5X}l1Qrnan#^wT1HQY1E6Q-Jw!*}7ZFh22AI2}IYKF&(1uF@X z)b+4*`q|;lx}~x+F@^)lT(~GnBxiJ{3B& zDH~Bk1$M{-h;@ICdSri}ShEx2bZ24gvAV3eTPqnc>QY&L>q50Aq%ifO)E@XWKTaQR z{W$8;MSLj08Gh|HU}lcj60N;H9{INZGJ*Nw0hnh&p<3DJ0^PJi^tuP1JFA3(HS_BO zqGNB2er^ai&_QgPEp*WwKF5SLJ2aJ21b=IhuXLMjc8Lg`&J0@b1oc!2wJ5js!v)vpk{4uG&?NC3QMWtrqlQofJp}n9lu*1{ z%DGgxaIF0!gj?@hd=Cw0+tN_B>yV?oDUXkj_b^PX-23m!nUf)8HL0jyQwwYP42lUu zRZH?D9hsHsWq$_2aX3z$6DB7P+g*%qwC(vNy$0H*~!5Gh#0O( zt8OQmxFAQZg?qyF$OB2+lWdq`pDoHVZ6x2>6d3~gx0A4PmS?7-=s;IJ3#Vbt#8V8aSkM9fPIkAC*)5b9#$*!n0Mv!rm1SGzO`d+?Lv zB&Muez5u6mfVK{Oq-gNkCq&&_zC*guFZRz}L~5Rx6Z3YN>ZL9|5-Tz-!Gc&>0{IQI zZmsUa1sO`MxKWctqA%a^PkhtW?p z{0?#aRg}@5woS%>@@@6(ke%1L;>t~)e~99y98y8L-HX7rz5a>4bVMcAARazJ%e@C& zysE)7!&oFX3qB~P?{>wWYD-r+b*GEPo9P}fo{Ijkt7yv^V$I|Z@6@JB#gmE}GR11_ zt2fSv^Td?m)U-)PQVo$lw`0qua0|~j z|Bdb1bm@pw#>t0#jAwJGILrsN&^hsW4cQaaM-oJaY#V=j@`j#w7#=$wwPgO`MUH>@ zC1v1A5V|)MIt@JnFuqHfD)$G=-bK+_FV2(J&~HS+Twu%Br`CD+jgvHmYNF2lHzYw_Y608C)3jZ2>6m5S7d@09j!R!+sSnmifM9M8v!ieA%`e`HT zywnj;pC(=C2@-bOZiKC_bl_tPg!gP6SxMeb6KIk}4ji;b;QTfk$KGvxARU7hz&B09 z10%El@aAyBs#`J@-qi2KGF-KM6PhlI81bi)X^JU)Gk_sMw9F;alP!ub^V2R`J9~~k z>9xfCiL|K*JUcz2w3(b68)Co7@3v{TxWSxF_9J5bWwpXAqf>z8PT9-&yII>| zx9*Q`$X>P%ezrVXl%8oSG3`_jPmWquX@C!T&YFJExU+fv#Vs*`CYYD(KO`2?&}40z z*RkW4r3GS85|(JW8N=<_?G9Jd@2$+($+nH_F3Of$+4mun`BzX)v@&m2DXEmkSjVos zaki_}UBob+5w7n9K*&8Fn&V==GME06FTDbvOU;+lGkJI@`Lx({f@mV^yUl-~yI6p% z_W|De0_SK7IAF)kpCz>Z_}lb;otr991^L`s0t!R;Ym>r-trXF;YGR_i6;#7uIVB$P zu#wFj0B^opd8)Y3tv+Xke9p*>tG7&Z(jhO?b|{hlOwXMguCY-6)DT%@P|w6}m}q#7 zla4O)#<%$9#(?8pxtR^a+&3v$;~DA?t9dX7=|Bm=DpO8c4Sm=t_v7+*u|k`4M_%^o z)lh*Lwy0(iZi#p3wrJKLv4~xs`sij>*g0XxuKTFM;C*P@?06(CS%2|_>2?WXn>W+Ybhcb{i%v|}G;?ni zp%QpRUY$LKseM^5`Gtj0mbsbbw?PM-5mOcas!$Ckw1fMYeS_OKOf9|dp*YzE}lS01Sb zL=6*7VMo?y4hK`lrQHfL^dT~$62$|G%xU3Tnu-Fk5vt?Syx*I_)Q*@@QLY$&xFpI8 zC}hVcjW~++m+x?McNJSru6EE93>%GlLX&BExhK_!z(9#@47uS_XmO@k;7`L{O?AV|3ic|YiX+?+)CYH#2y!ctS?W9JVWds zV^w?g9wc=PA^$=&8cM{+B87<;YOj9Yi3dNyZU1kRHUGab6GA zHA7E2pLZrabYk>`qrBv95hpMkK?(#A?m5Uu*-Puux>CbNxB^KbTCW9!7T|bDZIG*n2!BU|ofA6V$2jdiXM5J1hj3Il@ z)l;^>9Jh68*t)v|dPC5c+2uznoKd6bSF1%TqQn6&|98vlfMiG*n7W770%dIg2vxy` z)}tT=t1h#gZ0ey&?8;GnE(*pk;T)fK3dD&4TIwmt$e26P~}5%@!f!=~_oTe;pF)5sR(E%0bLSCj%@e2Ad)7XCHsgEDRecnk}i(!5j! zZx_g8H#BoCa@TTO6?}YmP6r0`Jr3V5%fp|;jzIFu5`-IhiMgSA3!oWthC#S9L)5+8 z>8EO<7k&VBEU1WNqS3GVnu1p$krz?(+>5!X;I&2pNEaX}F?*IPBl*}MD$!E?)nKyu zUS9`5vLHlXAND_*;8(FGpk>DHHFi+$f%1j&2Vo>z5ZBKIB*k`frZrdfh!P7T$Fv?) zT$Ci3YVoa(J;0f@0iO+OJkieDtxJ^&R4GkX_IkN$eIptH;Oh|GJvK`K)!4^+qi5PF zPl2jLCV>|;sVck9UEAcbVLMQl`X#<~jPKC+P>0{hQJM{!H7 z9ArUEYynl({+;^(SDPzhVD9^MqSW$^lW>L*b=PpQq)l%M2#1VSxdK8d9ShT;ktv1- z?8a3#;ce>bsYRPH(qrDed|3hLH_T(N_EsjgyyyFyU^EDmb_Z1oJyVUy&~#KXHLLVZ zCUc)pM<5U5YTKV;*-rF{c0gckvh(aP2x`(tJP|l|=R)UN0?+UkLWeno3S_A{h(BY2 z_)23%N$$cl1UqYB7;tUeOR9WJV#T5o>v;s|#VwGl(&?|$W`(qTQLlAO5VM$mcR*|d zQZ$@DLRG)od*R6I^7G@HfiTWuAha?ddtO6q+O`(rbtktS_;J+ruR>;J`6$#adhJq{6fq1IAUlfj zc2V*_b|#w?3xWKIPM~tJbGT#ZI^8hg5_SYYQ$NsHo~!#N*c8jQ6um$^-|Mmn-)%WY zg^Q8Oth$w7o!RPwy8gK4=za#qqjx89pQ2mTtgeHQjr_nzqHp*g7E`@8yk!&o`A zdF~XWYWSSmeKHxC8d06KQiuvP`PCY~vmh3(>)nhvS#$2*TOC7z?i6)0*n**jA=Ho} z&KQCslKsB3*|fK}5@nm<;SCr9R;D(IGKzbxoqg})a|GvMAdt?DTL<}*jQH=zlaY`* zU*Mypuu$VYQQef+yLQolTE?Me5)T53hOG~bn)HI_Bl-#gM#7%OO1|Z^B_?6&2l(+v zt!5MnpLoBQGu(Ds>OJ_iTa~ z;Uuhy5N?IzBxV@E2Ly~FlZ@3etnd6RurMO)pFI2C`f!G{o{G#2N78;Fh}p8?dCwIE z_Zd-Wn}V2DBj(~+t8PfSYoVJJi+5}T1$4*cDTIws7YI@6=5& zwd8_5bXhk;yKaLsluD2RZD=v=Gavm-Oh%818PhK-&KX zaSu2iSB-+ITlia_V3R~)qzSFG=Hrrs{Q8-o9k46cQiZBMT3qF$DS~v|>yXjAHiew2N$X5K_CV3*A!C=Gw5P0Ayh0O@d#Z4X8e|n> zC7y3X1vJ^5kkKve7R=RTq-=P_zf(x-t`x01BgenDX6gr5c-g`fD04=ThN#`Ax#Gv(|_1e=*I?*KWN?n936ipEGZKwfLQtN(T01*7>6t z#X7N@;uz@<0~spY?)O~#Vbm%c`}wFpylN`$7aTw?abN0MX_@MVf{WBVf0J$X@1D03 zk^Pot>7;&m-!){HWLufp6V585rwhPB(H&3Aa4Cgkdrdmn&UHi_QF;S>5E1`~>HyRU z%YR8qzlb-@&&pgF3{wMSXvwYWfXwKXDr6VhS%sE7E6TNchm%%Sf>3N209xEWV(>3f=LwiUAq ztAwtGK}(%KcvKd&o0OS%Je?unjreO^did_`{rgqNzYyCH|Y z8B5SN7QEs1yTy!z^7!F5fHn__TfAttRUIwZrdAuj8N_Bz+3FqKC2@M$LWUJ%IgZB`uQFEKfvg|(Kf$S^HY4It)ytbP~G+Bu&XX+(=L76 z=Uc>y_7Rdn^(wm}=h5MOtlh{9)^MjRmD!kV@K;CTAGJ~+Uf=NuBW7@mzoz?4OZMNW89CX0if&;EcDgn^( zp8^9JTBY6ha>Vd$EQbC4YZhb z5*xRpIFu$w@*j5rCrNA>iU;X*qt$%?=2$u?;!-!Q&xl>ew91Dq1n{OMNXTh!0%P{o zLaefHEC{PS6AP%>n2Fa_c3>1WwI|y6J8R`bX~1F^>jsmrBHtVchCDpV7C^4i94}(j z`wRdl{g>GQ<>|j{1_r+^@TEq#-wGUpHV_C~BC8A3I=|hDyn6ao!4W8DYwm`F7@v7+ zKLQX}?7r(4z1ZPgO9pKMu0oW0PyThC4=L_M`5rAM2QynEPF5{Y&=V@r8qV;ZHwrSq zAf?{_6^5q)7`9R0X+F!dgYKSTGGwN{+dF*YiY3UjV!<~CR5rasNSon z79?pOWGe?aW%<0%1O30bFPDE+T_)5si5Nd8b};__s6z6)7H*dgw0JLDkfy~FF%Mq# zDp@t!L#r6-M-Dqqo%2=%O)TZ03mJ}f?=qV0JNV|igWZ=_JU=GFAN2{y6SkP904zXq z($GKxQVz6UI0v@53Flxze`HDRe2hXr@vNzPxomauGV?QHK)T%Tzy;q(+LY&S0nYk6 zLhGq&JZndYp==n2*wTm1O?N2^q)lP|7eU=1rFRyNS5=D}+{gys0Fh(Z63Y)OH2euT zf=!J4ih$$P%2a)IrN*=K!GQcs4*9sTHuxWHkN(;twvZ`qwvb?%nh!%$L2f@9w)`c& z@JAt#|TOA~XI`^0IwL2g|BeZ#MJAAkgJRN$Q|Y12;(P&7wUIE2WYck}@C z>;VV}J0qIP{l^Zoz;W3|Y1d?@yr8tzL65tWK;hIh1durf_a%AbCb$2OcMQ1>zjLtw zMoR;dg5>59Iv{>60xH;(=)>Cr2A1nIQI`9(KwlaMV6wQb(q2Lll!`AN&XuFFbf61# zfw?6znTvl!tqv3C9h|A&tddJJW{|$HtLhI znhGdE=D-d50><103jngsguuNcH-uE#3=%*hHw2feys;1??IM;yg)j-xNNV#x zd->-Qmm~|~+1BqY(7;9HhR$p*9E6`$ped#9?M$^Vu5!$nE~doJya5OWquZh3OXNqb zYw@%O@9`VWFxklz&~0LZF>K0{!T6UmG=$qgd-1!!b&I~HCvqJspRE`)6B}P7 zHyU3&Kl=f6pP;{X4d( z8Rnh^wWx_7mp-``fA{QOHq>vF>h1{e><4ufw?ag+$vKVW7V1`u%Q1KOnkd`}1-=hK zqbXDdY+i(DpuxJl-bIYA@NeypP!ROy^n`)ky-@^N`qT@0CrUx0Pu$maed@mA zS*~A$FG839LvB|2Lqouu(twBNy|)iKpzmkSFU4{D*6pks535BVp8CPAmM z$H5@u*KGJK_wl9Y8q*8+HsbWKSX`KVdbvS0BA6Peup7SDH{$LvR$)hH=&%0w>-)TFV+F5%bP9?S0C*#bp<pC~$v9noAZe|!mJN(t%Q=1CqC`lb8*IpM}E znZs?R@1*QzaEqQPs+8?WXQw~%YCh9+&a9{31fl(bt-l7;e_8uyKqMTY8b~9O1h)ZA zkx>zSZ5vhZ{=XOO%w=0jkPEI1DjFbB;_ghZ?&GQ!dw|%=5g|Wule_QVdfPOqmB;OZ#d5q&>7uJW;oSg6%n%R zeR>%{tb9A=??FlR*9r5{UqAVH?z@sam!GL9?B&4c@d_cKas5=@#E%y#wt$TAj=cGw zx=P-tzjc6^8MwF##GDS7HX+bJ2wMrKgQ@f5+8#;yAMCJPBQ)tkfp}qwFECFfyU4Fq zc^~o*3fy@XU?8f2-lm|MFnAy4q;8m=Y`35IlKFo0Tp72e`wBRNHSbrle{P?esc%qm zn|Tz!u=JSZNXJ+f_qJBRUZNihl}G}T00MvFZgMOcqqx3j0;J~j9>7*pI%J*Sr~g5f z8RR6FLx*e7vC*%NkO6b@YKWHT5C$9_BL}eK2_rE(e)8kDw4|({L|K4TK&;H7oop#D zI<>Rdta*8z$j`SOtULxwUC{&?k4(U9{fbNO41dHxq?3^!as^ab3j*m)7h%NumTT77 z*3(Qk4(L`nxd2;?!Kfu9Kp}N;mtO}(r`z?AJ&pLVG4+-#5qW9IKI!E zeFl9~9*e7Y7?FM9BJl2-11QkC0PULr{o#-m$08;fR*E$2iSjzmo34yQV{M=2B6tdm zhZ>O0d$s|VQe>p{ zRQ_;qB@9YBDg`m(X}?w?C=oM`@0nn;vRHE zGp-5y0-&>To*+uK-dUU88fm(oD(=2$`Dkm|7D3gKslaC2`&=@Q%pG?fQwR(}TArYk z>>&R?D-&ZRS^-AJ&{)m&fD<<0vo{ZSQdd{^-tPr!dc&zb#70$|yf3c8@!Jg=lggs+ z;E0`IWAtn|%4Yc>-750?Sqy`yTXz7$v3fWnK&yHFzgjylMrpr-Y z-@Y^eq&)^t2pL42r>^syN;|2&ees9C z?g@iNv{krCh##)H1!8!8dCiWtWtp&1z-P-IBDtDbI0+R9hHn125lMgw7m;=mWMy&f zn7{rI@r+x4N#G!?4!lY3@Jf;plL6jin)@*T&KQ(L5WV5+#IMo}`#>+N{wZf2dT|U3 zN2nJ@DWz8Yv9JHwDA&$h=+c(#{Yp?PZ8e5&DjrW*&b&!BDShsU_M>u$4f0?ezsRqB ze?O3bw7Vmo-NFK$ta>=T*&+B_;!=R5kyO%LEPealK3N0VVy+XP^oLL7ky{n_zct<6 zIJD>|o{w|$27Ab;A4)Gvj$mJ^Yf0Q?xX`YFLJnyxr&)AM-oacj5utt@Dn-L`$vHs3 z#5|;;$y^G2A5BgEJuj~nu(bEjN2VdL``v!ZbhEC@xGkDwq9@hYAU+JkwNJ#|!hRTm zYo>VKo!z83#_bf2x}@%-{&&YP`J9UBq%2uS_3YH_vGVYA`3niY8b?Gv9{Y1wWSyJD zv{Sy`j0tjSZEence4P!0?ac8+*44Ji6e=DJB2c?SKy`ED&dzXL0Mq-_5_;ISdio}) zdZ}k#GJh`vb*~S@eD{Qv%l-;OziBV={L`y#F9o?yXQR|7ZJ85=R}!v5gxpt8b1EzF zq#{jra+C&r|E$a5%g131cape^d#2lD$ zldhv90ripIxyR0#_Ri(G^rTv3g=EIBEHYH|2^Tp;@m6NLEU|uW@Wyrh8pExmkdPFM zj~yFeK&{T4U5TWw=R8`KxJV?n^^+ zD9`ygaZxTuwwb+Os3cRL$n&13C%`f;xa6@T{tz?U+YerMj6!F00|gr)U>QZZfCG7roL-tYL*{T9Uk|TW-Q>oAU}oA4GQsM6z3%cKO8h~eYx$?!LA3h zHu1E0wtls9Rt1FwMUh$LNA@C*&?PP=yEl_e8!Y)}mD}=JR!-Er(~Ig66$^w{5{}nX zztu**&fvRRvg<}kJKMxnnd=Job9Juo4f76L0^!0o@rugUN&EA5q5t9Dklti8PvQwq z&)-k_Aa`#>l#?e-4}B0GOTod2EL^FH{902V9oKm7eCUM1$O$`V$*hoH?khB3s+C!a zn{*Xp+8-qomE*Vs4i0)oPbK>8g>bKrz2r7qV#OVdH?1{3WM~#P@2_aDsrt& zLZJRx>eju9=$A$p`kC&b=ORBnq^kTn;Lj=aK7TBe;ew9?)2WnSyr%Wz8SJ6QpWGTJ z&V7y!_A6WmoBoI>gsNZ>h?ejN!I{UeWAs&LX#-?s^;yrnqthc?Gd83mh>yJa+t_Hw zGV__4?|K3^L+s#>=+l^H&68BNB15h*%3n({Xv#XrFA1oxf7JH^Ly<8)rVno9C9?jQpVaH> z^dq@a`Y||5LQO;>Cp?vL68wHeyK+JD;i}Tjlji3{o^fy3kx$(~_ir|BPjjAW5$el% zOn72q2Te<95>Z-wlW^|iI_ug^E4C?A4Ehi)<~ffzT2kjT`3cP`4K2Ef7tmG>b&&6?D1AyR*C2pIC6OXG?0Lm!F; zLPs^7*wLH-JQ)L4>>U<`pSJ~YJzFw9t3nB)??p;**wz2w&KKkpcdYl54642!+$@M0 z)vH&dNHlIQEXe)+{EoF#!Fc3Bvhlh>@iS4$(>)t%l9=>K>SZ~G&RHmwm&yCk<{Pfn5$8OF8r%U*`y$p8E za;4Q31_tcc4yaD?PUhRGIWIl=c+G%v5ex(Zfc}&ht^FA$ci(BJnH_BV+hd4E6p)Ls zrB(%$7$qI+ULh68XRX5=Tvs5ftblcwz|1FGwac}v)c&aJvnksHPSOLxk#zsL40 z=XchZVt$X1qRCzt_V=z{6c!pU3hb8g5+q`!MZ&&h^|$k%G~5lM`3Tg&7ERUT6Aci% zr2#lnei+%?pfaO|-~H;=|LP)2M3Py{2?5tJm5qGN#a~4HbFiuIyn)^42#vR*Qdbui z5wX4+2@pGViv7!xG&Yw4){^{GT%CGyWi=|NOpXiQ7vGB*^+5GND(0X`gUCoHJ#QZ} zk-mo{1xVV-AJVUQjW6Oq+6&&u>gK=+$~!R>FT!-OF(yLE=G$K_fxpIZNsspSy%ca? z{BA^!U@ljGmi6EzLU>2mC#JK^E6^c~IpF((q!eis$crr{w*O^>B2g>ZoL0IG*wgU| z7fBF*@_b0|FoE%ira%8`Q**q2>%`rO9cL$0`Ip>idXZk~s|!pqEgvwt+_K+itpCQY zD9B#)2&CVRdG}1-ncNoAM7lNcwI@og)a?%2F1NHw6o*MHRj&%kjq+t|{FYOQ-+9~htH^3TN-8m=B>PlGy+Kp z@|gcao&rG#gpAD)A@+yp^EvdBVjiXi(4HDTmGdjERgo=J#hMYJWBl0^L+ z>d*CAXM#o^Iz8pcH>wfhbnWO8^cSB~ko^H*A2uzL&N^h$GWAsXMcxcsYKL`#6#h=H zXW!1Z%q63GVxiH^EcHANaA;^MY5S9x^UT85X`XZt;P#;V9%|pa9p4* z9UB=lA8i16h6VtS80q%Y45D9S$mdwzwMWw@=bdtPudWMuQVK~?mJt8K)Gu;$IXoR=$bm_fvEK@G%>Mr`om(te)=93EU+xhd` zfoY_yYC@%0P#k8l6v$IFEQv1ehHQnl6d1N&f~EoV53<25=g$kIj{Ce(FrGL)3l4@n5+n_y{6`FF25Pm8W3)^=xK zPMgcnYKhaT^I-2bX1p%lfLW$K*l2d&XIU%h93W)wr91SL+k`e#Xs#={YF#?KvR$^8 zVkL>NyvyJlvHuT+=@c)E9xhso-Yd4{bVep}*+V`tF2khlC9APl_NB|a2B+VaNO^Bq zO5E^2ERR;ThC=RY-26UJ^^)gfv@vO1#3lgrQGn92y_U`I1wjq$8WRy+b^gCeahr-k z{$dTt=nzR{D;W-SdGxiWppE9~C}G+|LxM+4DH~TO4gT~rCm}-+hZo?aTZw)O9O!s| z#c$b)q^U|1VZ8Y>4Dz3;Vo$I|?*T&JJ@t-(lD=pnDl?B66gtaX)Oei^`sUFpbn+KB~8q$o$kyKv9znUI)x?cs&l&(=$nd2!(GBsNI4pI#YU`6h#?k4$pc6L#!qs2 zgD`E=7R4v8etmzRNONmtNHRO|qaV-ZA=hN4r{ecTXwxw`8@&=C%ZmUA3D} z7B6oL1E5KI^r0Ng?=n5){4q*bamLE?%v&Rd#K9=Ag~T(Aov$a2J5^7^oDy}@Iz<6B z(-vAUSdt=O7C6zc_#rQUh0{% zOYZrJ;=YeprXcj0_0{4jr*V+j2aC(aN&-U?43~4vTCF80BQLXc63Y?ljwyt2%Tbm*wTmp<>CXis ze9VvQYm>Xe6Bz+obHeQQKl~ad7_wol1Atgl^Q2~L_E%~#qEAC?vv-CZri@rgnlGT3 zocE9LIgH2;mGqUvwb}?s1%~wGBuSmU@|)w7masE}z>b3YODXa5;cB zI_Ohf)@ex<7;@W<3Ms*l*Fcf#Z%EC-TTk&W<^Y9RoIhJhsaPo0`zb_NFeb!>bnS9! zIboiQ7u$*Oa>5iZ!HgrXUH21zSfojXa>M0h4(9Ph$)mh)Pm-v4xl*_rGxMhGhz}y>{v3(7~xx&I!o&M zhyczaa!w^@Lf=M=Nw%vpQhDv81K}J^%O`xgQ}!jI(NCvg7`kz_ z|72zQXT1D!B91EDlhAFRh;=Oq6wkD65pukwJv+?wIlbkL1jVW(#bO&y!=JT;c4L)_ z=>wn?!Hx|`i;urIC_R^SOJ}hZsx=|rzo}RiHG*w3!{k=EL5!Wo=qCx+);p+AqbFrz zB(t6G5umM36&O~LnUhJEFF*`a`Pi_rXF7mnddoJFR9~>Iqc(#oG^t`oBbC+mte*yM zk5`QPnl3oklGAuPm1II9l)#|f@|C=*;bQO3LyBWXJntv(ETVrPc|X#W#thekH_mvP z>FQ72sehaC=!0<G6;xT5K(lLKd65Ss_`1Se% zbGkK9l_S1%2}bb_|0CdeOS;rqzXz;GnvTqPnJIwh2J^CdJ-<~y$H1u^2;y9XNCZaL z8Ul-df)A@|gSh+i7iE4fH?)T~9N8*u>yzCE-g1_Xge%Aj1pmB*v%&vpypW@ZF1?Jj=#=-%~7^c?Z9dhNLPpMBkgzqmdihbZ~PzovEvlC6aHa7>@{emC%Hj8prOEbNEb zk$gf(L%&q>Q4-*;vg~Jca&h(UOS*1gmOzzrd%56c$JK?&nrJ*`35L)yLv6M5=BeQ) z9QhDRJzAcd?Sl8_c_(uDB(?}X@Q@qQ?v{L?1j<2JhDCScZRQpTSW@8zU*fzO{`Lkl zN^ze%)uKcG-1nKa_Md>AiqIK3%NiZ8diil3M~nQpZ-{GW;*z49+~s0`KMn( zV|m8rTr4_D3Vrq7wp1ehqELDg$%=KJO`F_dwCT%;T9NjxX8Ru{y$8jsq4)U3D0;)} zTZGx15h*H2I>>e0u8)WdMp!)rIH*JtaP&&HeuHxFTl8~cl#C~}7xVLgy}H3CLR&fc zXz6lo^v#y4^I0mjk7w?iCXGdcye*Wu4HZbyCZur}#BpvFNGw+0uniKcRp#gJ$0Y-3 zkjsw6W-FcP2r&_LAUFEYVVYZSiObQ_^K;55jj@@=690YfF)5=3XRBMx&Yq7SAqq}- zPOOknWgA9pd;CH{%~;LreYDU0(*BjpoOVl|){43@Uu%B_69^_#O+IUhk5Ug`Ej&TA zhUhdSMDeXf8PlxJxJ0RcK?DiZ2}BOOAE1}e(BPKHW^%niX2#$VbRFMZ)gL5g7FI!d zsX_-E9jmo3M7fhU?(5x7eb*dtzkjvJG`X2M6MQU}hDXknuTpr-t#`@o)INGQ8BM)D zl}zll{jZ5gaiuw$=gXc04_UDz*QM&2@Y`zy z2KvqtSz&i1v2zX=uehJ~X|qPnv10C9&zlD|(@aeypOA$OJ4-O`60bN$&-_*%NvF?}k+`dmx!GY{;_6N<`WUQeo zZfrgvIM&U-@$%{yk~S#2ZM@Yx&YQ2;Z37?!4{J7Q0?o@daytwTmm z^#iP?!ZPIN#7RY`=EpzW;n`21Ln-<%zGa-{63q&y_%i_eiOrIGeNRiM;>96nCZQbr z7*?$jbjGRmy&D1gRw1IpE5-Y&XQsDGUXmP*N+v`Xt&7&B1Qqp*8;{Fj{R zRuQqalV8&4CK)JO&ffCr^Zfa%&`NWzc{{o0D3ZAwEkZ>%9v+vRhr`B~k*9RVtSTZw zL3PE)MIP%t_`5fo88$?QJdhYdiKy(k_;{Y*{F5SO{iofhr?6+gyD8j9hp!T=cmg$H zgfF9`!glFHZ6)Y>dR&zkfHL4wfj%QiDMs2``Ic z#5d&&I7<%GxsJQ9ik4voN8};jSS(q9Yf$?t>3UcfCrFWBqcnnK>Z7#DMv39Yh&m-L& z-rdQ2jtsE&Oz8Cer>|KKNvWSDyZWIAXQ&6I8=O|^g4_G~$70_ycpl9RVy}2SNk3n; zdXb@dGG2bI-}?zCAcbpYl^HdFY}Ej^$-zkWx+UVxKt{=rHal{s?v~#-8-Rcm+oxoV z5BO@AOZAx+0ja7$oNAiN)#T@dT5=)Y$xLQ;1?aA} zMW=z>=mO?sqAi2AXp3e(sxY&LdN?K}6=*QR_q*~xDA|?tw@G<_fledh8Q98&;2f1q zeR`0~*-YF8ITIDbr_8`Dei9k}IqgE~hTTExSg-lk_QB~z4w;$A>J_kSATzzDMZU8E zHgi{n5FP@eCHr1vBbEm^8fK7W z((?KUYboUz5l5#3;9PMpn}OakH}?P+hOYfbNr+=D&wdCx8IJ&q(x+Qbs+q6bXOaNunYD$dGSJ%C&M}&EKpLn*R1PFH}^H+_9 zuR($g>Im1$2#&=lDLuQXaF0P}R0h7{H<=dxCh>+x*k{=M`?F95C?8%c%ZYAr9|F^Y!aO3 z$#>3dKk?!PVLkyRSr!1Db28mid)WBD`Hl%H&losbI{S8s~xiS*T*)8-lR6Q5a zN6io$kDI8FQ^&kDCaPKlOCR zmTvB&I0^2bnXShv9&;w{gLecQF$(Y8s$Q9DNTQ$Y<3G0aevXAPe5Olfb>jzXV?#R6!cl^ znx3!LP3bGx>NE7g`7aR&9q-tQN#z26BcY6wLZ0E93mTX9 zL*Ix2ZTMW?ugs<|W_OsbJOkdVd61O!4#K-pElqKluOY|K?j{w&Y(j&qS%v0JX~lpc`Da`M2&IDa!HUIuEA# z%FvPe9o`lDl}1bU7TSK$GWNhT?od#+xUjMm{baNyi4h&F~%QP8S zblRY_MG_!nS&cohv+mdn$?)M!_!QqK$MB0)_wE)ai&In)$>XE50I30KmW`;yY_n_2D@it?(m>?+<2ao#;7nTY=OSF2aZe908lz; zgdxq4&bN3_Ioq^EJf1T3zPH^*4&kEXt}sNVH?AJ3w8Tqh3P{*rs2NdsH)a9Y9h=`*K?5A zJ?_W=)%Oc&zmE{6<-vzTbop+1@dCsTUqvKb$;KWAyjn=@1wd01fp5f{{J@JL+(S4$ z@>-eviv5T{D!B;h_~jZyp3WB}Ydr-64O8XE$RdUOY@TKF7u z*8_?dYafm01PO~h(KJX>uP-LwDz_cz1};Vuv=Phxkan`n7>LvoKfNDd=e@V>r!O9} zrF{f(tq%LYOtUSpJ)gFYYTne3i39shtNqlT$C_i^m42L@ANQZ_Npn_Cj+TraVD=e3 zB((pIvgU5kqX|+jq=-0~bQ5|*$wboLORz-~O^HK7&8bm5$I9fVo3C#MSh^Lo33M&9 z&WLbA{36|b!V8J9#CYhWt!7X~GmOP3S2Kw$yqW;ayY%qH-nD?EgOs=}1BeFFD8ItA z44T%FmBh@A?9ZK;JwbSeQ+TxgYt^-ouJOxJPrBWymc^W&A|gzZ>n7#P8&})#l0*NN zza;^pVer4)jTBs=s&73@`q6Fj^C6xH1#g>K_6AsCWlD8D@co3on(}@nGUjAVda^@M z>7wl7?hc2t0I@rqyDKU?4wO@>wEuyZ1ddszphk{n6e-5}g81J(f+N11)Ny1Wr(ic% zM{{#`MG6SFA}i7rOWE5NS$`Cn=yxGrJ8qNq~CjEq#Bv#Nh( zN18icL~_yi&hXu=FWcBtnDYTWL&0^vFq*TZS3#Z2SRE?LBSmX7pMjP`#L_QgsWC|S z^JulpYnqPF(iT(r-X_ju2gLIKTo@|E4C9W8XI&fhc}!F;Zr-9&nRLzX#>z6<1Q z?vK^g&-~5;&S>bo=I)fjLtrnL{r&G@l#5qK;@v!PDEp+>*V`WZS8q)~GK9w|TlIg| zqyuY0_Vtb_8J2MRFUIt4`wzL;KT-~c4HgS1?67`FUo*tggZiJnMXA&a-DDdRYHbHN zQ=c+lGrxB5n2kliz`c3ywaGzK$&b?2TIZ=52F@bi?;;>68skHkD6ub!o%B41eyw}n z1&ty$X@_KVhmh(#uDXOUa*I3lzPl;+-ZE^>OyE35>=e>pRY!^JjT}S?!(*_UlY;6S zWJs(0-IH~@^2Cj6`DM}XPEOj;$4eC}S=|z=?X0QYzRSFN`^nAL0@ltqxRg>5W^%=M z$GJx80ukEHD;!dLv!b{<$t{XIKIdVI%0=K1B) zW^xt(S}tWv_R3KEA51OSjfTkOzV-!j&3ZwFe-9ag z-Tr#d5O?7I=zh#t_fB}xC^r8xCno7`wVlT@lb*f&=wgM&MCQ14=TJU#3-;T>rGkOd z_|LDzpn{#G!kb@`{y6}XBe;Ce*=e+<{i(4}0FgOK9~^*U`<&OnoC(CREJ`ix@g?WM zzzufrLgWC(pp?LGMW!-_beS)DA?v6cW)#d@($D(U*hPfhj@MycdFlDdTo^NAA?!HG z*fN{zS|gOJ`^?pPj3+>#w*HVi?6PE7D=1-`zUS%jhY4am2F!G$v>{2n&Olq#mUl9qy<8)flo=Lq#y;Eh62;4&X1;0TYfCv6s1SulHV;k5=st zufx#lgx%IP2dhivV*GmC-1;ucQD@D5_GLOD(QD0C$;Q?%MVy$*blFOgQUSX?ZPzBu z8?>koJP}+-2}Vwq*uqY?{p#_&q$Ar0uU$h-8de+}nME(qE*ksj#a#)Y7y&s&SPkFr zg@N|&3@M4^Yd$alSx&w2!BHz$;N0vTZPzAOv0-H~{ZyAA;4xKJ&^tI} z!Wy&>;{+6=P{PXOYQdR^I3i^q_#(2!*0Z{6h%W?m4lVffR>%<>50{2|a=}zBruPCw zw#c3sZ7`arSHz^(J*TIOA=u6Va*Vx zo_|yxIrDm)^Q_hiK6tpqhX`ZVTP0Tr%OigySR1j{nIrw+_HWU|w)h+IGEC4p2tehI zc&1o;;HL9h>2zvaPGqGH-62a%?fL4suT{XUkIuL>ygIctL&?PdY9dMAd&QA>o@@Cf z7Q8~x7URABibmZZQ&(5y%tkBhk`1bz&5D!h^Wz?KJB*gTnIJRdX=Z6kqmX~cj$%Z{ zUGo8hHZF~ndjt(-&gc(oSf$(s}!abQNlkYNdC~GfLbra`;!?hb?Bx&_=QEf7d()>8#b* zDhu<%`aSd%N@1crUX?%~rjQr)4IIc4X0B{02Wj%0I^pQftko4b=Ix;NoN{4JU7I%Y z?l*D039N0}?@QIGtt9kWpZ=ynM?%V03S#a?6GsXac=JwgMO7?{+r3$BnwC#osnI9!t(nyeg>YP#z+37nRrtJGxgHU%ncV-GlpU%i|A-v z9>GI%wkMHlNnzFr=tK=>Dh^3i^RWV^M55{Nq}bHpo!MtHOux@ytRx7K8F^MG zOjWvmQ>1GhH^goQ*(x>Uo(q@lG+xk{w#Y4LiUs}&noBjG{x&+<+EjWu+~D!d6A7H> zc9VMNOQQAn07NOUqT|VN3Rk$#-qy_Wox=ad@28urKgB&)?5imA^ra|2-iShnMj4*` zdJ^A9ay`}5Kw7`};y#4d!U-HwLw&KN#49{WOT0hUUj=Bda3npEsi5aUh1e<9NuR+N zQFZkrthDu%yq`#2QC=V$bTZ!0l6TF|JUxPn8^zYxiT>n)KAOG5t-R7&b+QZmq=XnYZYb?7{1a(C}KHNwQweX_| zsx~f8AlUU1?cKiIwpfF77)ra@~efQB~;dl+g&^y|_)&y9{T|au5VPc0v1DhC6@@^GM?c~kRHTM{woc|#^c6RKY zG_FNcbzyyxG&_-_*@ni_DNZd*Zg^*kBDmk-8kK65DW zU+kp+w1Z$FFx$2?9jby}SFbsLEHe;bt zX7}jD`SuK|mKK|K6pi&lwN3Yj<4?5EBP3Y;f3z2SOh~Wwp7U~GZL>wuOKF?RtLf*5 zh|IHJKtR_yVVfG73Ff1Zc93MFLW?D*LA;o%{$;^E?`7YxL*yw#&(#WVPTz{|W#hy2 z(T}rswUE96SE?mT=`OzK`^)s*A278&9o}|qc(w@U_mcl9xu7XoZTkux7lM;t@mw+5 zfAJ*>IqVmai}6S!sj!g1!ZJ6rl&r2_Y8mbgb7|0bJk<-aSg_3`r>DvIt&W(RW@Ixv zo^1%uw{q7xwKD(1NAwY|U-5<`eq@h?go|i*5Xj|1Eke%NlI?zSAwe10FWLCPolRZh zOo!j%0kC=xi0?Ikcy#!z6O)2y2;nCNR8pr3?^Z^MWqCa7xPI46A1tmg$37~y>Ap5> zWC5Tq?J|bYGXfk#9e3}P1WV9S1WeK`nste_@847Pv_+y{DN=*nq*$VbxOqq#$Tr*< zT*?P3LbSGw&wZEh-k8;|J>1xBQ8b_Jh%c#}vs!eGJlXxB2|eIaxg@%&z5M_mG#bic-$q&R-Ay3`6-H0F*M#S588@Ts)gF0 zp-v?Ji`0*e+`F+a`Ir8j-VF%o=?3?!{rM*9C!atuG{R+tI1p|mfb%T;Q_;K+PSe{E$iue|8FSDbw`% zTtUA+PpVNV0XCL_4m={=;Q$rOe5#8!kPutq0^?0Cw6(tD(r%tjf4ZU#*>>EWCFcRF z_9$@+@$$r2)OoCopQA70R$=c0ccuOI3!(|%%^r_2%6hW#YUK2?jIp{sgr*2fP%oh# zC*uv%r(#`Rxp~vsVNF)SOtbxE#7z@uSmIn+h%WQK*TCJe@6Y*ygC>0<4Bizx0*=hG z3@*|+tiM=-0u}8Qh09as=5vo;-C4Gc@0;t{D{XvCVfynCK_R0P*Hmba$3yyPW?H>w zIi9Mr$5Jn>Pd)ktLWlfSMhTDd#M27LIjV{F%;=ipzmHXdaHF5Xoa@iUpB3=Ny+F}c$-1X0B(}`bz`3P zEz1lejYM92H8Mop+kcpnx_Tv7*UxP-sx^K((@n3{#P=3OT0=fw7F=)4y`rh9y~oVu zJoF{OOZY2PVU|qaAv?BA6R(oe2L#0 z)whn@Q{3%nD!kdoz#FxG6wOH5?$EC$qQ=|L@NS%uu)BJw^}VU5#x;?qEq&caa=d0^ zEVL_D#zZ?#X`){17%{X}F(&n-he-SF;R}9qcAPW8cA&~?1fH9z`>EnK#`YS!5kJc+ z#@OTsU9B{pE#JFndU5^=@mjkgQLW(~l8#HOGf!xAQ#2!V8=imbu2!}1%+fL)3)Obq z#l_Z!Q3DG~^YTVU^)OdA*%q;F;?DNt(2ca1G-V=yTi5Mk|%iW=Er*BimLOOat2ga3ft3j%nE#mxjm4vtqEUp z=O$UZ;7U@XC@!r{gI`kQ9dUkA$#$WmsLSm)e}Fg^Ud-SkyebmXLr)i@L@)x!R$w<+ zj#QmdIR`kP0z_ss_B2tqjyIfcmFPNFMG3qeF0g)-dApByyl!B8`-l0ae;;XghQlP` zdo~iL6onDihs`Wo`nw1&&Y?6_qC>=Y;V!YI4D2SQnSXt|pGic&{=etqQdLYZ0@FB;tPhemgIr38Cnw~}{ zIf!DK7E43;($F;lS(ar`R*Fp}B@VV?7HbfH8<=_>K31_bE?XWQIxJR5pV+uBF0nD| zw8N(vHbE>ifwN|&-QFCWB1Bk~mBVdfLv_7<+uJ$e>$jN3=i_|#_jdPM-Sb@?(O5aO5Fq zw&zQ>HH*|X&-WLj;=mgpgF_K>z@$=A%*w%(PHC6X7 zM^9-VPCay`0-V1lm5PdFymZUH-jq%c4(()v2oL^L&NJ3@aClu?X*Gihx*z|%{-v1C zYV5aYkxq}x?s+kQdxCK@Es07$l!?x5G1QnXd5X9AA@${1f(9pLGFlZH)n$LW;McET zwY6+o4pD9oLp8pSuys$@=W7Dq`JT$&eU4S-AI~iwMr9?m771d!t*2T9l}*kxTT?yn zCwx79ZzosPT|*bgP#u<>%q}2(wOXNjr*+qetur+qUhdXprKOu3*NjpLchCIayq%mb zIH!b)MwL76R=q2AY8HHR%Qi^7ZHc)=T4e_$`~PEC*+ZJuK(+U`#q`%i9@fY?OJtCJ+x>x zhhBjBP+aH3Znmd?nRAiQ%SeIk-towz#@nS1tohRzbLWQjeAnMhCA_CokHb^_z#nhI ze(rLz$2klw7|rgtRl0Z|^!5VG_HhJLA08fRx?kHEN&DSlDpW~%2vIUhcRT%F9?#Fu z{a>&01U*hQt2x1*vU74`Yf{&vS-X1DEwpB^7J6qt*01~=xkmddN&GVa#JVU^i{I+kB{~#kf6=M~!s3SSm_hW%$z!0=wYj%Q;x< z_P4P))OYL*b^JW~ht1zmyLof!rD*DiVZhrgn545c-O&7yCT4?8xb9}0UHD@76DU&8 zvlbV%quGBpj=?2^teu{)4+O7&_hl99CR3K#YZg}gu86WOa!7i5qe-&Okhj=-?u|sF z`u1eT{+FVtSu)B^3R~$pHmbpmeuhd*o9)1fvThmihyQL!Y?R|JJ1!uG` zaUw6Ld{O&2Ro7}9q$*tKrTxkybe5{2c-O~7WF&T89GER^n&z{fsWxY!(SrgFD!lJbjeT#hje1F6&tdtDJvX3>DQmhO z8HD6YRk6C`a0$a4B5EEsq2O>z9d^LFjMv=e4ZB}&YD6FRDR*qv{Du?A+jz;8J=ceb zK)R0MmfSfazFx}8C`jY7dLy85VRMglaeE)1=e<1tYT?Nu$Oe~*EN;(%x`9epL`YaE z3U(E5)w@$R&=%WQ{1ROzy+*hP7I!p5`t;e2R8ESXv_dI}3rHo&O;eN0jF{UaIbkh4 zOMM71f+&qML_6Pz?F_QjjUIs(8|)OR#nb^}6W^A%DJY@71^?p{+?9*{zTSn?b`Cyg z=em3J+VY1RjLU`{+z-F`15p6lS->Y<^bqgtf? z`bK_#ryXYY+|(>Ez4~q@pY!;!9jp0~Xl>Xfo&4I15GG|EPb2YBgn7|&{i*H}oBNX7 zWZ!P&{O{4vw`Fa*$At~N9LQt>G0h8k`Qa9>zbrT%fM?GvX^A|X?o)5%u=BdMSFeZg z&AidB5eJiY7U(OfC<)9Ol5 zij>3ZyHDgAfjsGL=AB_aeS7CfBu2{z(T@5j;;OCSuM-kGlrkm|C})gP2u=;|MV}*| zzyDOo%Jx8joOruTfU=z?7;@SCbIYHxruc{)hAg>{N#371B)#n>d3@D7$68D&)P^vm zP;q?$5;^?ads_Ju1}#aO1nDvdm?xYe6x|=Xd z^6;4ULGca65!<4`Jes4JZ-OEtz~3I{yXUI(VfU`4M2$5ysg!?coOL}_LuL2UQOd-~ zDJe-&lo-f3c0c~9Dc(p{5&3#G!5d9VDrOaYe{?c!x+v}!rlZ8i&yW8hA;Khnn)6m! zAd|s6MFKyAchbbqL5(HVvJgIL?3ttLv zFNR2QY4tV~`M>QW_j)bWQk(oLmgj4}?TRs{DF=W!%b#u|GTJlq6Ls~QP*VeBUUd7%u$TjeWq46ionDej8t z(uA-n?GTKivjdq>Eg?8VD61E1=e4@Dbf`0bUFnbAW3nfVt$=aa0P^o&ckhhxI|^zM zU~JaB*6p0k@UdxE6~A+D(AH{DgfBpIf#UkZ*srv=?cGVbSU#C2UYi^d{#HYQU_;e8 zH*ex2hV%dV5#`37b!lFk6Ax~bN)|PF+`wD&IfE*$_@13zv+A*hox0mSK2}?!k7!!k z4w=AAp`O*sK_qekI`ZMum0G9qg7M$hhxH6|KNq+2mVs2ZFW>f7oYMF#9QX+Kb;b0* z=20|B*+Kj1J6n1=C{V?^Lj9<$=D?_Ta+tBPV_8Mk*xpINlO!E1GXeD zxS8ZC0s_Lc!ncg7Tp{hxnL=6pbApUQcPlP|ZglDJF@A3^cl|$a=JfZb@>rFxBkMpo zY~e{s7+P!zx~5EcXh=>=Z_n{gDd$mJtPRr4Qdn2vu_nS=3#g*cwawIEF4MFS;nK>y zHaTmMyO4<9Pq!y#EiAY62i7_Kd>J(>Yb}>eyUIyg;rNzCiGDm- z%4+p=hSvA;Fc211R3MO+W;?Xe^YMLb{dR8qdD*4x729}9e2OS6x2KXH+p5wQ`l(#Y z8K%3u57e3*RRZhs7X0L<4qdiO-cD8I){W+W0VX`f`u!&F=NHi|K}OdL#0}@NwY=?n zEn)MM#G`O`?5ADRzxm*1MfyL+%pk}8TP{Muict4&X07{>>Ygf00y>Xy%^dD$N1aQZJ3AP!Lhsh(yVY*2(fyfzydTa|JFK`^)QKIUU9>(A?iHJE9Wtq2c0| zj@|?sPUmS~4b64!4KhuDTN3_WMr-B*CEYdTz5GZHd>&ASpEjxL*vs_>4eInzE2c%n z4!^!UMI)=Gq^i|ZfJ^e#ctj9!+oZ(Y?`Atv@CRci%6U8O7=hL1M+3m*rKU3o1i?=F`XY)FaXRx!8#qwn*$(f#g znP%%RE2E>V_zU0{QlihEuHUI4#aqavH^CP)F8Zgvk*|LcWK}FI5aSKj)dibV=kQ4# z<~9ZTg7Br12_1fl3sr^sR&YqStcP!vD}}m}2>-k~y-eOjN8>MZlr0iBjD9?R?G!L@ zb||fwhdE&8Zw?Rnt!QCEeYvm5(h60o+j_V)Io8g)=BkN3p0R7f`+Uq9ZkpS(a^dS* zW#VYM;P&QLZ0`KJ)pC=v+g8vT{@h7Bg>o6bG2NeAf7lQ#(9^>;eLE&A>EF3N#JwD+ zXrJuUaX{yeS!6CL`7LPvlHnNp_AeI&lEP?Zol-wrJ3E49gp<}{kEz%G^aYg!jKq?; zhbH)ipF2O-k30g(-PEV2VesDDKjVRuXJ{slYV#l~d)9njA{-}(pVQeNMJG0Y)5E)m zkF>P^fH`BaTkze1@Z$-`G{tkDW&b6nOo0NScks9Oc40raY(O9S_C~VZfXAg2#0%nG z^SJ`jwMrHjJsq7~>!IWs7Lq+=Lsjo%^$(4$2_7`UqXYl9r?q6a4gk8VGn&j8*O?9E zc&sk=u21>DHoU;5Dw82~np$h@2)LiF92`ScYF8y~)CNTl3Dp6hol6rM@^2)H7;Q-I;^Y*nD zr2lo zGlOh8{!l#5X3y$x6!#EOb?0%@yoHt_SlAv-YOL3)v za2=34(;Z?8>c&%K*ks4_HqZ8T@KO-n`0TwCEoruyu|CZAP3lYkw1dB{9s`fSkXVIF zdvQ7S>#tfd;e^2rVu~<_pj!?EFUh<|=D<2O3Zy445Op)lZ}1^TMP|t+GZ^C{gb`^_?D83P>#-^OH_m)EcCFQj1fkHMx*@W6$6aS zT3%k>%oYt&vjC+5wiS-x@a8d2@H9agt*8Wg5yK2LM~2jEW{&a;QtzPp6IK~V2IuEE zKL4lXwZjp`fOS>7Z}Udp_7|H2hj{p6CF4oK@PgN2l=LKDL-mRxAEpmHUHS)e#FqDs z&x*bmR1HsAF0!|dnskKc-d>?a z75ZPhS=Cn`#o~l~?$2p%O+ul-VN z>99|O%DzuaTu0;q@_Efpw1BX0ANRNTW5~s2XVSMt7G%_n_Ie^^uCF)qzUGrhG3eAt z%gB=LeU!pnC<5ZO40tQ}_EW?sS9ie)t{=RtSp`6K1L$dBO7NTHkQ<*i&?1e4!MIWa z!hj`N6vyttQqYHUW+gpy?fA* za%bWKR0n@ErKyX$TUys63()oEQMed}gyv%9&xggNhT!MDRqr$gOpgFJ|Bb#-XMdyQ z^mJao=X?9*=5h{xL(8e$*m-)5?{am>94@;`9+qk#Hv)k}<}W;K5}mh5s>@`zh`yYbisJznI= zW+o>WPwfnmCH2*O#b;+S8r@<4L^g50(Ju;sMy=1nUnI=U%--8QEeBz;WM`1NhDPd< zYh*+O9>*s*tthmk*->4rH25EUk&%%VD+<7XrD94H)1x-5!;lGaNJ-=8kqLPWJpQ_= zLTEYZ0W}|0J=|3`RRwo%)@dUYcN5#T4NE_9O5{l?W_)~{bNukjLU3?!yW7$C(N#!y zBI8mDN=mIvw7ky%4c2sOKKDa+A2Yg!fmhmPOSpH4)StS7=Mz~_aB9y`p07r;DhoG$uHei%Ee(=2`}E zhOUjqN`#)|WZoX}D8NYSfC(`v)$qSFxD4p#xfLQD7~fIhvX0pJJut|c;F2kx zo!!wQ8z`H^@;JzHdV)pR1uV@Rts648#3f6=U(~Jl(&Om&6_c+bwejNZQc6b5Z_Ob3 zs)Mp1)Ya9g48gK_?346-zasNYe*oc7$#@^1#EQ%iK86HtF4UQqxWB!=a3EAnOD!Gh zecl!z3^Jt*P0B4%2!PF3QNrjPF~kRvEewFcQW+Vi^oLmBZf6XK+yo|d4qls3A~lI^ zl78Jr*DN6AHxqN$^-6n5f{d2CLVH9zKv4@ZCS|dP2En5~*MfT`R8LD0D2SrSLXv3m z=jF`G#8t#l$ZqYV8>cat7zy!5>Zn=m-2q0e82N))m!3x<{t1~#;6Ec9k9QLFBG8VK%u4tsS#SVVOktN zdI1pR#Xi{jG!#$IXRWA54QA;Fq-@cW`{};f1e0Nga{z29s%bMCLeW8llso_RsU?!D z8+pH3%Lv^OsB83uX0a*p8mmW3Y?SXHKDgjj+k3U&z7P!HRxCo^`;aN_QegV8!>d zCu)4(E84oz?;~2fFSmAPA|{h2D?0K#4i!NO@f2isWwilCpyL|*)GZXr#P->$sU>2m zWCKVc5}lZsIm}=!fziZyL@`0Sptu-B;>rMvLiDlz6Fk;65Wv{+21m*58kVomd!meE zKW#(jfxc5g&5EN3Jd<2oMhUFu;NYO54-7FaH)+M=VT<&wtOj<|B#Lc6e1!AK838*XR*w*|9rT zho4)l`o?~tR{V~B%oQLZX$QBSE-j;@q9pKWkVGx3Ur@HUx7YvpcushKmN6D3;&-Mp zy1Ke5p<8iZwl~{1d_8gWXAI--y3i=H_F>|@49o&J5@qn!sfFnC^DpHTAXuxMA?icJ z+DSC@f?!zGP3$#c;{ExWJajh%=Wxgmzimt#UUqrA13#axwB9!ok|SIl&UJcwSY*E6 zxzE91A3{m5$1T7Qj+*MiBO+>~Vy>z(t`)sNZs4AS_s|fy;=`$_%^|2%HVn`9|QDWXFT=&>I9T(@6?N zA{g!V)^=2l2oI0m2{L<`ktG#>o$&#PMj$s)Xrc`3&upBx1rf>2C*BXLe30bgm;-p8 za35mugf^p2FaDKlAdD}XXdll9@N4c*`FAuAUu+%@D{D5jeoIga^HI@Re)!vDn_jQP zg}>h8G9{dzni@KQwYEq&WeMcU^GE-;JAZYou7_R1j@$hi$tV=7_nX;nZ#_2YJaXF_ zMva`SF=mw(e@qm~M%*p3w9M})4FbUhg}nYbVDF)qOnv1hRAxb;NwfZO12<^KJcUkH zApTlsJxk+*Eq0=%W4LoZA!#mRfjsatbWml&I)HZyV7yxW-(F*4kcdi3a{&mAEfIk_ zJ&M6?(gSAkhdgh?WA&?S)JImLInZEabaelb=<5Y4J;b%@nT}$_C{U41Ox!rH=DT09 zmBWX!ZdANxmI3k~()@aVW)nRNiO=4l>%p=^mY<-`0%;X_(efz7#oDf(tga* zK~c$egto1UU5+sMWbdO)^4d8X{hCpW@5;zTn&CA3PG@50XiQKcv8{Dwo{gXE9iSUphJ|@Wpi_Y3ZVGdsLs;??eVr=sK$DRY@TA{NCUqp;|`=c|w;$U~bLb9hp)70j_ zM?xUL{UHt-jmf@FBcoMP2gMOdqJv;K8Tl=b-8`&gAd-`3OP=!w)}uT#Y!(vPsefZ z0oLtO=VV$H?LQ$2bHNzWO9K62$YWDe{)gqI+x#ObDJcN7I)|+VfaYrSJLr@4WR3d2 zFyd)S8Eu}A`dg>sg6-Uo8J_1$1V6(eK=z>u00cm%!5j>?8EISq>nI-sIc{_<5mS(Z zL){Jy2j@1bw?eBjCHnoaz8nl7D>a!9q2S5ISO45Zc);aNP(;S(0F`+_>4g?6U;|J$ zLBpw3id;*g4+>I(`b`fN3$9gDa_Y=swPW#{Apls(Emxj@LSfJpf7sdCna+)7X|n>v zwBeHNJd4>L%DckBc+wgJ0I)`2I;7E2DH;1*4D@YXMb`+4ejyp8_q1`mAK+`j|r{{V}lUJ9=2%!ev4-YZsz+wIx>dPdAFlEX<1px63dCK zlJ{|i0O5#Ms6I`*P^i918}cz3C$+3dHs0@c@pBE~52Mbu`g(P(cbQqa@tag?T3XlD zq#zJvB)kqQCoOBMtuA{lt6r753^zdk$im|Zkiw});|mR+Q6Du!VG=&~nAj~he~`f~ zZYI~RHi-1pvPx;PoiF4CRdN8qCZMNWSl`g#_;Vu+Xlx#zo?xM%kcb6b0T=`HrWI}U zwJBTJmoSgFCybMvP#Ay8HE6ZUQ0az3agF#s4Wq@p-pm`v6L2f2h+)A&(D;8C3cS3$ zbokp=F43RQEEXQ2!vYN4tuaALOH;GaaZQAZN-7nZ<>z`(j-W?{ga#3yX&*OC;XI{x zKbPQrhQkmHr_V%3C*ZO|i#b_tiRO^UZba~_%ehgP8p9@j0mxVKKsK-I{SC7@pwY7r z$4M%ysHpH70BbAx@mM4~rV%29kfMBnf z&a#=vG@<0@_xiAxhYBg+b=tZYr4fuigU}bLvw#O}-Wvuk9JXD?7wpAKOF_c_P0rB7 zWId5m7Ni14E@ed?8Po%$i!uq~)YR0brlyK%EXgpW-ZoTZRf{c(Y^Oi=L?KWNK`YQr zKosG|M?g_Qy$%l#&lJf@hHO_5{M^m5RrNk!?>*~&Bav=Q`Ymfd8Iu30)9Z#~MHJk+ zmo9;YD?B!XS--hQCa4Lh&oW7z$eZXt5d8em6fJ;t#BSBy&(9~T zizgLj34_FwR>b|Se1r^x-6>AXA^AIsT*U~CNA$9q+*ASwNLq0~=LROx z1WazrnqRxi-XyNUm%ykm$lL0k1HaJk&k#q2mAGvUTzd)r*#k|HRCIQrMuP1rxZs>+UQ+kqR(V*=lrm6kxa zKihuR<^8aezUDl}JTo%`D1D$HKR`+DE27AP;19>6Q2zKh18L`Ev+a%&L@fi+=$s$f zWdV&=#5zQN=G2u^3drhjw{arZ`~>K z*CQ7Idaw$h-laHJV7*rxwkrexTx~j{MM5~xMfL|{QIU~}32p#YWu@K%F$xYRk&O{n zZ0-gKe@ZbDqv=c>vHG0^P(G|x#zGkZ!09(aZ%XMyDHHNT2_d@D_|98l?*VGnFjp^Air|zk>A-)_0aw@U+l9v(M0GQ9xQoP z+|V2Q`vmk5-oVSHnRl`6<0K?x-oQV+gW;POB31`IbqJMu0PftM=~dV%XNQ!84@ zEkl=xn3|UO2k}8Z@$cE(Lu96uNkR`*WJWe(3e4U)TMB(sQLHd!hroB!K@;b~^0xY3 zP8S66&YWOK%L#MwMl+m<(tRq;_AeCE!^@Sb+_?BhZYM8A{#Vle|HY`hwLy{Jtgm*n zm_Btt)aXB+ME!NSea*V%_w`T_nzpso3it3n^L>w@;aRo!MR_ZVX+p6jaGS_ z5?whdINiyyZ&FEx{kynxUP7#*B(T6Ka*lW0etRc_ZaV+G;F13(f6Zoh#~-osRc_B-LYylRtlBh%Y|?CG!W&dm*{ma*wK`QWt#e-jmvCyjz6c;vI-U`6JmA``~Tym9wi3 z7u22)%z%^g)9Jq-@cPo3vNLf%XoPkagdrU<^e{DoGJ0w0W6m1kAs$Hq+Ui*IuKBm` zaA64g*BN~p7;ev>Cj1rRtCn=*=8LqrM-}C=Kiym?|LYPPevu5-e0Aqfq-Vy7qAn+s zU)N3s7>{*cJseFR;IYN!2)9xbeE<7s%SZ+$Q4#MK)VveA%JL@MDMWar!)?^9=*>&r zBM*B)&+$|0;@G-lPuzdq)t6E!tv|oNJ1%K>Jr`qn!@6g@j=kO)OzTHsr~Y}ncb~dQ z)^6QT&&;%LSkw$eQ@Na(nH;sr2nh*UZ1`LmG?tIOIs#<4^78Uh_NetyqYV7l^i6jU z``P8Kv-AoCT)sVzW!zmNb!gn4j}wP^o`?Wii$_pUL;+Ai9%74WcJ{jFx#1hQ3pRhm%g{epT(@R@TEaG~cvQ>AGU0Tr z=HP+fR~AP^Q7mYB4dgM)*V6qJ;r7Urhb zxrbWFHxh^BvcsjN9PCmdG^et9ugwA9YNV6uQ5d-fgVwq9loTjm1XR>?Ggntv85tR8 zXAV0T8EEQgK;Y9)VkT1v!&`9XKI?@g1%PY<8<~!#YDvy+%!jBp{c;S#4*+{OKm&5a zA#oV&HYIm7e98UoC@uc2XQL{jrExJ>+p|3?mciQW6$|WYnWXuWN2%eq(8%vC*ZFEglt(Hl zDXDcgp!8ntP2r-7I3}>{!%`u@2&v)@XTK`&eZBm|-dMYViKzb#;#rjjAN?0JcrZFH zZj0ZG7apVb53!RhZd*{A8r%gJz~z`JWv~^LmBGQRmU$i>dgMRYYEz1(<=dET%@(XZ zyX=k!GOrC1iEulBd{`BPNJUm07h7bh*pu2dNbUGy*sN039Mjp^31BzV-St)KW~NH^ zDh6m@j4k$=y}slF)A2=K|z7Q7JIN1Y>mLc zj2WbSaP{yF0vQ3NRe5l2l|d`UV4-xhNwh}K9;q>>)>fOX*Kk?_rzuv%+HfM}jJ91l zb+N9HZ&`S~!QeCV2N4v{qP7fv{s7dJdS&Rf^WWL4_rKR&iWvyjxqygESP?VHZPyS! z(pPt{H?DmtrJt}+U3)x>&D3c5YeCy`Qm&2-LIhf#zi1>YtJioQf<=zuOoz?AhtVpO zVj<^&PO9{9NnMZOXQ}rx06kOJON*xEOfQLs&k3pG=O^+As+43FxgAc{RD|TaFvRA^ z#3%grv;c~7D0xBU(^6K+Jcn>w~ zQ8)d%05z=tBLfor?{Y$(oIG?#P!0w+9p8DDORyHWF{C%tk0sr%vyZ9IUbvu8=$y6L zl05D8eoS=q0#W6!U%vt^#q9SF$%Vz-325kqi3v2U8lZuJlJDOoRyA8uuEUrVu$9O@ zON?@xf#4S8=Gg=&N}>`hopQSgyN0(A@h?eUL_F@lVy=EGON~eBni`>o4dCq%`V6%` zKaV#}xO$6X3`ID^?Cmt$K#f^_c(Kv{LdI~Z_?6EKWp!Fv|H41-=xw!oa+^KjQVmDjt(r* zMA(TP1}P;aq^_NVV_29Z@`iq=yIDAf-)FUxRe0=<0IQv6|??ExL zY-VoG9+C@2KC!7{;czdHw(56j5Zs{#i-ecYfTSADs(zU`GBT1#*aAjM?L$!v|NLl_ z(s6PlJDwW7P+Et(YwLi9u|FGjLc8stv1Bh?K#k~v@?zl%cbU6D>n^_l$gM!%beCDI z(269r-DtcPEg?ju`n(YKR`T%~q*(VMPsDdH2ESsP#$Ef{@Lw%8*ZuodN-f_u*Zs9B z4Lhs5z`qZ?bdmG5K;H#;BDB5){(23TaL=s|%WAbgSw;0ycuSdcoR7^=va00b3DYf9$P_M|HV4T9OrlpeZe9`0mwp}-7H!vHD9^^ zr+TxXo`?EJ4)WdxdEx>cuh8VSgT=pU=Rb;d%<3MZ3jY68bEh%ZC_Uo;!3Qg|GWGjES{!_em^expG%CKwCn4x#{6SgK#S`6?Mm_RZI7)3@gG<9+;+T1 z-#qzw=Xkv+((=ZM)1>1eD0p|CJG%6j-LU4b>+y2bp`(neUt|8|EF`TcKE}`Mq2xEF zay>L`)h|D8%L_48WL%GzR&Sr)ay@JPhxSQM9Nu2;1+I*mLQEyvA0-=!O#E_(^J{1DjtHOYEf;q}?^&oVB|cItdb zZNueRupl{xq$tK5J;iibt@o1~o=cjjrP~J;f23HFFn8N{UDG~a!6i1+#Zcy#tb5*) zjw}%;-c!SiL6>5)i$=acV}yPd3oI?y%0_kgTH2H0kyiJp+S0CCXT4pewjy# zf;L;gjX@}0_!ch4NgfBwX)2}dDr+lmuRU=#0*LF)!M z4F$Xaa%DL3M?fCk|5KSBL+1xPhOWRT>ch=wR+(GCJN^x@wSz!XJ2zK=`)PIU^|l27 z7rmsUq%|GNcB>r^0H3d@tSqw>VzOfoc5VI)v#6}Copy;K0e1nv!m73o*!g8w&F5%U zjf_YzFfa%RveMJTi)Fv&l$DkB*lKEG)fWPH6^*HW4e&cX!OctjfDQi|64kCl0%8E* z0zkay5mK@EoG>+*w8|-kWRrjr@J=?weo_P4)iPp^PjY~0=|_Ne@Vhq{mXd-381Fg~ z3Q8E}izwji;$8JDny}0U$SR9;Lz>=yJh$cRgW1pH83hWfV8w_BSgc3r@%3&;+QpX@ z>t6w01(=foqYlqHJQN?mng9(A{qE#rc%qBOVSao(sxkIDpw@Co0aSP4x96*BsIh@; z+FVbG)JR@1`%5{T9rxXdY+C!q|K%iiAJU)fT9(=I&m(a+Wc zQP^gbA3~7K{Y%RBYG&H$b#ZATQP>ldt4O?$*&qHOxNlsJv8F#{pelF5BJ_S44Held zlKl}mZ?I1ZY6;{q0Uzj#Eio4Q7?GTm6cgKty1=2tw0MyS4r|{Xc}M|7($4t+FC?~*Pq8V> z=7qD2FBjSvM9@2kL`g}>&YtNnDF%JPfGqCg(}9EfnGHM>>2XLrAaI=~RX*6{<-C^X zTYT<)BsbuCFe6V$9OkAYTf2sKQHMbL&R`%%Gk$%%sG(a;E_(hYRK)kuBq;-x3#_vH zXfg6g@*7M>YQ568+Zjq`R3KSu!&rwKO<$B4rP*yGBO8KCruN6LQTwVvL&_x<6I)71 zNVxV}jHN}I?mk~lg^MW^LQc~P4VzD=^6AtVF>8UTQz?&kH#TbS8NJ7^%VTIxl43N* zcTVPU*mlZhMlRQnwcQ!<3wm4ZWvd@LwLOtPzO>B~$-uy% zjzeB0`|)E&{UlOeI^8ErfDsfu5o8DC35cH>g>l4!-vRn19^l0+a_~jy)uypuvP(Ii z<f!^RH&qB%Co)YV!UAkW`fp#$f2wQ$M!*0Ku$I1pjL6*t<(Z?f(8oN9(m8N%i(7o1F>j#hUq9r()faR*Kg>dp2Rg z1Ep$kBUA)PynwN0Ct|{q5onm9ftOX`%TxgGS`qDkLMj6@APb|dtqrUa<9M(qw4r#? zZl*>|8_D)3O7)5?Dh>{eAoAkx-x*ke%QXiIQXf8X=iN-cS*_$S zk)X;}MtCxy&J(ZDsG;R<`MoMesr(TAQm;{}JgP4Xu)S|-Iz{gOCBo`o3B{;}eyCVd zP*CI>4Oen-aBOaFf^=0?6Oxl5X)E5F(n)})fXAfiiCii!rpgJI|72#i32bXpqpm_D zYXTlJQ_wQiXzcM)6Qhujft^cXFokmt;2=|DwTgjS$8Mv3(1EJ-kZ#+q#CoF_4}-#prBg0X~)y3jxCcn%3%nvX#rd+tycpB+HkRP zH#%7V@?6i*uqsvFR*RCXbYya}nzt06%>?X{+_jqhC^i$=1Vx^sE)J9AmKn%#K+Ey2 zV?|g1gbuOrL-I2qfFM2miA_y6h@PL!5tPh~%V``7VARFR;I_qq8q_V3iNOo>8BS$% zrZD^<0tHUp&zP4AJb1)S<;cV1Hw{OC(_Qf|+&%hLkt17aDwzrKa)LW+FjCk96c}e0 zmjZQXY!rYQfq6zFX%Ge6RhviDqN1Yo^zsyemsx1!Qd-K&aexj8SBC^Fmpcr=W0AfN z<(oNqoK8El5lA4<9Kake3WohTpm1d|i2;l}rQ-V9wL@XE1o=IPqk&lb=8$8F1mCu^ zQtiy`=$XetH+Xx*&@_MDf;)AzC>`~_NVb5r>IHLy=QF7b`E+|aT>u&NGIwiLq4Fz;OT28zzfw0OsZLXIf6{ zOYBgdyz#w58bc#S#_gpCr&b`E#PGqUZlulp(8B_*YsRW=UM22+6^@~mh-uw zR@03{gHw3&VtXKlMj4mxN`Fj{zOJ#*@7leg>mSUF>a!r_VEL}vSl1+9*s+%p0_qx*cU;TZCAS?K1v~tr~d8jZc*k(C#)g&>s$!((dBvwxM&h* z`LD$DqiU*gBCu%#p(Xk%wr_lDA($j|M`ve>L9m>zxom)Rfa{bk_2>8RuGiR?z)p{@ zwbqtRKB235ToZ4ayS2y2u08EH*>5t@Gyxp3c=+BgRgwI8pN|G!PG_7H>zxrtZR&1N z5yKhs6{6xrlUdjyu%HFVwf13i$`C|F?~VQap`Yt?hHQl;!TQ!iSR|B5?zgz=q#xKu z7eX>vd9i!=-FBJw6C6Ty_};q6wlW*7YjL}>L$&GpBJl;37ObRzf&*!G9>vCOjTFE3J4pg5muRsKKzEtpH_3%<<6Zb*_Ukr{UN||`x&=P zW%KLO@wLujxs}{7-A4zBkfDSDN#xZdvfcnP>lz4@LRfQ5vxNNN94a#0iQ3a>Sb3x< zGzQ;`59Z3o1PaXtRIXxp^>p}pJX#wN7&Wv?5i}eezqDm7EjhbD+dDf2@}>pLrw%k! zRK?$yYOFEM=vN+of?7n041PL!H`JGSC6*XOgYyjc%bqc%>Gk?-pzzTuwZtigF+{{7 z!BEiN9t6H7N|y&ArX1HBFLQ0NnM#BJRv*1!kkpf#C2nL~oJ{ihmzKYO$45sMR77_i zSb!7{P&F%;I`>9i0?4|F40r}Evv^cmf*(|dfIuO2*KPF6Ldi_)-@=$*%c4USG12d) z*+asHFn{qC54#TgkXv9CLFh5C^}5U(b67v{R;+`v z&Hc-Nq-|CdB-V6y_rd0tZ;4tja5RpKTI1p4x0($gxNtzJ=;`UHC%r)Q{LpRqu2d%) z!wKv>Dc3lW7ZPGi5XHv90kHkf-d;32uu*@Ze+;eFOL)jDr;%5~T&x$q-LCkJscdOc|++meZVPVxip+ zP1f|=BhIALw42^yY}-aDU3HCCGZYc3;^Kj2%0@=H!x#x*uxODwza^~69Bav~0gkv0 z-V5v(vltS@G4snapmW2=_j3Kn5JzdgU3(afV0L2Rz%%iuEnarLyO0G z2JfH2WTu*@zbwr_5O&|+#*n0wfh706)dW}*LD14=xZ9?{-cg_#S4d)jMWcB|r<9TN zg4zhIh`bcHoQ52poWw!Bh5?t+XeWp?g)yU%@$vDImmhh&IZ6~7xhAv3Q?`M(24C@E z9ThO}w=MKr3VM|4$O4Cip&PRR3Y_#q034pHa;mLuLw(kr2UB7)eRM+Fz-ORdtbsii zyAb;ZRy)bW5>V?rb5Y91rHqA@id$KgIb>&Mjv)FLQv+E3R~9f@AKB!`0qr`x{3$9wcE<`?B6J@X!laX(32j*WaZ-p zDxT)Udf}xoW9fGRITol602+7XS{PbX2P|42jqz%d%IQTCe-~b#Hy|gYZ@Q-aY0-A7uD$wk; zV2i2;F7pw_LqT(5rat*8x>hUwth`)+g{OJxF!_BLywZRkRMi`W&6v>ypa?>MP1b5P zcNwUVUWoHeH#BUPwXUcCnqL;{I?VJEDNEj#5S6$s$`jSzsoi1PHAaqDDI--gW@cVlzEER-ujQ&S9Lk-4GotkIBVLLmHWJY#IT*DV z4s{M(1o$*L_J$O&xD9B3iwRA~YvYodiR2C0c<5979GJDEQ3e zE^8_|(M>5lyNm3Zwt66^vIm?h=$TG#=JD8P;Q>3V!zi)_u+8ZKl)oedG?DH(-uHJX z{c~Ni#`@u4b#)I-ck?{Y43FbI^>JK`6ciFHapVsP-qM!{sM`MFcwf~gedLk#s4oLP zA(~Jxu!#q~Z(l`~6=NC* zmTMSBmypvB^Ou>^5OX8rnT+2Phf7XQKI-(6{{i_H!vq*1vfqCJ@IvNaB<-jM6%EbY z6Qu#)*HmC%he6=K?E(2;GtEEY_`f?N{y&~H04(V`o0-$b%35Mi^Iws~*`PsfU||E{ zWd$UmVl^QAXz$MWns*fKQU!Vb5Yb~2>f8TuvhS}cd~X_L{;RnLu7i!{CVgJTS?dW@uu%XMe1>1C6s;NDoada5GN(-d#7_<=lj0v zI)8lE`TsY|^?TpqFe_$ixW*4I1=LE$(N4Qky` z?FP)lB%PA^_#^3bdTp)7cp?T+v~tuyHjP`Bkxk9qFPBrFW;B)^74WNZEYui z*!jeQKR%7cH90Ydtiqap`QMTse0fw*p!=lF=yIAgy#B)e6ZyIBMv`FN7H0u}6;{jl ze4{naq7b{iHel!FRZV&F3-)g{3Kg_N*pZlg0-1WwL*!0MyP-j|%9*<5eVTVS5&Zo8 z-A5C-DVQTGDN(ustCRamUs4M=n51j&0620FM75{YFB7XjyFSC4{*Y6v&WPRn^}XWx zR>tNFe&W&b@xw>iE!K`671h@Z;k_o1Ip#R$#I*6j+J z>F(;{*BO+MGkoUOgLEg8lc#I-F3;(rLYCq|ah4r_Xqlt!(gC;mofX3>i^mUc*I2MF zI00Z>JT6Tg9v%jr&b5??Ai{rHPQko8gF6J!(#ZpV9`Ax4N4i9tKu}&nqHUDW4)X{J z{hx>YA0b1*UMhRBe~0zhXyc30t;aJ_V{6*=zH9tZtGDI8SKmd8j@EbvXPT>G+LBk^ zH8lmUz5PZ08+SjOs=J>Q{UU}I6Z2WS zB)hXsA1a85z2plT8sH_d$L-Z_uVyh%*nY{hQc2JGe+ zU%B1cX`+1=_C`OG-ml@xIXbC1dtwY z>-;^QE}xZBR~L%YpoCm6;sfygv_k^SIKlRgj+f0Qw_VSW9}CFZ zdX#hW@d+&faJVffuXJ_U+CMobhmQaXTyk}Md^`Y=AVn)PGc#RXXjU5JVu!~TO4!lT zNFII6@-jd#x}v1yzWW^FHxN%@t)4(+8hB+%>gs2++1S{ibD&jnbZ%-BA%<_-U|U1a zkUCiES4DJEVO-xbGT0(;Q*i%#@Os!i%NMwq27+KU`-(rZ^D8SWv$Dj55eZ#)q~o5Q z-cHXI>sJ#-u#N+5smv9F>j5*ytB~Sztv;j$^HXbEXW2}oT(GYD^KQx0P!9(A$Q=9v zqQIPk1GW6dfdpgg-d_DRZ`st+t*>2gvkCqlV=Irz$)hAuK?SEH=!<;zMTRwr0nMy( zVaElx7m}-Cmd_-ce(4@b!5O~+B3<9%rwzsLV3l3 zwg4xUYt3o7`Z7Q9e++T$ zbf+2LgE@fReYzt{w}M5$-=1;&Ut*eIp?zsND=S_bga~7$jZb1%0Y2V)-Z>EHzqo7?y-lcpyJBaVHuv$oB7o3m(YW(M{Ll^3hfvLkOdNWocw z)o(O&5B}C&i;K&i{>ez-`|it7HO;cpUJ5>$$P@Dlm#jEK&@w}R zjy#ltG~9~Nc8%`Pjdcs{uncIK)=_~gtApucoBCfS2Y+@iLeR?d+b>>Q3~!<&}fFT zObSsRXO#nn^QfF;X709;?QbTW{|Gq$?n8q=OjvD>xfFYPzMHY#8DX@33KV}^yB*#7 zrQ>dhgJ}ZKr>WGR_1JO^5LR8Ac~OH$=$(mBXxbg@IXxVy6~)29Fhl}LPF9WU) z8(@23QTrKW@QWz&%mY6oj^G>G*DLSbeJ4lePf!p!K%6ovpRe6MsEcTv)>B z?-iVC`Ysot_r_tZ_aOL33dZ7Z)^hi$R5m#maFJBu zOHVK)p+d*&OuqNnE&J!}kVWAe^plhz5;)R+>52*VPmfDMSfA3xNfAHlTl#`}@6$U^>`#cZca(az~%}8;tYpz*&c{xZZPfSeMXSc^( z6$vQS1vy8Jo}<;k<_2>J3i>+N9w!M{BrBB6&D6Y);BXY8aSeiX=8?h62y~k=ICuP< zIB4CVMX>WDBnlOANfKhXRip(PfN;!-9Pt0|LLcHoXx()Eu;=IB6=0=~^hQTVPfwrK zuq(08lcp3|q$xrzC@zu~K+NX>Z%im>MDj}(V^I#*>^$CI90(gW(3#Ndtu0AF zo+X_)5mT|dtLR=Su$m6U88=+0U97wz#C}qjFROBUPE{HBwczzM|o;x9>T-3TILL5r*G$v(b>w7-LvJ zJ0%`_Gu#AFFR0<^st<=UHE;Q`&n+M@evUID=udwolQenu7X~iz@^}wFQf|3{ zO=5zv#Ck<$AVim(@Gs$CI1K$q&Fpt^5?Kl~V;2tY?*0%T8zrVITpAeww|7EL7+M%S I(K{FZZ^IG}RR910 From d7a12452b2e318899ec6e9303639564d81b2d4d0 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Thu, 26 Mar 2020 12:01:13 -0700 Subject: [PATCH 019/149] Feedback changes to Kiosk Adding Lavinder's feedback to the Kiosk doc. @Teresa-Motiv --- devices/hololens/hololens-kiosk.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 81b7cd49f2..ca615c8f6c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -33,18 +33,21 @@ To configure a HoloLens (1st gen) device to use kiosk mode, you must first make ## Select a kiosk mode -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. +When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user in the startup tiles user experience. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +> [!NOTE] +> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) + > [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. +> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. > > Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. The following table lists the device capabilities in the different kiosk modes. -|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Auto sign-in | Can distinguish different users to use Kiosk mode or full access | +|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Accounts may sign-in automatically | Can distinguish different users to use Kiosk mode or full access | | --- | --- | --- | --- | --- | --- | --- | --- | |Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | |Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | @@ -52,6 +55,7 @@ The following table lists the device capabilities in the different kiosk modes. While camera and video voice commands and UI are disabled by default the button commands can still be used. To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. +Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retreving your pictures, such as Photos, Mail, or OneDrive. > [!NOTE] > When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): @@ -147,6 +151,7 @@ Some common in-box apps you may wish to use are: | Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | | Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). @@ -164,9 +169,9 @@ There is an important distinction between the **User logon type** and the **Assi **Examples:** -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk. +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. -- You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. +- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. @@ -354,7 +359,7 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ## Recommendations for selecting kiosk apps - You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. From 62285cab860d8630f68659caa7c38fc574a7aeb4 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Thu, 26 Mar 2020 13:08:01 -0700 Subject: [PATCH 020/149] Link fix --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ca615c8f6c..6bff0bc2ac 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -23,7 +23,7 @@ appliesto: Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. -This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/en-us/windows/configuration/kiosk-methods). +This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). ## Kiosk mode requirements From 8fb3a255bf0185c92e4cd7a82c2bcb6fd240982c Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Fri, 27 Mar 2020 09:12:03 -0700 Subject: [PATCH 021/149] UI and Security note, Full AUMID List @Teresa-Motiv --- devices/hololens/hololens-kiosk.md | 35 ++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6bff0bc2ac..8045db06c4 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -25,6 +25,9 @@ Kiosk mode is a convenient feature that you can use to focus the HoloLens device This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). +> [!IMPORTANT] +> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) + ## Kiosk mode requirements You can configure any HoloLens 2 device to use kiosk mode. @@ -37,9 +40,6 @@ When HoloLens is configured as a multi-app kiosk, only the allowed apps are avai Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. -> [!NOTE] -> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) - > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. > @@ -142,16 +142,27 @@ It's important that the group or groups you choose includes users you want to us Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. -Some common in-box apps you may wish to use are: +In-box apps you may wish to use are: -| App Name | AUMID | -|---------------|----------------------------------------------------------------------| -| Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -| Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | -| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | +| App Name | AUMID | +|----------------------------|----------------------------------------------------------------------------------| +| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | +| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | +| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +| File Explorer | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.mail | +| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +| Microsoft Edge | Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge | +| Microsoft Store | Microsoft.WindowsStore_8wekyb3d8bbwe!App | +| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | +| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | +| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | +| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | +| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). From fa3c6c86bf0bb4854a5eb46eb4a822dbf8217216 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 27 Mar 2020 16:27:22 -0700 Subject: [PATCH 022/149] Cleanup --- devices/hololens/hololens-kiosk.md | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 8045db06c4..c5fbfc557e 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -23,10 +23,10 @@ appliesto: Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. -This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). +This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). > [!IMPORTANT] -> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) +> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) ## Kiosk mode requirements @@ -83,7 +83,7 @@ There are three methods that you can use to configure the device as a kiosk: - You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. > [!NOTE] > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. @@ -116,7 +116,7 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the ### Create a device configuration policy -1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** 1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. @@ -139,9 +139,9 @@ For **User logon type**: Add one or more user accounts that can use the apps you It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. -Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. +Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. In-box apps you may wish to use are: | App Name | AUMID | @@ -169,10 +169,11 @@ For more information on settings for both modes of Kiosk visit [here](https://do ### Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. + Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). @@ -184,7 +185,7 @@ There is an important distinction between the **User logon type** and the **Assi - You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. ### Set up the device @@ -192,7 +193,7 @@ Now it's time to set up the device to both receive the policy and log into the a #### Set up a single-app kiosk -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. @@ -282,7 +283,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). @@ -317,7 +318,7 @@ To set up kiosk mode by using the Windows Device Portal, follow these steps. If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. -> [!NOTE] +> [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. ### Start layout file for MDM (Intune and others) @@ -369,11 +370,11 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ## Recommendations for selecting kiosk apps -- You cannot select the Shell app as a kiosk app. +- You cannot select the Shell app as a kiosk app. - We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information From fe23996d8691dfc0480cadc38459304fcac3eda9 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 31 Mar 2020 13:55:07 -0700 Subject: [PATCH 023/149] Revisions --- devices/hololens/hololens-kiosk.md | 266 ++++++++++++++++++----------- 1 file changed, 167 insertions(+), 99 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c5fbfc557e..0c51860a98 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -21,36 +21,52 @@ appliesto: # Set up HoloLens as a kiosk -Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. +You can configure a HoloLens device to function as a fixed-purpose device, also called a *kiosk*, by configuring the device to run in kiosk mode. Kiosk mode limits the applications (or users) that are available on the device. Kiosk mode is a convenient feature that you can use to dedicate a HoloLens device to business apps, or to use the HoloLens device in an app demo. This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). > [!IMPORTANT] -> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) +> Kiosk mode determines which apps are available when a user signs in to the device. However, kiosk mode is not a security limitation. It does not stop an "allowed" app from launching an app that is not allowed. In order to block apps or processes from launching, use [Windows Defender Application Control (WDAC) CSP](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) to create appropriate policies. -## Kiosk mode requirements +You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. + +## Plan the kiosk deployment + +### Kiosk mode requirements You can configure any HoloLens 2 device to use kiosk mode. To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready. -## Select a kiosk mode +### Decide between a single-app kiosk or a multi-app kiosk -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user in the startup tiles user experience. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. +A single-app kiosk starts the specified app when the user signs in to the device. The Start menu is disabled, as is Cortana. A HoloLens 2 device does not respond to the [Start](hololens2-basic-usage.md#start-gesture) gesture. A HoloLens (1st gen) device does not respond to the [bloom](hololens1-basic-usage.md) gesture. Because only one app can run, the user cannot place other apps. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +A multi-app kiosk displays the start menu when the user signs in to the device. The kiosk configuration determines what apps are available on the Start menu. You can use a multi-app kiosk to provide an easy-to-understand experience for users by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. -> [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. -> -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. +The following table lists the feature capabilities in the different kiosk modes. -The following table lists the device capabilities in the different kiosk modes. - -|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Accounts may sign-in automatically | Can distinguish different users to use Kiosk mode or full access | +|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast | | --- | --- | --- | --- | --- | --- | --- | --- | -|Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | -|Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | +|Single-app kiosk |No |No |No* |No | +|Multi-app kiosk |Yes |Yes* |Yes* |Yes* | +\* For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). + +The following table lists the user capabilities in the different kiosk modes. + +|   |Supported user types | Automatic sign-in | Multiple access levels | +| --- | --- | --- | --- | +|Single-app kiosk |Managed Service Account (MSA) in Azure Active Directory (AAD) or local account |Yes |No | +|Multi-app kiosk |AAD account |No |Yes | + +For a better idea of how to use these capabilities, see the following table: + +|Use a single-app kiosk for: |Use a multi-app kiosk for: | +| --- | --- | +|A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | +|A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | + +### Select kiosk apps and features While camera and video voice commands and UI are disabled by default the button commands can still be used. @@ -65,17 +81,50 @@ Also while enabling the camera allows on to take pictures or video, you may also > For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. +> [!WARNING] +> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. +> +> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. + +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- You can select Cortana as a kiosk app. +- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. + +### Plan access control One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. -Examples scenarios of when to use which kiosk: +Assign the policy to the group to receive the policy -- A device dedicated to Guides to help new hires: Single-app kiosk -- A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk -- You have a custom app and only allow access to it: Single-app kiosk -- You want a device the majority of your users can only use custom App, but that one user group can use your custom app, Remote Assist, Feedback Hub, and Settings if needed: Multi-app Kiosk mode (With only your custom app in the Kiosk, and the one user group has full access to Windows Holographic.) +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. -## Select a deployment method +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + +> [!IMPORTANT] +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. + +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. + +**Examples:** + +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. + +- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. + +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. + + +### Select a deployment method + +What are you deploying: + +- Single-app kiosk +- Simple multi-app kiosk +- Fully-customized multi-app kiosk There are three methods that you can use to configure the device as a kiosk: @@ -101,6 +150,82 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | +### Create a kiosk configuration XML file + +Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: + +- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. +- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. + +#### Add guest access to the kiosk configuration (optional) + +In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. + +Use the following snippet in your kiosk configuration XML to enable the **Guest** account: + +```xml + + + + + + +``` + +## Start layout for HoloLens + +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. + +> [!NOTE] +> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. + +### Start layout file for MDM (Intune and others) + +Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). + +> [!NOTE] +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). + +```xml + + + + + + + + + +``` + +### Create a start layout for a customized multi-app kiosk + +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. + +```xml + + + + + + + + + + + + + + + ]]> + + +``` + ## Set up kiosk mode by using Microsoft Intune or MDM To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. @@ -114,7 +239,7 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Set up a single-app kiosk](#set-up-a-single-app-kiosk). - [Set up a multi-app kiosk](#set-up-a-multi-app-kiosk). -### Create a device configuration policy +### [MDM] 1. Create a device configuration policy 1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** @@ -122,17 +247,23 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. -For full details creating a device profile for Kiosk mode check out [Kiosk settings]( https://docs.microsoft.com/intune/configuration/kiosk-settings). +For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). ### Select the settings that you want to see in your kiosk -#### Configure the settings for a single-app kiosk +#### [MDM] 2. Configure the settings for a single-app kiosk Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). -#### Configure the settings for a multi-app kiosk +#### [MDM] 2. Configure the settings for a multi-app kiosk + +Additional information: + +- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). + +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. @@ -166,7 +297,7 @@ In-box apps you may wish to use are: For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -### Assign the policy to the group to receive the policy +### [MDM] 3. Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. @@ -191,7 +322,7 @@ There is an important distinction between the **User logon type** and the **Assi Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. -#### Set up a single-app kiosk +#### [MDM] 4. Set up a single-app kiosk Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. @@ -203,7 +334,7 @@ Give your store app a short amount time to download as well as policy to be appl If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -#### Set up a multi-app kiosk +#### [MDM] 4. Set up a multi-app kiosk For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. @@ -215,13 +346,9 @@ To enable Kiosk mode simply **sign out** of your account and **sign in** to a pr If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -Additional information: -For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - -## Set up kiosk mode by using a provisioning package +## Use a provisioning package to set up a single-app or muti-app kiosk As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). @@ -231,7 +358,7 @@ To set up kiosk mode by using a provisioning package, follow these steps. 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) -### Create a kiosk configuration XML file +### [PP] 1. Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: @@ -253,7 +380,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ``` -### Add the kiosk configuration XML file to a provisioning package +### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). 2. Choose **Advanced provisioning**. @@ -281,13 +408,13 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* 16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. -### Apply the provisioning package to HoloLens +### [PP] 3. Apply the provisioning package to HoloLens You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode by using the Windows Device Portal +## Use the Windows Device Portal to set up a single-app kiosk To set up kiosk mode by using the Windows Device Portal, follow these steps. @@ -296,12 +423,12 @@ To set up kiosk mode by using the Windows Device Portal, follow these steps. > [!IMPORTANT] > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi){broken} or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb){broken}. +2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb). -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password){broken} if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate){broken}. + > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#security_certificate). 4. In the Windows Device Portal, click **Kiosk Mode**. @@ -314,67 +441,8 @@ To set up kiosk mode by using the Windows Device Portal, follow these steps. 6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** -## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. -> [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. - -### Start layout file for MDM (Intune and others) - -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). - -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). - -```xml - - - - - - - - - -``` - -### Start layout for a provisioning package - -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. - -```xml - - - - - - - - - - - - - - - ]]> - - -``` - -## Recommendations for selecting kiosk apps - -- You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. -- You can select Cortana as a kiosk app. -- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information From 6719e19444fbbda1c9fca64875c621bd6e0a15bd Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 31 Mar 2020 16:32:48 -0700 Subject: [PATCH 024/149] Revisions in progress (to be continued) --- devices/hololens/hololens-kiosk.md | 84 ++++++++++++++++++++++++++---- 1 file changed, 73 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 0c51860a98..1284f45cae 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -46,11 +46,12 @@ A multi-app kiosk displays the start menu when the user signs in to the device. The following table lists the feature capabilities in the different kiosk modes. -|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast | -| --- | --- | --- | --- | --- | --- | --- | --- | -|Single-app kiosk |No |No |No* |No | -|Multi-app kiosk |Yes |Yes* |Yes* |Yes* | -\* For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | +|Single-app kiosk |No |No |No1 |No |No1, 2 | +|Multi-app kiosk |Yes |Yes1 |Yes1 |Yes1 |Yes1 | +>1 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +>2 Even if Cortana is disabled, the built-in voice commands are available. The following table lists the user capabilities in the different kiosk modes. @@ -66,12 +67,26 @@ For a better idea of how to use these capabilities, see the following table: |A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | |A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | -### Select kiosk apps and features +### Select kiosk apps + +For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). + +If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. If you use the Windows Device Portal to configure kiosk mode, you select the app to run during the setup process. + + + +While camera and video voice commands and UI are disabled by default the button + + + +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). +[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) + +[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) -While camera and video voice commands and UI are disabled by default the button commands can still be used. To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. -Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retreving your pictures, such as Photos, Mail, or OneDrive. +Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retrieving your pictures, such as Photos, Mail, or OneDrive. > [!NOTE] > When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): @@ -80,20 +95,67 @@ Also while enabling the camera allows on to take pictures or video, you may also > - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow` > For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. + > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. > -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. +> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. - You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. + - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +> [!CAUTION] +> We recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as a kiosk app. + +In-box apps you may wish to use are: + +| App Name | AUMID | +|----------------------------|----------------------------------------------------------------------------------| +| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | +| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | +| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | +| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | +| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | +| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | +| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | +| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | + + + +### [MDM] 3. Assign the policy to the group to receive the policy + +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. + +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + +> [!IMPORTANT] +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. + +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. + +**Examples:** + +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. + +- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. + +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. + ### Plan access control +It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. + One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. Assign the policy to the group to receive the policy From d73fa1a7d64652eac8b2a3e549f92a73eedf9a47 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 2 Apr 2020 13:12:26 -0700 Subject: [PATCH 025/149] Revisions --- devices/hololens/hololens-kiosk.md | 83 +++++++++++++++--------------- 1 file changed, 42 insertions(+), 41 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 1284f45cae..63ba1b8546 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -46,21 +46,23 @@ A multi-app kiosk displays the start menu when the user signs in to the device. The following table lists the feature capabilities in the different kiosk modes. -|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana | -| --- | --- | --- | --- | --- | --- | --- | --- | --- | -|Single-app kiosk |No |No |No1 |No |No1, 2 | -|Multi-app kiosk |Yes |Yes1 |Yes1 |Yes1 |Yes1 | ->1 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). ->2 Even if Cortana is disabled, the built-in voice commands are available. +|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +|Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled1 | +|Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | -The following table lists the user capabilities in the different kiosk modes. +> 1 Voice commands that relate to disabled features do not function. +> 2 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +> 3 Even if Cortana is disabled, the built-in voice commands are enabled. + +The following table lists the user support features of the different kiosk modes. |   |Supported user types | Automatic sign-in | Multiple access levels | | --- | --- | --- | --- | |Single-app kiosk |Managed Service Account (MSA) in Azure Active Directory (AAD) or local account |Yes |No | |Multi-app kiosk |AAD account |No |Yes | -For a better idea of how to use these capabilities, see the following table: +For examples of how to use these capabilities, see the following table. |Use a single-app kiosk for: |Use a multi-app kiosk for: | | --- | --- | @@ -71,67 +73,56 @@ For a better idea of how to use these capabilities, see the following table: For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). -If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. If you use the Windows Device Portal to configure kiosk mode, you select the app to run during the setup process. - - - -While camera and video voice commands and UI are disabled by default the button - - - -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) - -[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) - - -To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. -Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retrieving your pictures, such as Photos, Mail, or OneDrive. - -> [!NOTE] -> When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): -> -> - **Camera app AUMID**: `HoloCamera_cw5n1h2txyewy!HoloCamera` -> - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow` -> For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). +If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. +If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. > [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. +> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide. These policies impact other users on the device. > -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. +> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. +To revert these policies, you have to reset the device to the factory settings. + +[the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). -- You cannot select the Shell app as a kiosk app. -- You can select Cortana as a kiosk app. -- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. > [!CAUTION] -> We recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as a kiosk app. +> You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. +[Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): In-box apps you may wish to use are: | App Name | AUMID | |----------------------------|----------------------------------------------------------------------------------| | 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | | Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Camera1, 2 | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Cortana2 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | | Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | | Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | | Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +| Miracast3 | | | Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | | OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | | Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | | Settings | HolographicSystemSettings_cw5n1h2txyewy!App | | Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +> 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. +> 2 When you enable the Camera app, be aware of the following: +> - The Quick Actions menu includes the Photo and Video buttons. +> - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive). +> +> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. +> 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. -### [MDM] 3. Assign the policy to the group to receive the policy +While camera and video voice commands and UI are disabled by default the button + +[MDM] 3. Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. @@ -182,6 +173,10 @@ There is an important distinction between the **User logon type** and the **Assi ### Select a deployment method + +While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. + + What are you deploying: - Single-app kiosk @@ -212,6 +207,12 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | + +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). +[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) + +[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) + ### Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: From 5e1e5596a1d3d12deac38f376efc778f4bd545e8 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 3 Apr 2020 16:46:04 -0700 Subject: [PATCH 026/149] Revisions --- devices/hololens/hololens-kiosk.md | 52 ++++++------------------------ 1 file changed, 10 insertions(+), 42 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 63ba1b8546..80514d9c93 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -30,6 +30,11 @@ This article provides information about aspects of configuring kiosks that are s You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. +> [!WARNING] +> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, [certain policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy) are enforced system-wide. These policies impact other users on the device. +> +> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. To revert these policies, you have to reset the device to the factory settings. + ## Plan the kiosk deployment ### Kiosk mode requirements @@ -69,42 +74,29 @@ For examples of how to use these capabilities, see the following table. |A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | |A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | -### Select kiosk apps +### Plan kiosk apps For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. -If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. - -> [!WARNING] -> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide. These policies impact other users on the device. -> -> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. -To revert these policies, you have to reset the device to the factory settings. - -[the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). - - +If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. The CSP uses [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app) to identify applications. The following table lists the AUMIDs of some in-box applications that you can use in a multi-app kiosk. > [!CAUTION] > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. -[Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): -In-box apps you may wish to use are: - | App Name | AUMID | |----------------------------|----------------------------------------------------------------------------------| | 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | | Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | | Camera1, 2 | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Cortana2 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Cortana3 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | | Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | | Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | | Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | -| Miracast3 | | +| Miracast4 | | | Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | | OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | | Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | @@ -116,33 +108,9 @@ In-box apps you may wish to use are: > - The Quick Actions menu includes the Photo and Video buttons. > - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive). > -> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. +> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. > 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. - -While camera and video voice commands and UI are disabled by default the button - -[MDM] 3. Assign the policy to the group to receive the policy - -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. - -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. - -> [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. - -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). - -There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. - -**Examples:** - -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. - -- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. - ### Plan access control It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. From 81b25acdc95ecf7024d3bf59c45d74bff20a6d91 Mon Sep 17 00:00:00 2001 From: Mati Goldberg Date: Fri, 10 Apr 2020 03:38:03 +0300 Subject: [PATCH 027/149] added missing endpoints --- .../microsoft-defender-atp/microsoft-defender-atp-mac.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md index a22b112426..fe71625482 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md @@ -74,9 +74,9 @@ The following table lists the services and their associated URLs that your netwo | Service location | DNS record | | ---------------------------------------- | ----------------------- | | Common URLs for all locations | x.cp.wd.microsoft.com
cdn.x.cp.wd.microsoft.com
eu-cdn.x.cp.wd.microsoft.com
wu-cdn.x.cp.wd.microsoft.com
officecdn-microsoft-com.akamaized.net
crl.microsoft.com
events.data.microsoft.com | -| European Union | europe.x.cp.wd.microsoft.com
eu-v20.events.data.microsoft.com
usseu1northprod.blob.core.windows.net 
usseu1westprod.blob.core.windows.net | -| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com
uk-v20.events.data.microsoft.com
ussuk1southprod.blob.core.windows.net 
ussuk1westprod.blob.core.windows.net | -| United States | unitedstates.x.cp.wd.microsoft.com
us-v20.events.data.microsoft.com
ussus1eastprod.blob.core.windows.net 
ussus1westprod.blob.core.windows.net | +| European Union | europe.x.cp.wd.microsoft.com
eu-v20.events.data.microsoft.com
usseu1northprod.blob.core.windows.net 
usseu1westprod.blob.core.windows.net
winatp-gw-weu.microsoft.com
winatp-gw-neu.microsoft.com | +| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com
uk-v20.events.data.microsoft.com
ussuk1southprod.blob.core.windows.net 
ussuk1westprod.blob.core.windows.net
winatp-gw-ukw.microsoft.com
winatp-gw-uks.microsoft.com | +| United States | unitedstates.x.cp.wd.microsoft.com
us-v20.events.data.microsoft.com
ussus1eastprod.blob.core.windows.net 
ussus1westprod.blob.core.windows.net
winatp-gw-cus.microsoft.com
winatp-gw-eus.microsoft.com | Microsoft Defender ATP can discover a proxy server by using the following discovery methods: - Proxy auto-config (PAC) From 12b713411d24bb0df9495cf532f6d0010c8d0914 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Mon, 13 Apr 2020 15:29:01 -0700 Subject: [PATCH 028/149] Update monitor-the-use-of-removable-storage-devices.md Removable storage note per CSS --- .../monitor-the-use-of-removable-storage-devices.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index 18d2e3d8c2..870101a427 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -14,7 +14,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/19/2017 +ms.date: --- # Monitor the use of removable storage devices @@ -28,7 +28,9 @@ If you configure this policy setting, an audit event is generated each time a us Use the following procedures to monitor the use of removable storage devices and to verify that the devices are being monitored. ->**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. +Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +> [!NOTE] When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/en-us/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/en-us/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. **To configure settings to monitor removable storage devices** From 61b0ffb053f509534fa61099a7b8ed8e69b2438d Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Mon, 13 Apr 2020 15:58:44 -0700 Subject: [PATCH 029/149] Update monitor-the-use-of-removable-storage-devices.md --- .../auditing/monitor-the-use-of-removable-storage-devices.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index 870101a427..1188b932e6 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -30,7 +30,7 @@ Use the following procedures to monitor the use of removable storage devices and Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -> [!NOTE] When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/en-us/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/en-us/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. +> [!NOTE] When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. **To configure settings to monitor removable storage devices** From 95525768f0e7292962811c103d2b571e1cb3446d Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 15 Apr 2020 17:13:45 -0700 Subject: [PATCH 030/149] Added bitmask table --- .../client-management/mdm/bitlocker-csp.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 6ba943ffca..002104212e 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1331,4 +1331,26 @@ The following example is provided to show proper format and should not be taken ``` + +### Bitmask error codes +The following table provides the mapping of strings to status node bits: +| Bit | UI Text | +|-----|---------| +|0|The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| +|1|The encryption method of the OS volume doesn't match the BitLocker policy.| +|2|The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| +|3|The BitLocker policy requires a TPM-only protector for the OS volume, but TPM protection isn't used.| +|4|The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.| +|5|The BitLocker policy requires TPM+startup key protection for the OS volume, but a TPM+startup key protector isn't used.| +|6|The BitLocker policy requires TPM+PIN+startup key protection for the OS volume, but a TPM+PIN+startup key protector isn't used.| +|7|The OS volume is unprotected.| +|8|Recovery key backup failed.| +|9|A fixed drive is unprotected.| +|10|The encryption method of the fixed drive doesn't match the BitLocker policy.| +|11|To encrypt drives, the BitLocker policy requires either the user to sign in as an Administrator or, if the device is joined to Azure AD, the AllowStandardUserEncryption policy must be set to 1.| +|12|Windows Recovery Environment (WinRE) isn't configured.| +|13|A TPM isn't available for BitLocker, either because it isn't present, it has been made unavailable in the Registry, or the OS is on a removable drive. | +|14|The TPM isn't ready for BitLocker.| +|15|The network isn't available, which is required for recovery key backup. | +|16-31|For future use.| From 03c6904f77fcf58a10546a241d7c2e308b00349f Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 16 Apr 2020 14:07:45 -0700 Subject: [PATCH 031/149] Added bitmask table --- .../client-management/mdm/bitlocker-csp.md | 54 +++++++++---------- 1 file changed, 26 insertions(+), 28 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 002104212e..6fdb0ccaad 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -13,9 +13,6 @@ manager: dansimp --- # BitLocker CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it is also supported in Windows 10 Pro. > [!NOTE] @@ -25,7 +22,7 @@ The BitLocker configuration service provider (CSP) is used by the enterprise to A Get operation on any of the settings, except for RequireDeviceEncryption and RequireStorageCardEncryption, returns the setting configured by the admin. -For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if TPM protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption does not verify that the a minimum PIN length is enforced (SystemDrivesMinimumPINLength). +For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if Trusted Platform Module (TPM) protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption does not verify that the a minimum PIN length is enforced (SystemDrivesMinimumPINLength). The following diagram shows the BitLocker configuration service provider in tree format. @@ -284,7 +281,7 @@ ADMX Info: > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This setting is applied when you turn on BitLocker. +This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a TPM. This setting is applied when you turn on BitLocker. > [!NOTE] > Only one of the additional authentication options can be required at startup, otherwise an error occurs. @@ -1058,7 +1055,7 @@ Interior node. Supported operation is Get. **Status/DeviceEncryptionStatus** -This node reports compliance state of device encryption on the system. +This node reports compliance state of device encryption on the system. See @@ -1088,9 +1085,31 @@ Supported values: - 0 - Indicates that the device is compliant. - Any other value represents a non-compliant device. - Value type is int. Supported operation is Get. +The following table provides the mapping of the bits in the **Status/DeviceEncryptionStatus** node to the error code string: +| Bit | Error Code String | +|-----|---------| +|0|The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| +|1|The encryption method of the OS volume doesn't match the BitLocker policy.| +|2|The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| +|3|The BitLocker policy requires a TPM-only protector for the OS volume, but TPM protection isn't used.| +|4|The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.| +|5|The BitLocker policy requires TPM+startup key protection for the OS volume, but a TPM+startup key protector isn't used.| +|6|The BitLocker policy requires TPM+PIN+startup key protection for the OS volume, but a TPM+PIN+startup key protector isn't used.| +|7|The OS volume is unprotected.| +|8|Recovery key backup failed.| +|9|A fixed drive is unprotected.| +|10|The encryption method of the fixed drive doesn't match the BitLocker policy.| +|11|To encrypt drives, the BitLocker policy requires either the user to sign in as an Administrator or, if the device is joined to Azure AD, the AllowStandardUserEncryption policy must be set to 1.| +|12|Windows Recovery Environment (WinRE) isn't configured.| +|13|A TPM isn't available for BitLocker, either because it isn't present, it has been made unavailable in the Registry, or the OS is on a removable drive. | +|14|The TPM isn't ready for BitLocker.| +|15|The network isn't available, which is required for recovery key backup. | +|16-31|For future use.| + + + @@ -1332,25 +1351,4 @@ The following example is provided to show proper format and should not be taken ``` -### Bitmask error codes -The following table provides the mapping of strings to status node bits: -| Bit | UI Text | -|-----|---------| -|0|The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| -|1|The encryption method of the OS volume doesn't match the BitLocker policy.| -|2|The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| -|3|The BitLocker policy requires a TPM-only protector for the OS volume, but TPM protection isn't used.| -|4|The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.| -|5|The BitLocker policy requires TPM+startup key protection for the OS volume, but a TPM+startup key protector isn't used.| -|6|The BitLocker policy requires TPM+PIN+startup key protection for the OS volume, but a TPM+PIN+startup key protector isn't used.| -|7|The OS volume is unprotected.| -|8|Recovery key backup failed.| -|9|A fixed drive is unprotected.| -|10|The encryption method of the fixed drive doesn't match the BitLocker policy.| -|11|To encrypt drives, the BitLocker policy requires either the user to sign in as an Administrator or, if the device is joined to Azure AD, the AllowStandardUserEncryption policy must be set to 1.| -|12|Windows Recovery Environment (WinRE) isn't configured.| -|13|A TPM isn't available for BitLocker, either because it isn't present, it has been made unavailable in the Registry, or the OS is on a removable drive. | -|14|The TPM isn't ready for BitLocker.| -|15|The network isn't available, which is required for recovery key backup. | -|16-31|For future use.| From c5b2ef0657b7179036b7464c1d417dbb0b6ac907 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 16 Apr 2020 14:59:38 -0700 Subject: [PATCH 032/149] Update monitor-the-use-of-removable-storage-devices.md fix note style --- .../auditing/monitor-the-use-of-removable-storage-devices.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index 1188b932e6..ee4ffad617 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -30,7 +30,8 @@ Use the following procedures to monitor the use of removable storage devices and Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -> [!NOTE] When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. +> [!NOTE] +> When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. **To configure settings to monitor removable storage devices** From d6137383a3b5884adf8cb3e012a1562003a6727b Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 16 Apr 2020 15:34:43 -0700 Subject: [PATCH 033/149] Minor update to trigger build --- windows/client-management/mdm/bitlocker-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 6fdb0ccaad..247f122787 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.technology: windows author: lomayor ms.localizationpriority: medium -ms.date: 09/27/2019 +ms.date: 04/16/2020 ms.reviewer: manager: dansimp --- From ddc12e15dd47681072e0caa8dd31ca7a0fcdcd43 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 16 Apr 2020 15:51:42 -0700 Subject: [PATCH 034/149] Updated table format --- windows/client-management/mdm/bitlocker-csp.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 247f122787..3eb71e57d5 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1055,7 +1055,7 @@ Interior node. Supported operation is Get. **Status/DeviceEncryptionStatus** -This node reports compliance state of device encryption on the system. See +This node reports compliance state of device encryption on the system.
@@ -1087,8 +1087,8 @@ Supported values: Value type is int. Supported operation is Get. -The following table provides the mapping of the bits in the **Status/DeviceEncryptionStatus** node to the error code string: -| Bit | Error Code String | +The following table provides the mapping of the bits in the **Status/DeviceEncryptionStatus** node to the error codes: +| Bit | Error Code | |-----|---------| |0|The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| |1|The encryption method of the OS volume doesn't match the BitLocker policy.| From a35f30cde322a3aa20330e3f17ecd2217279fbcd Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 16 Apr 2020 16:29:24 -0700 Subject: [PATCH 035/149] Updated table --- windows/client-management/mdm/bitlocker-csp.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 3eb71e57d5..f53cc96b95 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1088,6 +1088,7 @@ Supported values: Value type is int. Supported operation is Get. The following table provides the mapping of the bits in the **Status/DeviceEncryptionStatus** node to the error codes: + | Bit | Error Code | |-----|---------| |0|The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| From 1c42ce2aa063efb24677ac156557628f87804030 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 16 Apr 2020 16:51:31 -0700 Subject: [PATCH 036/149] Updated table format --- .../client-management/mdm/bitlocker-csp.md | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index f53cc96b95..3d9cf7a67b 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1090,24 +1090,24 @@ Value type is int. Supported operation is Get. The following table provides the mapping of the bits in the **Status/DeviceEncryptionStatus** node to the error codes: | Bit | Error Code | -|-----|---------| -|0|The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| -|1|The encryption method of the OS volume doesn't match the BitLocker policy.| -|2|The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| -|3|The BitLocker policy requires a TPM-only protector for the OS volume, but TPM protection isn't used.| -|4|The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.| -|5|The BitLocker policy requires TPM+startup key protection for the OS volume, but a TPM+startup key protector isn't used.| -|6|The BitLocker policy requires TPM+PIN+startup key protection for the OS volume, but a TPM+PIN+startup key protector isn't used.| -|7|The OS volume is unprotected.| -|8|Recovery key backup failed.| -|9|A fixed drive is unprotected.| -|10|The encryption method of the fixed drive doesn't match the BitLocker policy.| -|11|To encrypt drives, the BitLocker policy requires either the user to sign in as an Administrator or, if the device is joined to Azure AD, the AllowStandardUserEncryption policy must be set to 1.| -|12|Windows Recovery Environment (WinRE) isn't configured.| -|13|A TPM isn't available for BitLocker, either because it isn't present, it has been made unavailable in the Registry, or the OS is on a removable drive. | -|14|The TPM isn't ready for BitLocker.| -|15|The network isn't available, which is required for recovery key backup. | -|16-31|For future use.| +|-----|------------| +| 0 |The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| +| 1 |The encryption method of the OS volume doesn't match the BitLocker policy.| +| 2 |The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| +| 3 |The BitLocker policy requires a TPM-only protector for the OS volume, but TPM protection isn't used.| +| 4 |The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.| +| 5 |The BitLocker policy requires TPM+startup key protection for the OS volume, but a TPM+startup key protector isn't used.| +| 6 |The BitLocker policy requires TPM+PIN+startup key protection for the OS volume, but a TPM+PIN+startup key protector isn't used.| +| 7 |The OS volume is unprotected.| +| 8 |Recovery key backup failed.| +| 9 |A fixed drive is unprotected.| +| 10 |The encryption method of the fixed drive doesn't match the BitLocker policy.| +| 11 |To encrypt drives, the BitLocker policy requires either the user to sign in as an Administrator or, if the device is joined to Azure AD, the AllowStandardUserEncryption policy must be set to 1.| +| 12 |Windows Recovery Environment (WinRE) isn't configured.| +| 13 |A TPM isn't available for BitLocker, either because it isn't present, it has been made unavailable in the Registry, or the OS is on a removable drive. | +| 14 |The TPM isn't ready for BitLocker.| +| 15 |The network isn't available, which is required for recovery key backup. | +| 16-31 |For future use.| From 4e18fdbb29347542348109d5a7790e078e233745 Mon Sep 17 00:00:00 2001 From: v-miegge <49650192+v-miegge@users.noreply.github.com> Date: Mon, 20 Apr 2020 11:14:46 -0700 Subject: [PATCH 037/149] CI 113983 - updated file --- devices/surface/support-solutions-surface.md | 60 +++++++++----------- 1 file changed, 28 insertions(+), 32 deletions(-) diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md index a7ef242da7..543d6250ee 100644 --- a/devices/surface/support-solutions-surface.md +++ b/devices/surface/support-solutions-surface.md @@ -20,16 +20,36 @@ ms.audience: itpro # Top support solutions for Surface devices > [!Note] -> **Home users**: This article is only intended for use by IT professionals and technical support agents, and applies only to Surface devices. If you're looking for help with a problem with your home device, please see [Surface Devices Help](https://support.microsoft.com/products/surface-devices). +> **Home users**: This article is only intended for use by IT professionals and technical support agents, and applies only to Surface devices. If you're looking for help with a problem with your home device, please see [Surface Devices Help](https://support.microsoft.com/products/surface-devices). -Microsoft regularly releases both updates and solutions for Surface devices. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface devices updated. For a complete listing of the update history, see [Surface update history](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) and [Install Surface and Windows updates](https://www.microsoft.com/surface/support/performance-and-maintenance/install-software-updates-for-surface?os=windows-10&=undefined). +These are the Microsoft Support solutions for common issues you may experience using Surface devices in an enterprise. If your issue is not listed here, [contact Microsoft Support](https://support.microsoft.com/supportforbusiness/productselection). +## Surface Drivers and Firmware -These are the top Microsoft Support solutions for common issues experienced when using Surface devices in an enterprise. +Microsoft regularly releases both updates and solutions for Surface devices. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface devices updated. + +- [Surface update history](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) +- [Install Surface and Windows updates](https://www.microsoft.com/surface/support/performance-and-maintenance/install-software-updates-for-surface?os=windows-10&=undefined) +- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482) +- [Deploy the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) +- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates) +- [How to manage Surface driver updates in Configuration Manager](https://support.microsoft.com/help/4098906) + +## Surface Dock Issues + +- [Troubleshoot Surface Dock and docking stations](https://support.microsoft.com/help/4023468/surface-troubleshoot-surface-dock-and-docking-stations) + +- [Troubleshoot connecting Surface to a second screen](https://support.microsoft.com/help/4023496) + +- [Microsoft Surface Dock Firmware Update](https://docs.microsoft.com/surface/surface-dock-updater) + +## Device cover or keyboard issues + +- [Troubleshoot your Surface Type Cover or keyboard](https://www.microsoft.com/surface/support/hardware-and-drivers/troubleshoot-surface-keyboards) ## Screen cracked or scratched issues -- [Contact Microsoft Support](https://support.microsoft.com/supportforbusiness/productselection) +- [Contact Microsoft Support](https://support.microsoft.com/supportforbusiness/productselection) ## Surface Power or battery Issues @@ -41,29 +61,13 @@ These are the top Microsoft Support solutions for common issues experienced when - [Maximize your Surface battery life](https://support.microsoft.com/help/4483194) -## Device cover or keyboard issues +## Reset device -- [Troubleshoot your Surface Type Cover or keyboard](https://www.microsoft.com/surface/support/hardware-and-drivers/troubleshoot-surface-keyboards) +- [Creating and using a USB recovery drive for Surface](https://support.microsoft.com/help/4023512) -## Surface Dock Issues +- [FAQ: Protecting your data if you send your Surface in for Service](https://support.microsoft.com/help/4023508) -- [Troubleshoot Surface Dock and docking stations](https://support.microsoft.com/help/4023468/surface-troubleshoot-surface-dock-and-docking-stations) - -- [Troubleshoot connecting Surface to a second screen](https://support.microsoft.com/help/4023496) - -- [Microsoft Surface Dock Firmware Update](https://docs.microsoft.com/surface/surface-dock-updater) - -## Surface Drivers and Firmware - -- [Surface Update History](https://support.microsoft.com/help/4036283) - -- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482) - -- [Deploy the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) - -- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates) - -- [How to manage Surface driver updates in Configuration Manager](https://support.microsoft.com/help/4098906) +- [Microsoft Surface Data Eraser](https://docs.microsoft.com/surface/microsoft-surface-data-eraser) ## Deployment Issues @@ -72,11 +76,3 @@ These are the top Microsoft Support solutions for common issues experienced when - [Surface Pro Model 1796 and Surface Laptop 1TB display two drives](https://support.microsoft.com/help/4046105) - [System SKU reference](https://docs.microsoft.com/surface/surface-system-sku-reference) - -## Reset device - -- [Creating and using a USB recovery drive for Surface](https://support.microsoft.com/help/4023512) - -- [FAQ: Protecting your data if you send your Surface in for Service](https://support.microsoft.com/help/4023508) - -- [Microsoft Surface Data Eraser](https://docs.microsoft.com/surface/microsoft-surface-data-eraser) From 0de78dc058a0d8bc875833e487f59b2f4347733d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 21 Apr 2020 13:11:37 -0700 Subject: [PATCH 038/149] update topic --- .../configure-server-endpoints.md | 32 ++++++++++--------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index e7da43acc6..9a9e8530ab 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -43,26 +43,15 @@ The service supports the onboarding of the following servers: For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128). -> [!NOTE] -> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services) ## Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016 There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP: -- **Option 1**: Onboard through Azure Security Center -- **Option 2**: Onboard through Microsoft Defender Security Center +- **Option 1**: Onboard through Microsoft Defender Security Center +- **Option 2**: Onboard through Azure Security Center -### Option 1: Onboard servers through Azure Security Center -1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. - -2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system. - -3. Click **Onboard Servers in Azure Security Center**. - -4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp). - -### Option 2: Onboard servers through Microsoft Defender Security Center +### Option 1: Onboard servers through Microsoft Defender Security Center You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center. - For Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements: @@ -125,6 +114,19 @@ Once completed, you should see onboarded servers in the portal within an hour. - If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that you [enable access to Microsoft Defender ATP service URLs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). + +### Option 2: Onboard servers through Azure Security Center +1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. + +2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system. + +3. Click **Onboard Servers in Azure Security Center**. + +4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp). + +> [!NOTE] +> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services) + ## Windows Server, version 1803 and Windows Server 2019 To onboard Windows Server, version 1803 or Windows Server 2019, refer to the supported methods and versions below. @@ -169,7 +171,7 @@ Support for Windows Server, provide deeper insight into activities happening on ## Integration with Azure Security Center -Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers. +Microsoft Defender ATP can integrate with Azure Security Center to provide a comprehensive server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers. The following capabilities are included in this integration: - Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding). From 05d890fb8c38d6bdd3207c34285f213ca8dfafed Mon Sep 17 00:00:00 2001 From: Mike Eggers <49650192+v-miegge@users.noreply.github.com> Date: Wed, 22 Apr 2020 12:25:05 -0700 Subject: [PATCH 039/149] Updated title --- devices/surface/support-solutions-surface.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md index 543d6250ee..ab4c3a46c4 100644 --- a/devices/surface/support-solutions-surface.md +++ b/devices/surface/support-solutions-surface.md @@ -1,5 +1,5 @@ --- -title: Top support solutions for Surface devices +title: Top support solutions for Surface devices in the enterprise description: Find top solutions for common issues using Surface devices in the enterprise. ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A ms.reviewer: From 5e5d8d9c57f63f4641123a154da9d52bb60104fc Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 Apr 2020 12:49:29 -0700 Subject: [PATCH 040/149] add note --- .../microsoft-defender-atp/configure-server-endpoints.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 9a9e8530ab..f060b6bc94 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -51,6 +51,11 @@ There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 - **Option 1**: Onboard through Microsoft Defender Security Center - **Option 2**: Onboard through Azure Security Center +> [!NOTE] +> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or +an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services). + + ### Option 1: Onboard servers through Microsoft Defender Security Center You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center. @@ -124,8 +129,7 @@ Once completed, you should see onboarded servers in the portal within an hour. 4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp). -> [!NOTE] -> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services) + ## Windows Server, version 1803 and Windows Server 2019 To onboard Windows Server, version 1803 or Windows Server 2019, refer to the supported methods and versions below. From c730491beef8f28e83cfcd514f7fe7da16277b1a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 Apr 2020 13:19:12 -0700 Subject: [PATCH 041/149] fix line --- .../microsoft-defender-atp/configure-server-endpoints.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index f060b6bc94..a2550f9980 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -52,8 +52,7 @@ There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 - **Option 2**: Onboard through Azure Security Center > [!NOTE] -> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or -an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services). +> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services). ### Option 1: Onboard servers through Microsoft Defender Security Center From 8cbe1e136394ffa9f86f8f7abe9df2a73f8e20b5 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Wed, 22 Apr 2020 17:41:19 -0700 Subject: [PATCH 042/149] Revisions --- devices/hololens/hololens-kiosk.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c114270ae2..ab4ab88f47 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -25,7 +25,7 @@ You can configure a HoloLens device to function as a fixed-purpose device, also This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). -> [!IMPORTANT] +> [!IMPORTANT] > Kiosk mode determines which apps are available when a user signs in to the device. However, kiosk mode is not a security limitation. It does not stop an "allowed" app from launching an app that is not allowed. In order to block apps or processes from launching, use [Windows Defender Application Control (WDAC) CSP](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) to create appropriate policies. You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. @@ -43,6 +43,9 @@ You can configure any HoloLens 2 device to use kiosk mode. To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready. +> [!IMPORTANT] +> To help protect devices that run in kiosk mode, consider adding device management policies that turn off features such as USB connectivity. Additionally, check your update ring settings to make sure that automatic updates do not occur during business hours. + ### Decide between a single-app kiosk or a multi-app kiosk A single-app kiosk starts the specified app when the user signs in to the device. The Start menu is disabled, as is Cortana. A HoloLens 2 device does not respond to the [Start](hololens2-basic-usage.md#start-gesture) gesture. A HoloLens (1st gen) device does not respond to the [bloom](hololens1-basic-usage.md) gesture. Because only one app can run, the user cannot place other apps. @@ -56,7 +59,7 @@ The following table lists the feature capabilities in the different kiosk modes. |Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled1 | |Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | -> 1 Voice commands that relate to disabled features do not function. +> 1 Voice commands that relate to disabled features do not function. > 2 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). > 3 Even if Cortana is disabled, the built-in voice commands are enabled. @@ -78,7 +81,7 @@ For examples of how to use these capabilities, see the following table. For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). -If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. +If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. The CSP uses [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app) to identify applications. The following table lists the AUMIDs of some in-box applications that you can use in a multi-app kiosk. From 6f6c565f903025ff82f7bb9b49c27ca67c2c3d74 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Wed, 22 Apr 2020 18:04:20 -0700 Subject: [PATCH 043/149] Revisions --- devices/hololens/hololens-kiosk.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ab4ab88f47..7602c26e6e 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -114,9 +114,13 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. > 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. -### Plan access control +### Plan user and device groups + +In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +In short, you configure assignments to deploy the kiosk configuration to devices and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a Kiosk experience. + -It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. @@ -129,9 +133,7 @@ Click assignments and add the group(s) that you want the Kiosk mode policy deplo > [!IMPORTANT] > If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). -There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. **Examples:** From dec8475ee01c9b4c2503c537b9f645e9da5c0274 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Wed, 22 Apr 2020 18:28:17 -0700 Subject: [PATCH 044/149] Update manage-updates-baselines-windows-defender-antivirus.md First draft to verify the process flow --- ...es-baselines-windows-defender-antivirus.md | 68 ++++++++++++++----- 1 file changed, 50 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index d444eaedc1..fe00cf4804 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -48,24 +48,56 @@ You can manage the distribution of updates through Windows Server Update Service Only the main version is listed in the following table as reference information: -Month | Platform/Client | Engine ----|---|--- -Mar-2020 | 4.18.2003.x| 1.1.16900.x -Feb-2020 | - | 1.1.16800.x -Jan-2020 | 4.18.2001.x | 1.1.16700.x -Dec-2019 | - | - | -Nov-2019 | 4.18.1911.x | 1.1.16600.x -Oct-2019 | 4.18.1910.x | 1.1.16500.x -Sep-2019 | 4.18.1909.x | 1.1.16400.x -Aug-2019 | 4.18.1908.x | 1.1.16300.x -Jul-2019 | 4.18.1907.x | 1.1.16200.x -Jun-2019 | 4.18.1906.x | 1.1.16100.x -May-2019 | 4.18.1905.x | 1.1.16000.x -Apr-2019 | 4.18.1904.x | 1.1.15900.x -Mar-2019 | 4.18.1903.x | 1.1.15800.x -Feb-2019 | 4.18.1902.x | 1.1.15700.x -Jan-2019 | 4.18.1901.x | 1.1.15600.x -Dec-18 | 4.18.1812.X | 1.1.15500.x +
+ March-2020 (4.18.2003.8/1.1.16900.2) + + + + Released: **March 26, 2020** + Platform/Client: **4.18.2003.8** + Engine: **1.1.16900.2** + + ### What´s new + * fix1 + * fix2 + * fix3 + + ### Known Issues + * New file path + Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled. +To work around this issue, open Group Policy, and then change the setting to Allow for the following path: + + +%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\* + + +> [!NOTE] +> Information the user should notice even if skimming. + +
+ +
+ Jan-2020 (4.18.2001.10/1.1.16700.2) + + + Released: **March 26, 2020** + Platform/Client: **4.18.2001.10** + Engine: **1.1.16700.2** + + ### What´s new + * fix1 + * fix2 + * fix3 + + ### Known Issues + * New file path + Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled. +To work around this issue, open Group Policy, and then change the setting to Allow for the following path: + +%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\* + +
+ ## In this section From b90b5e6cf16fd6ac10c56fa8982c62367a3299c3 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 10:00:37 -0700 Subject: [PATCH 045/149] Revisions --- devices/hololens/hololens-kiosk.md | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 7602c26e6e..39986a9f07 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -118,31 +118,32 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). -In short, you configure assignments to deploy the kiosk configuration to devices and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a Kiosk experience. +In short, you assign kiosk configuration profiles to device groups, and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. +#### User-dependent experiences +When you configure a HoloLens device as a single-app kiosk, all of the users who sign on to that device see the kiosk experience. Users who do not belong to an appropriately configured user group cannot use the device. -One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. +When you configure a HoloLens device as a multi-app kiosk, the device can provide a kiosk experience to one group of users and a non-kiosk experience to another group of users. In other words, it can function as a kiosk or as a normal HoloLens device, depending on who signs in. -Assign the policy to the group to receive the policy +#### Profile conflicts -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. +If two or more kiosk configuration profiles target the same device, they conflict. In the case of Intune-managed devices, Intune does not apply any of the conflicting profiles. -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. +Other types of profiles and policies, such as device restrictions that are not related to the kiosk configuration profile, do not conflict with the kiosk configuration profile. -> [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +#### Examples of how to use groups +- You use a single group for both devices and users. One device and users A, B, and C are members of this group. No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. +- You use a device group and a user group. Users A, B, and C are members of the device group. Users B and C are also members of the user group (user A is not a member). No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, after that the user experiences differ as follows: -**Examples:** - -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. - -- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. + - Users B and C can sign in to the device, and they get the kiosk experience. + - User A can sign in to the device, but does not get the kiosk experience. If the device is a multi-app kiosk, user A can use the device as a typical non-kiosk device. +- You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. + + You use a single user group that includes users from both vendors. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. ### Select a deployment method From f264152d3400cde485db89dcb6bf1112748ca468 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 10:58:42 -0700 Subject: [PATCH 046/149] Revisions --- devices/hololens/hololens-kiosk.md | 313 ++++++++++++----------------- 1 file changed, 123 insertions(+), 190 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 39986a9f07..134b8595f0 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -116,9 +116,9 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you ### Plan user and device groups -In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). +In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). Because these groups are security groups (for example, Azure Active Directory, or Azure AD, security groups) you can use a single group for devices and users. Separate groups are typically easier to manage. -In short, you assign kiosk configuration profiles to device groups, and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. +In short, you assign a user group to a kiosk configuration profile, and you assign the profile to a device group. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. #### User-dependent experiences @@ -143,27 +143,17 @@ Other types of profiles and policies, such as device restrictions that are not r - You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. - You use a single user group that includes users from both vendors. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. + You use a single user group that includes users from both vendors, and you assign that group to both profiles. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. ### Select a deployment method +You can select one of three methods to deploy kiosk configurations: -While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +- [Provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) -What are you deploying: - -- Single-app kiosk -- Simple multi-app kiosk -- Fully-customized multi-app kiosk - -There are three methods that you can use to configure the device as a kiosk: - -- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. - -- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. - -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. +- [Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) > [!NOTE] > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. @@ -181,17 +171,111 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | +## Set up kiosk mode by using Microsoft Intune or MDM + +To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. + +1. [Create a kiosk configuration profile](#create-a-kiosk-configuration-profile). +1. Select the settings that you want to see in your kiosk. + - [Configure the settings for a single-app kiosk](#mdmconfigsingle). + - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). +1. [Assign the kiosk configuration profile to the device group](#mdmassign). +1. Deploy the devices. + - [Deploy a single-app kiosk](#mdmsingledeploy). + - [Deploy a multi-app kiosk](#mdmmultideploy). + +### [MDM] 1. Create a kiosk configuration profile + +1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** +1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. + +Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. + +For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). + +### Select the settings for your kiosk + For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). [Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) +#### [MDM] 2. Configure the settings for a single-app kiosk + +Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. +For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). + +#### [MDM] 2. Configure the settings for a multi-app kiosk + +Additional information: + +- You can optionally use a custom Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). +- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). + +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. + +**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. +For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. + +It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. + +Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. + +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. + +### [MDM] 3. Assign the kiosk configuration profile to the device group + +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. + +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + +### Deploy the devices + +Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. + +#### [MDM] 4. Deploy a single-app kiosk + +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. + +During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. + +Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. + +Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. + +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). + +#### [MDM] 4. Deploy a multi-app kiosk + +For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. + +If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. + +Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. + +To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) + +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). + +## Use a provisioning package to set up a single-app or muti-app kiosk + +As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). + +To set up kiosk mode by using a provisioning package, follow these steps. + +1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) +2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) +3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) + + ### Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: -- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. +- Do not include Classic Windows applications (Win32). HoloLens does not support these applications. - Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. #### Add guest access to the kiosk configuration (optional) @@ -211,33 +295,13 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. +> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start screen and does not need a Start layout. -### Start layout file for MDM (Intune and others) - -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). - -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). - -```xml - - - - - - - - - -``` +> [!NOTE] +> If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). ### Create a start layout for a customized multi-app kiosk @@ -263,158 +327,27 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ``` -## Set up kiosk mode by using Microsoft Intune or MDM +### Start layout file for MDM (Intune and others) -To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. +Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). -1. [Create a device configuration policy](#create-a-device-configuration-policy). -1. Select the settings that you want to see in your kiosk. - - [Configure the settings for a single-app kiosk](#configure-the-settings-for-a-single-app-kiosk). - - [Configure the settings for a multi-app kiosk](#configure-the-settings-for-a-multi-app-kiosk). -1. [Assign the policy to the group to receive the policy](#assign-the-policy-to-the-group-to-receive-the-policy). -1. Set up the device. - - [Set up a single-app kiosk](#set-up-a-single-app-kiosk). - - [Set up a multi-app kiosk](#set-up-a-multi-app-kiosk). - -### [MDM] 1. Create a device configuration policy - -1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. -1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** -1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. - -Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. - -For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). - -### Select the settings that you want to see in your kiosk - -#### [MDM] 2. Configure the settings for a single-app kiosk - -Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. -For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). - -#### [MDM] 2. Configure the settings for a multi-app kiosk - -Additional information: - -- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - -**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. -For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. - -It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. - -Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. - -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. -In-box apps you may wish to use are: - -| App Name | AUMID | -|----------------------------|----------------------------------------------------------------------------------| -| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | -| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | -| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -| File Explorer | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.mail | -| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | -| Microsoft Edge | Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge | -| Microsoft Store | Microsoft.WindowsStore_8wekyb3d8bbwe!App | -| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | -| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | -| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | -| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | -| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | -| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | - -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). - -### [MDM] 3. Assign the policy to the group to receive the policy - -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. - -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. - -> [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. - -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). - -There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. - -**Examples:** - -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. - -- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. - -### Set up the device - -Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. - -#### [MDM] 4. Set up a single-app kiosk - -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. - -During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. - -Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. - -Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. - -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). - -#### [MDM] 4. Set up a multi-app kiosk - -For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. - -If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. - -Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. - -To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) - -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). - - - -## Use a provisioning package to set up a single-app or muti-app kiosk - -As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). - -To set up kiosk mode by using a provisioning package, follow these steps. - -1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) -2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) -3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) - -### [PP] 1. Create a kiosk configuration XML file - -Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: - -- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. -- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. - -#### Add guest access to the kiosk configuration (optional) - -In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. - -Use the following snippet in your kiosk configuration XML to enable the **Guest** account: +> [!NOTE] +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). ```xml - - - - - - + + + + + + + + + ``` ### [PP] 2. Add the kiosk configuration XML file to a provisioning package From e4eede7b1fc6848dd0275faf6a40b18ba53a9b84 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 11:40:19 -0700 Subject: [PATCH 047/149] Revisions --- devices/hololens/hololens-kiosk.md | 43 ++++++++++++++++-------------- 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 134b8595f0..bcfab903dc 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -192,39 +192,42 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. -For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). +For full details about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). -### Select the settings for your kiosk +### [MDM] 2. Configure the settings for a single-app kiosk +This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following locations: -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) +- For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). +- For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks) +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file). -[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) +Configure the following settings in the kiosk configuration profile: -#### [MDM] 2. Configure the settings for a single-app kiosk +- **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +- **User logon type**.** Select **Local user account** to enter the local (to the device) user account, or a Microsoft Account (MSA) account that is associated with the kiosk app. **Autologon** user account types aren't supported on Windows Holographic for Business. +- **Application type**. Select **Store app**, and then select an app from the list. -Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. -For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). +### [MDM] 2. Configure the settings for a multi-app kiosk -#### [MDM] 2. Configure the settings for a multi-app kiosk - -Additional information: - -- You can optionally use a custom Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). +This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following locations: +- For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). +- For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) - For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. +- You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. -For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. +Configure the following settings in the kiosk configuration profile: -It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. +- **Target Windows 10 in S mode devices**. Select **No**. S mode isn't supported on Windows Holographic for Business. +- **User logon type**. Select **Azure AD user or group** or **HoloLens visitor**, and then add one or more user groups or accounts. + + Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience. -Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. +- Apps. You may choose to add just one or add many apps. You can use the following options to add apps: -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. + - To add an uploaded line of business app, select **Add store app**. + - To add an app by specifying its AUMID, select **Add by AUMID**. ### [MDM] 3. Assign the kiosk configuration profile to the device group From 9d58e595d1107a8e3c3f4225c6395e7b4a223909 Mon Sep 17 00:00:00 2001 From: Max Stein Date: Thu, 23 Apr 2020 12:48:49 -0700 Subject: [PATCH 048/149] Updated Microsoft browser extension policy URL Current URL: https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy leads to 404. Updated URL to reflect new URL: https://docs.microsoft.com/legal/microsoft-edge/microsoft-browser-extension-policy. --- .../microsoft-browser-extension-policy-shortdesc.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md b/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md index 91065aa687..8a7bd04455 100644 --- a/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md +++ b/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md @@ -1,12 +1,13 @@ --- author: dansimp ms.author: dansimp -ms.date: 10/02/2018 +ms.date: 04/23/2020 ms.reviewer: -audience: itpro manager: dansimp +audience: itpro +manager: dansimp ms.prod: edge ms.topic: include --- -[Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy): +[Microsoft browser extension policy](https://docs.microsoft.com/legal/microsoft-edge/microsoft-browser-extension-policy: This document describes the supported mechanisms for extending or modifying the behavior or user experience of Microsoft Edge and Internet Explorer or the content displayed by these browsers. Any technique not explicitly listed in this document is considered **unsupported**. From e28f537634559e97623c9a2ee9b5c3aaefdf757a Mon Sep 17 00:00:00 2001 From: illfated Date: Thu, 23 Apr 2020 22:35:19 +0200 Subject: [PATCH 049/149] Identity Protection/VPN: grammar, links & spacing As reported in issue ticket #6556 (Traffic filter sentence incomplete), there is a missing part in the sentence "Network admins to effectively add interface specific firewall rules on the VPN Interface." to make it work as a full descriptive sentence in this context. This PR aims to correct this issue, in addition to various other adjustments. Thanks to klishb for reporting this issue. Changes proposed: - Add the missing part of the Traffic Filters sentence - Update 2 outdated and permanently redirected MSDN links - Uppercase adjustments for "Traffic filters" & "Lockdown" - Add MarkDown indent marker compatibility spacing in the Note blob - Reduce bullet point spacing from 3 to 1 in the "Applies to" section - Remove all redundant end-of-line spacing - Add missing space after the corrected sentence (after the period) Ticket closure or reference: Closes #6556 --- .../vpn/vpn-security-features.md | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index 18e7b41ec9..22517e110c 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -8,7 +8,7 @@ ms.pagetype: security, networking author: dulcemontemayor ms.localizationpriority: medium ms.date: 07/27/2017 -ms.reviewer: +ms.reviewer: manager: dansimp ms.author: dansimp --- @@ -16,8 +16,8 @@ ms.author: dansimp # VPN security features **Applies to** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile ## LockDown VPN @@ -29,51 +29,50 @@ A VPN profile configured with LockDown secures the device to only allow network - The user cannot delete or modify the VPN profile. - The VPN LockDown profile uses forced tunnel connection. - If the VPN connection is not available, outbound network traffic is blocked. -- Only one VPN LockDown profile is allowed on a device. +- Only one VPN LockDown profile is allowed on a device. ->[!NOTE] ->For built-in VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. - -Deploy this feature with caution as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. +> [!NOTE] +> For built-in VPN, LockDown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. +Deploy this feature with caution as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. ## Windows Information Protection (WIP) integration with VPN Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally. -The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include: +The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include: - Core functionality: File encryption and file access blocking - UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations - WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN - Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN -The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app. +The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app. Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip) -## Traffic filters +## Traffic Filters -Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins to effectively add interface specific firewall rules on the VPN Interface.There are two types of Traffic Filter rules: +Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins can use Traffic Filters to effectively add interface specific firewall rules on the VPN Interface. There are two types of Traffic Filter rules: - App-based rules. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface. - Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface. -There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level. +There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level. -For example, an admin could define rules that specify: +For example, an admin could define rules that specify: -- The Contoso HR App must be allowed to go through the VPN and only access port 4545. +- The Contoso HR App must be allowed to go through the VPN and only access port 4545. - The Contoso finance apps is allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889. -- All other apps on the device should be able to access only ports 80 or 443. +- All other apps on the device should be able to access only ports 80 or 443. ## Configure traffic filters -See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) for XML configuration. The following image shows the interface to configure traffic rules in a VPN Profile configuration policy using Microsoft Intune. From 3110c0ed5bb45058e4d2dab913f4c1de52b6f811 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Thu, 23 Apr 2020 15:28:13 -0700 Subject: [PATCH 050/149] removal of acronym sccm --- windows/deployment/update/fod-and-lang-packs.md | 8 ++++---- windows/deployment/update/how-windows-update-works.md | 6 +++--- .../update/waas-delivery-optimization-reference.md | 4 ++-- .../deployment/update/waas-delivery-optimization.md | 2 +- windows/deployment/update/waas-wu-settings.md | 2 +- .../update/windows-update-troubleshooting.md | 4 ++-- windows/deployment/windows-10-poc-sc-config-mgr.md | 2 +- ...-level-windows-diagnostic-events-and-fields-1703.md | 6 +++--- ...-level-windows-diagnostic-events-and-fields-1709.md | 10 +++++----- ...-level-windows-diagnostic-events-and-fields-1803.md | 8 ++++---- ...-level-windows-diagnostic-events-and-fields-1809.md | 8 ++++---- ...-level-windows-diagnostic-events-and-fields-1903.md | 4 ++-- .../resolved-issues-windows-10-1903.yml | 4 ++-- ...issues-windows-7-and-windows-server-2008-r2-sp1.yml | 2 +- .../threat-protection/mbsa-removal-and-guidance.md | 2 +- 15 files changed, 36 insertions(+), 36 deletions(-) diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md index 9dbe7740b3..d125672d4a 100644 --- a/windows/deployment/update/fod-and-lang-packs.md +++ b/windows/deployment/update/fod-and-lang-packs.md @@ -1,6 +1,6 @@ --- -title: Windows 10 - How to make FoD and language packs available when you're using WSUS/SCCM -description: Learn how to make FoD and language packs available when you're using WSUS/SCCM +title: Windows 10 - How to make FoD and language packs available when you're using WSUS or Configuration Manager +description: Learn how to make FoD and language packs available when you're using WSUS or Configuration Manager ms.prod: w10 ms.mktglfcycl: manage @@ -14,7 +14,7 @@ ms.reviewer: manager: laurawi ms.topic: article --- -# How to make Features on Demand and language packs available when you're using WSUS/SCCM +# How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager > Applies to: Windows 10 @@ -26,6 +26,6 @@ In Windows 10 version 1709 and 1803, changing the **Specify settings for optiona In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It’s currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location. -For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS or SCCM or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. +For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](https://docs.microsoft.com/windows/client-management/). diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md index ac597ae387..7284fecba7 100644 --- a/windows/deployment/update/how-windows-update-works.md +++ b/windows/deployment/update/how-windows-update-works.md @@ -106,7 +106,7 @@ When users start scanning in Windows Update through the Settings panel, the foll |MU|7971f918-a847-4430-9279-4a52d1efe18d| |Store|855E8A7C-ECB4-4CA3-B045-1DFA50104289| |OS Flighting|8B24B027-1DEE-BABB-9A95-3517DFB9C552| -|WSUS or SCCM|Via ServerSelection::ssManagedServer
3DA21691-E39D-4da6-8A4B-B43877BCB1B7 | +|WSUS or Configuration Manager|Via ServerSelection::ssManagedServer
3DA21691-E39D-4da6-8A4B-B43877BCB1B7 | |Offline scan service|Via IUpdateServiceManager::AddScanPackageService| #### Finds network faults @@ -117,9 +117,9 @@ Common update failure is caused due to network issues. To find the root of the i - The WU client uses SLS (Service Locator Service) to discover the configurations and endpoints of Microsoft network update sources – WU, MU, Flighting. > [!NOTE] - > Warning messages for SLS can be ignored if the search is against WSUS/SCCM. + > Warning messages for SLS can be ignored if the search is against WSUS or Configuration Manager. -- On sites that only use WSUS/SCCM, the SLS may be blocked at the firewall. In this case the SLS request will fail, and can’t scan against Windows Update or Microsoft Update but can still scan against WSUS/SCCM, since it’s locally configured. +- On sites that only use WSUS or Configuration Manager, the SLS may be blocked at the firewall. In this case the SLS request will fail, and can’t scan against Windows Update or Microsoft Update but can still scan against WSUS or Configuration Manager, since it’s locally configured. ![Windows Update scan log 3](images/update-scan-log-3.png) ## Downloading updates diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/update/waas-delivery-optimization-reference.md index de0d1957dc..a5d605d778 100644 --- a/windows/deployment/update/waas-delivery-optimization-reference.md +++ b/windows/deployment/update/waas-delivery-optimization-reference.md @@ -110,7 +110,7 @@ Download mode dictates which download sources clients are allowed to use when do | Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. | | Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. | -|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using SCCM. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. | +|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using Configuration Manager. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. | >[!NOTE] >Group mode is a best-effort optimization and should not be relied on for an authentication of identity of devices participating in the group. @@ -119,7 +119,7 @@ Download mode dictates which download sources clients are allowed to use when do By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and Active Directory Domain Services site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or Active Directory Domain Services site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group. -[//]: # (SCCM Boundary Group option; GroupID Source policy) +[//]: # (Configuration Manager Boundary Group option; GroupID Source policy) >[!NOTE] >To generate a GUID using Powershell, use [```[guid]::NewGuid()```](https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 9de80024c2..d37589c3e6 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -54,7 +54,7 @@ The following table lists the minimum Windows 10 version that supports Delivery | Windows Defender definition updates | 1511 | | Office Click-to-Run updates | 1709 | | Win32 apps for Intune | 1709 | -| SCCM Express Updates | 1709 + Configuration Manager version 1711 | +| Configuration Manager Express Updates | 1709 + Configuration Manager version 1711 | ``` -### Start layout file for MDM (Intune and others) +#### Start layout file for MDM (Intune and others) Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). @@ -365,66 +366,65 @@ Save the following sample as an XML file. You can use this file when you configu ### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). -2. Choose **Advanced provisioning**. -3. Name your project, and click **Next**. -4. Choose **Windows 10 Holographic** and click **Next**. -5. Select **Finish**. The workspace for your package opens. -6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. -7. In the center pane, click **Browse** to locate and select the kiosk configuration XML file that you created. +1. Select **Advanced provisioning**. +1. Name your project, and then select **Next**. +1. Select **Windows 10 Holographic**, and then select **Next**. +1. Select **Finish**. The workspace for your package opens. +1. Select **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. +1. In the center pane, select **Browse** to locate and select the kiosk configuration XML file that you created. - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) + ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](./images/multiappassignedaccesssettings.png) -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. -9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. -10. On the **File** menu, select **Save.** -11. On the **Export** menu, select **Provisioning package**. -12. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -13. On the **Provisioning package security** page, do not select **Enable package encryption** or provisioning will fail on HoloLens. You can choose to enable package signing. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. - -14. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. - -15. Click **Next**. - -16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. By using this account, you can view the provisioning status and logs. +1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. For **UserGroup**, select **Standard Users**. +1. Select **File** > **Save**. +1. Select **Export** > **Provisioning package**, and then set **Owner** to **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources. +1. Select **Next**. +1. On the **Provisioning package security** page, select a security option. + > [!IMPORTANT] + > If you select **Enable package signing**, you also have to select a valid certificate to use for signing the package. To do this, select **Browse** and select the certificate that you want to use to sign the package. + + > [!CAUTION] + > Do not select **Enable package encryption**. On HoloLens devices, this setting causes provisioning to fail. +1. Select **Next**. +1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**. +1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status. ### [PP] 3. Apply the provisioning package to HoloLens -You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances: -You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). +- You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). + +- You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). ## Use the Windows Device Portal to set up a single-app kiosk To set up kiosk mode by using the Windows Device Portal, follow these steps. -1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. +> [!IMPORTANT] +> Kiosk mode is only available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md) installed. - > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) +1. [Set up the HoloLens device to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. + + > [!CAUTION] + > When you set up HoloLens to use the Device Portal, you have to enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables you to side-load apps. However, this setting creates a risk that a user can install apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** by using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb). +1. On a computer, connect to the HoloLens by using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb). -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +1. Do one of the following: + - If you are connecting to the Windows Device Portal for the first time, [create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password) + - Enter the user name and password that you previously set up. > [!TIP] > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#security_certificate). -4. In the Windows Device Portal, click **Kiosk Mode**. +1. In the Windows Device Portal, select **Kiosk Mode**. + +1. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**. ![Kiosk Mode](images/kiosk.png) - - > [!NOTE] - > The kiosk mode option will be available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md). - -5. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**. - -6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** - - - +1. Restart HoloLens. If you still have your Device Portal page open, you can select select **Restart** at the top of the page. ## More information From a52a78eda28935e9fc436cf53b09a0a44a9c2cb8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 10:58:13 -0700 Subject: [PATCH 066/149] edits --- .../microsoft-defender-atp/manage-indicators.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index ef48d72ec9..c2674dbb21 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -151,8 +151,11 @@ It's important to understand the following prerequisites prior to creating indic You can create indicators for certificates. Some common use cases include: -- Deploying blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) but allow behaviors from signed applications using certificate whitelisting. -- Blocking the use of a specific signed application across your organization. Using the certificate 'block' indicator, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same. +- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) but need to allow behaviors from signed applications by using the adding the certificate in the allow list. +- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same. +- + + ### Before you begin @@ -160,9 +163,8 @@ It's important to understand the following requirements prior to creating indica - This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). - Supported on machines on Windows 10, version 1703 or later. -- The Antimalware client version must be or later. -- The Engine version must be x or later. -- This feature currently supports entering … or … +- The Antimalware client version must be 4.18.1901.x or later. +- The virus and threat protection definitions must be up-to-date. >[!IMPORTANT] > - A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it’s trusted by the client (Root CA certificate is installed under the Local Machine 'Trusted Root Certification Authorities'). From a5da7d7719dc3ca2fc8ed6846e85ba8703115ff2 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 11:37:28 -0700 Subject: [PATCH 067/149] edits --- .../microsoft-defender-atp/manage-indicators.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index c2674dbb21..f93b12d0ad 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -69,6 +69,7 @@ There are two ways you can create indicators for files: ### Before you begin It's important to understand the following prerequisites prior to creating indicators for files: + - This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). - The Antimalware client version must be 4.18.1901.x or later. - Supported on machines on Windows 10, version 1703 or later. @@ -151,10 +152,8 @@ It's important to understand the following prerequisites prior to creating indic You can create indicators for certificates. Some common use cases include: -- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) but need to allow behaviors from signed applications by using the adding the certificate in the allow list. +- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) and [controlled folder access](controlled-folders.md) but need to allow behaviors from signed applications by adding the certificate in the allow list. - Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same. -- - ### Before you begin @@ -162,8 +161,8 @@ You can create indicators for certificates. Some common use cases include: It's important to understand the following requirements prior to creating indicators for certifications: - This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). -- Supported on machines on Windows 10, version 1703 or later. - The Antimalware client version must be 4.18.1901.x or later. +- Supported on machines on Windows 10, version 1703 or later. - The virus and threat protection definitions must be up-to-date. >[!IMPORTANT] From b21891d0f20ee66a596ef09d7d6ca59371e73de6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 11:50:54 -0700 Subject: [PATCH 068/149] typo --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index f93b12d0ad..e04c52cc32 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -158,7 +158,7 @@ You can create indicators for certificates. Some common use cases include: ### Before you begin -It's important to understand the following requirements prior to creating indicators for certifications: +It's important to understand the following requirements prior to creating indicators for certificates: - This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). - The Antimalware client version must be 4.18.1901.x or later. From 5dd024466cade8dff7f4e70777f4ef8e1366192f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 11:54:01 -0700 Subject: [PATCH 069/149] fix warning --- ...lock-potentially-unwanted-apps-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index 91816a7033..612a4ddb65 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -62,7 +62,7 @@ Admins can [configure](https://docs.microsoft.com/DeployEdge/configure-microsoft Defender SmartScreen available, including [one for blocking PUA](https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#smartscreenpuaenabled). In addition, admins can [configure Windows Defender SmartScreen](https://docs.microsoft.com/microsoft-edge/deploy/available-policies?source=docs#configure-windows-defender-smartscreen) as a whole, using group policy settings to turn Windows Defender SmartScreen on or off. -Although Microsoft Defender ATP has its own block list, based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md#create-indicators-for-ips-and-urlsdomains-preview) in the Microsoft Defender ATP portal, Windows Defender SmartScreen will respect the new settings. +Although Microsoft Defender ATP has its own block list, based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md#create-indicators-for-ips-and-urlsdomains) in the Microsoft Defender ATP portal, Windows Defender SmartScreen will respect the new settings. ### Windows Defender Antivirus From 9e5a8bf3e72e11c7795633ed08e0e90d111a654d Mon Sep 17 00:00:00 2001 From: Todd Lyon <19413953+tmlyon@users.noreply.github.com> Date: Fri, 24 Apr 2020 12:10:46 -0700 Subject: [PATCH 070/149] Update hololens-insider.md Fix typo in speech command section --- devices/hololens/hololens-insider.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-insider.md b/devices/hololens/hololens-insider.md index c4d1cee1a2..385eed565c 100644 --- a/devices/hololens/hololens-insider.md +++ b/devices/hololens/hololens-insider.md @@ -88,7 +88,7 @@ Provisioning packages let you set HoloLens configuration through a config file r 1. Plug it into any freshly flashed HoloLens and press **Volume down + Power** to apply your provisioning package. ### System voice commands -You can now can access these commands with your voice: +You can now access these commands with your voice: - "Restart device" - "Shutdown device" - "Brightness up" From 31806c89cd852e3fcb6f053302939890746311cf Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 12:12:14 -0700 Subject: [PATCH 071/149] fix link --- ...lock-potentially-unwanted-apps-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index 612a4ddb65..7c0db7f78f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -62,7 +62,7 @@ Admins can [configure](https://docs.microsoft.com/DeployEdge/configure-microsoft Defender SmartScreen available, including [one for blocking PUA](https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#smartscreenpuaenabled). In addition, admins can [configure Windows Defender SmartScreen](https://docs.microsoft.com/microsoft-edge/deploy/available-policies?source=docs#configure-windows-defender-smartscreen) as a whole, using group policy settings to turn Windows Defender SmartScreen on or off. -Although Microsoft Defender ATP has its own block list, based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md#create-indicators-for-ips-and-urlsdomains) in the Microsoft Defender ATP portal, Windows Defender SmartScreen will respect the new settings. +Although Microsoft Defender ATP has its own block list, based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md) in the Microsoft Defender ATP portal, Windows Defender SmartScreen will respect the new settings. ### Windows Defender Antivirus From 8f015dafcbe59878379b7debe8aa18d7cdac5956 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 24 Apr 2020 12:13:03 -0700 Subject: [PATCH 072/149] Update miracast-over-infrastructure.md --- .../surface-hub/miracast-over-infrastructure.md | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md index 2bb6381924..1401112971 100644 --- a/devices/surface-hub/miracast-over-infrastructure.md +++ b/devices/surface-hub/miracast-over-infrastructure.md @@ -6,13 +6,13 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 06/20/2019 +ms.date: 04/24/2020 ms.reviewer: manager: laurawi ms.localizationpriority: medium --- -# Miracast on existing wireless network or LAN +# Miracast over infrastructure In the Windows 10, version 1703, Microsoft has extended the ability to send a Miracast stream over a local network rather than over a direct wireless link. This functionality is based on the [Miracast over Infrastructure Connection Establishment Protocol (MS-MICE)](https://msdn.microsoft.com/library/mt796768.aspx). @@ -28,7 +28,12 @@ Miracast over Infrastructure offers a number of benefits: ## How it works -Users attempt to connect to a Miracast receiver as they did previously. When the list of Miracast receivers is populated, Windows 10 will identify that the receiver is capable of supporting a connection over the infrastructure. When the user selects a Miracast receiver, Windows 10 will attempt to resolve the device's hostname via standard DNS, as well as via multicast DNS (mDNS). If the name is not resolvable via either DNS method, Windows 10 will fall back to establishing the Miracast session using the standard Wi-Fi direct connection. +Users attempt to connect to a Miracast receiver through their Wi-Fi adapter as they did previously. When the list of Miracast receivers is populated, Windows 10 will identify that the receiver is capable of supporting a connection over the infrastructure. When the user selects a Miracast receiver, Windows 10 will attempt to resolve the device's hostname via standard DNS, as well as via multicast DNS (mDNS). If the name is not resolvable via either DNS method, Windows 10 will fall back to establishing the Miracast session using the standard Wi-Fi direct connection. + +> [!NOTE] +> For more information on the connection negotiation sequence, see [Miracast over Infrastructure Connection Establishment Protocol (MS-MICE)](https://msdn.microsoft.com/library/mt796768.aspx) + + ## Enabling Miracast over Infrastructure @@ -36,13 +41,19 @@ Users attempt to connect to a Miracast receiver as they did previously. When the If you have a Surface Hub or other Windows 10 device that has been updated to Windows 10, version 1703, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: - The Surface Hub or device (Windows PC or phone) needs to be running Windows 10, version 1703. +- Open TCP port: **7250**. - A Surface Hub or Windows PC can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*. - As a Miracast receiver, the Surface Hub or device must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Surface Hub or device is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself. - As a Miracast source, the Windows PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. - The DNS Hostname (device name) of the Surface Hub or device needs to be resolvable via your DNS servers. You can achieve this by either allowing your Surface Hub to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the Surface Hub's hostname. - Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. +- On Windows 10 PCs, the **Projecting to this PC** feature must be enabled in System Settings, and the device must have a Wi-Fi interface enabled in order to respond to discovery requests that only occur through the Wi-Fi adapter. It is important to note that Miracast over Infrastructure is not a replacement for standard Miracast. Instead, the functionality is complementary, and provides an advantage to users who are part of the enterprise network. Users who are guests to a particular location and don’t have access to the enterprise network will continue to connect using the Wi-Fi Direct connection method. The **InBoxApps/WirelessProjection/PinRequired** setting in the [SurfaceHub configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp) is not required for Miracast over Infrastructure. This is because Miracast over Infrastructure only works when both devices are connected to the same enterprise network. This removes the security restriction that was previously missing from Miracast. We recommend that you continue using this setting (if you used it previously) as Miracast will fall back to regular Miracast if the infrastructure connection does not work. + +## FAQ +**Why do I still need Wi-Fi to use Miracast over infrastructure?** +Discovery requests to identify Miracast receivers can only occur through the Wi-Fi adapter. Once the receivers have been identified, Windows 10 can then attempt the connection to the network. From 51a324d7cb43060bb472017a701f48c33e8ef70d Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 12:22:43 -0700 Subject: [PATCH 073/149] Revisions --- devices/hololens/hololens-kiosk.md | 88 +++++++++++++++++++++++------- 1 file changed, 67 insertions(+), 21 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ee917f8b5d..6a906f35a9 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -116,21 +116,83 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you ### Plan user and device groups -In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). +In an MDM environment, you use groups to manage device configurations and user access. -The kiosk configuration profile includes the **User logon type** setting. **User logon type** identifies the user (or group that contains the users) who can use the app (or apps) that you add. If a user signs in by using an account that is not included in the configuration profile, that user cannot use apps on the kiosk. Similarly, if a device does not belong to a group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. +The kiosk configuration profile includes the **User logon type** setting. **User logon type** identifies the user (or group that contains the users) who can use the app (or apps) that you add. If a user signs in by using an account that is not included in the configuration profile, that user cannot use apps on the kiosk. > [!NOTE] > The **User logon type** of a single-app kiosk specifies a single user account. This is the user context under which the kiosk runs. The **User logon type** of a multi-app kiosk can specify one or more user accounts or groups that can use the kiosk. -In addition, you assign the configuration profile to a group. This group can be the same as that specified by **User logon type**, or a different group. These settings provide flexibility in how you manage user access and device behavior: +Before you can deploy the kiosk configuration to a device, you have to *assign* the kiosk configuration profile to a group that contains the device or a user that can sign on to the device. This setting produces behavior such as the following. -- To associate the kiosk configuration with the users who sign on to devices, assign the kiosk configuration profile to the group that contains the users. -- To associate the kiosk configuration with specific devices, assign the kiosk configuration profile to a group that contains the devices (such groups can include dynamically-generated groups that automatically enroll devices that meet certain criteria). +- If the device is a member of the assigned group, the kiosk configuration deploys to the device the first time that any user signs in on the device. +- If the device is not a member of the assigned group, but a user who is a member of that group signs in, the kiosk configuration deploys to the device at that time. +For a full discussion of the effects of assigning configuration profiles in Intune, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-profile-assign). +**Example 1** +You use a single group (Group 1) for both devices and users. One device and users A, B, and C are members of this group. You configure the kiosk configuration profile as follows: +- **User logon type**: Group 1 +- **Assigned group**: Group 1 + +No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. + +**Example 2** + +You use two groups that have the following members: + +- Group 1: + - User A + - User B +- Group 2: + - User A + - User B + - User C + - Device 1 + +You configure the kiosk configuration profile as follows: + +- **User logon type**: Group 1 +- **Assigned group**: Group 2 + +No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, the user experiences differ as follows: + +- Users A and B can sign in to the device, and they get the kiosk experience. +- User C can sign in to the device, but does not get the kiosk experience. User C can use the device as a typical non-kiosk device. + +**Example 3** + +You contract devices out to two different vendors who need different kiosk experiences. Both vendors have users, and you want all of the users to have access to kiosks from both their own vendor and the other vendor. You configure groups as follows: + +- Device Group 1: + - Device 1 (Vendor 1) + - Device 2 (Vendor 1) + +- Device Group 2: + - Device 3 (Vendor 2) + - Device 4 (Vendor 2) + +- User Group: + - User A (Vendor 1) + - User B (Vendor 2) + +You create two kiosk configuration profiles that have the following settings: + +- Kiosk Profile 1: + - **User logon type**: User Group + - **Assigned group**: Device Group 1 + +- Kiosk Profile 2: + - **User logon type**: User Group + - **Assigned group**: Device Group 2 + +These configurations produce the following results: + +- When any user signs on to Device 1 or Device 2, Intune deploys Kiosk Profile 1 to that device. +- When any user signs on to Device 3 or Device 4, Intune deploys Kiosk Profile 2 to that device. +- User A and user B can sign in to any of the four devices. If they sign in to Device 1 or Device 2, they see Vendor 1's kiosk experience. If they sign in to Device 3 or Device 4, they see Vendor 2's kiosk experience. #### Profile conflicts @@ -138,22 +200,6 @@ If two or more kiosk configuration profiles target the same device, they conflic Other types of profiles and policies, such as device restrictions that are not related to the kiosk configuration profile, do not conflict with the kiosk configuration profile. - - - -#### Examples of how to use groups - -- You use a single group for both devices and users. One device and users A, B, and C are members of this group. No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. - -- You use multiple groups. Users A, B, and C are members of Group 1. The HoloLens device is also a member of Group 1. Users B and C are also members of Group 2 (user A is not a member). No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, after that the user experiences differ as follows: - - - Users B and C can sign in to the device, and they get the kiosk experience. - - User A can sign in to the device, but does not get the kiosk experience. User A can use the device as a typical non-kiosk device. - -- You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. - - You use a single user group that includes users from both vendors, and you assign that group to both profiles. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. - ### Select a deployment method You can select one of three methods to deploy kiosk configurations: From 567d837d9f993188b0ffc64827db97103a47b4a0 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 24 Apr 2020 12:45:46 -0700 Subject: [PATCH 074/149] MDT updates Removes outdated content. --- ...-windows-10-to-surface-devices-with-mdt.md | 776 +----------------- ...-surface-devices-to-windows-10-with-mdt.md | 214 +---- 2 files changed, 6 insertions(+), 984 deletions(-) diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md index a12b2f2dc4..05db1ef1d7 100644 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md @@ -13,6 +13,7 @@ ms.localizationpriority: medium ms.audience: itpro ms.reviewer: manager: laurawi +ms.date: 04/24/2020 --- # Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit @@ -27,779 +28,8 @@ manager: laurawi - Surface 3 - Windows 10 -This article walks you through the recommended process to deploy Windows 10 to Surface devices with Microsoft deployment technologies. The process described in this article yields a complete Windows 10 environment including updated firmware and drivers for your Surface device along with applications like Microsoft Office 365 and the Surface app. - > [!NOTE] -> MDT is not currently supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) - -When the process is complete, the Surface device will be ready for use by the end user. You can customize this process to include your own applications and configuration to meet the needs of your organization. You can also follow the guidance provided in this article to integrate deployment to Surface devices into existing deployment strategies. - -By following the procedures in this article, you can create an up-to-date reference image and deploy this image to your Surface devices, a process known as *reimaging*. Reimaging will erase and overwrite the existing environment on your Surface devices. This process allows you to rapidly configure your Surface devices with identical environments that can be configured to precisely fit your organization’s requirements. - -An alternative to the reimaging process is an upgrade process. The upgrade process is non-destructive and instead of erasing the existing environment on your Surface device, it allows you to install Windows 10 while retaining your user data, applications, and settings. You can read about how to manage and automate the upgrade process of Surface devices to Windows 10 at [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md). - -The goal of the deployment process presented in this article is automation. By leveraging the many technologies and tools available from Microsoft, you can create a process that requires only a single touch on the devices being deployed. The automation can load the deployment environment; format the device; prepare an updated Windows image with the drivers required for the device; apply that image to the device; configure the Windows environment with licensing, membership in a domain, and user accounts; install applications; apply any Windows updates that were not included in the reference image; and log out. - -By automating each aspect of the deployment process, you not only greatly decrease the effort involved, but you create a process that can be easily repeated and where human error becomes less of a factor. Take for example a scenario where you create a reference image for the device manually, but you accidentally install conflicting applications and cause the image to become unstable. In this scenario you have no choice but to begin again the manual process of creating your image. If in this same scenario you had automated the reference image creation process, you could repair the conflict by simply editing a step in the task sequence and then re-running the task sequence. - -## Deployment tools - -The deployment process described in this article leverages a number of Microsoft deployment tools and technologies. Some of these tools and technologies are included in Windows client and Windows Server, such as Hyper-V and Windows Deployment Services (WDS), while others are available as free downloads from the [Microsoft Download Center](https://www.microsoft.com/download/windows.aspx). - -#### Microsoft Deployment Toolkit - -The Microsoft Deployment Toolkit (MDT) is the primary component of a Windows deployment. It serves as a unified interface for most of the Microsoft deployment tools and technologies, such as the Windows Assessment and Deployment Kit (Windows ADK), Windows System Image Manager (Windows SIM), Deployment Image Servicing and Management (DISM), User State Migration Tool (USMT), and many other tools and technologies. Each of these is discussed throughout this article. The unified interface, called the *Deployment Workbench*, facilitates automation of the deployment process through a series of stored deployment procedures, known as a *task sequence*. Along with these task sequences and the many scripts and tools that MDT provides, the resources for a Windows deployment (driver files, application installation files, and image files) are stored in a network share known as the *deployment share*. - -You can download and find out more about MDT at [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741). - -#### Windows Assessment and Deployment Kit - -Although MDT is the tool you will interact with most during the deployment process, the deployment tools found in the Windows ADK perform most of the deployment tasks during the deployment process. The resources for deployment are held within the MDT deployment share, but it is the collection of tools included in Windows ADK that access the image files, stage drivers and Windows updates, run the deployment experience, provide instructions to Windows Setup, and back up and restore user data. - -You can download and find out more about the Windows ADK at [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#windowsadk). - -#### Windows 10 installation media - -Before you can perform a deployment with MDT, you must first supply a set of operating system installation files and an operating system image. These files and image can be found on the physical installation media (DVD) for Windows 10. You can also find these files in the disk image (ISO file) for Windows 10, which you can download from the [Volume Licensing Service Center (VLSC)](https://www.microsoft.com/Licensing/servicecenter/default.aspx). - - ->[!NOTE] ->The installation media generated from the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT. - - -#### Windows Server - -Although MDT can be installed on a Windows client, to take full advantage of Windows Deployment Services’ ability to network boot, a full Windows Server environment is recommended. To provide network boot for UEFI devices like Surface with WDS, you will need Windows Server 2008 R2 or later. - - ->[!NOTE] ->To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter). - - -#### Windows Deployment Services - -Windows Deployment Services (WDS) is leveraged to facilitate network boot capabilities provided by the Preboot Execution Environment (PXE) server. The boot media generated by MDT is loaded onto the Surface device simply by pressing Enter at the prompt when the device attempts to boot from the attached network adapter or Surface Dock. - -#### Hyper-V virtualization platform - -The process of creating a reference image should always be performed in a virtual environment. When you use a virtual machine as the platform to build your reference image, you eliminate the need for installation of additional drivers. The drivers for a Hyper-V virtual machine are included by default in the factory Windows 10 image. When you avoid the installation of additional drivers – especially complex drivers that include application components like control panel applications – you ensure that the image created by your reference image process will be as universally compatible as possible. - ->[!NOTE] ->A Generation 1 virtual machine is recommended for the preparation of a reference image in a Hyper-V virtual environment. - -Because customizations are performed by MDT at the time of deployment, the goal of reference image creation is not to perform customization but to increase performance during deployment by reducing the number of actions that need to occur on each deployed device. The biggest action that can slow down an MDT deployment is the installation of Windows updates. When MDT performs this step during the deployment process, it downloads the updates on each deployed device and installs them. By installing Windows updates in your reference image, the updates are already installed when the image is deployed to the device and the MDT update process only needs to install updates that are new since the image was created or are applicable to products other than Windows (for example, Microsoft Office updates). - - ->[!NOTE] ->Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center. - - -#### Surface firmware and drivers - -For your deployed Windows environment to function correctly on your Surface devices, you will need to install the drivers used by Windows to communicate with the components of your device. These drivers are available for download in the Microsoft Download Center for each Surface device. You can find the correct Microsoft Download Center page for your device at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). - -When you browse to the specific Microsoft Download Center page for your device, you will find a Windows Installer (.msi) file. This file is used to update drivers on devices that are already running Windows or that have device management solutions. Firmware updates maintain the instructions used by the device hardware to communicate between components and Windows. The firmware of Surface device components is updated by installation of specific driver files and thus is installed along with the other drivers during deployment. For more information, see [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). - ->[!NOTE] ->Beginning in Windows 10, the drivers for Surface devices are included in the Windows Preinstallation Environment (WinPE). In earlier versions of Windows, specific drivers (like network drivers) had to be imported and configured in MDT for use in WinPE to successfully deploy to Surface devices. - -#### Application installation files - -In addition to the drivers that are used by Windows to communicate with the Surface device’s hardware and components, you will also need to provide the installation files for any applications that you want to install on your deployed Surface devices. To automate the deployment of an application, you will also need to determine the command-line instructions for that application to perform a silent installation. In this article, the Surface app and Microsoft Office 365 will be installed as examples of application installation. The application installation process can be used with any application with installation files that can be launched from command line. - ->[!NOTE] ->If the application files for your application are stored on your organization’s network and will be accessible from your Surface devices during the deployment process, you can deploy that application directly from that network location. To use installation files from a network location, use the **Install Application Without Source Files or Elsewhere on the Network** option in the MDT New Application Wizard, which is described in the [Import applications](#import-applications) section later in this article. - -#### Microsoft Surface Deployment Accelerator - -If you want to deploy only to Surface devices or you want an accelerated method to perform deployment to Surface devices, you can use the Microsoft Surface Deployment Accelerator to generate an MDT deployment share complete with Surface device drivers, Surface apps, and pre-configured task sequences to create a reference image and perform deployment to Surface devices. Microsoft Surface Deployment Accelerator can automatically import boot images into WDS and prepare WDS for network boot (PXE). You can download the Microsoft Surface Deployment Accelerator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. - -### Install the deployment tools - -Before you can configure the deployment environment with Windows images, drivers, and applications, you must first install the deployment tools that will be used throughout the deployment process. The three main tools to be installed are WDS, Windows ADK, and MDT. WDS provides the capacity for network boot, Windows ADK provides several deployment tools that perform specific deployment tasks, and MDT provides automation and a central interface from which to manage and control the deployment process. - -To boot from the network with either your reference virtual machines or your Surface devices, your deployment environment must include a Windows Server environment. The Windows Server environment is required to install WDS and the WDS PXE server. Without PXE support, you will be required to create physical boot media, such as a USB stick to perform your deployment – MDT and Windows ADK will still be required, but Windows Server is not required. Both MDT and Windows ADK can be installed on a Windows client and perform a Windows deployment. - ->[!NOTE] ->To download deployment tools directly to Windows Server, you must disable [Internet Explorer Enhanced Security Configuration](https://technet.microsoft.com/library/dd883248). On Windows Server 2012 R2, this can be performed directly through the **Server Manager** option on the **Local Server** tab. In the **Properties** section, **IE Enhanced Security Configuration** can be found on the right side. You may also need to enable the **File Download** option for the **Internet** zone through the **Security** tab of **Internet Options**. - -#### Install Windows Deployment Services - -Windows Deployment Services (WDS) is a Windows Server role. To add the WDS role to a Windows Server 2012 R2 environment, use the Add Roles and Features Wizard, as shown in Figure 1. Start the Add Roles and Features Wizard from the **Manage** button of **Server Manager**. Install both the Deployment Server and Transport Server role services. - -![Install the Windows Deployment Services role](images/surface-deploymdt-fig1.png "Install the Windows Deployment Services role") - -*Figure 1. Install the Windows Deployment Services server role* - -After the WDS role is installed, you need to configure WDS. You can begin the configuration process from the WDS node of Server Manager by right-clicking your server’s name and then clicking **Windows Deployment Services Management Console**. In the **Windows Deployment Services** window, expand the **Servers** node to find your server, right-click your server, and then click **Configure** in the menu to start the Windows Deployment Services Configuration Wizard, as shown in Figure 2. - -![Configure PXE response for Windows Deployment Services](images/surface-deploymdt-fig2.png "Configure PXE response for Windows Deployment Services") - -*Figure 2. Configure PXE response for Windows Deployment Services* - ->[!NOTE] ->Before you configure WDS make sure you have a local NTFS volume that is not your system drive (C:) available for use with WDS. This volume is used to store WDS boot images, deployment images, and configuration. - -Using the Windows Deployment Services Configuration Wizard, configure WDS to fit the needs of your organization. You can find detailed instructions for the installation and configuration of WDS at [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426). On the **PXE Server Initial Settings** page, be sure to configure WDS so that it will respond to your Surface devices when they attempt to boot from the network. If you have already installed WDS or need to change your PXE server response settings, you can do so on the **PXE Response** tab of the **Properties** of your server in the Windows Deployment Services Management Console. - ->[!NOTE] ->You will add boot images to WDS when you update your boot images in MDT. You do not need to add boot images or Windows images to WDS when you configure the role. - -#### Install Windows Assessment and Deployment Kit - -To install Windows ADK, run the Adksetup.exe file that you downloaded from [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#adkwin10). Windows ADK must be installed before MDT. You should always download and use the most recent version of Windows ADK. A new version is usually released corresponding with each new version of Windows. - ->[!NOTE] ->You can also use the Adksetup.exe file to download the Windows ADK installation files locally for use on other devices. - -When you get to the **Select the features you want to install** page, you only need to select the **Deployment Tools** and **Windows Preinstallation Environment (Windows PE)** check boxes to deploy Windows 10 using MDT, as shown in Figure 3. - -![Required options for deployment with MDT](images/surface-deploymdt-fig3.png "Required options for deployment with MDT") - -*Figure 3. Only Deployment Tools and Windows PE options are required for deployment with MDT* - -#### Install Microsoft Deployment Toolkit - -After the Windows ADK installation completes successfully, you can install MDT. When you download MDT, ensure that you download the version that matches the architecture of your deployment server environment. For Windows Server the architecture is 64-bit. Download the MDT installation file that ends in **x64**. When MDT is installed you can use the default options during the installation wizard, as shown in Figure 4. - -![MDT installation with default options](images/surface-deploymdt-fig4.png "MDT installation with default options") - -*Figure 4. Install the Microsoft Deployment Toolkit with default options* - -Before you can open the MDT Deployment Workbench, you must enable execution of scripts in PowerShell. If you do not do this, the following error message may be displayed: *"Initialization Error PowerShell is required to use the Deployment Workbench. Please install PowerShell then relaunch Deployment Workbench."* - -To enable the execution of scripts, run the following cmdlet in PowerShell as an Administrator: - - `Set-ExecutionPolicy RemoteSigned -Scope CurrentUser` - -## Create a reference image - -Now that you have installed the required tools, you can begin the first step of customizing your deployment environment to your needs – create a reference image. Because the reference image should be created in a virtual machine where there is no need for drivers to be installed, and because the reference image will not include applications, you can use the MDT deployment environment almost entirely with default settings. - -### Create a deployment share - -Now that you have the tools installed, the next step is to configure MDT for the creation of a reference image. Before you can perform the process of creating a reference image, MDT needs to be set up with a repository for scripts, images, and other deployment resources. This repository is known as the *deployment share*. After the deployment share is created, you must supply MDT with a complete set of Windows 10 installation files, the last set of tools required before MDT can perform reference image creation. - -To create the deployment share, follow these steps: - -1. Open the Deployment Workbench from your Start menu or Start screen, as shown in Figure 5. - - ![The MDT Deployment Workbench](images/surface-deploymdt-fig5.png "The MDT Deployment Workbench") - - *Figure 5. The MDT Deployment Workbench* - -2. Right-click the **Deployment Shares** folder, and then click **New Deployment Share** to start the New Deployment Share Wizard, as shown in Figure 6. - - ![Summary page of the New Deployment Share Wizard](images/surface-deploymdt-fig6.png "Summary page of the New Deployment Share Wizard") - - *Figure 6. The Summary page of the New Deployment Share Wizard* - -3. Create a new deployment share with New Deployment Share Wizard with the following steps: - - * **Path** – Specify a local folder where the deployment share will reside, and then click **Next**. - - >[!NOTE] - >Like the WDS remote installation folder, it is recommended that you put this folder on an NTFS volume that is not your system volume. - - * **Share** – Specify a name for the network share under which the local folder specified on the **Path** page will be shared, and then click **Next**. - - >[!NOTE] - >The share name cannot contain spaces. - - >[!NOTE] - >You can use a Dollar Sign (**$**) to hide your network share so that it will not be displayed when users browse the available network shares on the server in File Explorer. - - * **Descriptive Name** – Enter a descriptive name for the network share (this descriptive name can contain spaces), and then click **Next**. The descriptive name will be the name of the folder as it appears in the Deployment Workbench. - * **Options** – You can accept the default options on this page. Click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the deployment share. - * **Progress** – While the deployment share is being created, a progress bar is displayed on this page to indicate the status of the deployment share creation process. - * **Confirmation** – When the deployment share creation process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Deployment Share Wizard. - -4. When the New Deployment Share Wizard is complete, you can expand the Deployment Shares folder to find your newly created deployment share. -5. You can expand your deployment share, where you will find several folders for the resources, scripts, and components of your MDT deployment environment are stored. - -To secure the deployment share and prevent unauthorized access to the deployment resources, you can create a local user on the deployment share host and configure permissions for that user to have read-only access to the deployment share only. It is especially important to secure access to the deployment share if you intend to automate the logon to the deployment share during the deployment boot process. By automating the logon to the deployment share during the boot of deployment media, the credentials for that logon are stored in plaintext in the bootstrap.ini file on the boot media. - ->[!NOTE] ->If you intend to capture images (such as the reference image) with this user, the user must also have write permission on the Captures folder in the MDT deployment share. - -You now have an empty deployment share that is ready for you to add the resources that will be required for reference image creation and deployment to Surface devices. - -### Import Windows installation files - -The first resources that are required to perform a deployment of Windows are the installation files from Windows 10 installation media. Even if you have an already prepared reference image, you still need to supply the unaltered installation files from your installation media. The source of these files can be a physical disk, or it can be an ISO file like the download from the Volume Licensing Service Center (VLSC). - ->[!NOTE] ->A 64-bit operating system is required for compatibility with Surface devices except Surface Pro X which cannot be managed with MDT. - -To import Windows 10 installation files, follow these steps: - -1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench, and then click **New Folder** to open the **New Folder** page, as shown in Figure 7. - - ![Create a new folder on the New Folder page](images/surface-deploymdt-fig7.png "Create a new folder on the New Folder page") - - *Figure 7. Create a new folder on the New Folder page* - -2. On the **New Folder** page a series of steps is displayed, as follows: - * **General Settings** – Enter a name for the folder in the **Folder Name** field (for example, Windows 10 Enterprise), add any comments you want in the **Comments** field, and then click **Next**. - * **Summary** – Review the specified configuration of the new folder on this page, and then click **Next**. - * **Progress** – A progress bar will be displayed on this page while the folder is created. This page will likely pass very quickly. - * **Confirmation** – When the new folder has been created, a **Confirmation** page displays the success of the operation. Click **Finish** to close the **New Folder** page. -3. Expand the Operating Systems folder to see the newly created folder. -4. Right-click the newly created folder, and then click **Import Operating System** to launch the Import Operating System Wizard, as shown in Figure 8. - - ![Import source files with the Import Operating System Wizard](images/surface-deploymdt-fig8.png "Import source files with the Import Operating System Wizard") - - *Figure 8. Import source files with the Import Operating System Wizard* - -5. The Import Operating System Wizard walks you through the import of your operating system files, as follows: - * **OS Type** – Click **Full Set of Source Files** to specify that you are importing the Windows source files from installation media, and then click **Next**. - * **Source** – Click **Browse**, move to and select the folder or drive where your installation files are found, and then click **Next**. - * **Destination** – Enter a name for the new folder that will be created to hold the installation files, and then click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the installation files are imported, a progress bar is displayed on this page. - * **Confirmation** – When the operating system import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Operating System Wizard. -6. Expand the folder you created in Step 1 to see the entry for your newly imported installation files for Windows 10. - -Now that you’ve imported the installation files from the installation media, you have the files that MDT needs to create the reference image and you are ready to instruct MDT how to create the reference image to your specifications. - -### Create reference image task sequence - -As described in the [Deployment tools](#deployment-tools) section of this article, the goal of creating a reference image is to keep the Windows environment as simple as possible while performing tasks that would be common to all devices being deployed. You should now have a basic MDT deployment share configured with default options and a set of unaltered, factory installation files for Windows 10. This simple configuration is perfect for reference image creation because the deployment share contains no applications or drivers to interfere with the process. - ->[!NOTE] ->For some organizations keeping a simple deployment share without applications or drivers is the simplest solution for creation of reference images. You can easily connect to more than one deployment share from a single Deployment Workbench and copy images from a simple, reference-image-only deployment share to a production deployment share complete with drivers and applications. - -To create the reference image task sequence, follow these steps: - -1. Right-click the **Task Sequences** folder under your deployment share in the Deployment Workbench, and then click **New Task Sequence** to start the New Task Sequence Wizard, as shown in Figure 9. - - ![Create new task sequence to deploy and update a Windows 10 reference environment](images/surface-deploymdt-fig9.png "Create new task sequence to deploy and update a Windows 10 reference environment") - - *Figure 9. Create a new task sequence to deploy and update a Windows 10 reference environment* - -2. The New Task Sequence Wizard presents a series of steps, as follows: - * **General Settings** – Enter an identifier for the reference image task sequence in the **Task Sequence ID** field, a name for the reference image task sequence in the **Task Sequence Name** field, and any comments for the reference image task sequence in the **Task Sequence Comments** field, and then click **Next**. - >[!NOTE] - >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - * **Select Template** – Select **Standard Client Task Sequence** from the drop-down menu, and then click **Next**. - * **Select OS** – Navigate to and select the Windows 10 image you imported with the Windows 10 installation files, and then click **Next**. - * **Specify Product Key** – Click **Do Not Specify a Product Key at This Time**, and then click **Next**. - * **OS Settings** – Enter a name, organization, and home page URL in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. - * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**. - >[!NOTE] - >During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. - * **Progress** – While the task sequence is created, a progress bar is displayed on this page. - * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard. -3. Select the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**. -4. Select the **Task Sequence** tab to view the steps that are included in the Standard Client Task Sequence template, as shown in Figure 10. - - ![Enable Windows Update in the reference image task sequence](images/surface-deploymdt-fig10.png "Enable Windows Update in the reference image task sequence") - - *Figure 10. Enable Windows Update in the reference image task sequence* - -5. Select the **Windows Update (Pre-Application Installation)** option, located under the **State Restore** folder. -6. Click the **Options** tab, and then clear the **Disable This Step** check box. -7. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option. -8. Click **OK** to apply changes to the task sequence, and then close the task sequence properties window. - -### Generate and import MDT boot media - -To boot the reference virtual machine from the network, the MDT deployment share first must be updated to generate boot media with the resources that have been added in the previous sections. - -To update the MDT boot media, follow these steps: - -1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard, as shown in Figure 11. - - ![Generate boot images with the Update Deployment Share Wizard](images/surface-deploymdt-fig11.png "Generate boot images with the Update Deployment Share Wizard") - - *Figure 11. Generate boot images with the Update Deployment Share Wizard* - -2. Use the Update Deployment Share Wizard to create boot images with the following process: - * **Options** – Click **Completely Regenerate the Boot Images**, and then click **Next**. - >[!NOTE] - >Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page. - * **Summary** – Review the specified options on this page before you click **Next** to begin generation of boot images. - * **Progress** – While the boot images are being generated, a progress bar is displayed on this page. - * **Confirmation** – When the boot images have been generated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard. -3. Confirm that boot images have been generated by navigating to the deployment share in File Explorer and opening the Boot folder. The following files should be displayed, as shown in Figure 12: - * **LiteTouchPE_x86.iso** - * **LiteTouchPE_x86.wim** - * **LiteTouchPE_x64.iso** - * **LiteTouchPE_x64.wim** - - - ![Boot images in the Boot folder after Update Deployment Share Wizard completes](images/surface-deploymdt-fig12.png "Boot images in the Boot folder after Update Deployment Share Wizard completes") - - *Figure 12. Boot images displayed in the Boot folder after completion of the Update Deployment Share Wizard* - -To import the MDT boot media into WDS for PXE boot, follow these steps: - -1. Open Windows Deployment Services from the Start menu or Start screen. -2. Expand **Servers** and your deployment server. -3. Click the **Boot Images** folder, as shown in Figure 13. - - ![Start the Add Image Wizard from the Boot Images folder](images/surface-deploymdt-fig13.png "Start the Add Image Wizard from the Boot Images folder") - - *Figure 13. Start the Add Image Wizard from the Boot Images folder* - -4. Right-click the **Boot Images** folder, and then click **Add Boot Image** to open the Add Image Wizard, as shown in Figure 14. - - ![Import the LiteTouchPE_x86.wim MDT boot image](images/surface-deploymdt-fig14.png "Import the LiteTouchPE_x86.wim MDT boot image") - - *Figure 14. Import the LiteTouchPE_x86.wim MDT boot image* - -5. The Add Image Wizard displays a series of steps, as follows: - * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, click **Open**, and then click **Next**. - * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options. - * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**. - * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard. - ->[!NOTE] ->Only the 32-bit boot image, LiteTouchPE_x86.wim, is required to boot from BIOS devices, including Generation 1 Hyper-V virtual machines like the reference virtual machine. - -If your WDS configuration is properly set up to respond to PXE clients, you should now be able to boot from the network with any device with a network adapter properly configured for network boot (PXE). - ->[!NOTE] ->If your WDS server resides on the same server as DHCP or in a different subnet than the devices you are attempting to boot, additional configuration may be required. For more information, see [Managing Network Boot Programs](https://technet.microsoft.com/library/cc732351). - -### Deploy and capture a reference image - -Your deployment environment is now set up to create a reference image for Windows 10 complete with Windows Updates. - ->[!NOTE] ->You cannot install version updates (such as Windows 10, Version 1511) in a reference image. To create a reference image with a new version of Windows, you must use installation files from that version of Windows. When you install a version update in Windows, it effectively performs an upgrade to a new version of Windows, and upgraded installations of Windows cannot be prepared for deployment with Sysprep.

-By using a fully automated task sequence in an MDT deployment share dedicated to reference image creation, you can greatly reduce the time and effort required to create new reference images and it is the best way to ensure that your organization is ready for feature updates and new versions of Windows 10. - -You can now boot from the network with a virtual machine to run the prepared task sequence and generate a reference image. When you prepare your virtual machine in Hyper-V for reference image creation, consider the following: - -* Use a Generation 1 virtual machine for the simplicity of drivers and to ensure maximum compatibility with both BIOS and UEFI devices. -* Ensure your virtual machine has at least 1 GB of system memory at boot. You can ensure that the virtual machine has at least 1 GB of memory at boot but allow the memory to adjust after boot by using Dynamic Memory. You can read more about Dynamic Memory in the [Hyper-V Dynamic Memory Overview](https://technet.microsoft.com/library/hh831766). -* Ensure your virtual machine uses a legacy network adapter to support network boot (PXE); that network adapter should be connected to the same network as your deployment server, and that network adapter should receive an IP address automatically via DHCP. -* Configure your boot order such that PXE Boot is the first option. - -When your virtual machine (VM) is properly configured and ready, start or boot the VM and be prepared to press the F12 key when prompted to boot via PXE from the WDS server. - -Perform the reference image deployment and capture using the following steps: - -1. Start your virtual machine and press the F12 key when prompted to boot to the WDS server via PXE, as shown in Figure 15. - - ![Start network boot by pressing the F12 key](images/surface-deploymdt-fig15.png "Start network boot by pressing the F12 key") - - *Figure 15. Start network boot by pressing the F12 key* - -2. Click **Run the Deployment Wizard to Install a New Operating System** to begin the MDT deployment process. -3. Enter your MDT username and password, a user with rights to access the MDT deployment share over the network and with rights to write to the Captures folder in the deployment share. -4. After your credentials are validated, the Windows Deployment Wizard will start and process the boot and deployment share rules. -5. The Windows Deployment Wizard displays a series of steps, as follows: - * **Task Sequence** – Select the task sequence you created for reference image creation (it should be the only task sequence available), and then click **Next**. - * **Computer Details** – Leave the default computer name, workgroup name, and the **Join a Workgroup** option selected, and then click **Next**. The computer name and workgroup will be reset when the image is prepared by Sysprep and captured. - * **Move Data and Settings** – Leave the default option of **Do Not Move User Data and Settings** selected, and then click **Next**. - * **User Data (Restore)** – Leave the default option of **Do Not Restore User Data and Settings** selected, and then click **Next**. - * **Locale and Time** – Leave the default options for language and time settings selected. The locale and time settings will be specified during deployment of the image to other devices. Click **Next**. - * **Capture Image** – Click the **Capture an Image of this Reference Computer** option, as shown in Figure 16. In the **Location** field, keep the default location of the Captures folder. You can keep or change the name of the image file in the **File Name** field. When you are finished, click **Next**. - - ![Capture an image of the reference machine](images/surface-deploymdt-fig16.png "Capture an image of the reference machine") - - *Figure 16. Use the Capture Image page to capture an image of the reference machine after deployment* - - * **Ready** – You can review your selections by expanding **Details** on the **Ready** page. Click **Begin** when you are ready to perform the deployment and capture of your reference image. - -6. Your reference task sequence will run with the specified options. - -As the task sequence processes the deployment, it will automatically perform the following tasks: -* Install the Windows 10 image from the installation files you supplied -* Reboot into Windows 10 -* Run Windows updates until all Windows updates have been installed and the Windows environment is fully up to date -* Run Sysprep and prepare the Windows 10 environment for deployment -* Reboot into WinPE -* Capture an image of the Windows 10 environment and store it in the Captures folder in the MDT deployment share - ->[!NOTE] ->The Windows Update process can take some time to complete as it searches the Internet for updates, downloads those updates, and then installs them. By performing this process now, in the reference environment, you eliminate the need to perform these tasks on each deployed device and significantly reduce the amount of time and bandwidth required to perform your deployment. - -When the task sequence completes, your virtual machine will be off and a new reference image complete with updates will be ready in your MDT deployment share for you to import it and prepare your deployment environment for deployment to Surface devices. - -## Deploy Windows 10 to Surface devices - -With a freshly prepared reference image, you are now ready to configure the deployment process for deployment to the Surface devices. Use the steps detailed in this section to produce a deployment process that requires minimal effort on each Surface device to produce a complete and ready-to-use Windows 10 environment. - -### Import reference image - -After the reference image has been created and stored in the Captures folder, you need to add it to your MDT deployment share as an image for deployment. You perform this task by using the same process that you used to import the installation files for Windows 10. - -To import the reference image for deployment, use the following steps: - -1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench or the folder you created in when you imported Windows 10 installation files, and then click **Import Operating System** to start the Import Operating System Wizard. -2. Import the custom image with the Import Operating System Wizard by using the following steps: - * **OS Type** – Select Custom Image File to specify that you are importing the Windows source files from installation media, and then click **Next**. - * **Image** – Click **Browse**, and then navigate to and select the image file in the **Captures** folder in your deployment share. Select the **Move the Files to the Deployment Share Instead of Copying Them** checkbox if desired. Click **Next**. - * **Setup** – Click **Setup Files are not Neededf**, and then click **Next**. - * **Destination** – Enter a name for the new folder that will be created to hold the image file, and then click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the image is imported, a progress bar is displayed on this page. - * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Operating System Wizard. -3. Expand the folder in which you imported the image to verify that the import completed successfully. - ->[!NOTE] ->You can import the reference image into the same deployment share that you used to create your reference image, or you could import the reference image into a new deployment share for deployment to your Surface devices. If you chose to create a new deployment share for deployment of your reference image, remember that you still need to import a full set of installation files from installation media. - -Now that your updated reference image is imported, it is time to prepare your deployment environment for deployment to Surface devices complete with drivers, applications, and automation. - -### Import Surface drivers - -Before you can deploy your updated reference image to Surface devices, or any physical environment, you need to supply MDT with the drivers that Windows will use to communicate with that physical environment. For Surface devices you can download all of the drivers required by Windows in a single archive (.zip) file in a format that is ready for deployment. In addition to the drivers that are used by Windows to communicate with the hardware and components, Surface firmware and driver packs also include updates for the firmware of those components. By installing the Surface firmware and driver pack, you will also bring your device’s firmware up to date. If you have not done so already, download the drivers for your Surface device listed at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). - -Many devices require that you import drivers specifically for WinPE in order for the MDT boot media to communicate with the deployment share and to boot properly on that device. Even Surface Pro 3 required that network drivers be imported specifically for WinPE for deployment of Windows 8.1. Fortunately, for Windows 10 deployments to Surface devices, all of the required drivers for operation of WinPE are contained within the out-of-box drivers that are built into Windows 10. It is still a good idea to prepare your environment with folder structure and selection profiles that allow you to specify drivers for use in WinPE. You can read more about that folder structure in **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec05). - -To import the Surface drivers (in this example, Surface Pro 4) into MDT, follow these steps: - -1. Extract the downloaded archive (.zip) file to a folder that you can easily locate. Keep the driver files separate from other drivers or files. -2. Open the Deployment Workbench and expand the Deployment Shares node and your deployment share. -3. If you have not already created a folder structure by operating system version, you should do so now and create under the Windows 10 x64 folder a new folder for Surface Pro 4 drivers named Surface Pro 4. Your Out-of-Box Drivers folder should resemble the following structure, as shown in Figure 17: - * WinPE x86 - * WinPE x64 - * Windows 10 x64 - * Microsoft Corporation - * Surface Pro 4 - - ![Recommended folder structure for drivers](images/surface-deploymdt-fig17.png "Recommended folder structure for drivers") - - *Figure 17. The recommended folder structure for drivers* - -4. Right-click the **Surface Pro 4** folder, and then click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 18. - - ![Progress page during drivers import](images/surface-deploymdt-fig18.png "Progress page during drivers import") - - *Figure 18. The Progress page during drivers import* - -5. The Import Driver Wizard displays a series of steps, as follows: - * **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 4 firmware and drivers in Step 1. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the drivers are imported, a progress bar is displayed on this page. - * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard. -6. Click the **Surface Pro 4** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 19. - - ![Drivers for Surface Pro 4 imported and organized in the MDT deployment share](images/surface-deploymdt-fig19.png "Drivers for Surface Pro 4 imported and organized in the MDT deployment share") - - *Figure 19. Drivers for Surface Pro 4 imported and organized in the MDT deployment share* - -### Import applications - -You can import any number of applications into MDT for installation on your devices during the deployment process. You can configure your applications and task sequences to prompt you during deployment to pick and choose which applications are installed, or you can use your task sequence to explicitly define which applications are installed. For more information, see **Step 4: Add an application** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec04). - -#### Import Microsoft Office 365 Installer - -The Office Deployment Tool is a free download available in the Microsoft Download Center that allows IT professionals and system administrators to download and prepare Office installation packages for Office Click-to-Run. You can find the Office Deployment Tool and instructions to download Click-to-Run for Office 365 installation source files at [Download Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/library/jj219424). - -Download and install the version of Office Deployment Tool (ODT), for Office 2013 or Office 2016, that fits your organization’s needs and use the steps provided by that page to download the Office installation files for use with MDT. - -After you have downloaded the source files for your version of Office Click-to-Run, you need to edit the Configuration.xml file with instructions to install Office Click-to-Run silently. To configure the Office Deployment Tool for silent installation, follow these steps: - -1. Right-click the existing **Configuration.xml** file, and then click **Edit**. -2. This action opens the file in Notepad. Replace the existing text with the following: - ``` - - - - - - - - ``` - -3. Save the file. - -The default behavior of Setup.exe is to look for the source files in the path that contains **Setup.exe**. If the installation files are not found in this folder, the Office Deployment Tool will default to online source files from an Internet connection. - -For MDT to perform an automated installation of office, it is important to configure the **Display Level** option to a value of **None**. This setting is used to suppress the installation dialog box for silent installation. It is required that the **AcceptEULA** option is set to **True** to accept the license agreement when the **Display Level** option is set to **None**. With both of these options configured, the installation of Office will occur without the display of dialog boxes which could potentially cause the installation to pause until a user can address an open dialog box. - -Now that the installation and configuration files are prepared, the application can be imported into the deployment share by following these steps: - -1. Open the Deployment Workbench. -2. Expand the deployment share, right-click the **Applications** folder, and then click **New Application** to start the New Application Wizard, as shown in Figure 20. - - ![Enter the command and directory for Office 2016 Click-to-Run](images/surface-deploymdt-fig20.png "Enter the command and directory for Office 2016 Click-to-Run") - - *Figure 20. Enter the command and directory for Office 2016 Click-to-Run* - -3. The New Application Wizard walks you through importing the Office 2016 Click-to-Run files, as follows: - * **Application Type** – Click **Application with Source Files**, and then click **Next**. - * **Details** – Enter a name for the application (for example, Office 2016 Click-to-Run) in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**. - * **Source** – Click **Browse** to navigate to and select the folder where you downloaded the Office installation files with the Office Deployment Tool, and then click **Next**. - * **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name. - * **Command Details** – Enter the Office Deployment Tool installation command line: - - `Setup.exe /configure configuration.xml` - - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the installation files are imported, a progress bar is displayed on this page. - * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard. - -4. You should now see the **Office 2016 Click-to-Run** item under the **Applications** folder in the Deployment Workbench. - -#### Import Surface app installer - -The Surface app is a Microsoft Store app that provides the user with greater control over specific Surface device functions and capabilities (for example, control over the sensitivity of the Surface Pen). It is a highly recommended app for Surface devices to provide end users with the best experience and greatest control over their device. Find out more about the Surface app at [Install and use the Surface app](https://www.microsoft.com/surface/support/apps-and-windows-store/surface-app?os=windows-10). - -To perform a deployment of the Surface app, you will need to download the app files through Microsoft Store for Business. You can find detailed instructions on how to download the Surface app through Microsoft Store for Business at [Deploy Surface app with Microsoft Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business). - -After you have downloaded the installation files for Surface app, including the AppxBundle and license files, you can import these files into the deployment share through the same process as a desktop application like Microsoft Office. Both the AppxBundle and license files must be together in the same folder for the import process to complete successfully. Use the following command on the **Command Details** page to install the Surface app: - ``` -DISM.exe /Online /Add-ProvisionedAppxPackage /PackagePath: Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle /LicensePath: Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml - ``` - -### Create deployment task sequence - -The next step in the process is to create the deployment task sequence. This task sequence will be configured to completely automate the deployment process and will work along with customized deployment share rules to reduce the need for user interaction down to a single touch. Before you can make customizations to include all of this automation, the new task sequence has to be created from a template. - -To create the deployment task sequence, follow these steps: -1. In the Deployment Workbench, under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard. -2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard: - * **General Settings** – Enter an identifier for the deployment task sequence in the **Task Sequence ID** field, a name for the deployment task sequence in the **Task Sequence Name** field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, then click **Next**. - >[!NOTE] - >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - * **Select Template** – Click **Standard Client Task Sequence** from the drop-down menu, and then click **Next**. - * **Select OS** – Navigate to and select the reference image that you imported, and then click **Next**. - * **Specify Product Key** – Select the product key entry that fits your organization's licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**. - * **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. - * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. - * **Progress** – While the task sequence is being created, a progress bar is displayed on this page. - * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard. - -After the task sequence is created it can be modified for increased automation, such as the installation of applications without user interaction, the selection of drivers, and the installation of Windows updates. - -1. Click the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**. -2. Click the **Task Sequence** tab to view the steps that are included in the new task sequence. -3. Click the **Windows Update (Pre-Application Installation)** step, located under the **State Restore** folder. -4. Click the **Options** tab, and then clear the **Disable This Step** check box. -5. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option. -6. Between the two **Windows Update** steps is the **Install Applications** step. Click the **Install Applications** step, and then click **Add**. -7. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 21. - - ![A new Install Application step in the deployment task sequence](images/surface-deploymdt-fig21.png "A new Install Application step in the deployment task sequence") - - *Figure 21. A new Install Application step in the deployment task sequence* - -8. On the **Properties** tab of the new **Install Application** step, enter **Install Microsoft Office 2016 Click-to-Run** in the **Name** field. -9. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -10. Select Office 2016 Click-to-Run from the list of applications, and then click **OK**. -11. Repeat Steps 6 through 10 for the Surface app. -12. Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step. -13. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. -14. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 22), configure the following options: - * **Name** – Set DriverGroup001 - * **Task Sequence Variable** – DriverGroup001 - * **Value** – Windows 10 x64\%Make%\%Model% - - ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images/surface-deploymdt-fig22.png "Configure a new Set Task Sequence Variable step in the deployment task sequence") - - *Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence* - -15. Select the **Inject Drivers** step, the next step in the task sequence. -16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options: - * In the **Choose a selection profile** drop-down menu, select **Nothing**. - * Click the **Install all drivers from the selection profile** button. - - ![Configure deployment task sequence not to choose the drivers to inject into Windows](images/surface-deploymdt-fig23.png "Configure deployment task sequence not to choose the drivers to inject into Windows") - - *Figure 23. Configure the deployment task sequence not to choose the drivers to inject into Windows* - -17. Click **OK** to apply changes to the task sequence and close the task sequence properties window. - -### Configure deployment share rules - -The experience of users during a Windows deployment is largely governed by a set of rules that control how the MDT and Windows Deployment Wizard experience should proceed. These rules are stored in two configuration files. Boot media rules are stored in the Bootstrap.ini file that is processed when the MDT boot media is first run. Deployment share rules are stored in the Customsettings.ini file and tell the Windows Deployment Wizard how to operate (for example, what screens to show and what questions to ask). By using these the rules stored in these two files, you can completely automate the process of deployment to where you will not be asked to supply the answer to any questions during deployment and the deployment will perform all tasks completely on its own. - -#### Configure Bootstrap.ini - -Bootstrap.ini is the simpler of the two rule files. The purpose it serves is to provide instructions from when the MDT boot media starts on a device until the Windows Deployment Wizard is started. The primary use of this file is to provide the credentials that will be used to log on to the deployment share and start the Windows Deployment Wizard. - -To automate the boot media rules, follow these steps: - -1. Right-click your deployment share in the Deployment Workbench, and then click **Properties**. -2. Click the **Rules** tab, and then click **Edit Bootstrap.ini** to open Bootstrap.ini in Notepad. -3. Replace the text of the Bootstrap.ini file with the following text: - - ``` - [Settings] - Priority=Model,Default - - [Surface Pro 4] - DeployRoot=\\STNDeployServer\DeploymentShare$ - UserDomain=STNDeployServer - UserID=MDTUser - UserPassword=P@ssw0rd - SkipBDDWelcome=YES - - [Surface Pro 4] - DeployRoot=\\STNDeployServer\DeploymentShare$ - ``` - -4. Press Ctrl+S to save Bootstrap.ini, and then close Notepad. - -You can use a number of variables in both boot media and deployment share rules to apply rules only when certain conditions are met. For example, you can use MAC addresses to identify specific machines where MDT will run fully automated, but will run with required user interaction on all other devices. You can also use the model of the device to instruct the MDT boot media to perform different actions based on computer model, much as the way **[Surface Pro 4]** is listed in Step 3. You can use the following cmdlet in a PowerShell session to see what the Model variable would be on a device: - -```wmic csproduct get name``` - -Rules used in the text shown in Step 3 include: - -* **DeployRoot** – Used to specify the deployment share that the MDT boot media will connect to. -* **UserDomain** – Used to specify the domain or computer where the MDT user account is located. -* **UserID** – Used to specify the MDT user account for automatic logon to the deployment share. -* **UserPassword** – Used to specify the MDT user password for automatic logon to the deployment share. -* **SkipBDDWelcome** – Used to skip the Welcome page and to start the Windows Deployment Wizard immediately using the specified credentials and deployment share. - -#### Configure CustomSettings.ini - -The bulk of the rules used to automate the MDT deployment process are stored in the deployment share rules, or the Customsettings.ini file. In this file you can answer and hide all of the prompts from the Windows Deployment Wizard, which yields a deployment experience that mostly consists of a progress bar that displays the automated actions occurring on the device. The deployment share rules are shown directly in the **Rules** tab of the deployment share properties, as shown in Figure 24. - -![Deployment share rules configured for automation of the Windows Deployment Wizard](images/surface-deploymdt-fig24.png "Deployment share rules configured for automation of the Windows Deployment Wizard") - -*Figure 24. Deployment share rules configured for automation of the Windows Deployment Wizard* - -To configure automation for the production deployment, copy and paste the following text into the text box on the **Rules** tab of your deployment share properties: - - ``` -[Settings] -Priority=Model,Default -Properties=MyCustomProperty - -[Surface Pro 4] -SkipTaskSequence=YES -TaskSequenceID=Win10SP4 - -[Default] -OSInstall=Y -SkipCapture=YES -SkipAdminPassword=YES -SkipProductKey=YES -SkipComputerBackup=YES -SkipBitLocker=YES -SkipBDDWelcome=YES -SkipUserData=YES -UserDataLocation=AUTO -SkipApplications=YES -SkipPackageDisplay=YES -SkipComputerName=YES -SkipDomainMembership=YES -JoinDomain=contoso.com -DomainAdmin=MDT -DomainAdminDomain=contoso -DomainAdminPassword=P@ssw0rd -SkipLocaleSelection=YES -KeyboardLocale=en-US -UserLocale=en-US -UILanguage=en-US -SkipTimeZone=YES -TimeZoneName=Pacific Standard Time -UserID=MDTUser -UserDomain=STNDeployServer -UserPassword=P@ssw0rd -SkipSummary=YES -SkipFinalSummary=YES -FinishAction=LOGOFF - ``` -Rules used in this example include: - -* **SkipTaskSequence** – This rule is used to skip the **Task Sequence** page where the user would have to select between available task sequences. -* **TaskSequenceID** – This rule is used to instruct the Windows Deployment Wizard to run a specific task sequence. In this scenario the task sequence ID should match the deployment task sequence you created in the previous section. -* **OSInstall** – This rule indicates that the Windows Deployment Wizard will be performing an operating system deployment. -* **SkipCapture** – This rule prevents the **Capture Image** page from being displayed, prompting the user to create an image of this device after deployment. -* **SkipAdminPassword** – This rule prevents the **Admin Password** page from being displayed. The Administrator password specified in the task sequence will still be applied. -* **SkipProductKey** – This rule prevents the **Specify Product Key** page from being displayed. The product key specified in the task sequence will still be applied. -* **SkipComputerBackup** – This rule prevents the **Move Data and Settings** page from being displayed, where the user is asked if they would like to make a backup of the computer before performing deployment. -* **SkipBitLocker** – This rule prevents the **BitLocker** page from being displayed, where the user is asked if BitLocker Drive Encryption should be used to encrypt the device. -* **SkipBDDWelcome** – This rule prevents the **Welcome** page from being displayed, where the user is prompted to begin Windows deployment. -* **SkipUserData** – This rule prevents the **User Data (Restore)** page from being displayed, where the user is asked to restore previously backed up user data in the new environment. -* **UserDataLocation** – This rule prevents the user from being prompted to supply a location on the User Data (Restore) page. -* **SkipApplications** – This rule prevents the **Applications** page from being displayed, where the user is prompted to select from available applications to be installed in the new environment. -* **SkipPackageDisplay** – This rule prevents the **Packages** page from being displayed, where the user is prompted to select from available packages to be installed in the new environment. -* **SkipComputerName** – This rule, when combined with the **SkipDomainMembership** rule, prevents the **Computer Details** page from being displayed, where the user is asked to supply computer name and join a domain or workgroup. -* **SkipDomainMembership** – This rule, when combined with the **SkipComputerName** rule, prevents the **Computer Details** page from being displayed, where the user is asked to supply computer name and join a domain or workgroup. -* **JoinDomain** – This rule instructs the Windows Deployment Wizard to have the computer join the specified domain using the specified credentials. -* **DomainAdmin** – This rule specifies the username for the domain join operation. -* **DomainAdminDomain** – This rule specifies the domain for the username for the domain join operation. -* **DomainAdminPassword** – This rule specifies the password for the username for the domain join operation. -* **SkipLocaleSelection** – This rule, along with the **SkipTimeZone** rule, prevents the **Locale and Time** page from being displayed. -* **KeyboardLocale** – This rule is used to specify the keyboard layout for the deployed Windows environment. -* **UserLocale** – This rule is used to specify the geographical locale for the deployed Windows environment. -* **UILanguage** – This rule is used to specify the language to be used in the deployed Windows environment. -* **SkipTimeZone** – This rule, along with the **SkipLocaleSelection** rule, prevents the **Locale and Time** page from being displayed. -* **TimeZoneName** – This rule is used to specify the time zone for the deployed Windows environment. -* **UserID** – This rule is used to supply the username under which the MDT actions and task sequence steps are performed. -* **UserDomain** – This rule is used to supply the domain for the username under which the MDT actions and task sequence steps are performed. -* **UserPassword** – This rule is used to supply the password for the username under which the MDT actions and task sequence steps are performed. -* **SkipSummary** – This rule prevents the **Summary** page from being displayed before the task sequence is run, where the user is prompted to confirm the selections before beginning the task sequence. -* **SkipFinalSummary** – This rule prevents the **Summary** page from being displayed when the task sequence has completed. -* **FinishAction** – This rule specifies whether to log out, reboot, or shut down the device after the task sequence has completed. - -You can read about all of the possible deployment share and boot media rules in the [Microsoft Deployment Toolkit Reference](https://technet.microsoft.com/library/dn781091). - -### Update and import updated MDT boot media - -The process to update MDT boot media with these new rules and changes to the deployment share is very similar to the process to generate boot media from scratch. - -To update the MDT boot media, follow these steps: - -1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard. -2. The Update Deployment Share Wizard displays a series of steps, as follows: - * **Options** – Choose between the **Completely Regenerate the Boot Images** or **Optimize the Boot Image Updating Process** options. Completely regenerating the boot images will take more time, but produces boot media that is not fragmented and does not contain out of date components. Optimizing the boot image updating process will proceed more quickly, but may result in longer load times when booting via PXE. Click **Next**. - * **Summary** – Review the specified options on this page before you click **Next** to begin the update of boot images. - * **Progress** – While the boot images are being updated a progress bar is displayed on this page. - * **Confirmation** – When the boot images have been updated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard. - -To import the updated MDT boot media into WDS for PXE boot, follow these steps: - -1. Open Windows Deployment Services from the Start menu or Start screen. -2. Expand **Servers** and your deployment server. -3. Click the **Boot Images** folder. -4. Right-click the existing MDT boot image, and then click **Replace Image** to open the Replace Boot Image Wizard. -5. Replace the previously imported MDT boot image with the updated version by using these steps in the Replace Boot Image Wizard: - * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, and then click **Open**. Click **Next**. - * **Available Images** – Only one image should be listed and selected **LiteTouch Windows PE (x86)**, click **Next**. - * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options. - * **Summary** – Review your selections for importing a boot image into WDS, and then click **Next**. - * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Replace Boot Image Wizard. -6. Right-click the **Boot Images** folder, and then click **Add Image** to open the Add Image Wizard. -7. Add the new 64-bit boot image for 64-bit UEFI device compatibility with the Add Image Wizard , as follows: - * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, select **LiteTouchPE_x64.wim**, and then click **Open**. Click **Next**. - * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options. - * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**. - * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard. - ->[!NOTE] ->Although it is a best practice to replace and update the boot images in WDS whenever the MDT deployment share is updated, for deployment to Surface devices the 32-bit boot image, LiteTouchPE_x86.wim, is not required. Only the 64-bit boot image is required for 64-bit UEFI devices. - -### Deploy Windows to Surface - -With all of the automation provided by the deployment share rules and task sequence, performing the deployment on each Surface device becomes as easy as a single touch. - ->[!NOTE] ->For the deployment to require only a single touch, the Surface devices must be connected to a keyboard, connected to the network with a Microsoft Surface USB Ethernet Adapter or Surface Dock, and configured with PXE boot as the first boot option, as shown in Figure 25. - -![Set boot priority for PXE boot](images/surface-deploymdt-fig25.png "Set boot priority for PXE boot") - -*Figure 25. Setting boot priority for PXE boot* - -On a properly configured Surface device, simply turn on the device and press Enter when you are prompted to boot from the network. The fully automated MDT deployment process will then take over and perform the following tasks: - -* The MDT boot media will be loaded to your Surface device via the network -* The MDT boot media will use the provided credentials and rules to connect to the MDT deployment share -* The task sequence and drivers will be automatically selected for your device via make and model information -* The task sequence will deploy your updated Windows 10 image to the device complete with the selected drivers -* The task sequence will join your device to the domain -* The task sequence will install the applications you specified, Microsoft Office and Surface app -* Windows Update will run, installing any new Windows Updates or updates for installed applications, like Microsoft Office -* The task sequence will complete silently and log out of the device - ->[!NOTE] ->For Surface devices not configured to boot to the network as the first boot option, you can hold Volume Down and press Power to boot the system immediately to a USB or network device. - -The resulting configuration is a Surface device that is logged out and ready for an end user to enter their credentials, log on, and get right to work. The applications and drivers they need are already installed and up to date. - - +> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) +For the latest information about using MDT, refer to [Deploy a Windows 10 image using MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt). diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md index f483ed4583..82e6317686 100644 --- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md +++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md @@ -13,6 +13,7 @@ ms.localizationpriority: medium ms.audience: itpro ms.reviewer: manager: laurawi +ms.date: 04/24/2020 --- # Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit @@ -37,216 +38,7 @@ manager: laurawi - Surface Pro - Windows 10 -In addition to the traditional deployment method of reimaging devices, administrators that want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. The process described in this article shows how to perform a Windows 10 upgrade deployment to Surface devices. +In addition to the traditional deployment method of reimaging devices, administrators who want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. -If you are not already familiar with the deployment of Windows or the Microsoft deployment tools and technologies, you should read [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) and familiarize yourself with the traditional deployment method before you proceed. +For the latest information about upgrading surface devices using MDT, refer to [Perform an in-place upgrade to Windows 10 with MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit) -#### The upgrade concept - -When you use the factory installation media to install Windows on a device, you are presented with two options or *installation paths* to install Windows on that device. The first of these installation paths – *clean installation* – allows you to apply a factory image of Windows to that device, including all default settings. The second of these installation paths – *upgrade* – allows you to apply Windows to the device but retains the device’s users, apps, and settings. - -When you perform a Windows deployment using traditional deployment methods, you follow an installation path that is very similar to a clean installation. The primary difference between the clean installation and the traditional deployment method of *reimaging* is that with reimaging, you can apply an image that includes customizations. Microsoft deployment technologies, such as the Microsoft Deployment Toolkit (MDT), expand the capabilities of the reimaging process by modifying the image during deployment. For example, MDT is able to inject drivers for a specific hardware configuration during deployment, and with pre and post imaging scripts to perform a number of tasks, such as the installation of applications. - -For versions of Windows prior to Windows 10, if you wanted to install a new version of Windows on your devices and preserve the configuration of those systems, you had to perform additional steps during your deployment. For example, if you wanted to keep the data of users on the device, you had to back up user data with the User State Migration Tool (USMT) prior to the deployment and restore that data after the deployment had completed. - -Introduced with Windows 10 and MDT 2013 Update 1, you can use the upgrade installation path directly with Microsoft deployment technologies such as the Microsoft Deployment Toolkit (MDT). With an upgrade deployment you can use the same deployment technologies and process, but you can preserve users settings, and applications of the existing environment on the device. - -> [!NOTE] -> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) - -## Deployment tools and resources - -Performing an upgrade deployment of Windows 10 requires the same tools and resources that are required for a traditional reimaging deployment. You can read about the tools required, including detailed explanations and installation instructions, in [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md). To proceed with the upgrade deployment described in this article, you will need the following tools installed and configured: - -* [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741) -* [Windows Assessment and Deployment Kit (Windows ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#windowsadk), which includes: - * Deployment Image Servicing and Management (DISM) - * Windows Preinstallation Environment (Windows PE) - * Windows System Image Manager (Windows SIM) - -You will also need to have available the following resources: - -* Windows 10 installation files, such as the installation media downloaded from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx) - - >[!NOTE] - >Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT. -* [Surface firmware and drivers](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10 - -* Application installation files for any applications you want to install, such as the Surface app - -## Prepare the upgrade deployment - -Before you begin the process described in this section, you need to have installed and configured the deployment tools outlined in the previous [Deployment tools and resources](#deployment-tools-and-resources) section. For instructions on how to install and configure the deployment tools, see the **Install the deployment tools** section in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#install-the-deployment-tools) article. You will also have needed to create a deployment share with MDT, described in the section Create a Deployment Share in the aforementioned article. - -### Import Windows 10 installation files - -Windows 10 installation files only need to be imported if you have not already done so in the deployment share. To import Windows 10 installation files, follow the steps described in the **Import Windows installation files** section in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#import-windows-installation-files) article. - -### Import Surface drivers -In the import process example shown in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) article, drivers for Surface Pro 4 were imported for Windows 10. To perform an upgrade deployment of Windows 10 to Surface Pro 3, drivers for Surface Pro 3 must also be imported. To import the Surface drivers for Surface Pro 3, follow these steps: - -1. Download the Surface Pro 3 firmware and driver pack for Windows 10 archive file (.zip), SurfacePro3_Win10_xxxxxx.zip, from the [Surface Pro 3 download page](https://www.microsoft.com/download/details.aspx?id=38826) in the Microsoft Download Center. -2. Extract the contents of the Surface Pro 3 firmware and driver pack archive file to a temporary folder. Keep the driver files separate from other drivers or files. -3. Open the Deployment Workbench and expand the Deployment Shares node and your deployment share. -4. If you have not already created a folder structure by operating system version, you should do so next. Under the **Windows 10 x64** folder, create a new folder for Surface Pro 3 drivers named **Surface Pro 3**. Your Out-of-Box Drivers folder should resemble the following structure: - * WinPE x86 - * WinPE x64 - * Windows 10 x64 - * Microsoft Corporation - * Surface Pro 4 - * Surface Pro 3 -5. Right-click the **Surface Pro 3** folder, and then click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 1. - - ![Import Surface Pro 3 drivers for Windows 10](images/surface-upgrademdt-fig1.png "Import Surface Pro 3 drivers for Windows 10") - - *Figure 1. Import Surface Pro 3 drivers for Windows 10* - -6. The Import Driver Wizard displays a series of steps, as follows: - - **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 3 firmware and drivers in Step 1. - - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - - **Progress** – While the drivers are imported, a progress bar is displayed on this page. - - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Drivers Wizard. -7. Select the **Surface Pro 3** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 2. - - ![Drivers for Surface Pro 3 imported and organized in the MDT deployment share](images/surface-upgrademdt-fig2.png "Drivers for Surface Pro 3 imported and organized in the MDT deployment share") - - *Figure 2. Drivers for Surface Pro 3 imported and organized in the MDT deployment share* - -### Import applications - -Installation of applications in an upgrade deployment is not always necessary because the applications from the previous environment will remain on the device. (For example, in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) article, the deployment includes Office 365 which is not required in an upgrade deployment where the user is already using Office 365 on the device.) - -There are still some circumstances where you will want to deploy an application, even during an upgrade deployment. For example, you may have Surface Pro 3 devices on which you would like to add the Surface app. To deploy the Surface app in an upgrade scenario use the same process as you would for a traditional deployment. See the [Deploy Surface app with Microsoft Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business) article for instructions on how to add the Surface app to an MDT task sequence. - -### Create the upgrade task sequence - -After you have all of the resources in place to perform the deployment (including the installation files, Surface drivers, and application files), the next step is to create the upgrade task sequence. This task sequence is a series of steps that will be performed on the device being upgraded that applies the new Windows environment, compatible drivers, and any applications you have specified. - -Create the upgrade task sequence with the following process: - -1. In the Deployment Workbench under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard. -2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard: - - **General Settings** – Enter an identifier for the deployment task sequence in the Task Sequence ID field, a name for the deployment task sequence in the Task Sequence Name field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, and then click **Next**. - >[!NOTE] - >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - - **Select Template** – Select **Standard Client Upgrade Task Sequence** from the drop-down menu, and then click **Next**. - - **Select OS** – Navigate to and select the Windows image that you imported, and then click **Next**. - - **Specify Product Key** – Select the product key entry that fits your organization’s licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**. - - **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. - - **Admin Password** – Select **Use the Specified Local Administrator Password** and enter a password in the provided fields, and then click **Next**. - - **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. - - **Progress** – While the task sequence is being created, a progress bar is displayed on this page. - - **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete New Task Sequence Wizard. - -After the task sequence is created, you can modify some additional settings to provide additional automation of the task sequence and require less interaction during deployment. Follow these steps to modify the task sequence: - -1. Select the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**. -2. Select the **Task Sequence** tab to view the steps that are included in the new task sequence. -3. Select the **Windows Update (Pre-Application Installation)** step, located under the **State Restore** folder. -4. Click the **Options** tab, and then clear the **Disable This Step** check box. -5. Repeat Step 3 and Step 4 for the **Windows Update (Post-Application Installation)** step. -6. Between the two Windows Update steps is an **Install Applications** step. Select that step and then click **Add**. -7. Hover the mouse over **General** under the **Add** menu, and then choose **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3. - - ![A new Install Application step in the deployment task sequence](images/surface-upgrademdt-fig3.png "A new Install Application step in the deployment task sequence") - - *Figure 3. A new Install Application step in the deployment task sequence* - -8. On the **Properties** tab of the new **Install Application** step, enter **Install Surface App** in the **Name** field. -9. Select **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -10. Select **Surface App** from the list of applications, and then click **OK**. -11. Expand the **Preinstall** folder and select the **Enable BitLocker (Offline)** step. -12. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. -13. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 4) configure the following options: - - - **Name** – Set DriverGroup001 - - **Task Sequence Variable** – DriverGroup001 - - **Value** – Windows 10 x64\%Make%\%Model% - - ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images/surface-upgrademdt-fig4.png "Configure a new Set Task Sequence Variable step in the deployment task sequence") - - *Figure 4. Configure a new Set Task Sequence Variable step in the deployment task sequence* - -14. Select the **Inject Drivers** step, the next step in the task sequence. -15. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 5) configure the following options: - * In the **Choose a selection profile** drop-down menu, select **Nothing**. - * Click the **Install all drivers from the selection profile** button. - - ![Configure the deployment task sequence to not install drivers](images/surface-upgrademdt-fig5.png "Configure the deployment task sequence to not install drivers") - - *Figure 5. Configure the deployment task sequence to not install drivers* - -16. Click **OK** to apply changes to the task sequence and close the task sequence properties window. - -Steps 11 through 15 are very important to the deployment of Surface devices. These steps instruct the task sequence to install only drivers that are organized into the correct folder using the organization for drivers from the [Import Surface drivers](#import-surface-drivers) section. - -### Deployment share rules - -To automate the upgrade process, the rules of the MDT deployment share need to be modified to suppress prompts for information from the user. Unlike a traditional deployment, Bootstrap.ini does not need to be modified because the deployment process is not started from boot media. Similarly, boot media does not need to be imported into WDS because it will not be booted over the network with PXE. - -To modify the deployment share rules and suppress the Windows Deployment Wizard prompts for information, copy and paste the following text into the text box on the **Rules** tab of your deployment share properties: - -``` -[Settings] -Priority=Model,Default -Properties=MyCustomProperty - -[Surface Pro 4] -SkipTaskSequence=YES -TaskSequenceID=Win10SP4 - -[Surface Pro 3] -SkipTaskSequence=YES -TaskSequenceID=Win10SP3Up - -[Default] -OSInstall=Y -SkipCapture=YES -SkipAdminPassword=YES -SkipProductKey=YES -SkipComputerBackup=YES -SkipBitLocker=YES -SkipBDDWelcome=YES -SkipUserData=YES -UserDataLocation=AUTO -SkipApplications=YES -SkipPackageDisplay=YES -SkipComputerName=YES -SkipDomainMembership=YES -JoinDomain=contoso.com -DomainAdmin=MDT -DomainAdminDomain=contoso -DomainAdminPassword=P@ssw0rd -SkipLocaleSelection=YES -KeyboardLocale=en-US -UserLocale=en-US -UILanguage=en-US -SkipTimeZone=YES -TimeZoneName=Pacific Standard Time -UserID=MDTUser -UserDomain=STNDeployServer -UserPassword=P@ssw0rd -SkipSummary=YES -SkipFinalSummary=YES -FinishAction=LOGOFF -``` - - - -For more information about the rules configured by this text, see the **Configure deployment share rules** section in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#configure-deployment-share-rules) article. - -### Update deployment share - -To update the deployment share, right-click the deployment share in the Deployment Workbench and click **Update Deployment Share**, then proceed through the Update Deployment Share Wizard. See the **Update and import updated MDT boot media** section of the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#update-and-import-updated-mdt-boot-media) article for detailed steps. - -### Run the upgrade deployment - -Unlike a traditional deployment, the upgrade task sequence must be launched from within the Windows environment that will be upgraded. This requires that a user on the device to be upgraded navigate to the deployment share over the network and launch a script, LiteTouch.vbs. This script is the same script that displays the Windows Deployment Wizard in Windows PE in a traditional deployment. In this scenario, Litetouch.vbs will run within Windows. To perform the upgrade task sequence and deploy the upgrade to Windows 10 follow these steps: - -1. Browse to the network location of your deployment share in File Explorer. -2. Navigate to the **Scripts** folder, locate **LiteTouch.vbs**, and then double-click **LiteTouch.vbs** to start the Windows Deployment Wizard. -3. Enter your credentials when prompted. -4. The upgrade task sequence for Surface Pro 3 devices will automatically start when the model of the device is detected and determined to match the deployment share rules. -5. The upgrade process will occur automatically and without user interaction. - -The task sequence will automatically install the drivers for Surface Pro 3 and the Surface app, and will perform any outstanding Windows Updates. When it completes, it will log out and be ready for the user to log on with the credentials they have always used for this device. From 098f935dbfe13b51a9caf088b9708a0548aea211 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 24 Apr 2020 13:38:19 -0700 Subject: [PATCH 075/149] Update miracast-over-infrastructure.md --- devices/surface-hub/miracast-over-infrastructure.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md index 1401112971..5ef43af85c 100644 --- a/devices/surface-hub/miracast-over-infrastructure.md +++ b/devices/surface-hub/miracast-over-infrastructure.md @@ -55,5 +55,5 @@ It is important to note that Miracast over Infrastructure is not a replacement f The **InBoxApps/WirelessProjection/PinRequired** setting in the [SurfaceHub configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp) is not required for Miracast over Infrastructure. This is because Miracast over Infrastructure only works when both devices are connected to the same enterprise network. This removes the security restriction that was previously missing from Miracast. We recommend that you continue using this setting (if you used it previously) as Miracast will fall back to regular Miracast if the infrastructure connection does not work. ## FAQ -**Why do I still need Wi-Fi to use Miracast over infrastructure?** +**Why do I still need Wi-Fi to use Miracast over infrastructure?**
Discovery requests to identify Miracast receivers can only occur through the Wi-Fi adapter. Once the receivers have been identified, Windows 10 can then attempt the connection to the network. From a441d05778f416991fc54e39f40db8f03f047f6f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 24 Apr 2020 14:28:12 -0700 Subject: [PATCH 076/149] Added missing end punctuation --- .../surface/deploy-windows-10-to-surface-devices-with-mdt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md index 05db1ef1d7..47f14939db 100644 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md @@ -29,7 +29,7 @@ ms.date: 04/24/2020 - Windows 10 > [!NOTE] -> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) +> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md). For the latest information about using MDT, refer to [Deploy a Windows 10 image using MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt). From 1a5318944197b8a8de86356b8d5573229292d631 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 24 Apr 2020 14:29:13 -0700 Subject: [PATCH 077/149] Added missing end punctuation --- .../surface/upgrade-surface-devices-to-windows-10-with-mdt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md index 82e6317686..c9345502d8 100644 --- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md +++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md @@ -40,5 +40,5 @@ ms.date: 04/24/2020 In addition to the traditional deployment method of reimaging devices, administrators who want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. -For the latest information about upgrading surface devices using MDT, refer to [Perform an in-place upgrade to Windows 10 with MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit) +For the latest information about upgrading surface devices using MDT, refer to [Perform an in-place upgrade to Windows 10 with MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit). From ebb463bbb5f5b32f312ab31189bd6f361a2782ba Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 14:58:07 -0700 Subject: [PATCH 078/149] Revisions --- devices/hololens/hololens-kiosk.md | 140 ++++++++++++++++------------- 1 file changed, 80 insertions(+), 60 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6a906f35a9..53196dcfdf 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -88,6 +88,7 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > [!CAUTION] > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. + | App Name | AUMID | |----------------------------|----------------------------------------------------------------------------------| | 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | @@ -130,6 +131,9 @@ Before you can deploy the kiosk configuration to a device, you have to *assign* For a full discussion of the effects of assigning configuration profiles in Intune, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-profile-assign). +> [!NOTE] +> The following examples describe multi-app kiosks. Single-app kiosks behave in a similar manner, but only one user account gets the kiosk experience. + **Example 1** You use a single group (Group 1) for both devices and users. One device and users A, B, and C are members of this group. You configure the kiosk configuration profile as follows: @@ -230,118 +234,135 @@ The following table lists the capabilities and benefits of each of the three dep To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. +1. [Prepare to enroll the devices](#mdmenroll). 1. [Create a kiosk configuration profile](#create-a-kiosk-configuration-profile). -1. Select the settings that you want to see in your kiosk. +1. Configure the kiosk. - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). -1. [Assign the kiosk configuration profile to the device group](#mdmassign). -1. [Prepare to enroll the devices](#mdmenroll) +1. [Assign the kiosk configuration profile to a group](#mdmassign). 1. Deploy the devices. - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). -### [MDM] 1. Create a kiosk configuration profile -1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. -1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** -1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. +### [MDM] 1. Prepare to enroll the devices -Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. +You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups. -For full details about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). +For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -### [MDM] 2. Configure the settings for a single-app kiosk +### [MDM] 2. Create a kiosk configuration profile -This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following locations: +1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account. +1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**. +1. Enter a profile name. +1. Select **Platform** > **Windows 10 and later**, and then select **Profile type** >**Device restrictions**. +1. Select **Configure** > **Kiosk**, and then select one of the following: + - To create a single-app kiosk, select **Kiosk Mode** > **Single-app kiosk**. + - To create a multi-app kiosk, select **Kiosk Mode** > **Multi-app kiosk**. +1. To start configuring the kiosk, select **Add**. + +Your next steps differ depending on the type of kiosk that you want. For further information, select one of the following: +- [Single-app kiosk](#mdmconfigsingle) +- [Multi-app kiosk](#mdmconfigmulti) + +For more information about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). + +### [MDM] 3. Configure the settings for a single-app kiosk + +This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following articles: - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks) - For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file). -Configure the following settings in the kiosk configuration profile: +1. Select **User logon type** > **Local user account**, and enter the user name of the local (device) account or Microsoft Account (MSA) that can sign in to the kiosk. + > [!NOTE] + > **Autologon** user account types aren't supported on Windows Holographic for Business. +1. Select **Application type** > **Store app**, and then select an app from the list. -- **User logon type** Select **Local user account** to enter the local (to the device) user account, or a Microsoft Account (MSA) account that is associated with the kiosk app. **Autologon** user account types aren't supported on Windows Holographic for Business. -- **Application type**. Select **Store app**, and then select an app from the list. +Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 2. Configure the settings for a multi-app kiosk +### [MDM] 3. Configure the settings for a multi-app kiosk -This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following locations: +This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following articles: - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) - For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -Configure the following settings in the kiosk configuration profile: +1. Select **Target Windows 10 in S mode devices** > **No**. + >[!NOTE] + > S mode isn't supported on Windows Holographic for Business. +1. Select **User logon type** > **Azure AD user or group** or **User logon type** > **HoloLens visitor**, and then add one or more user groups or accounts. -- **Target Windows 10 in S mode devices**. Select **No**. S mode isn't supported on Windows Holographic for Business. -- **User logon type**. Select **Azure AD user or group** or **HoloLens visitor**, and then add one or more user groups or accounts. - - Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience. + Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience. -- Apps. You may choose to add just one or add many apps. You can use the following options to add apps: +1. Select one or more apps by using the following options: + - To add an uploaded line-of-business app, select **Add store app** and then select the app you want. + - To add an app by specifying its AUMID, select **Add by AUMID** and then enter the AUMID of the app. [See the list of available AUMIDs](#aumids) - - To add an uploaded line of business app, select **Add store app**. - - To add an app by specifying its AUMID, select **Add by AUMID**. +Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 3. Assign the kiosk configuration profile to the device group +### [MDM] 4. Assign the kiosk configuration profile to a group -Use the **Assignments** page of the kiosk configuration profile to assign the profile to one or more device groups. +Use the **Assignments** page of the kiosk configuration profile to set where you want the kiosk configuration to deploy. In the simplest case, you assign the kiosk configuration profile to a group that will contain the HoloLens device when the device enrolls in MDM. -### [MDM] 4. Prepare to enroll the devices +### [MDM] 5. Deploy a single-app kiosk -You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). +When you use an MDM system, you can enroll the device in MDM during OOBE. After OOBE finishes, device sign-in is easy. -### [MDM] 4. Deploy a single-app kiosk +During OOBE, follow these steps: -When you use an MDM system, you can enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. +1. Sign in by using the account that you specified in the kiosk configuration profile. +1. Enroll the device. Make sure that the device is added to the group that the kiosk configuration profile is assigned to. +1. Wait for OOBE to finish, for the store app to download and install, and for policies to be applied. Then restart the device. -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. +The next time you sign in to the device, the kiosk app should automatically launch. -During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. +If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. +### [MDM] 4. Deploy a multi-app kiosk -Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. +When you use an MDM system, you can join the device to your Azure AD tenant and enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). +> [!NOTE] +> If you have assigned the kiosk configuration profile to a group that contains users, make sure that one of those user accounts is the first account to sign in to the device. -#### [MDM] 4. Deploy a multi-app kiosk +During OOBE, follow these steps: +1. Sign in by using the account that belongs to the **User logon type** group. +1. Enroll the device. +1. Wait for any apps that are part of the kiosk configuration profile to download and install, and for policies to be applied. +1. After OOBE finishes, you can install additional apps from the Microsoft store or by sideloading. [Required apps](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the group that the device belongs to install automatically. +1. Restart the device. -When you use an MDM system, you can enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. -For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. +The next time you sign in to the device by using an account that belongs to the **User logon type**, the kiosk app should automatically launch. -If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. - -Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. - -To enable Kiosk mode, simply sign out of your account and sign in to a profile that is a member of a group targeted by the **User logon type** setting. (This may be the same user.) - -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). +If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). ## Use a provisioning package to set up a single-app or muti-app kiosk -As part of creating your Provisioning package, you'll need to create a [Start layout](#start-layout-for-hololens). - To set up kiosk mode by using a provisioning package, follow these steps. -1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig) +1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig), including a [Start layout](#start-layout-for-hololens). 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) ### [PP] 1. Create a kiosk configuration XML file -Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: +Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), except for the following: - Do not include Classic Windows applications (Win32). HoloLens does not support these applications. - Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. +- Optional: Add guest access to the kiosk configuration -#### Add guest access to the kiosk configuration (optional) +#### Optional: Add guest access to the kiosk configuration In the [**Configs** section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. -Use the following snippet in your kiosk configuration XML to enable the **Guest** account: +To enable the **Guest** account, add the following snippet to your kiosk configuration XML : ```xml @@ -357,14 +378,12 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start screen and does not need a Start layout. +> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout. > [!NOTE] > If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -### Create a start layout for a customized multi-app kiosk - -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: ```xml @@ -412,8 +431,7 @@ Save the following sample as an XML file. You can use this file when you configu ### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). -1. Select **Advanced provisioning**. -1. Name your project, and then select **Next**. +1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**. 1. Select **Windows 10 Holographic**, and then select **Next**. 1. Select **Finish**. The workspace for your package opens. 1. Select **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. @@ -421,10 +439,12 @@ Save the following sample as an XML file. You can use this file when you configu ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](./images/multiappassignedaccesssettings.png) -1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. By using this account, you can view the provisioning status and logs. -1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. For **UserGroup**, select **Standard Users**. +1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Select **Runtime settings** > **Accounts** > **Users**, and then create a user account. Provide a user name and password, and then select **UserGroup** > **Administrators**. + + By using this account, you can view the provisioning status and logs. +1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Select **Runtime settings** > **Accounts** > **Users**, and then create a local user account. Make sure the user name is the same as the account that you specify in the configuration XML. Select **UserGroup** > **Standard Users**. 1. Select **File** > **Save**. -1. Select **Export** > **Provisioning package**, and then set **Owner** to **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources. +1. Select **Export** > **Provisioning package**, and then select **Owner** > **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources. 1. Select **Next**. 1. On the **Provisioning package security** page, select a security option. > [!IMPORTANT] From 8ffd49e7451a0cdd76a35e01fe4bcd1a9fbda43c Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 15:28:26 -0700 Subject: [PATCH 079/149] Link fixes --- devices/hololens/hololens-kiosk.md | 29 +++++++++++------------ devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 17 insertions(+), 18 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 53196dcfdf..5b25494c44 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -60,7 +60,7 @@ The following table lists the feature capabilities in the different kiosk modes. |Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | > 1 Voice commands that relate to disabled features do not function. -> 2 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +> 2 For more information about how to configure these features, see [Select kiosk apps](#plan-kiosk-apps). > 3 Even if Cortana is disabled, the built-in voice commands are enabled. The following table lists the user support features of the different kiosk modes. @@ -210,9 +210,9 @@ You can select one of three methods to deploy kiosk configurations: - [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) -- [Provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) +- [Provisioning package](#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) -- [Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) +- [Windows Device Portal](#use-the-windows-device-portal-to-set-up-a-single-app-kiosk) > [!NOTE] > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. @@ -235,7 +235,7 @@ The following table lists the capabilities and benefits of each of the three dep To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. 1. [Prepare to enroll the devices](#mdmenroll). -1. [Create a kiosk configuration profile](#create-a-kiosk-configuration-profile). +1. [Create a kiosk configuration profile](#mdm-2-create-a-kiosk-configuration-profile). 1. Configure the kiosk. - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). @@ -244,7 +244,6 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). - ### [MDM] 1. Prepare to enroll the devices You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups. @@ -274,7 +273,7 @@ This section summarizes the settings that a single-app kiosk requires. For more - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks) -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file). +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig). 1. Select **User logon type** > **Local user account**, and enter the user name of the local (device) account or Microsoft Account (MSA) that can sign in to the kiosk. > [!NOTE] @@ -289,7 +288,7 @@ This section summarizes the settings that a multi-app kiosk requires. For more d - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig), and make sure to include the [Start layout](#Start layout for HoloLens) in the XML file. - You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). 1. Select **Target Windows 10 in S mode devices** > **No**. @@ -342,13 +341,13 @@ The next time you sign in to the device by using an account that belongs to the If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -## Use a provisioning package to set up a single-app or muti-app kiosk +## Use a provisioning package to set up a single-app or multi-app kiosk To set up kiosk mode by using a provisioning package, follow these steps. 1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig), including a [Start layout](#start-layout-for-hololens). -2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) -3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) +2. [Add the XML file to a provisioning package.](#ppconfigadd) +3. [Apply the provisioning package to HoloLens.](#ppapply) ### [PP] 1. Create a kiosk configuration XML file @@ -375,7 +374,7 @@ To enable the **Guest** account, add the following snippet to your kiosk configu #### Start layout for HoloLens -If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. +If you use a [provisioning package](##use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout. @@ -383,7 +382,7 @@ If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-p > [!NOTE] > If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: +For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: ```xml @@ -410,7 +409,7 @@ For the Start layout, add the following **StartLayout** section to the kiosk pro Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). > [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-hololens). ```xml ``` -### [PP] 2. Add the kiosk configuration XML file to a provisioning package +### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). 1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**. @@ -456,7 +455,7 @@ Save the following sample as an XML file. You can use this file when you configu 1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**. 1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status. -### [PP] 3. Apply the provisioning package to HoloLens +### [PP] 3. Apply the provisioning package to HoloLens The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances: diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index aa636e08c1..6484efeabd 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -33,7 +33,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk). ## Provisioning package HoloLens wizard @@ -49,7 +49,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll the device in Azure Active Directory, or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md##use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7a97637124..7c653de149 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From 2c50d29fd068cfd819ff9a4fd9cbd4d6c71759a1 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 16:08:34 -0700 Subject: [PATCH 080/149] typos --- devices/hololens/hololens-kiosk.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 5b25494c44..fdc46ab8fd 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -1,5 +1,5 @@ --- -title: Set up HoloLens as a kiosk for specific applications +title: Set up HoloLens as a kiosk description: Use a kiosk configuration to lock down the apps on HoloLens. ms.prod: hololens ms.sitesec: library @@ -7,7 +7,7 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 03/12/2020 +ms.date: 04/27/2020 ms.custom: - CI 115262 - CI 111456 @@ -208,7 +208,7 @@ Other types of profiles and policies, such as device restrictions that are not r You can select one of three methods to deploy kiosk configurations: -- [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +- [Microsoft Intune or other mobile device management (MDM) service](#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) - [Provisioning package](#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) @@ -230,7 +230,7 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | -## Set up kiosk mode by using Microsoft Intune or MDM +## Use Microsoft Intune or other MDM to set up a single-app or multi-app kiosk To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. @@ -262,6 +262,7 @@ For more information about enrolling the devices, see [Enroll HoloLens in MDM](h 1. To start configuring the kiosk, select **Add**. Your next steps differ depending on the type of kiosk that you want. For further information, select one of the following: + - [Single-app kiosk](#mdmconfigsingle) - [Multi-app kiosk](#mdmconfigmulti) @@ -361,7 +362,7 @@ Follow [the instructions for creating a kiosk configuration XML file for desktop In the [**Configs** section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. -To enable the **Guest** account, add the following snippet to your kiosk configuration XML : +To enable the **Guest** account, add the following snippet to your kiosk configuration XML: ```xml @@ -380,7 +381,7 @@ If you use a [provisioning package](##use-a-provisioning-package-to-set-up-a-sin > Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout. > [!NOTE] -> If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). +> If you use [MDM](#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: From 720a404170e7ac79eedd188d8a78ec4a52a1aaa4 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 16:23:23 -0700 Subject: [PATCH 081/149] Link fixes --- devices/hololens/hololens-commercial-infrastructure.md | 2 +- devices/hololens/hololens-requirements.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 69cc524581..ddeb2b11b2 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -175,7 +175,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) ## Certificates and Authentication diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7c653de149..c8be6947ae 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From dc0062c6b87827051bfb2ccaf4fa3d89b560922d Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sat, 25 Apr 2020 12:42:17 +0500 Subject: [PATCH 082/149] Update configure-server-endpoints.md --- .../microsoft-defender-atp/configure-server-endpoints.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index a2550f9980..c0c8157b48 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -77,8 +77,6 @@ You'll need to take the following steps if you choose to onboard servers through > After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md). ### Configure and update System Center Endpoint Protection clients -> [!IMPORTANT] -> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2. Microsoft Defender ATP integrates with System Center Endpoint Protection. The integration provides visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware. From 818b815adae8e76485f0435b740a0e3406e45ed9 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Sun, 26 Apr 2020 18:07:51 -0700 Subject: [PATCH 083/149] Update manage-updates-baselines-windows-defender-antivirus.md revision of the doc + supportability statement --- ...es-baselines-windows-defender-antivirus.md | 212 ++++++++++++++---- 1 file changed, 168 insertions(+), 44 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index fe00cf4804..9cbd8b642a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Manage Windows Defender Antivirus updates and apply baselines -description: Manage how Windows Defender Antivirus receives protection and product updates. +title: Manage Microsoft Defender Antivirus updates and apply baselines +description: Manage how Microsoft Defender Antivirus receives protection and product updates. keywords: updates, security baselines, protection, schedule updates, force updates, mobile updates, wsus search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -17,7 +17,7 @@ ms.reviewer: manager: dansimp --- -# Manage Windows Defender Antivirus updates and apply baselines +# Manage Microsoft Defender Antivirus updates and apply baselines **Applies to:** @@ -25,16 +25,16 @@ manager: dansimp There are two types of updates related to keeping Windows Defender Antivirus up to date: -1. Protection updates +1. Security intelligence updates 2. Product updates -You can also apply [Windows security baselines](https://technet.microsoft.com/itpro/windows/keep-secure/windows-security-baselines) to quickly bring your endpoints up to a uniform level of protection. -## Protection updates -Windows Defender Antivirus uses both [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloaded protection updates to provide protection. These protection updates are also known as Security intelligence updates. +## Security intelligence updates -The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. +Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads Security intelligence updates to provide protection. + +The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the Security intelligence updates occur on a scheduled cadence (configurable via policy). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. Engine updates are included with the Security intelligence updates and are released on a monthly cadence. @@ -46,59 +46,183 @@ You can manage the distribution of updates through Windows Server Update Service ## Released platform and engine versions -Only the main version is listed in the following table as reference information: +### Monthly platform and engine releases +For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform)
- March-2020 (4.18.2003.8/1.1.16900.2) - + April-2020 (Platform: 4.18.2004.5 | Engine: 1.1.17000.2) +Security intelligence update version: **TBD** +Released: **April 30, 2020** +Platform: **4.18.2004.5** +Engine: **1.1.17000.2** +Support phase: **Security and Critical Updates** - Released: **March 26, 2020** - Platform/Client: **4.18.2003.8** - Engine: **1.1.16900.2** - - ### What´s new - * fix1 - * fix2 - * fix3 - - ### Known Issues - * New file path - Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled. -To work around this issue, open Group Policy, and then change the setting to Allow for the following path: +### What's new +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 -%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\* - - -> [!NOTE] -> Information the user should notice even if skimming. - + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues
- Jan-2020 (4.18.2001.10/1.1.16700.2) + March-2020 (Platform: 4.18.2003.8 | Engine: 1.1.16900.2) + +Security intelligence update version: **1.313.8.0** +Released: **March 24, 2020** +Platform: **4.18.2003.8** +Engine: **1.1.16900.4** +Support phase: **Technical upgrade Support (Only)** + +### What's new + +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 + + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues +
+ +
+ + February-2020 (Platform: - | Engine: 1.1.16800.2) + + Security intelligence update version: **1.311.4.0** + Released: **February 25, 2020** + Platform/Client: **-** + Engine: **1.1.16800.2** + Support phase: **N/A** + +### What's new + +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 + + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues +
+ +
+ January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) - Released: **March 26, 2020** + Security intelligence update version: **1.309.32.0** + Released: **January 30, 2020** Platform/Client: **4.18.2001.10** - Engine: **1.1.16700.2** - - ### What´s new - * fix1 - * fix2 - * fix3 - - ### Known Issues - * New file path - Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled. -To work around this issue, open Group Policy, and then change the setting to Allow for the following path: + Engine: **1.1.16700.2** + Support phase: **Technical upgrade Support (Only)** + +### What's new -%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\* +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues
+
+ November-2019 (Platform: 4.18.1911.2 | Engine: 1.1.16600.7) +Security intelligence update version: **1.307.13.0** +Released: **December 7, 2019** +Platform: **4.18.1911.2** +Engine: **1.1.17000.7** +Support phase: **No support** + +### What's new + +:::row::: + :::column::: + **Platform** + * fix1 + * fix2 + + :::column-end::: + :::column::: + **Engine** + * fix1 + * fix2 + :::column-end::: +:::row-end::: + +### Known Issues +No known issues +
+ +## Windows Defender Antivirus platform support +As stated above, platform and engine updates are provided on a monthly cadence. +Customers must stay current with the latest platform update to be fully supported. Our support structure is now dynamic, evolving into two phases depending on the availability of the latest platform version. + + +* **Security and Critical Updates servicing phase** - When running the latest platform version, you will be eligible to receive both Security and Critical updates to the anti-malware platform. + + +* **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported.* + +*Technical support will continue to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version. + +During the technical support (only) phase, commercially reasonable support incidents will be provided through Microsoft Customer Service & Support and Microsoft’s managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a non-security update, or requires a security update, customers will be asked to upgrade to the latest platform version or an intermediate update(*). + +### Platform version included with Windows 10 releases +The below table provides the Windows Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases: + +|Windows 10 release |Platform version |Engine version |Support phase | +|-|-|-|-| +|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade Support (Only) +|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade Support (Only) +|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade Support (Only) +|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade Support (Only) +|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade Support (Only) +|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) +|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) +Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) ## In this section From 16e9e90cee6d810cf86ba1e9c9b2d38cd7ff5a42 Mon Sep 17 00:00:00 2001 From: komsorg <33907047+komsorg@users.noreply.github.com> Date: Mon, 27 Apr 2020 15:33:55 +0300 Subject: [PATCH 084/149] Fixed link address Fixed link address in markdown markup. --- .../creating-and-managing-app-v-51-virtualized-applications.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md index c781eb4fea..a2dc196c47 100644 --- a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md +++ b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md @@ -20,7 +20,7 @@ ms.date: 06/16/2016 After you have properly deployed the Microsoft Application Virtualization (App-V) 5.1 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. **Note**   -For more information about configuring the App-V 5.1 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx). +For more information about configuring the App-V 5.1 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx). **Note** The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. From 7ab11c6f127ec3e0f077a7e009deeda4a432f9df Mon Sep 17 00:00:00 2001 From: komsorg <33907047+komsorg@users.noreply.github.com> Date: Mon, 27 Apr 2020 15:40:55 +0300 Subject: [PATCH 085/149] Fixed broken link Fixed broken link to App-V 5.0 Sequencing Guide.docx --- .../appv-creating-and-managing-virtualized-applications.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md index 197cff66cb..29d79221c5 100644 --- a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md +++ b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md @@ -18,7 +18,7 @@ ms.topic: article After you have properly deployed the Microsoft Application Virtualization (App-V) sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. -For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](). +For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx). >[!NOTE] >The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. From 91683a5cd6a34f752a4de8c98a1c0fe05b8066f6 Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Mon, 27 Apr 2020 08:17:31 -0700 Subject: [PATCH 086/149] Update advanced-hunting-shared-queries.md --- .../microsoft-defender-atp/advanced-hunting-shared-queries.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md index de3d5741a4..b661399a57 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md @@ -52,6 +52,9 @@ You can save a new or existing query so that it is only accessible to you or sha 2. Select **Delete** and confirm deletion. Or select **Rename** and provide a new name for the query. +## Create a direct link to a query +To generate a link that opens your query directly in the advanced hunting query editor, finalize your query and select **Share link**. + ## Access queries in the GitHub repository Microsoft security researchers regularly share advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/). From d41d3dcab0eab844524269e1c080a4b2ada060c9 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 08:47:07 -0700 Subject: [PATCH 087/149] Table formatting cleanup --- devices/hololens/hololens-kiosk.md | 34 +++++++++++++++--------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index fdc46ab8fd..6749505830 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -89,23 +89,23 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. -| App Name | AUMID | -|----------------------------|----------------------------------------------------------------------------------| -| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | -| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -| Camera1, 2 | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Cortana3 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | -| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | -| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | -| Miracast4 | | -| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | -| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | -| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | -| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | -| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +|App Name |AUMID | +| --- | --- | +|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | +|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | +|Camera1, 2 |HoloCamera_cw5n1h2txyewy!HoloCamera | +|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +|Device Picker |HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | +|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +|Miracast4 |  | +|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | +|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe!App | +|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe!App | +|Settings |HolographicSystemSettings_cw5n1h2txyewy!App | +|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: From 83feacbc67116d1cd92c109b2d5ed950e84716e7 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Mon, 27 Apr 2020 09:21:39 -0700 Subject: [PATCH 088/149] Update index.yml --- devices/surface/index.yml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/devices/surface/index.yml b/devices/surface/index.yml index d9d7043dc2..cd2e9ae131 100644 --- a/devices/surface/index.yml +++ b/devices/surface/index.yml @@ -30,12 +30,7 @@ additionalContent: # Card - title: Surface Hub documentation summary: Learn how to deploy and manage Surface Hub 2S, the all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device. - url: https://docs.microsoft.com/surface-hub/index - # Card - - title: Surface Hub adoption guidance - summary: Get best practices for technical readiness and adoption across your lines of business. - url: https://docs.microsoft.com/surface-hub/surface-hub-2s-adoption-kit - + url: https://docs.microsoft.com/surface-hub/index - title: Other resources # < 60 chars (optional) items: # Card From 7b26000055a735324fac1c4591043d2c356c1aa2 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Mon, 27 Apr 2020 09:31:06 -0700 Subject: [PATCH 089/149] Update index.yml Adds adoption guidance link to Learn section --- devices/surface/index.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/devices/surface/index.yml b/devices/surface/index.yml index cd2e9ae131..b173beeed8 100644 --- a/devices/surface/index.yml +++ b/devices/surface/index.yml @@ -45,6 +45,8 @@ additionalContent: links: - text: Surface training on Microsoft Learn url: https://docs.microsoft.com/learn/browse/?term=Surface + - text: Surface Hub 2S adoption guidance + url: https://docs.microsoft.com/surface-hub/surface-hub-2s-adoption-kit - text: Microsoft Mechanics Surface videos url: https://www.youtube.com/watch?v=Uk2kJ5FUZxY&list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ From b56979cc0136e8140d8fdc4379943438c979c61b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 27 Apr 2020 09:44:12 -0700 Subject: [PATCH 090/149] add cern pem --- .../microsoft-defender-atp/manage-indicators.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index e04c52cc32..b2176faf1d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -164,6 +164,7 @@ It's important to understand the following requirements prior to creating indica - The Antimalware client version must be 4.18.1901.x or later. - Supported on machines on Windows 10, version 1703 or later. - The virus and threat protection definitions must be up-to-date. +- This feature currently supports entering .CER or .PEM file extensions. >[!IMPORTANT] > - A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it’s trusted by the client (Root CA certificate is installed under the Local Machine 'Trusted Root Certification Authorities'). From 061d4481412794a3cc532fb93cac598d6f5f2cd8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 27 Apr 2020 09:46:58 -0700 Subject: [PATCH 091/149] preview --- .../threat-protection/microsoft-defender-atp/preview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index e4676f46b6..a92e6a198a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -44,6 +44,8 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: +- [Create indicators for certificates](manage-indicators.md)
Create indicators to allow or block certificates. + - [Microsoft Defender ATP for Linux](microsoft-defender-atp-linux.md)
Microsoft Defender ATP now adds support for Linux. Learn how to install, configure, update, and use Microsoft Defender ATP for Linux. - [Threat & Vulnerability supported operating systems and platforms](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os)
Ensure that you meet the operating system or platform requisites for Threat & Vulnerability Management so the activities in your devices are properly accounted for. Threat & Vulnerability Management supports Windows 7, Windows 10 1607-1703, Windows 10 1709+, Windows Server 2008R2, Windows Server 2012R2, Windows Server 2016, Windows Server 2019.

Secure Configuration Assessment (SCA) supports Windows 10 1709+, Windows Server 2008R2, Windows Server 2012R2, Windows Server 2016, and Windows Server 2019. See [Secure Configuration Assessment (SCA) for Windows Server now in public preview](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/secure-configuration-assessment-sca-for-windows-server-now-in/ba-p/1243885) and [Reducing risk with new Threat & Vulnerability Management capabilities](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/reducing-risk-with-new-threat-amp-vulnerability-management/ba-p/978145) blogs for more information. From f0d49fc76f79c60c85caa7be54cf8c4b925290a5 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 10:33:10 -0700 Subject: [PATCH 092/149] Escape apostrophes --- devices/hololens/hololens-kiosk.md | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6749505830..d86fd07281 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -91,21 +91,21 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you |App Name |AUMID | | --- | --- | -|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | -|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -|Camera1, 2 |HoloCamera_cw5n1h2txyewy!HoloCamera | -|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | -|Device Picker |HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | -|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | +|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe\!microsoft.windowslive.calendar | +|Camera1, 2 |HoloCamera_cw5n1h2txyewy\!HoloCamera | +|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe\!App | +|Device Picker |HoloDevicesFlow_cw5n1h2txyewy\!HoloDevicesFlow | +|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe\!MicrosoftGuides | +|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe\!Microsoft.RemoteAssist | +|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\!App | +|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\!App | |Miracast4 |  | -|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | -|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe!App | -|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe!App | -|Settings |HolographicSystemSettings_cw5n1h2txyewy!App | -|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe\!Microsoft.ZuneVideo | +|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe\!App | +|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe\!App | +|Settings |HolographicSystemSettings_cw5n1h2txyewy\!App | +|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe\!HoloLensTips | > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: From ae0b57ae98d4eec420b721a38dd8c9919aee1841 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 10:54:49 -0700 Subject: [PATCH 093/149] Revisions --- devices/hololens/hololens-kiosk.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index d86fd07281..26b232e88b 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -244,13 +244,13 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). -### [MDM] 1. Prepare to enroll the devices +### MDM, step 1 – Prepare to enroll the devices You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups. For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -### [MDM] 2. Create a kiosk configuration profile +### MDM, step 2 – Create a kiosk configuration profile 1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**. @@ -268,7 +268,7 @@ Your next steps differ depending on the type of kiosk that you want. For further For more information about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). -### [MDM] 3. Configure the settings for a single-app kiosk +### MDM, step 3 (single-app) – Configure the settings for a single-app kiosk This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following articles: @@ -283,13 +283,13 @@ This section summarizes the settings that a single-app kiosk requires. For more Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 3. Configure the settings for a multi-app kiosk +### MDM, step 3 (multi-app) – Configure the settings for a multi-app kiosk This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following articles: - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig), and make sure to include the [Start layout](#Start layout for HoloLens) in the XML file. +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig). If you use an XML file, make sure to include the [Start layout](#start-layout-for-hololens). - You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). 1. Select **Target Windows 10 in S mode devices** > **No**. @@ -305,11 +305,11 @@ This section summarizes the settings that a multi-app kiosk requires. For more d Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 4. Assign the kiosk configuration profile to a group +### MDM, step 4 – Assign the kiosk configuration profile to a group Use the **Assignments** page of the kiosk configuration profile to set where you want the kiosk configuration to deploy. In the simplest case, you assign the kiosk configuration profile to a group that will contain the HoloLens device when the device enrolls in MDM. -### [MDM] 5. Deploy a single-app kiosk +### MDM, step 5 (single-app) – Deploy a single-app kiosk When you use an MDM system, you can enroll the device in MDM during OOBE. After OOBE finishes, device sign-in is easy. @@ -323,7 +323,7 @@ The next time you sign in to the device, the kiosk app should automatically laun If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -### [MDM] 4. Deploy a multi-app kiosk +### MDM, step 5 (multi-app) – Deploy a multi-app kiosk When you use an MDM system, you can join the device to your Azure AD tenant and enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. @@ -350,7 +350,7 @@ To set up kiosk mode by using a provisioning package, follow these steps. 2. [Add the XML file to a provisioning package.](#ppconfigadd) 3. [Apply the provisioning package to HoloLens.](#ppapply) -### [PP] 1. Create a kiosk configuration XML file +### Prov. package, step 1 – Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), except for the following: @@ -428,7 +428,7 @@ Save the following sample as an XML file. You can use this file when you configu ``` -### [PP] 2. Add the kiosk configuration XML file to a provisioning package +### Prov. package, step 2 – Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). 1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**. @@ -456,7 +456,7 @@ Save the following sample as an XML file. You can use this file when you configu 1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**. 1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status. -### [PP] 3. Apply the provisioning package to HoloLens +### Prov. package, step 3 – Apply the provisioning package to HoloLens The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances: From f81659266710157ae50236a17ce5e6bc7e25e7c8 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 27 Apr 2020 10:56:43 -0700 Subject: [PATCH 094/149] Reset TPM. Added small line about resetting TPM. --- devices/hololens/hololens-recovery.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md index 60d46d7e1c..4ea73d7495 100644 --- a/devices/hololens/hololens-recovery.md +++ b/devices/hololens/hololens-recovery.md @@ -82,7 +82,7 @@ If you're still having problems, press the power button for 4 seconds, until all If your HoloLens is still experiencing issues after restarting, try resetting it to factory state. Resetting your HoloLens keeps the version of the Windows Holographic software that's installed on it and returns everything else to factory settings. -If you reset your device, all your personal data, apps, and settings will be erased. Resetting will only install the latest installed version of Windows Holographic and you will have to redo all the initialization steps (calibrate, connect to Wi-Fi, create a user account, download apps, and so forth). +If you reset your device, all your personal data, apps, and settings will be erased, including TPM reset. Resetting will only install the latest installed version of Windows Holographic and you will have to redo all the initialization steps (calibrate, connect to Wi-Fi, create a user account, download apps, and so forth). 1. Launch the Settings app, and then select **Update** > **Reset**. 1. Select the **Reset device** option and read the confirmation message. @@ -100,7 +100,7 @@ All of the data HoloLens needs to reset is packaged in a Full Flash Update (ffu) ### HoloLens 2 -The Advanced Recovery Companion is a new app in Microsoft Store restore the operating system image to your HoloLens 2 device. +The Advanced Recovery Companion is a new app in Microsoft Store restore the operating system image to your HoloLens 2 device. Advanced Recovery Companion erases all your personal data, apps, and settings, and resets TPM. 1. On your computer, get [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from Microsoft Store. 2. Connect HoloLens 2 to your computer. From c05bbb1529e9e4889a92208d34272109db1eb059 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 11:38:53 -0700 Subject: [PATCH 095/149] Revision --- devices/hololens/hololens-kiosk.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 26b232e88b..8b4117e2e3 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -30,9 +30,7 @@ This article provides information about aspects of configuring kiosks that are s You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. -> [!WARNING] -> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, [certain policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy) are enforced system-wide. These policies impact other users on the device. -> +> [!IMPORTANT] > Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. To revert these policies, you have to reset the device to the factory settings. ## Plan the kiosk deployment From 12c4eb4b7fbf148747dd36bbcf5960cce834d757 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 11:51:34 -0700 Subject: [PATCH 096/149] Link fix --- devices/hololens/hololens-kiosk.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 8b4117e2e3..a7ef78c0fb 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -233,7 +233,7 @@ The following table lists the capabilities and benefits of each of the three dep To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. 1. [Prepare to enroll the devices](#mdmenroll). -1. [Create a kiosk configuration profile](#mdm-2-create-a-kiosk-configuration-profile). +1. [Create a kiosk configuration profile](#mdmprofile). 1. Configure the kiosk. - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). @@ -248,7 +248,7 @@ You can configure your MDM system to enroll HoloLens devices automatically when For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -### MDM, step 2 – Create a kiosk configuration profile +### MDM, step 2 – Create a kiosk configuration profile 1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**. From 8fa4f1193885344fc1a0e5667bf20ba395d0df58 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 12:23:44 -0700 Subject: [PATCH 097/149] Excape underscores --- devices/hololens/hololens-kiosk.md | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index a7ef78c0fb..53136291e4 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -89,21 +89,21 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you |App Name |AUMID | | --- | --- | -|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | -|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe\!microsoft.windowslive.calendar | -|Camera1, 2 |HoloCamera_cw5n1h2txyewy\!HoloCamera | -|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe\!App | -|Device Picker |HoloDevicesFlow_cw5n1h2txyewy\!HoloDevicesFlow | -|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe\!MicrosoftGuides | -|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe\!Microsoft.RemoteAssist | -|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\!App | -|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\!App | +|3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | +|Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar | +|Camera1, 2 |HoloCamera\_cw5n1h2txyewy\!HoloCamera | +|Cortana3 |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App | +|Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | +|Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | +|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | +|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | +|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | |Miracast4 |  | -|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe\!Microsoft.ZuneVideo | -|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe\!App | -|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe\!App | -|Settings |HolographicSystemSettings_cw5n1h2txyewy\!App | -|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe\!HoloLensTips | +|Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | +|OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | +|Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App | +|Settings |HolographicSystemSettings\_cw5n1h2txyewy\!App | +|Tips |Microsoft.HoloLensTips\_8wekyb3d8bbwe\!HoloLensTips | > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: From f8950778c61ae507c3a33882cf3a283329d4bb0e Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 12:45:30 -0700 Subject: [PATCH 098/149] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index f4483bee95..fc0b06a62d 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -13094,17 +13094,17 @@ { "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", "redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", "redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", From 1a2685212f8af26f2ee97f5d8eabc0d230246bf5 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 13:21:23 -0700 Subject: [PATCH 099/149] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index fc0b06a62d..c92572ba2b 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -13095,10 +13095,9 @@ "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", "redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": false -}, { "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", "redirect_document_id": false }, { From 3ff8630d041cea4945a6ef1ee03a6fbfa8f1bd8b Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 13:51:11 -0700 Subject: [PATCH 100/149] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index c92572ba2b..0d6d205c5a 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -15852,7 +15852,8 @@ }, { "source_path": "windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", "redirect_document_id": false +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", +"redirect_document_id": false } ] } From 81095837960e95422bf325527cae0a6f0cb5122e Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 13:59:06 -0700 Subject: [PATCH 101/149] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 1 + 1 file changed, 1 insertion(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 0d6d205c5a..7ac89fbd66 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -13095,6 +13095,7 @@ "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", "redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": false +}, { "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", "redirect_url": "https://docs.microsoft.com/windows/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", From f17cb7022caeffae5d04c69ccc29ec8830c6de9d Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 27 Apr 2020 14:36:06 -0700 Subject: [PATCH 102/149] Adding ARC offline Install instructions High Pri. This change is meant to include Offline Install instructions for ARC. This will help mitigate a Sev3 incident that is currently active. --- devices/hololens/hololens-recovery.md | 29 ++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md index 4ea73d7495..71896daba2 100644 --- a/devices/hololens/hololens-recovery.md +++ b/devices/hololens/hololens-recovery.md @@ -7,7 +7,7 @@ ms.prod: hololens ms.sitesec: library author: mattzmsft ms.author: mazeller -ms.date: 08/30/2019 +ms.date: 04/27/2020 ms.custom: - CI 111456 - CSSTroubleshooting @@ -109,6 +109,8 @@ The Advanced Recovery Companion is a new app in Microsoft Store restore the oper 5. On the **Device info** page, select **Install software** to install the default package. (If you have a Full Flash Update (FFU) image that you want to install instead, select **Manual package selection**.) 6. Software installation will begin. Do not use the device or disconnect the cable during installation. When you see the **Installation finished** page, you can disconnect and use your device. +#### Manual flashing mode + > [!TIP] > In the event that a HoloLens 2 gets into a state where Advanced Recovery Companion cannot recognize the device, and it does not boot, try forcing the device into Flashing Mode and recovering it with Advanced Recovery Companion: @@ -117,6 +119,31 @@ The Advanced Recovery Companion is a new app in Microsoft Store restore the oper 1. The device should be visible in **Device Manager** as a **Microsoft HoloLens Recovery** device. 1. Launch Advanced Recovery Companion, and follow the on-screen prompts to reflash the OS to the HoloLens 2. +#### Downloading ARC without using the app store + +If an IT environment prevents the use of the Windows Store app or limits access to the retail store, IT administrators can make this app available through other ‘offline’ deployment paths. + +This deployment path can be enabled with the following steps: +1. Go to the [Store For Business website](https://businessstore.microsoft.com) and sign-in with an Azure AD identity. +1. Go to **Manage – Settings**, and turn on **Show offline apps** under **Shopping experience** as described at https://businessstore.microsoft.com/en-us/manage/settings/shop +1. Go to **shop for my group** and search for the [Advanced Recovery Companion](https://businessstore.microsoft.com/store/details/advanced-recovery-companion/9P74Z35SFRS8) app. +1. Change the **License Type** box to offline and click **Manage**. +1. Under Download the package for offline use click the second blue **“Download”** button . Ensure the file extension is .appxbundle. +1. At this stage, if the Desktop PC has Internet access, simply double click and install. +1. The IT administrator can also distribute this app through System Center Configuration Manager (SCCM) or Intune. +1. If the target PC has no Internet connectivity, some additional steps are needed: + 1. Select the unencoded license and click **“Generate license”** and under **“Required Frameworks”** click **“Download.”** + 1. PCs without internet access will need to use DISM to apply the package with the dependency and license. In an administrator command prompt, type: + +``` +C:\WINDOWS\system32>dism /online /Add-ProvisionedAppxPackage /PackagePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_1.19050.1301.0_neutral_~_8wekyb3d8bbwe.appxbundle" /DependencyPackagePath:"C:\ARCoffline\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x86__8wekyb3d8bbwe.appx" /LicensePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_8wekyb3d8bbwe_f72ce112-dd2e-d771-8827-9cbcbf89f8b5.xml" /Region:all +``` + +Other resources: +- https://docs.microsoft.com/en-us/microsoft-store/distribute-offline-apps +- https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-app-package--appx-or-appxbundle--servicing-command-line-options + + ### HoloLens (1st gen) If necessary, you can install a completely new operating system on your HoloLens (1st gen) with the Windows Device Recovery Tool. From 357a2f5588a6de8aa9e1bdc63d6ec6e84e0b5267 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 27 Apr 2020 14:49:53 -0700 Subject: [PATCH 103/149] Remove en-us --- devices/hololens/hololens-recovery.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md index 71896daba2..54d2d73ca6 100644 --- a/devices/hololens/hololens-recovery.md +++ b/devices/hololens/hololens-recovery.md @@ -125,7 +125,7 @@ If an IT environment prevents the use of the Windows Store app or limits access This deployment path can be enabled with the following steps: 1. Go to the [Store For Business website](https://businessstore.microsoft.com) and sign-in with an Azure AD identity. -1. Go to **Manage – Settings**, and turn on **Show offline apps** under **Shopping experience** as described at https://businessstore.microsoft.com/en-us/manage/settings/shop +1. Go to **Manage – Settings**, and turn on **Show offline apps** under **Shopping experience** as described at https://businessstore.microsoft.com/manage/settings/shop 1. Go to **shop for my group** and search for the [Advanced Recovery Companion](https://businessstore.microsoft.com/store/details/advanced-recovery-companion/9P74Z35SFRS8) app. 1. Change the **License Type** box to offline and click **Manage**. 1. Under Download the package for offline use click the second blue **“Download”** button . Ensure the file extension is .appxbundle. @@ -140,8 +140,8 @@ C:\WINDOWS\system32>dism /online /Add-ProvisionedAppxPackage /PackagePath:"C:\AR ``` Other resources: -- https://docs.microsoft.com/en-us/microsoft-store/distribute-offline-apps -- https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-app-package--appx-or-appxbundle--servicing-command-line-options +- https://docs.microsoft.com/microsoft-store/distribute-offline-apps +- https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-app-package--appx-or-appxbundle--servicing-command-line-options ### HoloLens (1st gen) From 44b7bad458117bec94e5eb8f2ff38b97c39e7e9d Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 15:06:19 -0700 Subject: [PATCH 104/149] Troubleshooting table --- devices/hololens/hololens-kiosk.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 53136291e4..03ec36149b 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -87,18 +87,31 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. + |App Name |AUMID | | --- | --- | |3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | |Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar | + +|App Name |AUMID | +| --- | --- | |Camera1, 2 |HoloCamera\_cw5n1h2txyewy\!HoloCamera | |Cortana3 |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App | + +|App Name |AUMID | +| --- | --- | |Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | |Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | |Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | + +|App Name |AUMID | +| --- | --- | |Miracast4 |  | + +|App Name |AUMID | +| --- | --- | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | |OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | |Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App | From 55f3bd0d6990d89986bbeeeca3c1aa424a1b0fe1 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 15:21:00 -0700 Subject: [PATCH 105/149] Troubleshootin table --- devices/hololens/hololens-kiosk.md | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 03ec36149b..6719d870b6 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -92,26 +92,14 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you | --- | --- | |3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | |Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar | - -|App Name |AUMID | -| --- | --- | |Camera1, 2 |HoloCamera\_cw5n1h2txyewy\!HoloCamera | |Cortana3 |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App | - -|App Name |AUMID | -| --- | --- | |Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | |Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | |Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | - -|App Name |AUMID | -| --- | --- | |Miracast4 |  | - -|App Name |AUMID | -| --- | --- | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | |OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | |Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App | @@ -120,10 +108,10 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: -> - The Quick Actions menu includes the Photo and Video buttons. +> - The Quick Actions menu includes the Photo and Video buttons. > - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive). > -> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. +> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. > 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. ### Plan user and device groups From e97569387028019fe8580fb18ddce47ceb76bbe8 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 15:22:08 -0700 Subject: [PATCH 106/149] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 7ac89fbd66..089957ea4a 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -762,17 +762,17 @@ }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", -"redirect_url": "hhttps://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", +"redirect_url": "hhttps://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", "redirect_document_id": true }, { @@ -13093,17 +13093,17 @@ }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", "redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", "redirect_document_id": false }, { From 0d85997bc89cc3383f58df850e31adcbde8516e9 Mon Sep 17 00:00:00 2001 From: martyav Date: Mon, 27 Apr 2020 18:46:56 -0400 Subject: [PATCH 107/149] linting --- ...cloud-protection-windows-defender-antivirus.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md index 985b6f0b7c..5d069878d5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md @@ -37,14 +37,14 @@ There are specific network-connectivity requirements to ensure your endpoints ca >[!NOTE] >In Windows 10, there is no difference between the **Basic** and **Advanced** options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. See the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839) for more information on what we collect. -**Use Intune to enable cloud-delivered protection** +## Use Intune to enable cloud-delivered protection 1. Sign in to the [Azure portal](https://portal.azure.com). 2. Select **All services > Intune**. 3. In the **Intune** pane, select **Device configuration > Profiles**, and then select the **Device restrictions** profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). 4. Select **Properties**, select **Settings: Configure**, and then select **Windows Defender Antivirus**. 5. On the **Cloud-delivered protection** switch, select **Enable**. -6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**. +6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**. 7. In the **Submit samples consent** dropdown, select one of the following: - **Send safe samples automatically** @@ -60,11 +60,11 @@ There are specific network-connectivity requirements to ensure your endpoints ca For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/intune/device-profiles) -**Use Configuration Manager to enable cloud-delivered protection:** +## Use Configuration Manager to enable cloud-delivered protection See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring Microsoft Endpoint Configuration Manager (current branch). -**Use Group Policy to enable cloud-delivered protection:** +## Use Group Policy to enable cloud-delivered protection 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -89,7 +89,7 @@ See [How to create and deploy antimalware policies: Cloud-protection service](ht 7. Click **OK**. -**Use PowerShell cmdlets to enable cloud-delivered protection:** +## Use PowerShell cmdlets to enable cloud-delivered protection Use the following cmdlets to enable cloud-delivered protection: @@ -108,14 +108,15 @@ See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn439474(v=vs.85).aspx) class for the following properties: ```WMI -MAPSReporting +MAPSReporting SubmitSamplesConsent ``` See the following for more information and allowed parameters: + - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) -**Enable cloud-delivered protection on individual clients with the Windows Security app** +**Enable cloud-delivered protection on individual clients with the Windows Security app > [!NOTE] > If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. From befaea37a94b55f728eca57cc0e2b8fd7659d2ff Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 15:55:12 -0700 Subject: [PATCH 108/149] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 089957ea4a..1c7f9c4f0c 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -15855,6 +15855,21 @@ "source_path": "windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", "redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", +"redirect_document_id": false } ] } From a8ec188c41d67449ea90d862a13cdc1648558496 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 15:55:43 -0700 Subject: [PATCH 109/149] Tabletweak --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6719d870b6..76a33a3064 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -97,7 +97,7 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you |Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | -|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | +|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | |Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | |Miracast4 |  | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | From 59ea54e63e139a77a4f3db3231fb02a223e73513 Mon Sep 17 00:00:00 2001 From: martyav Date: Mon, 27 Apr 2020 19:50:36 -0400 Subject: [PATCH 110/149] info on valid values + links --- ...e-cloud-protection-windows-defender-antivirus.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md index 5d069878d5..97460bb973 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md @@ -95,15 +95,20 @@ Use the following cmdlets to enable cloud-delivered protection: ```PowerShell Set-MpPreference -MAPSReporting Advanced -Set-MpPreference -SubmitSamplesConsent AlwaysPrompt +Set-MpPreference -SubmitSamplesConsent SendSafeSamples ``` >[!NOTE] ->You can also set -SubmitSamplesConsent to `None`. Setting it to `Never` will lower the protection state of the device, and setting it to 2 means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function. +> You can also set **-SubmitSamplesConsent** to SendAllSamples`, `NeverSend`, or `AlwaysPrompt`. -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. +>[!WARNING] +> Setting **-SubmitSamplesConsent** to `NeverSend` or `AlwaysPrompt` will lower the protection state of the device. +> +> In addition, setting it to `NeverSend` means that the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature won't work. -**Use Windows Management Instruction (WMI) to enable cloud-delivered protection:** +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. [Policy CSP - Defender](../../../client-management/mdm//policy-csp-defender.md) also has more information specifically on [-SubmitSampleConsent](../../../client-management/mdm//policy-csp-defender.md#defender-submitsamplesconsent). + +## Use Windows Management Instruction (WMI) to enable cloud-delivered protection Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn439474(v=vs.85).aspx) class for the following properties: From 79e3fb6b0e954a4cc1a7e20da64eefcca11480ef Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 27 Apr 2020 19:26:05 -0700 Subject: [PATCH 111/149] Indented code block in a list item --- devices/hololens/hololens-recovery.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md index 54d2d73ca6..ffe2dd9653 100644 --- a/devices/hololens/hololens-recovery.md +++ b/devices/hololens/hololens-recovery.md @@ -135,9 +135,9 @@ This deployment path can be enabled with the following steps: 1. Select the unencoded license and click **“Generate license”** and under **“Required Frameworks”** click **“Download.”** 1. PCs without internet access will need to use DISM to apply the package with the dependency and license. In an administrator command prompt, type: -``` -C:\WINDOWS\system32>dism /online /Add-ProvisionedAppxPackage /PackagePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_1.19050.1301.0_neutral_~_8wekyb3d8bbwe.appxbundle" /DependencyPackagePath:"C:\ARCoffline\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x86__8wekyb3d8bbwe.appx" /LicensePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_8wekyb3d8bbwe_f72ce112-dd2e-d771-8827-9cbcbf89f8b5.xml" /Region:all -``` + ```console + C:\WINDOWS\system32>dism /online /Add-ProvisionedAppxPackage /PackagePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_1.19050.1301.0_neutral_~_8wekyb3d8bbwe.appxbundle" /DependencyPackagePath:"C:\ARCoffline\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x86__8wekyb3d8bbwe.appx" /LicensePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_8wekyb3d8bbwe_f72ce112-dd2e-d771-8827-9cbcbf89f8b5.xml" /Region:all + ``` Other resources: - https://docs.microsoft.com/microsoft-store/distribute-offline-apps From 5e208b44e444124be72271bcdc3e623a4b237f54 Mon Sep 17 00:00:00 2001 From: Bill Mcilhargey <19168174+computeronix@users.noreply.github.com> Date: Tue, 28 Apr 2020 09:47:37 -0400 Subject: [PATCH 112/149] Delete rules-indicators.png removing/updating rules-indicators.png to show 15,000k indicators --- .../images/rules-indicators.png | Bin 54311 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png b/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png deleted file mode 100644 index 6062d5248d0d691ae69a1df25662d2f4149d4fbf..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 54311 zcmdSB2T+q+_de=(JQ@`tR!~Z?(3GaqA%KX8NC^UhQdO$-9zsZ>2LS;AAp!y>K~buJ zNN+*9p(6yOCG-vfLLh-8+<3m@Ip_DEJ9FpWxikNJ-x-ECVfKFayZ73At>;7mS*!%VazkT~o`2YO*56MY5Xy3lR8oirZWgtUa$&&_C98H^irPkuj(8 zvGcM19(xbZ`Y0d2dHbw!!E}23(YwcvLqjWm+z>$DJ~;dKc=Xd4_h>nwmhQ8Tm~Ud* zKiW4NUHeu`y`XVhko6gOTmu)y8m>4*;Cz|8G1X{k5fE8Hx`6cX<2u zeMP%3P}3`OM(myAYKO{cA6E;yVuKc8IbKV7p{-puHR_m-dk6dKmLLP(E8m(}(|3Ng z4DywB1o@)^CqvmWZfKG01$pmxHxaM?p2Mf7od_H0yQcPDg?WzG)n#cbs>&Oygp(8g z4&H9$X!ST%U}_pxu+IDO-j?Y}!fC?}1j=oBwD;M&=uTlGq50Qy?mtMn46I@yy}lo$ zvEOgd+!E&$lC>0kN;W8Z&s<``Mi_sm5o*5h2n!!D*r6_w6r0}-%sRnfNE82xn}_A>c9WA zKCd;>Z6s=;{&^uS5emc?IU)pE{$9%h;K0?5X?I_@d-+FPHMp(c6j*3UXZEHMzRXh0 z4^B!7w;U3UqbY#j4}^mQ$m1xi88mK;VnHjfZF!sm=;q zb6R8SZjE>UxVHby0eoEQJMZw$EHCjvVn<9|ji7AVHlICN++v^unRqr@A`M`O_@Z8g z^gzu-Oy`!U%<=xR!t{L6_Rt%CXg*~8QRGPom(C48i`ZKk3;vY7PeT%5Dz(@?wD*0L zfKdZ2Xe0e||Jmv^>lDQRPdK=7zz!m2A(|Trai%tj8&e{DVLi)pyHiUM9DDt>K3_xc ze+NtWZtp}8E|nzYWO>b_3sVO)iA~PCLpjr_2Z@hoXSTgW2Sq@ppv?_ zuT|z_J6u#BE(v;+XpYwbZEiKsmY(|6Yf0%Q%-CTyVkv7I|0e2rRXL9xwu}3sS^gvb zgX4O6Vj6H+r<1r=f8Qc#-JOCbJs}h5y4C2_AJZS~pAd&E-&%hv-tM{I{`jW{`SY@b z8NiI)x2oH-poP(DZyqiVS*6_JyJ3g94ZK$J^)(~}1OfHiJqdIwy4@GnZKHC6ygr{; zIh~uCDZ8m#Ji{@;%Cw86#l^Ls5%Z0*;v;WUxqo%-3vvUUN@M#vEDejmh7vS%e{{yv z+jI;ew?HLtN{^Jbh5ptzl@*vD$9KZe%}!7mxxQuKEBUK+NzqZ5@i_&FuAYxW(`}ZZ zk^uT7y>yAoz|PPyV(LK=%y^!?*;JXK_C4Nst_m?HHo|lJZ;#Rb8qnF@9b1ceEt4@t zxK|2x8NWdd&dNWH0W`068zKo(O=JW`D_jAVfHhWCeLMp_7fN1 zPAm}=faz~JhgIT5F49$b4Z-dKMPP0!Yq39edf7dvDEU{@^!hI|S|`P;(dRN1gL|0y zeQ6nsjw`+E01dB!%^#$SH&2oQwE`9jak9W%AXkakr+{yAP}co~U8&2!BL-}H^8QZX zUwwV;d!o0Iz98FW=2hNX4e$VOu?#iUhc49qxlp1m0a?vuF9^ zyPye#Ffz?LvFH@cI0#v^*s`iVa?G&P5GxS!u6SyulhEeui>ppVR6}BvG$vU&ZKR+S zBbi?#xUQz34A99pxRQ_XSz3M9ixwwwXHLAcLC9|PdoBv4xSTO|UY-4xw0M-`nuOJ$ zKFnd7_s*A%iM5_sTCX8D!)SiVRJIjrJp!E{of((0ka_viDdI$`kig62(NcCypZ&z+ zR*f?|YkAWH9|@tebEvmxR$?fif)O@4QL>lUrqcT{%I-d6b20Dvz&41r zcB4XP0e+xQ`(@EDJNjzs$XSWX5$A)pcTObnnr;u&6&jQ&4-IV6BZUZOZgggrA|miE z!R*gN`q~VDP{k_@m7U*LYLcZ&jD9Qn)4-E;^9&)L!4oUR^+*@wm(RmH@+ku=I}hJ4 z%>V7Mjf+M8+=EMrz*}3C)sYiG#>v=&{d}<^{;QKK!j_o5JXcTG$%e>ryg(kNhpQG* z%@Z4PEzm8u(}n_pyj82pgWC8fuf`Mt5x&)rR)w<)YLqGza*_u;V1Cng^63w%z!Ki5 zz>RjfUFbIcSa%s7x|DV?F^y0|1iMfdM%GV9Rtk$<7LN$5wXC)H+)&5^;tG7&PW)xu zPpd>bLhsk;OzZyoX6@^=mgALsu#0V>1K4jst6wv=@4&avJLA>GYLk8uLX|Z=dVimX z0eI;^KYb!D*1p_eSQq{mE&QXV}5+Cg*L!UNxrU^pi%aX5Tl}p9225nO%eXp26P(M zlaLl9dsaBRxxbc1kwg!l`}Mb^r{H;?H@nF98}+@2!Yz*ncKLq{;45gvdV66rv7b)- z?{HDq@c$d(;@@Nc|82ngzwZswKd`~OcId)i%MaqE>d$)YNWyiSdoEqyGjK&C)&~f9QK(Ul$8X6(>Z0_%lQwtdEBj7<7s%C8vO2 zIEwv^I-;z;falrEO#rW&o=VTb_+on{@hoR2XXi{$yJ|XtbHbHN_7My?Egq-*jbWZn zCP{E2a%Iv85x&_rHobB3HmK>^zek`4l2_8$*cfKF0SV3G=>O%BQDB!v^oo#Lm!W7f z@1vdJ97OF>m8x3R!1gMfva`vW-ub#2#x7vDZL)?U{j}9=7kOr3@1Sd&L5)KMC$D?4 z?&ONHjJ#s_)RL}bxifl6yDyO)`;4oPsu_ZGhp$PD?Y6wHCgZRbSH2Wdnz7?PYJ(my zs###p#<`@FzhQ@j=i!a?>cnSV?6$`cNnTv|G9PaAZ7L=O!(#7L7ecp}^9}BCy^{c{ znyTOtgYdzuKh8R3ijgRkg=KYwTFUuNZB9VC9g9vDryP_sAmi7fr7^V`N^=QTQ{eeQ zKJpkVx^1wp{)8uruSL5)p_~U(xnbkoxx73^C_)`FpK7|fV#FCy+W#C;+C>{Th=B+n z?-gkAguH{Mt?<|=V%hTh!gH9hbL&^e=KY(+_Fhnbp-O9MSi_EU`?}c=IZe#~e4X3w z&?2JYtSxDDj{qgi+;n~UzK3O%r34kMHnDp7KNkVc3EO;CKTn%nCBa3aTr3f zbx=vXvEMGMQ@s_9m#CWR4K6vE!nQ#T<~fT`ag{@AM^%&+PugXtvO-X-yA9xMpG1DM zZmpzOfTE6nS!SFD2VeM>kXHLUI>YDIj%1EFLy3(TiTbl~bp`r>TZZ---cR3m#VemX z;vAHb0J4@yh=srJ4JCE!-hRhHn0DqGV3jW@D0v{cs_{|OwASnJf6tMT3@^_dT9}fx z>gjkc4e;^S={ttN*MON-E6jJ8aqh030n2kOtSdl`~5ziE<@=zfCF~h?ivAV?5avJm@&GU zR2L9j41RIq-yLvv%HC9yi&ra`mqjK&*E<7FhiZyHN?FSeQ|?4J-mcJwPg%S7rwAR3 z?e0kcRzckou^3JG$O!;5)G-_9?l?HkY89i)>+*P?O+Z6;Qhw+2nhe@meirxjqTM)J zoSA94*EM>MiF~sw^H+@h75$hKaedvK>BX-W&_=dV-aeDn3v2FnWHP_7S}|(3s-QH~ zzBHp_JL@vM8g8rUBZ_r)3f{1E^xuBCB0+25grv;T&UlWoM|2q)G-sXOWe@xSXj?%B zJiP*ai&DC`3s*=!8^Qj`Igx&KKdPV(o7}Ktq8rn*S`(ThT~{jfAiZ^&-Y*LZx>lie zQL|`(^ougMDcdm{KG}ATCe53@eK#oYsb!w^fj48`@*^(Cr2F-6#P_j z*6N%Snq%ZxI@kq48L-%O?TdJHLSB7qtEzw&YVWgp4ruw@Qu&145o)??{)ra@%)8SU zH`1GDwQ_{j*SRX#{@_j9+`UbL=FM{yJe8Ctn}Kkc=N%(kfju7_uO$6oz=QKX3}oVPfcG~5(bTeFtMNE_T=#ew@&?N z%T76kKzR+>39gYib38`h6R!z}FLPLg(qe8NEC{0BP%5`ORea)ti( zOgFvRZjo#2l|>1cs?T@MqQ1_6uT9K?N9VO@@Q>Rj=GBRiE$2_`=T9(95stXgO|Eks z%&eg8@8;U-gq`2y=^lLzYjO~^l6J_!3H{e^rk{fyd);rE3}6|by+6{+iMZ{>AvJJc z2b3Mu!g-tBojR@P^XA&;^1ZO+oj6gyKz|QV$_qHwyJ#s;P!OhcziX{$;ELiR=S;70 z+$w(ec}fp7Isa9kkSg{0>rWP-USTOv=REypjuUeS3k^k%4N zCE;~HZNi^~TA=Uu@!|2E>DNnoI+QTSka)0HrpJ zwX+7~k7WezMJ}(9oom%HREGnTDE}Ns#pSuGwagC9?nU<%>}KoQ@?XKyfuGUP-`g>_ zFC|;*g?^Y5tY@=%ZAr`&ZFV8n_aM@O>%?q<;Nij?J|NU92BUU0cr7L$vHqkk;mf1N z(XH_%EdCv^?(N%rtdLYs;Ilq^c!sFFL4AHcFa3}sJU$4JnHlmffzQh_AS$`0_?gnPI(3tw}{p%eec#`Ug%zJVPf@49x(i4 zPZBi7o|J|u!FMKY_%&}fUZbWZEg&zf^P6W)XLh*908@v5d_)EQ_r;$6F|B260vRMU zPZrt81!inK= z_;Wz)cxYtB!jtN+L73fJt-g|h2;a=V7AyBUZvvcmvHi&>?cYj|WihlrG$w~!Izh<` zzqBhAVVW77GnO~d2OjkWC9d@fa}J!Fl5cHOHf`Hni%)*3R^2`pFmd9&P4DIcd>$FZ3_@Q0AP1)l zkiWY-u67&Qs=>3BYV=2yN^Bn1bfrO1LgeoTjei=|7f$befzM6apBSifJbK9rBjR@X zIYxDaz9;X1gClMywg0PJSd!`eK+VDDKnu7Lm3mW6h4#`pIz`M^k~|&hQpCT2>04gV zue;Jv+O~{aJM4i4d|W-PU*~>J_FW6WqpC=s_CGDDfWrX}EOgczj_v2md_Qu5Y*%BJ zAM$;80Q{)5hsd}!6EPqDCnZQsOu_7ED4gmo%_vQDul~vyp?LA&S2;9Q?nnLYtQPzm z_u{X*5+l*_n}Ycc!?D+E=B8%kAKWgfB~ZVAFpj){HHR6iO1tJg8B9207bTsQ%>+e1 zw-~U<@#(%f*ze?G*)iR3fyYl=G7LnX8{Q)ZxNY&@E({68?4LkaSAZpgH#dDM;MoowcG^o0N8vdVJ+ez+Al^JA67_x{#I7)fah<&CHss%+s8 zjqFg+B<-wqx}0As7p}gd^1v>oa%3(%kXFDY8(1*%1wP-nJ{`|@|KYY8LY-S04P7d~>drr+rU$PaH{e(RbxbeecOBEuUqgt;Pm2>yjY1cZdqozmpcEuKq`iESoTwl22Q0VA zz(ax`CV_Iy_#kW{jqlcK?rcp!%DGgBdv2Xj8eXsa0nj_NGm>q`P8T1c>(u12fZH$oCIEV1Cq_1}2U^^}q(HuIzVDyO7(JN)xCiKp%o?^yozvpb>Pd-qNbORz$I~z6iaD{10^cj{ z47IwV0SX1$=Sulw;?iOx?)&^}9HO0}CR6jzsUKRt5k^JHlOm_@&NkT^E~W57-QT3n zY7H^76;F4DrWWRd=NJA-okmGIgUq~KzR!`ON(iCD7^-B}`ALF>+Jhl00XfX;h;B}c z(Ep{yBhaY>SBVW`IDpQ@ZK-R(sH(TKGz0CXzE`}C(+!x+JdDIEfPz(o|2`35aND~^m!i+V*M+^iD71X)Hb^8*h2;X_z zLN}t@HX-Y(gI+OZ<$-rWo3H2t94!f7q-}! zuFQ#zU;krBMxftC|21)Fj;H`R#Xt;AaJcq=^2-dX#~F{~ z=DGi#X#YD$`~Pr`DiY?jPG(?)I35G74@vsTCdC$rLs<_z|Cz^%glVmx1XTftXd0XL zC89Zz`PH8J&S{g?$)7w|SA693_l#F?W%CPvucQ7_-QEm@OlA~rqxGXV$n2&5ZPZRX z3L>+9Q$iPXszrvipA{o&{0=Pf(sxHvzn^!8k5mS@j0G49Qsz~$mK-Aa(m9~(!tlhs zJRUnk8L-D{$Y$}qPW5ss6G|{}2vb{0jH8JBl`eYv1GTpvXQ9ckBO|sOyYY-|9o`#z zE9AYkg+1yRbZ-z+z+Tr4>p^F5GA#GI1#vFsRIm!n*nAx%A&vvApLzu--Rz&!Dy-S= zG$3L0brnCEA5swii)MU!kf=C628HY;lgSU3U9QvM>Z>>AySxBO?xSnoedAuZt;R6N zZ=nqbB?J$N^J`1Mkyl~HH$a=G5&)$lz#V!QvmD1$C-)X}(2fCVIp*q`vXPEr%qQN< zGiNPlm;*y-#>$I*6K;g&w`xjWqYSqVT4)v3hyJb95X;zVnKoell~KDHWv0*>y;F%0mq^w5H9S%7pn3E*WSvTw7`(6Qb#EFYh zS!Nh?lPV#fmAL2ST1HPb2so89aQhJq-H`+ge&3cgF|eun+_YqEzHQ#!ZbCK7lbb@k z&!u4FyVbU+8nK%d=y*j(Zcw=3vYeF@99<$&I-FvYT50bj`oMN0Jqe@(I+c9(0i;Q3 z({T~Bo`J08^g-H4h36gmGt6r%}-8TSEz@#2rMuLbwIT zXFY{QjnN(1h4axVMof*$U37s6PRL{L!GkEt4VXRFwRsmiBk_Ed#a>Ij=f)GV^^iQ~ zq@i|fbZL!35lvny0P)o6IO^zbf6-l<){46wZ2dO;rC1t3hr-CEOutXc-oZ=P*rWEY zZ+TezJ1!{&60I{AenUs+Bu0{S2a3~}4aK!ap4z^Ae$lDQAhP_`RLh6*kS&=7rRt#w zw=bRyE7P%uH$k-J2HY2`ADnz@ z=*NJc&{+?3Duv}PF$#psYV6SVD0}O5d(?WI&`z2&j|NpK0vWi5+uN=aQF7>r)8`&#NA5h5-gO-!gg5m?ocY*TTXSCuL&&^JiEyIjy9gmARR0r9z zGnBuD_fDtafvYL!{eENoAue78Z&X$#hCR2NvrOqYGR=pzp;`l9SH6+q0}3++15(7R{t__{>ZzH z8Lf5T@MN7F_zT!&!y@eu+7P2$Ep#ssU))n@)@&qWesgvDadRT&ziSq$6LICefdeO@ zNC-G!5La7U;Kmxi&ssCwdZEW9sRm5lUF;ty9kU{*-L_0iu}Va1tA$4m-awtztiF0Q zG?tsmYTZR{MLT0v=t_IrD7L+?{aC;F2q#kk5&{Y%x4s*H&Z}11qIn=nRT0LBKaiZn zF1Od1s{FNJZ}^-4Jhdr{z+EF z@znGSfzzyFEy|(21)$&_P4{pV#FOnjLg}I`9NshGf1v>vgbL`~O1M9n(H=KhoDtXb zopqHN88|m(fn9+)c6UcapzzM7f`?i10h51FG=_PdT)Oca18d_0*|(QeLKFspIvY48 zc2*cyu8u;;;zX*K)8!kkqe(le zQac{$s<4hYPM`Pq$=EeM7~n2XYwshs}XZ)hD3Lu5ADxoIMd-Qp3q`jM-o~iQXoC zoPaP%uq(v#a*aHd!7hFD%wM!13|XVW&vT)ag{EXgM+ee+a=Qk3j@HT5%rAT`i*-Vk zv688G^NNBS$q4@pjTh}5O2Rk^Z`(h_Y4aPQmQ|YJn!cJw$lccFqb31+5nf_>=SQ@w zllg-dyDfnJzpLe#gE~U0)Pm~sK};#^9EpgF(AM(UAzrxU0RNm}bjoj!%*(h#k0WTZ zjj?@NGCG~6120XHrlUk%ER$59G1BX%D7JF$+Ja{RtHPeOeV_J zTNMm%v*6?q@R^UJc{mhoEyHRdUfbD|>AIGPotN96$Jw>T^>J+DU6^U@E>td=$K%MX za)>m85dUR7FbsOwqB;O%#=7Ucmbh2qN(?=9qY`0)sIwjU;jC0kyQ}SQNP+SVSPw=v9D1uThNw9tPah!! z)*Ww7LrEaRmkQqs)Qz59`Rc;RL8wt9;ttxyf*6$wYAD!LS_h$-|MJHauP))?$_ep_ z<@&yoNArF2us4iZrA9cC7e#U;7OSg8$m&|OLLvGCu51#N6NBK-gLI%Yh~jd{oXN^) z3yrV4Fz}!p_z%oat<2Yx7x^tRsq={`?X8@2rXsG2kp6tXeZXxdUhsOHpSo{1(>367CXaSEDL6 zya>&@_8S?bhvFXkEzA^#Kg9bI>(UJUkPbzcYg=n0y>+403l*?NVf%UX6!Ws}Cqrui znzk+lt&R(-*p1USq6Hph2Y~uFU2LvcwTHgh#xpu6=p4%CwhQaF9qo*d{|cY@R+H{_ z!^N%$*;2bsU55wMboc+DUle@8QuA2zS^6sP-3NlwpHDdG(&k3VpS=_Nk#*Br-?$cTzv%6gc<8kY>(=q0gfVGiK{ljl1z=aA;NoG z{y~a4xMoUu0%a`J%fpg|_6Vg2{x}&fRS#YE5Eeb$HLY71wjJXsq;X71J`X$Qca@@b!J@0T6Btu3K0v+Kvhr|b)%ya6{b+8) z@?64|H@*3#Hru0E$W+_|k;Cm1jlGl`6PbwJCrr2d5BpZv%D?mtf_AbVbM}MZ6z0mQ zXj2v(7d8dR2UVHv-CHBYH1<|}SufVCpfQ}`1J9w^_ycu*GQ%r&kgLaYIE33*&DRtYsjc)HH-y_s2R>Zpt79vy2Hcd@;4acj!m501n zUDPAU!jSBB>{gj!|u4dlH3&fOi z93~Zq!v}8tNJ9uTni>Xd)|9Y*gb@~>Dhy5WRf6YNX^_~Xo-tiuV(C`1knZJDAHfFg z^S$w}7uHSJb8>9wg}~~z>WU|XoC$)GDR}lo{YvkVKgG5PY1H_~Rrc~qQ9J_COZeQ7 z5@#D(mNO&P4_ay^w8hhZw@SH(!PP1R{;8PomQ?*yEa0J_U7z2&G*UqmmWhZnCj-~n zdXS5IBc&M=RgSU0cgE~#e}3MXRTpbCP*z6Sw5UA(?6f#w;;0)qZiXdZSA&$ z&yLF#vZ!@p$@~2V;|`3_x0)AEo&~k*3!lo1R$>y1bL!xbd!$27vDnU_lMTsth^(bj zoo0w#z{7Xng0^z(-sUmT(KhOD)ej2BHrujpJBTph?(FU|pS+@->x;4t57zDc`?PM& zdezjM$YOp7p(^B=^!W){r-ZX6xl1swjY&>mNZjAD1m!{9wR2@=4FcHrz19L68+CGZ z&$9hXtAZK2?pIENm<5HTXVaAaXv>xPhTnECt0ZjnLgg&TL%cEtWjbUVRY9EnQl(+2 zFbWMmUAl{eYOs%bFc(JYEnl?-5q9avETa_XNgT!N_9wk<=k>raVT*#w;Bz&(L%l^i zJTJFxhi^c9X!vbUg!~zy3fNZGde$UmjD9a9-I+$UiYOeo)!`Z}~CR^#XcxIj1 z;kA8JcHE*NBVgiLnTMhI!^2X}px16Lt|seuE(6;_FoW{(Pe`5p&%N$g&T4fINSm&4 zPNXWYbI|S0W+#0f2VT$%Co411Ynf-R-~VIG#t&JUHmF;}Zzf^D5{|P*h)-Q~xX&zi zPX~^d*@flX`xa*ew8pRtRDYYt$#Neg$2BVLtdGakkMz*PrxC=(@?0+{+G{hGlbVPd5i_NqtQw;i)wR_~dQ7x<)9sO0U~))V)w=tO<@M7;WCXq} zn_#C?ErN8S*r*<3zaq~)_dXRBvz+~W%Nv^tQlc42;wJw3u6{%KOH7zh!2{LRA72t zMfUL65m=Q*Fz?U91QIqv37dvlsJgFzkmqVXsWW4syz zkHf<^nySU)RxQcB#338*$YG8swpEQIo7dzeEj1O5J+kdHwLu0+d?=pkiO*19DyIl* z__%vnQ#WHtFU`eeEL>afAhVBtTHz?eZqwp*g>sU|*4?DVY<*4ZQNC_Lui5ze zd~LqQfC5ScN980=Qa^+3$#?Usk<`FNabY*>GlG6#y{}{`azcl-z0D3efZcAE8Dp(* zPjFVN`>hZ}1`wyDc*cFW$gQ+GLN~cV7nt>@;PSp?9$vNA_>$<=zWGkZ0yzxO@CERB zQs+RPx_X&XO1=zfS}dY`xN_(AMmil>mSTP}Z=J$is9R?*^v$1JD=w@#&DII_UZRft zanBX%uOjtuiy0C`&(Dr~P#WAQTa3y@q{q=(+)is)uM|%95&*8KqBzabG{N^8pZyTt zk7!u3BCBt8nlYH6d!NND^R_w&Eg-`*MpHOPi$h@<*@8fBRC0%VXw#qlaJZYN7=t}y zEwuV|KS}^m5pd6WV{pOY$w--c`J=gRxAI#!1O`RVph$DQ(;Yk53>VwPDGDiDXiha? z{6-oi?^7sdqjg!;{m*Uf4l#+>8$?gxENo{TdYOtMB@g&;@SrlaeRVjY$y z2TfM|hPhm94yoI4P87kgp7$f^*O_sW7hx;JJ)Z-U6r)m9C?oVuJ(pV0*sZJ#y$>xy zFPyssFUH!f0A$4Z=Jr(O`Zk<9GD=>;j5p;p((*+XYxR{O(udnl%T2&vOcBzau4T3; z{oYxXQnfaAe`~DG%w&06K*F<>kw0zu2 z^67IM`9f};qKskI;jeFk-`dk#=DQe!{GNulLSGgdAdQ+>H*GdZk~H%QjQ9BoS7+!A z+nSD-VOH-)H6mp*k$@K{RZnG>hp$SI_Jcj*1-8OP^&ZF1>y)rvG3#**bwX`uIiD~# zC5f(bnPd0^2G-D}n2%kd1wuSzg#i>Rx?48ssMx7bu4rdXR^A{bquQCQ+XAm(3@E@F z+qp?VCb|T+7KIypi=u__8%0+^rK-HQ@0-Ho4lHN!B0AI6J`$O%ggu>0~ zM_SXev-ZS|GF%l#b95y5WJ0LMSS$Wh*V<1JSCApcn{8EF_0f)<2iZAO7uMcd6(@%` zXoUvWKqbi=4%^zkR|7sst(Le({FpRzYpvXJp5+(TsCWoEg#pVTx+;d+GpZwQP5ECs zyDtYm4(**%{B(~tbTrOe2T<$__`C=+_9&|o)3^FTaP$qA!!6vYOpl;f?^TC8iwl|87!F=cUG}oRCx^&ge2f5=BciBk zSJ>Bm7l#Zq3Is7UDQqP{QbqE?Z05;Qzx`r`5iTEi=TB?Oh;*IT_OB+Ws??8CEaR3>jID74#r@pKwpH@u&eo@#60dJpGLtF z$F{GFvya)(8zXhfwVu(12N&lC2LXw>?0DRg6MQpC78r$$az+*m65BYUyi-xAEsLz-vBvFVhNNR66i}*#>_m0Z zGHqy9>{Si)WfpUzn5&zlWI>&t!j2}O%QZ?5+=@%IOQB2Oy`t0puNm%-DuC=1OcVgR{bRoGB zS0<-!mS%vqoy809X@Ft=9PNj{8q160eE3ue$qUW=q>% zmC70ts#hRf`Z`Gj30jRq7Nn`^bqv%!;h$9-(7+lda%CT!)X&JSk5Vf0$xm=D-W@B< zjmW+R_?!TCaaUDwNYXf#B<0~HAN2jbjg17*^%$F`u;)BNmwlge`GPF=JS%H(Q~2)G z3ujt5rjEIpRwf)D6DKowYqfHR>W!th(IJJvts>H>@bjsp_q?bk;p-mn*Y`DbWL1YQ z`QhSur2pD;35bN?*Flo5+Pi?s*^5|ByjSqUtp5B1ad_t=?>;JL-5rE8BH_OoF!QdWl&3%H}C z1FDM+Jd8z{N(nm}eLE7aw#>M^p}255Es3#emL|Q&4Mx&d!LWtzd?^bpb-(Xr=WTZi zUM#@gxcYgA;Zau;kMxnj%z!J;^n`;YB<~%%SC`f5!EvG8FX?dqJO`12-oef183LJI z5yWLq^N@0O}>v2h=0-H$$Uk~Qz7=IVS~LDL^E zA|Q>B)|OR~k!@@BQ>$qnbGb0%zTVJDjoJmTO9T-7)wXTtJ?OBu{`(E*!G0qhKBIND zc6uLhJ=aNcW9OR*(OE@q%YBR6&8S*Q@L9jYdO$TvX>4lhjZUI+f z$SO3BS(h9{`{I>>wyQFEhMExP;n@6B@%B-=rpOb0WG=>7DoTG6DY0mui!luGEG(5> zRpu12Rz^?lDW4&^)pJz#W{zG#yq`HWF)>)MTHuO-@-##d*tRLEhxq;q&}>(ydM$8e zC&($)pj4-5x$Q&g(DP0Ed(A!uoYFB)QjZ&tn?9BUw0f;ws zBUyus9FAgQ==Fez^Xw53)FTaVe6UEhDiPv;k4R5mYzoca`fWFN;_jq^f$%ZCZroV+ zyAB1NIJ|gRPpznD=mojDF;hD#owAa0Va3(|Uh#hIO3X34Pb(8!5T8b#m$*;;b*UY4 z-zO8_66qg4*zI4>N5L;tUrUx@v5i*7Z&Y`K%I$)z>++ErV8oBYE<4q;F(IcYQCm<0 zMZd;penX`@lP1;2a_^cPV(IFQr2qJS8r(i~@IYHUV5aLl+J)X_P903~!YkK`t9ILL zWf4u{|4f|o-xM!g8KN$vj7#@SKpN|fKwr3zG?6pXP`DTfc33WCs!%CB)T=eG{2n}g zS^(kky6ZFhFyv;HYhPi5;>Cp?yFBr0gcnlv?;G@`@w8S=%Z>eWB_}xS(uxlAVf04M zy}a*pj&73W5EDw&<7m3VMV7wKwYO85*>55vG7QSi2{|tYZ(a;>;=Px=yw(ufV+I{= ztlA!WSOKc!&m7)v(p;G0%~d2l@z`IyD^5%j-4(BmFdeR)IP{^glK-@8&T-kj5QUus zg;j(Ugcag~NtQ;88E({pmcSRd663ouoINJF@X-VU^-Z1@!E?+0sXW5|MyPD$6mpe% zxgnxjdvju}PI8PNJa&Im=bDVswQoJ|Wb-n393Lkq!Hh#1J{9a$D&D_)*&t_DtMpm) z4Ihu3#HWQ|a(8p-!>q`I=o*i}e-Fv-M8Ia{Zq>P>Gb z5=CbayLEAg#;8xWN*>&cK}~i=?Y&RiISJjcm~oH3;Omik~KOfnH@1?+bDL-^s2y{6s8O zTkA^m>n^ahKK~ltJ-8<3e!R}feY9kua<05q0nDVTr(wC~Z2dk|d2!OU=ZBRRY|4WX zG-rq4yO(_YiWe&_4wBD;nQ5aj(H3J*fR{j5751tP&%uhZ%g?AjtJG!4w%`jz?@qUo z#SFj!+1QJ{`p|$96lr*i={HiQLlH==>-5+Tzxb+BOyjQq+P6nM!mA905nH#b!N#9K zgFL#Brd(%u;K9Q0-cLL0xNS*tIG&r3?i~z(bQZ)MqPhh)n6d^)FGNBQ=aW8D=Kz7& zqjn#l9OfmMrVHHZddT#7=4_`ayjSpLO^x%fEjT>rTaker?o+RCSEV5A2}IMmGH5_x z9DAo@pet5rZt`I!f0KxIvq;8*)Ej`Pb5<^orrgikb?>Wb02-$tNp#5Y%a3V)r-i@d zsvR7;s>y%4xA|m00=NpJ1~hAb+#fM~A)HqX-E>kwM@H~RMNCANXY&F@m71qOKWon| zi>M1#K%=8QGzIeYuBDrKutKduqpe7B5m)2NJvs95ny;1X6P@)N=zS6zD#M)0 zU;43Kj>tT8&SjT>_Y?RXJ-O$ zgcPygZI=Dxc6Q{x?PfVtG4}GMLvW=Rm|mQA#j&zA_7j?6VSfy!C^*gwd}XExrVLa8^nVQ z^D1McUO5w1Hg|kRYobE8UZ(1JC$p1yQ2^^@`PzAgL{+FcY}H?Q7EQ(ozwE=|-1(Wx zYCH27eepoAsEGBWo@3N@eW+{Q4F{Bd&Mr0Pq*Vs|6A}qIfTPRgDz#%Cufu*JUhFf1zjJy*9B86ce=V1dV%ygI}mf;eC-Yo-g8~Cd_^EO z+-(&>U4O{Tg_k+ct<9tm`m^&5w^n|N7`(DIjtd0F+H#jm{U8?VX6eIaLMHJ9thH27 zJd(d|)tS}Q5p0L${FZ;{Z5h_Wr3;;fchnHL3?v-g7# z&l(vFmDrUu{oNY(jJ=d+a>F7^F1kxrPOjV*Op(F^+WR%1?f^?!rcr)+*G&0L37PIq_+I9@i|*dLBA$pkjCe^tZpxOK3jZ1 zO}Op^DmzG->FpGhMI@d#;E$CdtLz1r^wZ}ztkxrouwyWpOT3^}%GSgnA!w_+Zo|BS zpSaNXuu{+FxVxEux+;6xk6O3NW-Lz3%YC09e{GyOx@uiV4Wah{ONLjr?ls!g zRP`fmi2qd;4U_yZOGH$4uv55$z*Jm)mYtHm&O; zG|)2}Bt}}>nV_Ox{2%PScU+U}+Ag@PQ4!-31f>KUMM01z0s+K^NC{OsC`j*}(4s~} zL_lijL69!J34tIWy-5jGf|P)C2m}ZOGB2*R7g>AecV>QPzBzk;XEy(7lD9nNe(rKz z*NvzY`7Q=cAS7yeCNIVRs>4fh^Y@=Byng)`q%)($Yn1YVte3>uw^_BlLf3zhZH5 z&$b($l$Hpbs&x19gjyLfwE-#x>C%!FmruyuT$B=(W=Hp33kL-S!$PY2Irz(+N20`F zL5+0BpRFc+nO|rr7+J~uCSmx~$Ak*%??H|~`wos0|19eL-N6qa#amq(2)h}l;`1qU zNdOXfEj1BU%7JmPF0G)H=XHL4+WrUSO!4TYta^F(JhX3-z|gB7!2que%yAtJs>fW) z3O4+iGcDVE4oXVkus{P!8dQ=|HKqMa!;O<$af@R}s)!D|7y$_9`$681$h+gav%Yh> zqnNoLF<(s4lLzq?IWE!m7H`QNUG&jBoGp@_oGhk-+Qad)~)bxNq`uq3|eWYPn-b zaAK>A@U3o2*1e;esiXgbc*~7Fgo3bj^p=CY^6rlf2Uiowvl6|fY%Y*7L>jDHnz9t= zEb!fAE@kKRdSv)Ib?u)o2zIwZ} zV@yD((PGhC@Vm<}a~!Bd-(ypC+Myh%K(BY;Vp_Y}NO!g9eBOFZ#f9Lrb`K%!+IeFx z{`NRy+!Uq*l+Nx>%fgudSa9Af_(*=lpr*wj(U$k`HVLo8Bql%*uFdHAxA>j9?^P<@`m6$L)~tZ3iKp zdL*GqSA0!;bdQP=k<$XD2OXTCA}%_VubWL!q+y}PycYI|pS zH5(nG%v8GSee2_Cl`jBjyp;7%gaD6L*0d8UvK+M>4>$IgqWWW_(j%!U#yPNmSyaf2`GVa47B$+|( zyH-M*)bzVv(p$(E$fW4PDOs&iouV;wuTz!6P)f%OsTG~!$3Wt*U55OyghXC0vftgQ z=Ip=zqk3ms4DF*Gd-DyT8TJ=Y`$s?-AVjnFX3lG)%H3zn*NOehgi0R(hx?wW)z_%` zElaaA2X4BtOqPLKrYq>HQFjEW(yr5upsi3xYNI4|x_bNK>a#xr*u5tQ{+^Hjmm)DhFfHMM11>p8k z0KaDMa=;%??lZWG$a59(LRR?cR>i+mIvBMUp+Bb{YMINqW^oF1i8swolOLHW1c^uJ zG<{teI-|CFg9qA2YH%y*=gu%?xT8V203_?lTxUNqxnyBaf|1cqanj+1bb7uF21)S zW@}koRZKnGw)?EANat;Y51GDjjtMU&wR#7x0w8s>CIU)RD{8xL_ASP>#nXq(&at(} zKYGbxZ#(dIYpRjR3Xo^iXc-Zap!*97@wJnzC>4$Fd!~wv?HaiRM2Nv_lDsXKC{Tfw^G>{w)GPKUu{ z^FE5-MnVh0Qwn|m40kyHE6F(;pCT$)zED1IT zF!3csrBY7ZbehC( z0=19Rm`>utVsHJljJJZTRD7`P{cJa5t(yzKphbDbygGMU5y*g$Z2 zwGHHHxlc3E-B61UT}Ue<|1pL5$}0&f9zH^9%0eVYv9l<6NG%UoDkgvr_K_ zwjyWUPo^oZ^w_nt5|dQI4sfdb=#9tp=ndr$w8cKNvn@DVlIkbi_(HV@qfX18AhaVb z@MmOi@85_UtZPQRpi4ufX+{Fd9&aAgkco&%fNDwd*}o_i|4k@x{{qe)4A93jm;q=b z(xLj-(gFRE1VDSRIrRYml&FwET7LWDYWUj@X!+{C2|K2HMthcJ*7 zJ;-*@2bm}pmk2;sC?mdXeH?*#<9YePs%AohFBm7$-%|gHK1&KIm z6W(<1`bxdNdAOC2lkhZCWLU6eVU_9ysS~PObH%Uc)WPihH@r|8db;|Mh|yPE?dnQf zFCdq|EuWs%QO0Uhj!dE2h_n}VhV-h`J-ZWcmifr+wQld36X7UDZHCC(C0ENc3#Kv! zK3?pTf7LIR83E8-bi#Yj&GniRlek!;tL=-cN^&wfD1Z&Cl7A~Ej$xRE-TRzD$>F2h zpQ!HuDQ$2)RhlzZA#GRw8Hku^E=X^nnjha*e}7Uor!Wyvql>Qnk!GpdYbE|cF_S^s zrOsG54jos18xo=0{1{WkqIG|xUBAxh{a<{{`s>z^-r}5q+;?%&-iH}lfb{YZSEW`- zh^6+t@oLiAoo-zNj+RKV(E9-R>t=q|(~CgCzd^KZ{uSlX&Ba${<8L!?uk$BqCo=|= znw?PW3F4?0gtIq`#uV3vEetxhO^BIEui6!mf z1~a&d$?rHJuvN)4>*P|?1g&$?0OgrAhz)+KE?^>L3L_b>8#>;I$kY~62)-Lr50Dw| zrV|qYDTtqQHnt4Wxoq~1sGsA&(^HQ2aR}mbhvHS8BJ?`f?mk0>k8%e^!iodCUv#yH zdc2;YyG*K|;_z#vQHv_`hO0z$J&TKsbs1GxdRd!U?IczaJ>$i4BJOrc$ni8lAZez? ziKz*BFmu~%Jo@9dd|F#pFdlK%@ClYjG@i|5mLci0UYxx*Ax zXc(Kk0NsdF=$C;eq{{<3uD9@AIHQ^H)MNlaQ3YdJsp+P}U;que(K{-$wwxZgk?9(A9@9~Se=tvakx~??Xm_TDH zA}@loqWHVc-2uA*EWOjbwC?6%__y}ZS)BrwJ2A^?Ha8f#?v+Gkq-0Cu%mbB+G%;8b zxipOBs^_;gWr!u)lh7VrFBDzfwDjK|XH`FyU*D&0+jeo}Zs&8KMoH zZsGc`6cyxb+zn$Y(Sf(nxB+DpxXL+<#zeIDL^l`s?WwOL!aszx~IQI3K zjIoPZEV0oInEs{V_oPY5#NO^9KJK#G&^9hHKsQOW>xoR4#_)SLxXQ$d!)n5lORPrW zS5tWo{N2i~oP!3bi++XYLwVwuG*dA#@4Q!ftW1-)rEf!e?ZksfFuRf-;d|DG)qwmC zkSjQ{0T82`FVOhfeNdj^tt-jA;TowITbf5W6%Ex&+V7-HJrm`toEc$IGPg?vmFOwk z`CYzFOq!26TF43vy{>~y6Eg86&1ezYkh*@7beuvY>)OD~p|rt+ao|)2D;{6n9N15Q zMc~$IDG2Gl1PBJHBo7$_fezgQ2>vZxc7N%X0dTqKk0N0AS$d_?fB=P9m!YscTPJ!Y zjp50=F@9tus)_^fN{-S@gHxjZNsGJtFY>>iOvAsx zNBxz3`ERCX@tT;0nZ?i+y8MID>OD0i@-9d|8FYDN_gow8r;zIWm+4 z*02RsJ z26muluxqt@-NdBJ;U0i{>!4rIHZtffa~_Kfn60u(%R_kF@ckal>X_|NPm0 zBVc98+7uMRE`{4f+@D&Q~2z*UMCP9XIDK6h=sb$V`c__q%GM8RcXb%vA1YKPT3_6RJe`g zZj48Q%@Q{!m$p6oz`;B3+unbol3TC~)fwLG{0>_Hu-Q}6^R;vy=WPH0Li)5I!WPt9$=JTXI}ZuPb%_@KR+jiMpL!v%BRMQ2}Jqj|0{ zf~;Uenv%@FpFR*9pt2=;i=Ma%}JGy_3E$`H5 z_%Y!GO5|AbP4uorIU_3ox6SJ8dk?DeG$Z!%o?*rw~@$8#G zY393#SuUn*X;tSo^ZgRd?r_E6G152@`GbGmbeRX58y=YYY~n*(@n$90O46R7)82++ zmXI_YkP>o}RKK8PBq_SA<_`3r*x}Ge=gQpy?7$H-d#zwwqkbG9RJ#&5c=pA92MHcK zKoMd#v(c$X{|tf86i|7OV?ithF-!EbZ(ZV;YV$P^@9iJyaZmF+T9Dd;GC%KRd~)a{8J+p&4mAt*3T>q611!OqtehEkH} zjUI0A4fF>EdF!>`_Qc;O{qsuo{b{N}Xx|uVtx9(DNev+e{v>zb6Ld%RJ(;G5+C$uogBhxWnB;_aSf4Rwy}tDj z)3Sp!2DvpHbYu!!b!*S!04RzC_CL&WYj|@^`9Xz9P&*!4gm9-Mjj$SVY%S}$S~`cL zg28q^nUdNuxqyU0uu-LfQA}Eh*G?UBSS*)b3p<^>+6@c-@V7XPYP^S??H$jj*ur7pllZsz=(vQuju$S(k< zWyTWo&`$R~^vzk|RsWns#=R&`VkKrTkR3ECkJGnNfP6ji5A7JBLc^;CS-a2`^7kKU zl|n5lx&^>5X^cSbyA)6mP?$LkWElZal}0)stTTJN&IjnKV&%N9r6%^uxsNH#@Kywk z2J~Jz=a!2~)_eeeT3AxRL{0skNRQeSR!mN92IeVF9-NegUZq|CXb`S}B%dl1n!hOz zW@da-fu2}#omu4e@wvhx&%^hkR-iD@kNefWMahMxfbM6i%zk__rY$=&&V44qn$PaF z+JFR)c0)=r1zf7Xj`2utweWAB&fdstENiU;VgOZ)d;Npgj1|_ESs!2&F*Q50@Z7( zKp9oM)$%xfgC&}rWUn}?!rTkN!E9qUS3q#lQ-YIfE#DW!;|#2JsZmBbC@38!A(UtPRF z&A^mD$Uq^w=ov97?lLZs>on)Bk}xjaJ6q!x*TIiaf?YNxev_+7ea<(_O|pl$+#9ca zYd$P>Xa^Vg!eUqB45O`4|C@@#YcTKt$qnfB8bn$#+gM&r?&ZEH-K zxmT~azV+^gpS)dGCz^pEl*z=6`2xJKs`GqLf*7=!S(Fy|GOBJu=${3~~b{Wg@R znx#ZjX@Mj0AUILZ?n zE|aP?3BU+54b2ZIO`YUOHT~9O(>!xssquE`>r}$cN?aCyg+sCkjb#NKv++yZ&PrK7 zj+^KD39Q7ELS1X$ak)1BN|2X!bpi_6uL=GeIrxb1IN^!`yGk_Aiu@6&n07_}zQ>=M zyVaN{u4fs>16)W%(sJ-%W9k~s)d@hg70($y@{umlik?Barb>vce8JWFS}6P;ppsHV znYWt0@;gj~9o_U%eC!U3a6-m`EM+ohI!76~yW2f4&!Kp?WR8_1qL4O|WDi+$IfhJB zTwQAt2?^4^NOM1+F$n7XZ!=wCpd5?+dA|k!cKN2y2gI5g(e;8vU4PhFC^6~mek%_k zTK4R%RS$6en3gJ@qpb)jPNuQf|H-WXVLW;MyE{t%U+OOYt%~qp<=OpPJa80n?A^kT z;NWX5`c8t@#>GV`**Eu^HpN{w0os7DngCJiugVCghbN6;i@LSf?apSQg1OIqp0)LX zOu!AW#5!SqUhx*tc&prr0>p_J5Wga483^$8a%lFjLL8{wKzs<0OOJFO#^A97pTK~= zKhUYqZ(waerE@4{qNMBfKmR5c1VAfC3MRg5L~PnnC$}euBDjE#2|IH!yo7(cd<@9X zwDZS+;<9E5LyL73h>&a3giLGfoJZ``19X?%4p%)qRJ3dDlj-s#t=V}B5s8#Y9{`xh z20)k^j8(Rb0v=SlZ*T+X`;n>-VdP6Ux24X+sTToRFn8|8&V+KIgztxW-_acLGsL83 znBl?zRmar^T|U>?XD7Ym>Xex!2n^N^em!@=eC`lEP~@E{sA9)-hy~v{%uC~H+W|TC zJXlrb`p->$Cre*nI|@gI7vM~w&OF^~q%r8glN6IV+|TcOtGB<%*J0j&atdg%QB2|h z+KA*A(wMYg9UJjeiHOgJdB}t0Cp@R8WDRhcdodx*u+o6to+nhQeBf8NiM@!`=UNe) z_6yo60#E_zXR_U8W@ZK=UHW@GoC=N(LV0d@VVrD$MixN&Ay};VUj9qk^>77vMYm$} z)qs`dh^H}@l*y^wGJ&+PL;z1in;D3e&wX*02HjG|2z1p;{Sb^At&Y@xgz=drbkr1h zep_AsGx&EqsUNM(U)w_K{k{Yw8pp96d+h*Gg?0(}?|bXQY33r(?y{MBxhK*WsG#jP z6XjX#nwITh-oo5OTNwf{*HK@DbN_k~PWq=T5Lo>gn5#!B{c1I1z1=3JwICNJx7edln> z*b_$|eece9{Vz>eaW#o};0|3?=V=KGNbhP^q4%=)Vc>c8rMBOQO+b0Hpm#GEj*}*3aZhpP#A^le zklv2xcEOLc~hUlgSXiQt9& zuE8k_*ce^d$!l1R(Z9c=A)vUp(uAHpaL2y|$z^_I;@PAu+rEzT1w&6jZ1X`rz#_y= zwcLPeL%tU5V=%_sg}^L%uu-aJQ)}XkfPXu(g@LuY>FjW5I`VGeyvNl`eWG|%1u zN~M?ta{Hs~9)sqA{N_J@bu6Qc^u0=uTvZdBH=3Myck1`doCiMi%Ezk&Yj=$jR$Yt8eyg>|$xpY99FUP?5S z5NF#d81h=`lgmql77$mR04_94+Jidr_`~7GfdA9Ww+bgzPL!{&fbswq+aQMl9;?Ux zUfcoVVqUr48xR@9iZfg6z;Q^Gto2PL7@KVO4}MH>5M#5ZvEqkXk;Dyzk~DRL6@|5^ zo}NpBf9tUC;Foq?)IEKUkejf*)r@moF-ZjN;Jo_vKwk>>0aW8s%c#H+^7y!QE7Ba# zj_TZu0gi%*rL8VAa+RBNap4WN5kBnnk^n1omr|aMuu(cfdpc}g0Vnu@4IW>U9o~qxO5UaYl z<+3(J42U$!M*jW1P{4b6?bOcHbnC_SfR2p}x<;Hr>rj`V)tWSQBmDF3R+VU133dr-_p5I1WAaCJmMh)1H2Uhm~{hxyi z&@lhE7zFm5m7&@vrY4x7m&f)uwc#bWiXo2gHJapDG94Y`2oV8{*D1N#kL3N*$auRn zxFs;kuV(0RNeo6@H=qewD)zca;n{iu$h7}6uya3^p2`${1GPw`S54E6s9`C!n1uIk=e>FOVWBfE)_wKI*HL5E}}MI@dNGLK7Nz zIK&6Gsiafg@N#YE++{Q6?&K#sL5;UW7Y7UxTo6W@Tfc^@z;=3y-66f-y_}1g9^8}) zP#nQB%C;4=WfjI{9k^zd82MD{j%xG#`m03aNzYuXjEecIEGhB^z0l9AKhVaS;rF9j zql49NJ{SpHVE-t1-{Vjqp=5oruyQ;r-QC8kSi0%~1hRj}rOhc>_25-4QVj z5>I=2x??VVmRXp)cDSqmOJXVd)*5pj=x2Im|J z^E@@H4afBs)wDe<`wGjYI$B*;804U3)gRlf#CSRdFdLGx#Z=V{Rq=eaEui ze&^V>8|V-Pt)TfeBQdG+fbMWs;>BL?>S(}SrI}dN zZAfv61YEFh-Qt$EK6o?~*Nh~-vdGu=eYuu??L}5qT^IG#DPDx7hFm1&(~Ka_V&uYA zeN9avKknC{kp95S?mCkn5!a4>g0(e%I%S8w@W~!dSg_(SVk_S+4>A~0_*pI9w$HJA zBeo6Acw}`Vp)K|N9HXh?Zu|%R-vwUP6O%o-v4` zL`K^3QVZT)+KI7af~&ZBCQLA1RGnDc9XBtm^sd-iTiN0VO_RG^irCyd9~XQy;NrYW zV=~%SlPVv_Fv@81tJ~i+PPox?^)QIpM{)b=Ew5?Wr%{Z@%=t=yDx=QR*q-pAS6aRA zUI>v_g3k68ZSdQd@mc|T{5{cW>y@w8rMS=1T=v~+(u4jmYth@XpTf2Ha(>Ie51;2Q z(^FKxrfeB`JLXBlBTSAZN~DItXDc?bkF$6peaeEQzthSKdE6V5>`2DA-Nzjmk;kAE z&(O@&;FRordiBb=EV50NYEoivni{ug zkW=b0quOFquVO=2@f}W;=qZ{)L7Ds7J%GTT$?M}wFqi zM^7ng;V_j8LAb58AG5V2Sf4%`{|?CLH12npej|o~X7HHACbaYxv&}~E*6Z}ZF89p9 zRlZ$WoC$oD6_LKxE2zXZ5ScLGv)17vUgiHFNhR3_v?3keiz>=)w&o-VAU0&G`KoK#Xiwf)kdNb- zeJytSOD*&#jG4;6Exj2>%{^_bOmmny1A*9(_cW^lVm$~^>6ty?%2Osy{fUy<98MpV zn)m#{Lt{pPFSGj%kiMwyXW4;p1fXkNrLo&;El6p&wcs$tzkQf$zE(%wob0ZBG9yq; zsxv|uF19Ur!^sKEQPfM4gs;`xAu^vg$e?E5T85uOCeke#?%v&XhI=ln7s$JxjZG)9ceH-^yJhG~yb^vL1pOZnNYShp6!JnqH-=|EPc$D{s1cBhhJl zeF;zA7!-i*l;zBC=TKLWPy)FRQ$5V@j^FK}dSqw7w}?pzIS6lwVaf)gy35zC6TRy? z2bRQb4427NFZYw5YQE@&mk&%=Qy$~DP6~KSixc{|?FmZVh^D|~d5DYg46Dp$hIg+D zsnw`I!y$CLeyQn^M<>X**)ifs+=4;sN%k;5rhr4iJ*nZPQcI1E;Q-hF9` z@GUT9`DdmKrL${W20pjc={*sL(18Y9cs`Z{ZxPY{gHu-^S+DM^o<9V1oiLH;%xR^H za;);2<13b%r^{wf9Y3`%Iq+3M0DR3j>Cv*n+{jbEk=3L{l}Nof>icTS951YTxegs) zy&Tsy+*M)N3{UN!_d>`-U`XVp zo4(##oy4Be-LG@?xAuX^rMCJ6d-eW8=OO;^u~RiL5On~bD<5NO=S)lGuUUT34-61_H z<-YWcjPJx(m+rD^y-LyfPHcgp)ai^kkS(@qc{;s1j(&H7BxXc5lO8I2JAJa|1&!Hg z=;_Y%ee;a@6Ho zF>VlI)vs)qjDQ!N^QWyQh=32e?E^5!n~@j(>Q?{T1pq63h9;l(ulSJN2XdJ0_`Z(< zgB%X{o0)yj^KbTHW3Pwp)BM5$1KUqvCjS(xiLqf_1O0Qsc8~Q8hFR;XqTKgVk3fa2 z^whMp`h5Q{H=09Bk3NWX*Ma5;3Ye6=A5~y(99HT-8qDSowdmeyGlHx+*nQsLo~Q?q z2+*av$gvl6ahKoTIrT|651PRZj>V_S34`An(bT$7_aG7ejB^urCmH1!{n!RRP0@cu zg9w>Q<+a=2bH#niwJBjV<_ib_pp{K?@5j&I0eJ!uK*rF+8{ig%{`I@8@NZ)@PkDS& z)>W=MK)7P0S%mW{mah-Jl@D#rK;)f>yo0+)5L7BJ`y@ux$ueRIeYEUVm5spLNrq8{ zr1-vzWk09W_G%~;)L>7T4fS;;J8+l zNKDyuSY0)+ODS2oUwL|~dqFw&syy$Bm{%;MWA~Yb*gv#9s{LkesvV-zCM|V~H4Bnno-Jvg z!hUrw%CqR*eU|=ne1-ZAYd>B~_2qlzbjRmb%v#wyC*bHa^RjpK7*RLMJKNu8l>E3x z$OJVL8jJ1v9a48OB2>lt=RMVytFXr-xfL^(1|#iVx&>j&0^MvM$~PNaBjrjTpT$>v zvlFYlm0gsm`1zxveP{Eh3_a&pk#)aIQ2l1RJf~W;aFV_zH9?$8 z_PTm=TrNw)J~Y+~$hEz7xN_1ncBk>cY7+k7<>+JsCl@pOD;LU*E5>JTkcU7d=YZx3hW8Y&8(t}=EF(FBszyYoXAenCyP*V28d+H8GOZ(bpL10T zlLP7x45ExD#m{{BWTk8XIA(3MU#)7RG&Xq4eE*F%D5?(ivWm z(Z*I{%eSa>XWh!j{Je|KiN{w>XQhjkdIkB=?4y_|*{U4*6_ZGv$fFnxOcEVTZ}O~gqQ zqc7O5SHr;-!~Y4JJyP9kcTw3r*O(J%%Uo+JQe8$GN#)g`BS6qw@I~voe+$zLdgg78c=~ zR*`NKYVqgr)5%IY=lkXaq9S(G^0J~ODz%1FNX_^@+}XGuSGPQV^3oLDB0RHlf+SALWX(Nuk|OqcE_*N zxD@lmq~z6OCJDE-iy22-I~|Hg6y;|>rgS}33>JW8`gTm-^%Hix7NmSoEhwD5X8`DT zRpQ?LQ&DOzC5w9z1Ano4xg+xJpo8Uz=S^kIm$t){UKI>h+Dqpnj&KfpuMOB|1QP z86$I33Xq=i-I$$Y&+Ffq<^k|8xo*@4&?_{*J&A^BMBJWh4^I85D&eZ&JK54;=&EuC z{;ezLBFuZe?L#eurwC{>v1Bzexf2d*r^&R6wW0z`SWt?gr7niiIBNWdG&xD|33gM+ zS4A3Q4j6{F?>Xl!-=f~+jk*7@(r9Stnz8qW(N@GaYtAynb{tV1Yo z`;}K88ZP^BSt?WUhV^#?xX>5o1{XFgt0yD&I4fgK>by!JWd+;`7%G=lXUXyRT?YFt0L=a+f)7h{8ndccl%FHzw{c(n`Rd z=B#md>ZBR8ibx&j4IkgM6xWy((5wve=L6iJV$;lPQ8Q)=)=TRRR^kS~f9}O8%;jH0 z%oyBG)4r?S#@Gnkin~-2qyO;iPsO>IhEPIfkIvR)BM9^=u0D3|1JPit2g%ZE(Wa*u zJ5u)quM8>Pj*UaacGR%F-1oZn&YG^m-XI0-)K{4*mswj%lr8IdNcgA+q%%zj`*-N$ zAj_kIF=qH)i7H_Qhl2Z3J(+H4Aeqn53|HgwFe3IW_f3K7f-I^2c&cTsr1}ED-=T@T z&Ei2v>H$r8MXN9g%<;Q1k7vR%)uW*gEKyQ9DrQ!BqZn1?Z&zHIzh&6QTK_zs1GxsX zjrCDWn0dCPb;d$dddzHYHr9HvW4IFM699__EtF36d7cR39Y0MokU9YR@Xg2SoZ}pw z>fQo|Iyeg3E%2w7texrZydfGm8L`+VtjP05x58n)N)tnj~bdV~rBK z|E>_r62+ghociIIPORV~`y#btZ_%%@qjkizn4w9Q7-e47A={|$kW8h;7X(?%XgFSe z15n4_u_U&lK=*0VD`sd=Bz=pqq}0`lsQHZt`C%J8K}MyIvx~B1XW7zk`IJedSGjwc zlu+~x_Bk*>bmnnmal=<+ai4+%fVLbN0lZpmf9_d(&Q-GlnuJIq^v&ha>PI$$ zn;tpZfPMcH>~Z?vKZg2O1a;2VmD1X5!KK+bDMcj}f0UR#9B8)8Jz^42C3c8U3IA2q zp7^OAe~y?mu}^ROs&E-xA+D=)F83r@f5686B*()8&N2yb0RFd6T0boi0OiTE?Q8V6 z@Cj>1s$Bs~EYjQr2)rm=lGb`S;a8`66Pl3g7ykY^fI@_d>99|a{we}_u9Wm%R|Tps zLucrj=3qYB_{H98)MZrGsjEw7Emfvc;hkzbVIk176vL%iblJ930R=VlbSzh1myzwX zp_4^OYo{iP!O;GeDmVC=ojvtqyTL*RPh}L&(OEMHvva}fqujpe&t4^lCr_Iz^HEpq zVcAZft!PUtVNElBAc#6H0t8X|{}(}&v{S+qqk(Fb4%7W0>yu16{3)SKO7oY&Eq&F) zl|j&q^4GJE6*ug1j?(eCDTUZv&x@=6oQ5+UT6&z*!a0d9tM ziLre0##HEn9{aJpTrcC#yNOT5C1}hNP@%bDe)W}T=L;a9(dCRz4&8hvQRGfc0suI0FI72qxm?W*R%jr6OKp{Ax9*$RDG-YW8O^@GC%Z1lX#pX-d6i+1j^# z=4MH2i37TtSRD#3mia!-UfwHA+xw_dv{P@AH>9?rfu>5YVBiywD)kcwlR7GCLmo$T ztG$sje~4?=hxP5Xq^axe^Nx*9BNkUt9D|6nZ2Q>sJ)o{d8J}55Bc3t6x4Kv@4ttqhT>q&90GM9iw(P$%WU)$}uM+ew!q zkvL&MID#h3;slxp1vPDLp3dpKs4RX4Y>NlJV#t5f=${PxfgA8%HR#=+x0e8gOHn`) zC2-%V{G+UX{GP+h3(B;C}9;dFqz4l#xTS%%*dvfxJvAqY!>$=E>BR56+*_0y?_TM{a z4#q09-wcd=)mSWWlYs)VSR8@mpzgBc5(E~%tW5#_+5(Xo9!)c}G1IbeysC_S+WF6b z6WbDEzs?ynpTeV&cKl)K$Qys5_P&oF3Od#+gBVuN4_gMp zKiu|O1$vNI>(o7a>5SpEnc=%tNtxMbU>{y!siU(ou;Kq~FV&wYnI$=@ZF`C4#sJPf z;nK&L9JU+a+3OEqUL89A(0n~#^eSV|*^u~VnI3~2I4k$Mi+Ie|^N#Wn)81H&CqvYa z;F2?Fx8NR$!jh(`6Ye^&514n0Mz*dwD`m$PVd}TEIx81Gr%OJ(;nbTT!2e--O@}7m z4d8|%l^$#eXNsJP0*PLZ47hN>(*1f(u9|kio-c=C73MI#I#|a$YXs-7{F1o+ts+Vlu@2twR;Bv=}ky= ze&!w;iFLkP)q0FErsL6N+z=_E;m8#C&851<`p(Iwtp>M6<940Zec6?+p?!@;$F& zQRp!XjOv$XTsVc(bByvT4v$FATpU(Fb_}Z;0_2$5REAbd*OjfJo71Icazh{KjpqJ% zy{0te?pz2f?NBDEk;HK3p2qHeQnAe1{3)yXXyZ(hN>C)Kr$pce+f6+yY^^0k1I-%m zq~VS&C}kW<+9wYJt^g|VfEP`4`k#~Nx8MGA90MEnKZCG02vb}DaP#^}02v%)*zb$2 z{7mUtNw8u#L*va!y@y(OnSB1d+)IXKxBI%wNK$*BINln{ExkM<10KSiT!YX3CN7pjkVM&pzJiO zUA}*I@LZlZN(ciL2j- zT90kWYh+~5f|uk3-KgXaE*xi}g(>KE`9gdihwI#Fc}rOA*sLq+Bxr>u5DiOe1qAY{ zmM7J2b}+OGP;H#I?N%nfCNg8IQ-S6`#K5A_t4oU0Lv-$T-rl(tu7fOn0;8XYdo*kj zXV`jlr=RBW7d7VNMpN0=t+@+LAV$73lry9C$gU8_2k3>$^?9|1xz<2fyf}4* ztL!ANrZO2->l+!8eu%kZmT%C`VQKIrNNbi{k7YPAIQLF}V z$eN9I?j*61xoRtJcICblpj4bRSt?Ma0xn#QD++{(CVmUYxGm0cYc=i!sFnX1%UC&B zm@t~i&WCj>SUH(06O8SV{*fi96YQ ze6Sv#$&N@dma2z(+I5O&^9Vy3W6&UUN0oqKIM$uq_5t=4Z0CYXy0I zkn?V1+d5W+KGI4m7+8EkDC%slFznf7#s8zdD-CPvYPa-rh*O~z5k(DDtFed#1p!F{ zMVu%@u*f__6bXZZ3^Eg1BWghf8yOTxP=tVyK?Wf}NI?S<3@8u~WDrOg!Vn;YIdFHV zmGry!`R@I9`$K-^;hZNq=iTpq_ugx-wYJymnPdXKkiwld3v7(!Ctpy|8d0+fSaJ$k z+ELKIk`p_btLpIzXweUjE$l$b+4m9cP`WSgRYS`Suk!hdG_+<;7&TuozN2yf6TRJ; zs08HxdcP7pAJ$BdTSRS;5p)_7cdn}eXqaj;k^9}E-qNCjUw98f=k<#3mZuyj=mSJy}V%| zU)`q7DSLGBB@^#20nwtagIuA(bpt)S(~OEd?X^*XvkjA|3t2CNH^(7i4^MvAQWu6& ze9}I^J9zFf0Q+Y071^~N(J$9(ggDIT8l^XHnKejEf7!V$d2suqAYdlypV#_s9fKzv>x^e~IuFkxb!hwK!Eb$?_kf z5lGo8mEzB1&xB=y1?w3XLcTRGmQ)3A*qNoDW3y&%?51VaGBV{?ZiMAuNa{K-e z%jUE+Zy3SQbiufAq$kY!1Lo4*=K8YsqZI#)U;1$J<gx8k^2Hk0k=gk4A!Iwd zBj7#2un>wg|A|-3oNVl#_Tr#im=1tqls-jRsndXokHjt&V7_kF9Uh%xlW3D~WC6ES z79*N!-AL~m96aN%yMuB4$r!L zyJ$M_2J5?34{7jFj8R8<@FBj`W@)0wMi|)V zC_Dkk=$~E&2*Td(8E*8&V6^8yoZ?zIRR0Z=3O?Hb93{J70eK#~w)OPiuW2kSwln7j znBu-S;!N6Mms;4bXlL)Zt1EkoptO>aXy~MCv9NWZBfrZAcgfo+CJc(v74YDiMSM$y zp#-b&i#FtclYjij2n8$%{uFl%xD*Pnh-Xm@Af;P#YGpWhWwcwSO^kkR;?@6pEfE-| zjn9dvoT^$%l52Va(zPrOrccrT=B$R+JRApS|;}%336|Az2V;vs05N% zft`LcZxp?rNm4GzdmfD)e~nL&+~iXM%B!v_xnY+1qr$8ZzF|UzTuTNmNtT8le<*ufp!XO2v)^9=0WWhyw2FJ8a*kW9Rzylu z4c2X>qc_cE_BZx%8sSBq`_9H1yaI$zdlH(1ytQv7|KY%Af#)`{0TvpGo;9*~KY13R zZ`)K<z>rvLZNLA^vS0{vkvwzNsYX9Nbvqm(}0k6;LKtC+D><4|n+K|xm@N}>TFp3NW7AhV*G z8XN&K{!#MlfmuXZdPh6wVKk5G1wE^`NdCqWQE|__@kg=)j{`yXjTpCqKxWD$L4+!q z*13OsJF(G6`hFjUi^fHd`hUS^}l?T1O;-|iJ@$fNne&*)KyvCq?W}=Xo89x}y z`1h0rf{E=VD7gQ6e3HXy4>)ki_^Xzc0dfS`8kKmpiIgoG#AB=Xt~3T3sp6Ab zU*GSri!Wz1zJFzsJHA|vs0b(bd=eRwwdtl1e&TKZkPCEF;~{ab#(iXKg&1Y6(7hQEF<^H^f*p9NMI3d-7hN&B^nbLUfopTgFf&~FM% zq3gD|8h5bp3WBwS8~OJmeYyHg5-}_gq}1g5Pl4lz(NfALc1gr^SfhfIxbmn!C<+WV z6V2scF_gVS8Q|!%f}+l4SYth=Dn}Wcqa{k1n3IPncUw=&k&T52v0B1)j6K(Q?sY^rqpu+mbHE*%+H_ulQST&3>ACNjPDs4{*5)NN=NNC~u0$^d z&BJ_=&j0FIR{!KMsImy6vD&erkCg=sw^K(MW~Cf`)Ee}+a{$D5KY1c86mSJs&OBKj zj?!OyD-5FV)oI{bG0-Mlo7q?(5jnK}F8pw^coXo54sakPdf zY7RZV;@K!3S9iw)72v-ZsejwSOWPgl{;foX0<*14fB^7PK53biaY$k1Il!gcoSe-& zRx9SnrAmDDKaSw`<$vNfUKW_&p;?|Zu4fhbef>T7uu6GIfe#=%I zU?GK>2^2KsXmP~@U@rQzl=^2&FZ77qW$001A=L8N_X8juiwJ+MOtA=5U?YGp)#k+blq z-SW_Q_uJ1dNIy_`F^Te4rqXea^ic8~^?R9MC1A|3e493~*ZSlb^+RIwcjATIMs$|L z*Q*|ti!s3YE`;EXY^x2P0gIyxXw%uF7A=>eZ*;FCu#)Rf=8zV7HJ4(li9zEu@1a5$ z1j)fRJTs|hyb%ju!1cTDadNw3v)?obpm!4%$pA>?JCvPS#0AXr;B`3c>~r2UKo()> z)5@yIh1ImWu83&kpVgDriX1xJ8&E z7HB^g>gMfM=e5UWglq&MHvF9VF?n;{hXTAfVKwFyt0Ak~K=+HV(+iv8oEvOvorYg_ z6gdl+RlES=HWlK|yNlMl-oA^6h~n9W=48kDF(2K^n_c1i5_={g7Ayi4LL*VdDMA19O z!ZUQ0R^(xK#g>GwIDQgpKDkKMt1Amv5-`%PzHxa)Z8h;oRqXNupVqxUPmKcxo zbNB9UvOTmo6FvKEn&b!ejD~4zz>z4xUFeh0=d?|4$Isz!cH9RRIcTC%(;Ga%=ZFA$ zRx3Gl`TXIF-V;nl`6;e5kjzDJ3$y07pJ-Vcob0JI@6U;~3#b}G7lx#cMCJ6=SGMkz z0li@M(pR;V-V*nxcfv&#livCdhUmz`;w$NLa~h7SFLHn%daZeX_L}P3U8s9mWA1^L zGqg;R&vTJ+Nj-A^ROi2dcS(apnu7BsO9OhXUNR!M0XWRQeL%GZFszAYPNNUSvPw06 zju>lx}F4Qw604_tas3k^w*-cFR)R945LCX98mIjtkKmMq2BN-A^%T4uG0G4;D zW!`BxP1fILR&9}EPO1@Jxm&GND)9TW~=im6hUT*qI3Aeivuafts-MVN|?$292K(k zGG@BAeqkX$4<9rGke!0WKSUELeRi~T&*-kBSI>`g2=!rJ;1_OZhvpq!9GgEC3yHv* zjD!Y{C-al*_B??(mTW11Ny$vOs0kcUMh}9-{~ioSf2yl~WCjn#c<5mq?X|*@By1e93C=EEJp_9DIkFDV)j>8EhzFeV$ASJmgiDh*)tKB_AIZ3UNTB0!S z^L+3Ka4xd*{@;~CwqMSGq`j0|zl6AWuhCx@zHdWEup{y25j>nkZKCAXEj*1R;9 z0N{5FR7KjVrEWE&Mhw1!lC!O2og&*er0fOKT4(-D_%6S<$PDDiOg5z`DyxA`o3>y4 zIoCla;X{0grNuUSVvBkOK4R292sNLU3^_>K@eGS;c^?lsf~C);4lCCQj~Gz_q?TjI zx5ug5@rL4uu$$!Malas4G1FT?G=AUrmxYDW#ZsCbuZ|x+XAHfo5lKMUQCg#o$aUr6 z0Fi_xT4`F+1+UI|2VLE{74~(O3%7iIt#c$uC$4HrBVX zKd&P|H|T)#P@QO{r8{%^-OzBaLWp?nexW`r zC&^X71m$Fk^N~8`8|*#;9+S|yonBg2e5I#VG4#q_deyX}qpqlL2rK(qA86H+&|Ae7RZbOEjb;a^qH; ZbjdMO+B(&fN#b-dJYjk~``Ec_{{^ejqk{kd From cef8a47b09f75c563bd46e1ee6a918b3e128b427 Mon Sep 17 00:00:00 2001 From: Bill Mcilhargey <19168174+computeronix@users.noreply.github.com> Date: Tue, 28 Apr 2020 09:51:22 -0400 Subject: [PATCH 113/149] Add files via upload replacing rules-indicators to show 15k indicators to match documentation update and new feature rollout in mdatp --- .../images/rules-indicators.png | Bin 0 -> 47424 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png b/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png new file mode 100644 index 0000000000000000000000000000000000000000..67f0679c18d920e09b96456aef8eabeb11f76c95 GIT binary patch literal 47424 zcmeFZcTm$^*Deey77)2n5b27F^xhFr5m1oc0|5bPq4yG+Afi-3YN*m75Nc=vA}GC= z5Gf%jy-P_bA#m`1?niviJ9FNdGw(Ow_s5qRhU}2t)>^-{*SglVd9R_SL`lv-PC`OL z`TW^aEfSJT$s{CXe_g(K`bjKXWcleYQa3H7CnT_brsdPd1?$JEk4Z=>VknNx$WGf= zoSzxGk&s+>|Mf#UZN=(MLQ;o%{`9eqx5*mjiXSbi<>Z7P6{x`~Z>vof2f7mI|0p~* zsPIFO7^(8-;lC_RwQj$w?9S$hxL`sCRV<8( zY(FZYER-Q>a^tu{k^U$Pl-NTZ)w>r#ZL!9Po4@x{2)Ue$3FwZsAOKWZQ9yO2H^sI$ z(8CXl5gF;_kCqFdCKAbTkBXZt-Ga*XQW^0jP1uGNO+z8LY~DG`$7Eg5lKP?gAF^XcS3@lB@1`1I();Y;Me6| z@*=c9?yC7YkrBoj&%XOvH9TnCxyw%pw%!k3R>ebUORSicKu-~Dvs!`OLtCm< zyH8$l6a4#1cXzWY09&@-pU3UYOT@T`5lmsKphGyddB1&JIuPORoBFhaphb3)q|WQ)hiWvF?rnLC>r%J zF!PhLthJNHPGjPN)7lU%_Qg7``4Y&umBo_y%4ychGO*(j3>z z0L-RTTEJ~l1GfCLOw%>LJjcIYu%IBrV{(uU9c71g`^tEm$vIhdImv{F#ciI zJw%Gz+`foz)g`z-_KihoFna2)%BVP(;+KV7kkc`~ouy!;`o|7A`C-6RPM*A?9p=u? zetm<^FfM6kEG(NgNp5vtEiZ6^K77H(>8*4!UOTBK=GF zH;k;{Zt5iZy*_O3@7|o9a!UcwVS)aO);F)!AfJo%j{s+{50g)4`nP;)Vzgc!FEEGy z@D>!@ug5`ldwDF=+~6laa}KZ;0CAhRM8~O|*#mSMv}Cruih(hQ#feVRi(dBywh^W} zwo^lBuWMeWC(};?J11sDGZc=uH_%m!(s!Zfr{GXeB5aG*c93JN1F8&NpU7OxugTjGF0HNjy8x7&|}OOCJ#nNv+mJ^euw$Du-;i z;#H6vPk`z2m^IteyS+7*O{KmO2iL5itW-8nEfD>w&@u6PK&?v{u`x|KBRv_Z`mN_V zj4)0}5#s?rA3|21J&QqF9M+#3)!jmZX>{@}VHJD07G$3Y(Z{!XCG~agWE+p&;SUyS zK}chZ1!yjf8G!f}y?*YJjq~EgZDbn)hY{xJ@UmCjL;lVREd4{R&1ix6Mq!2 zKm_(`_U9pXAKloaS+QIh9_;zd_;y@6T*6EKMNn^+8VUTZE101)s zHD+Ou!KxXR3%|`QsH~e_KpgcsN6Dl5Mb9IP%~d6h)c1e{NN)X?92%_=ShYkv6IL}x zd_tT2B$IzzUeCYkkqo3B>%dsNAdjA)9G))gTd#8G$eBs+x+9-&`xNm~|F*+V3csfz zQu-Q$do$0X-e0Mae;RlIemkG1E35@#Tl<-Hky$aS7?Vm^MMy7;y_7} zgvcm#vfg7dQfnyb3he?&SZN~QyGO%T{xcVunW zEbjB|l4l6M(`A~^_vb1;?xLJk=I4PWVZu+tusBh$PGp8a%#CSf^`~t%##$|+QvKct z6Kn#~iNWUU&JcMe{)(3S01O5iX;bmMV?YJ3ig>$QQ3~8Vn*P9PeO!D0OjyI5do<%H zyHSlOAzsw_U1O!A5Zas4sy(&#=;HmQ;Mm-5-S)}Vc@KeQ+M}5*zPS$<$&^Z*RarDX z0D0u(M8U3)jCvJQ8Qo*z$T;k}=g{uSH#v$e z{jVSB!(pb*VPn$BSqqe4HsU7BJPyOu6xO~+d= z`#xwwPGFBy~msKhmq^m?H^+Qhf=spTpoE14pwHJo{(+&Dm*Q{XZlxARju>`(#7HzR z#m{mR=D%dDjA|cWZO8JAt!{3_ju4~gGhGur?&(&^IjcuFL@V-Mej>aWiE33(KUnM} z`o`Rxm^{Q}u%0}pUrq4q^w^jh=>n9O*tb*<$d0F+WXzvyAt&Ud7n@8$zwV6yTcB*H z<^+QO*ER|mt8LOf>sC8}@1X4KA*E>59XQ(;I7n@e>Db7rW3q_$igbb{KA|GUjlh#* z3gpc%Kg5+}K5qFwrvA}~W#Cv8o8#{{!c)5AP3Q8ylIf7`1k*X*U6EVyY(nhBPorig0uKOf*)FOhx9Hm!9woK3M);A%*h7U|br`0;w>mgDBgnkIZ*RF8XG zUYT<)=5B)AKF&Np@tUvD2~*#Rgoetx193C(84jo*pMSHx#?|45@bdyYy`$aUV^Wrm zBX-RJSx1u*jr-t8hHIb^RcgKEWFeuoW}6#D0<0`)flwO{7v!ahy3J6c@ty^KXvE^< zJj=&*G@qJg+l$(D17RJ9zGfl(^8V4pkw48hBh5bJf!m)Y)TLu~yzx#WKgY)CE~T-I z#3vP6J!+|5qSF@T>-I={&@eD;f;bdvuj2G}loln%!2GRPtD%jB@0#l?UzBoe=e=ht z&?aN;yN$t7ATIxw(|%zZsT(B*%l5*|60jkThcO(jbl47kP+Hr=K{jjB^KDE+kPSdl zOV?K|yI)WO3(EJW$q`4hzaM6j_;+3c+)rJe?}+5P<*uM{ z?{+pWYY;oKM*}B74knuSu2xSw5God~#b^n~_#dsxW_zB`x79_qw%BNd(N7!=J&aoV z`7Rif6WBL<0;|pUbVe>pK3dN&9eUG$hrGOhzU)K)4LAr;y@CNbXjB}r3?-v>MxnYv z+!Erj2lo3f;boTaiKEdH-3JK!x*TXW>z>T^uHCJI`68&O=-AREU_)d?ofLN$#Vz}o zm2MsVRwV<6aXLM|uiZ z`v4B6ulOlk=>5Iy&mK`;0<+yK__6FQeM#dpjXPtwy*~SKN*j$^0{F(2K6|W2lZ3iw z6zX2NOY0g2y!3m7nS9-T&PuA)rj0VLHWTi2yssrLbF|Zhn>)YrY`CEA7U?r*NcenjPi0 z$;jwc43s?RCG}VLGHYwk^hToNF;9_Pb!sQC)onTKmYPR&Vmtx8vm?=5Qb%f zsQl=Wx*L4c6puga7sLf!Bi%tSGoVj&(^u;sueOIRhs9tuHnCxVyUFr_SRxBH_O06o&mSAS# zbT+^v-M_ccTv9Yye4>3aWuhYIwb&z7vYWIy5{c~7uN^rl1!Hm`c1OnW8pcUIq^c-V z1P_P)Az57&`g02_#mAErhu?>R4N#P%f2M;zG?vXox@hP`2JpZ%LSW2(9J^}FZ851L zx76ws<-ZR4V+km&w?PL1q9C{lp}A3?s^-v`lYZk(eFFo|umsbO0ZbKW27E|MkIf!1 zk|_iurwVYT4D{eX97S=qP}Iu+iR@Ipf>%q&Fbf_3Zm6=PlQ^x1tU{Su5lj%csjt`# z@`&(GrvAg-Xej*St7-bVExpsO;f@{+h}Y$=h;EyH^-Ec^&mn#@T4~&V%$qV|;x&n* zz5fgN`D5d-e4)sfVwh6=jgDtd_%WkP>%~8q{8XB-@$D~4_MQI#^fY|BZwW94(B})P zm}-_LFr((%_TmG!8~KPfwM6gdi|YBSO>~ID*=`6!l}%)8fNkyf!(G*4lXsVOcQ#bw zQ|!=Z(*}hJsl@`n9S~RH$00NhQyJO*1ySJ*s;Fk&OYqI9=jjk*j7tw1Lo+UUZJl^e zp)1uBot{=h)F`GvWqVX^`ts$9DoVfKw=n zvb@#uVDSS4j zZkEaCZx*D8Db!#5OAsM)HX9@Le;zrFA@yu?8>71&Z$asrSA7JZ_aMj+D=OTJ$zr@l z*?Z#agIjJ3Zzhk)19*&w{1uDP78y6}tT}yb>{R>9^_!O9Ye9-Oi4eR>wO!-o)WW`< zY@oJhrpj1(;qz_{Ctj?a)}677eE-r)fAISHs`0iago!Sa5_FOKN6dK|G`}*A2qbuW zIL3_e8Wqf~s;rvu{hDygsmcZNvm|1 z>BCPkg#*HOQ83xr_TRb=f<{sI(za|;D^NOzcBeSGYhx`_x(~VlIK%#FvK4C7FEFa) zCkp9Uew1*xqo4>PQwYxpuqdch_UVOw4|D3hJ>ij#9TO=Va&Gyw`=(-rT3RKAuC$MD zc1i-E{*-cbm&$n0`t6sN07I$cu5*+G3-LZ#gVxDU{8k_{{v4`|%sf@AI{OWykwWo) z@X<%OvZP~M-)}9Dz=RY9^y4$rCPZow?G7%X=>hOoTJf#>ILDj!kVYlN=JPCoES3tD zxeu97F7}Q@TC->dHL3TfvwO%=tcG0H^|7xRG>f3EFRkKO#w z(2tS3|eeOEcOWr`Q@?LLQFYQVp$FKcon}rEq=%xKW2;e=co_iy_H{)9> zZJrpst3eFb>HI!Nq_%x6D>J51qxhWJ=XSuH4A!gqRRBHS-%1OD7D7grd#ieMwSJWm8{S^y z9lB9L0o!MJc_PMdd+-%TE~dmo7YFUFwGegQstDF>^tw=ZjH#CjXqYK9+cM%0ytJd< zQC;ok#rtp_fP!V?$=8a7=k4jCH5OXyvjpzC=FBuCLw3xfLXXss`d5?@ zkld@dv2EgAT62fRIJjBiMEj-)-^*+H!3cY!)(z#r`b9qNA`}&DOL{*OyA%&7CYdat4B>V z`a%x9yuZRv+IYB)@nw^z0OVKO*2);soRB1&y~K+vnIEzQnV-k`oS^Rb3I4I7#3M=ch$>#xjSVRH8wCYg_xfT zhu&>3L+AEX%Fk^R253s~o=C`E0mU_DIelQuDf&1+uP{;m{*Pd;kSFqGJMMexD;dJv zy>;FA=_xT)YAf=yLdr}->t!orI#(etP?@34{)gZzNx$7&(CT$kVOUezsn5UP$MyC| z(6~kK%5R(ajC&hIuMb?P`~+z-i(y)HU1u zn%u$8X@*)J`NhEM$=@<0A<;FFJh!0IEgSe`*{b}Aa7UR?cB}7&v^%D@ z4BKE~8#VO%o$>au-&-OHDlWN7x+B|1Nv@@_v`H)eT_$}$kDjM&WQWQ>&+7-o=x%aq zM^jE2i?7LQZ`MK5gWc&j5=7b2Zx3u>|Cx0aFStwXtX0PJ21&}B^_zj>i3w`2UU6{x zz;5~L+Vf1?B+jA<7U66DfZa!KL|Mmb zwDb5bsv|-~YGV&{{FzPh4`lTbt$uXScxt|{WtDcnHlxTwttai-wr1XHoF-6wm>W3p zbm_pD4WD6HB?hzT<8e~zE{kJUJsF0H$k^J0kJFBCdc^$aMt-G_WgDfLpFW<{8STkU zb;5*2QB_TBI$t<2%uNObV#w@w2q141OS7rh$!xCB3L~MR_-twt-4`kOosPRU4;+rx z${FDAGy}f+newJjHUkL9_koA5u|Is9ig$Ocm%~u_asXyUMd$;}w418l|E#%kX-Z+8%c9Pi7x}vCOeN-d8*PKCrp;Gi!q!>ZpI_k4TEs{(%Gf z^S(d`y9T!1m%@*I(;Aw6o{65KSk3`;eq{~(04RNw&?tCGPIO`5%jgod{KS_ zK@YLaW&WQ-lV43Pqx=IyBq?N?&tN-)BT1ayZvWphSBn0AYFra&Zr!p;BAJS;tg2eq z8Yh-O+zSFJ!Dk+{&Fs%L{ZB%Db)VYW+y8)Y;^|0*gBTN~joDxQ_Nj%pPN7A|XA1I` zPptlJ=|S6fUtVz5+pZ{$YpZhqZr6>6kFayQUy$;dk=zn)6(O^>i zZ*a}2zbfM&is-1O(wMw;=!^?+1&zGf@cn*1%x=W3i($c$yL5ZaD7aU00oSjU-xT2Q zirZQX!LPI!CgHpSjK~BCxw!%T69PJ_i^f%qsmI;6XjjMhDwuQlgJv z6?WZ}LSaBRHuJSs6|BpM^&gk|sO^-C6vX)a%QU3HId-}tsVae9dEyjFvFjw z+yJ+|0d03)F!MiBfSo%vs=C;t>q`#~LTxmLNr?ybf6?330YD0N=6-cd zrn+lOj`1J2jDMKx3J%OqUCXn}J`|}zM^v7hzJOCU=;bi~XGC$HUn71`(WXdxSS)0> zdA;eck#5M3z4ysO0GBy(i}XNuE(^7i(^4!WH8k%MW^$23*sSDGQDy}q^vx!n32qR935l{klfH06eWR82q`H<1ys{9q?72j~9A zF8s#>a}#~VXpCN0T6DT+R|K23I9>Yj1Y~;xBP(K9uy*JdiqFhr_Jl{s`0ri>GZGBx zq^x2&JAor{lMybmXw=3RA|4cH-pt?M{#iY3oy`q)NRb#Rx34;yd2#`q4{d< zluDv!jHOrkWEz35k~VO5)JKA4BU%SwKizPRY6Js(m5X}L#(^KX%n0`s|35hmLWHR6b87Q`=!u7pD?O!%)FX3xq!ms~C@+Dx+m ziG8;qqUw&tC-*rQv*AYbQb{HEuY3>p9t9sI*Q=6^aPqH~M()2k8XUZOZqo5RPx4s( z38$)BIisr8qwxWYlTlyg82(eSjlNQ{(K4(O+@a+h6_Wi@Qzrfih4j zH?9r19sre;8E9C}u3ix`XCCc=5h&yTRQp3Jk%@v){c)EzJEwPwe+=OU zjcsk+s}-U*Ex}KQj4X`%i&
xy(3du~GvLidJR`^|&k*IR3e$~XEv!OENYsx@50 zP5uViiE~b;`o1=>$N-~NQMrt}VV;1m^LJczqjS16sNZ1vk8XZOpOX9>?2YGb~qT~-j}F*(?=d;<7F*Hy71HevL@GRl^&B&$JlWjOEkZXcZ#C{*vx zifA+R$;MVvVClt`?E;u0MoqFm*@5L(5ia@$YV|P~v;8iEmEL-dG53QBkk(<;Uh0Ry zacWV_^tU2JMryubX|QpJzhh9a8o%BIwOxlFiWoAwRv!!6<3{`d?Off>8K#K^91)!4 z-^Pgec8t}*eY-wsdk)rG^r+!hSb+jUHCxYkW8gh+dmY}BN5t@c!)8Py%AHl07N&n} zTU>N!$}+iPM4{Mfl@lsZ3XQKke-Nm=zcc#t7Mv7lA!HAv4_8FACp2R)9{vl%{;w;XV0`rGC00S@ z&4+X))mPMu4`xe6dG2T@h{<~zv~*(p2@zCDyrKDbqfz9D3BQZck?zH*_Z(~P+X)E@Zx>!Z^?!Ik{sx}M^kzSXGkY0k>B)%J$&<6h zX)GP~T9!+mJ4_@IWfV|PJ>_8(-=VVEOd|!!r@>W&U7IE&OZsaF1Tv#ft)Ovy$3V4D>b@yAB1NQt90dCt}!L!9E3GjUL@b7 z=jo_SQSLp`vvN-Zf2Z)T_Kk6M6zs3JeXqyl&hb!zoeToea7o-NlYcs zJ?um1bPibH@kf~_+NJWPSAhlGKpL2cwmW5DU~KnTR|59chgh`aD3~*t7&tW`DQOK{MexT=R{D}`^_mH z+!J&raeO#FK9)S`dSEEJtaieHXCU!*R)4;J?cd4o4134r)0i~K{FS4MPTBFBo`1%f zX+Ql~m*MVNX`PGekH%@8{Xf~}xlG!xHb;{ z_K(aBCUb5f+?~%*<+?AoqhBsf=FHCJxewp3tR%$dGq*+h{*L2Gf>s}=oL^9RK(+iK zA8MiTAsANYE>a^>Bj?jKO=yolHG3LX=m!8VEp=jHb%^H|S~5-v`vNBGHC_Hnv8%iy zrFi?yn6s>egf`~|=}z89s3;fylz}^XTC?t$AHg3!^o-ZTmfvwp^t6vv25;v z?0{{f&`{B=z?!#CEQN}mx;|v5rRO}mwNo~>YAkzyL?XSQ$|;c z6tBM4;*&QT;7mlS_**QOrWozlZj`;69y()h%rJ0$xxBF2gA)uMXDVfa(&7Pk%x=IX z19hruse4Um=v(Y7R@gb^ze7GqsSm-|eE+fZe;LWC9p-xpEP89V&%%ER{G(P$Ix__tH5of&$@Df@W-eTcC5y&mCgPbp6>9*ItqGg}Pm ze*D>3%`h{M^KOkt3nDJ!@A%}sGIvM(*kfhwN%l`55Wl`(*dMvOF&QdN%{l`Ji#zv= z4-}ND>FHSmmpB|YywtrA{62dqufA8_X_@)1$wf;BPXJGDz$}9}U`KnVrzmnwCf4QXY zYJCsq#12oqP=_OY(u&o+)PzsFN~ZRV;uPe{_7bLJbxJdfKE71#glx)HRJLBTa%yD< zRe_D%=vmCgZ?(408$e2Uz$oppw`~BkGvt>fi|w?ymhVs?kYru!_@pHLR|jgsPON44 zH~%i|1TkJEb;~0kdN=ysbypZ$u(k!8k9+k(%P7W6fX;u>RilG+C84}-My7v3IwOg_ z7(L6PZF~N+$6|?|N4?+ZrZ#k7VqLdq{%%U(r<-MKV;g9;9y*~wDU{UosQS9c{z900 zRGEcrSV8p)t0(Y^r@B}zuh|8hoZfQLb=k~ls<#}KSS@BaT4mrEH)xrlDa3a&lHyz3 zqmvi73L+yRIzOi4i#I!HnP&Za$64o2Sp_wKA&6bGiciWY`fAjo@f|C^?Q09vNvZ|R z*`43gl}~yDZtS#NP#t@U;~c1-B+)ROh#U!9wpFf5+TyjFphO4DKM%>!iV*J+)2ynE z?X}ix>#S&8jFOByXm#vcqbsVTf+6|Ij>_*UXtS=B9XrHTyGDG0H30$!Lq8G{0(MIR z3bSr6wxS7eyN=lHOY-O~;bNYCD)UnQB~j!sw$=~#Q9G609ZkVnC#!#2#%JhYUD;AV z{s8(+zUafxZ@$%i92?NU&^(YNY#%uQGB>@c|<^GEQZzKxNnd z&7xc9XzR~lez%6iR?`c86Nsl@vROn|PQi(P!4WOH+KG5Rmg1TP!B!*ark(96Vo{sI zCl!AL_!s1nLw7xT-c-dl4Tv>W&CVFs1}axP71cb!wVfOyoh6=YM`7sX&}n8u@kj{Q1-M)R5_)mgt6is47>8yl`*+D zmZxEe!6{-v_>7Tf4uDt{taDw;D40OFu_&dspj6hz~pUE?1tc55ne` z4>y#+#0HngoKR~n5m0%%N3=lqazg|4jsv;BPtvw$jJ6G#zn`6#Ns+L%9@hfeQ^62e zJ5X3D5x=FG&o=RtYcGUmomZt;e^lL23O6q(+1$se{mgsh=dgOess+xz_d3?;rJX3G`h%63ET2R94L=VdWICJ$QaKw?7 z-*UDNa#5tI$~m^lJ&vF%TpxDRX6AF7)?(Yl&!HCzCI(Qtw>(2G+)q!L%ZT&4_Q9hb z#~l*_rEpi-TczKxbd>n_rG$z_t><@vSqD{~v)ZAAA5Ta=(EC_3_ia6IB+wHwES6-R zg27JjxJFa`7@cb=5IJ!#KOC4Stlo`+9K0xW1tmBi__FMbO z7=|l8tt5}=qHPPW@xz9P0w<#;N{g(B+|YO-q2X@}oTU?XYOklB%=Rtl18#Mce6}re zB8EcLpA~)hAQ|{(v_Jj`9K)2t))8|pukqVsTnV*}416YwU^=x9PEX_OI2>AWMndI$ zo9icMr2+6t}Yw36|;w_tG1(K zwadzeEX5f}3SH+aJUOQF(eqFfezU1f5Q4uLB`nLRctSKqbgfTfAmd+f2Nj2In_iwF zUZDlwJokLUqxoXoqOLX~LljTigcq8#Fiv=Pc*=mqG@nmK%jC1Vs?6S9Z$;+n-Eu=a zChO_HJiG_}E-LhEPYECHY2H_j)}~lJh8CIZNc2q^{?Y9; z+ap%Uvbe{@QfQ%Ov4=}@%~9X<*M+G{#pT!MX)wL&(UE&N)g_T8VXi4hIC1WfxUIh@ zmu(eOpY-y;2rfBM@B5yKDta_I;0}4i1LM0UYh1{Yhy>5C_S2u>5zOTD$8m?^V#k5% z+!hGO_WH!U`rzH!Rk$-^biOSXq%ZyqhiJ;Brdj}vw5N0RpjEt@ewx!ztN(R#0@^W1&wwtfY0@+Vrt{m;>TQ{>)k_jhEn&=Mbf;E$=8`d58?A^=Gh z>6$ei1LqG-CZ2a<_Qt~ZpKJM*coT$zxMo8#V1IoxDbd)|Ul$ENwfieWb?0ZQHL9dO_3EdJE*H$D41;X6^rr4a=4f6 zkx*C$AUPlCcGvxt=OvuIBme;!(3p6g;JY%W%OK=w`CSw7d{%UabzRh=hdM8cQui=| zcN80tS#IGGsPNT()M0>UC|05&TE%s)#%*pA03{&$nC$!*XPu1DlFZv z6P`ZHl8iCoHF4)KpWsWE`uWNC7+jR^Hv`&PC~=|uL@n%|KYMjuTyCV@4T?xku{Hx(0W0}odA6%a$~PxAF1VgY?o4jJ$Kfn5(& zE;m==zAwW0m|QMWM>d-*D0A%vi$3sNR2wy5npUAXL(BCD?DURHhM5o z_U`#egTd@#vQCWkha6Q4V-Lfyn@h{=f&lN%Nz5@Y#Z(2pBAbi-CW;DSSfWlJp|c*C z6lF(W#(((6fkL+JBesL?HA&t!#u<0HymmrX9CC7G*@Sd`vY5P&>|psoa9Ry$p&ad9 zdTnuSc5}BNh7%Y78oQ0u#W6f&13t{xUW}BMI|xl{Pmpm(N?TEBg|N5BtSdzw4nucd z7CvFENov4yTK0I6dzQ&Dm2B4JE+HCNCLbDfOjng-pdH+KcnMXXPxXz+Y!~pIHTdFYFK5;AcyiJJEa=QvveW?Yk~-C2Sn9 zx-`pxo|XOWL-<}EyTTVbgRq?VvKDm^zzX|33p{dA!zR-XU_LJ=!E1&ntqHZRQ&n35Bf7r@Ix;5zWCXqqT zuGp$s%A~drl6~x%s&XSLz_Of;;lk=`Eah0d{@q+EF%WvZO4(4t1d)?(bKE0HUTS1S z^)zavJCx`l=JHxBquNVcM%*Oi3+ALcAQd!r6zV7*QG3$LfgW|J1yIgwAqZii(_Qv_ z+|o&2?gq@1EMf+Is~4dMLB}h$qic?m2D8#KSu^c2qsR!CqtU9+FS~<75FwE#RHOcn zsO1Z6lo>fWJ(4Q=NJ|;&m3@7}t#(Bx>=--Nq)jQNFQYapxZypsLt)Jl0GX8u?pg@Z z5|`*+fH8%^&4K&wMSIkqW9Df+`&i{N2bkq@L9<^!lk&-J1-J!(V-!H8`!q&_IXS^R zhELY6nt#x6b!TY08A}h@4n{3)pU&k6Fq+Np(>Un})5D%S6-Mw@P#O!@gX7a?be=+$=A4eo#y7KbRg1dIWfdt$`NX~&sGkzH8+`lH}wl?&Lq8{+}H%uc9f@Or=jQKPR)53OEYX)SQ1Nv>PR8c$L@NmR@ zKw#n%t=m}7ruvmb30p|E>lkQzXD4BqSE(tvX#D&|P?tIo&ViCJIlAjgBi-bhC>8}O zv%Ya$^o~y7P97AO|5o2CwAM86j#4KF?};};tjzoQofGR)6YtWW*azzTVAUezt&(}D zzTFc9Q)vWiG1;ZQh|?SVcSUJr?3#`t#}!*%V+`E_FtgV(+(DB5?%0iw)qB&Vziu=$ zE>LLM^~p`hB8@3uWioXz{sQS8H;|2fjMxlBNw`kk$H;($$(RZcJ)w*; zU8GC}+ur~<^OE&YkFlD=t-MQ- z*e~t=0^NshpAWC=#sJCvEs~n0KW1x+>N9kt+lCE<5`Wgaq*LKXVGTLe+e`H60J&~& zUl^9&pD3ia+>7qbm0~zaa-ZGXn^0!3O3Rr&XPdmWm$J+0d)p)b5V@Ms*Jg=^YFA79 zHG47>HHe$Wd3XGy+;5?TL;CnDx2r0Y8dYS)GWxBoKkm^E=iuj_dc zUm7RND@FF$Y`y&Qgw!S7G?h5dF>2ZZZ;E+?fHA!o4%V5iS&MaB7@li8uh{12aP;-) zfv;0$%%nR)3F0y4^3)pjgmQCli8?1!g=o07wqvxOg`R^CtXuzxsvsVRXua5BH+gbI zA=MD@T5&Hz=hahrl&xbFBTph4tj&z7$L_lvmUKL8Y(+K~XHOBAm78zD$~Dkma86@d z)XLi3p86#Wy9VIdO{1a-y9bCdo5jyIp=fdRlTkZA{m`jd{u2P@=)5{Gsv+GqO>k2A z=AdKlVJ*4dBh^4MI760+Svx%Kp)N;n6oZf^kl_+%mSenPq);@m53v5wQQWul@KuFg zTJ-4GeOR$+&%^1Llpy`y-R?1+-um#2ns49oUk8K8xa}WRuWrUu;m3YmW)y;PW|`@? zd5EnDsnN1LCUhi;=I2ykWhiNgN6$P20qAuxBsF!G=a*TU)64b8q9HUlCzZ?=3Kz-hlb!{wj?}6=LhzUE}$-rKN>sThViIqRGN;S6?wi~fW*GE$;@EEFhZz zK=pXUPFb9P)jYc6@@migaY3%$vX+{pX^1xMly53XeB;xBeBb!BMt{SeJ^lcck5&0a zxtk?39f#0Br<@-nHyMtUBUuU=i&=;nLdRAgwDt#F#Ai227V1IMzB($VDMgSnzQKLx zojpl(QsGKt#Ut(PV4&$&dP%^i%zlmTMHrC6SmRJ=R%-I}s!2VOb||aHgE=IpmtScA z*s^4JIjiMMF9G~WkQnL4uvp(jkkDs6>PKC&R`)%gw#N^7M-kEw<_m7&SZOSd>T6Y$ zA{w)Q)J%f7s|kLy5}s|eK2$0HP%rPF5(`s?dPtltikWln8%fz%q-G?A^%m$CS*J#= zlv}H*;SFRT?RqSKUEb}t@0>=Mo z2H04_0@lW{&!9TH=5TK(48z?x5}vff8bhsN?Y{74YgS*>!)X1bs0g10`qSM|#b<^@ zL&Wn?ynbKDq1`A&PPn0Oap)E@!(`G}<)j0~w8iqRQtJ|kYV3N9=9cZUO60(xp{lB= z($bhtdCF@hSMNv&;`ZvS8Pvg_-Ym(ErhKy2n%qC5JI|AudurNac;_8ncq>2I`jsos zX3<;0<>H;*>;B2FjCZ0rJtMr}A&kW}E>22nG`%W%?5i;xuGMZ|0P~;%cBOIQ z&rc(D8;0VxzU%3i`>KOIL<7nUYB6co3CW)9k~;-jW9pJp&77JeN*?+#8>Og5)9m^% zr~dV!hLlslrEJ4jD*IOz8g~#(I}?jMBqq^kEvyWy!#vdcKT1cPZA`9qa(JCKz`qzJVIN&6HOmDy8)+ENh6!RTst#KV(y^Tfg z{V(d?JF2NI+!wXuwjoN9z7-oFAOg~fTNG@7NUu?l8batTgkV7w2yB#IMWluz(rZAP z(jrmllzu&j^ya&@Gpr@Zd z&q7{QR*k9CG7&ilUEF`?z3uUQ;`uAxBds&3Gxb^F9~cwtW6)K{$vz^hZ>0bEq!%;j zu4N9S?5(Dm$X|Ek`c@$Ll-o)^Q8wiP2xuJS*2{yG~gutH08_P|jG4STM)>Z(#V_%IKVRMv?X8{r_#N9sJS z`51;TV4V@evBa}YHp$%KnX#_pJmYc?DAF0TAglb<=EXx9zmUkm?Mr&WqJ^nyN?v#C z7c%XRs(;Qudpk_VHdc3BCL$5pF;LgX40%0LB*W&`|ET?mnpS#CUZfxvtu+&Brn4N5 zr{pzf6~&)vJAb6Zq?ailMR^^|A|~`>ZIVmGn(Ff4io#4|eY3 zPkj*2i@fNI>t>QyJPSm!nx09?d(H)-(s?ppYh;G+8kJP=o|6z(f*WfaTpBxViYdoQMp2q=VNCHLn_#%s8owEJvpNiFqp9u z-46L0&e6Zwx+<|it*sohXKL1x8l{ERtMGojMY9lc@Fx@g^hXV{voo?18WX9_b4xV5^9I+OZngX-;hQ9nr{-RU-}xK`nlTD%1axK1-mGc3A{d zuFE_N9?(>TUChcYp&U-ffuV)AGc^EGoI5A2P2Dtora#eqrF!9+N-c2&P(QAU#*xl5 zwM&I7fmhRei}8?UTL%9{)P~9q{noUxPhxCR2WeL}j3r z3(Me%gJZUP1mlC@g75XP2HFu0 z{rUf7yeWUTS!H3caqfH&NVj)-b-&m0cvI3s=qs>rwT{%Qw!GD*-lVs6YsEdI_N*!Q zaZm@liuW%`804d-+#TH+5Ey0{MYEq3Ct=NK+UOLSAmt<4XmZ?M$bGLMB8#zILDm(s zUSPFu;8@ECBqZO}fpfABfZJ;Bu#M{Q%a`c-% z`?1X)E^>5PYs+Brn;{(24_^MgyE^{kadX7tA{XDbV2MVt`)ROE?16YO*4whc@wZN$ zhUz@`bZHP7*lWtW86yFZM{H7^YO}yIquLF>ZohNa)xnmN3sDVIWwD1)Ff;9gc$wG$ zWUf`Qmgzn7ZcrEQ!E$eY>AkX~U4m3>K|fWj&+D%1#zXP&`h7-GzS`n8?T+PZgnvD5 z`Ol#Er7KOkE{6*3x9x9ut2wp((E#gMwkpI%r*E7v=-5ghduOA8#*6 zb2iOM8_`pJ$%~FWYj>sB=|gxf!8()NHvKMHFYg{XYx3A%CbB_mUo<6^XvFN073Ht} zb=`*t26vo7c>L3ZFmc8Sa;cn`x^oa8Vcb!?2ND=jpD|Oh7sbAxrNy*~4R}&#ymA;@bEjWMPl)XkKvvY(JO6RahpE*=4qQG%n zqHN<1Doo|&@eJ?&`?qUE)*h`FIdI0SXWmBLP=6IGC7d*znK8So5*O1fRknCLOiQ7H zUcLQGU{bbM$l2MbXy?@-vGto*$h!ObWDBoVT0fCuKXvr3uCji1lg^uTLz!Y>0`~@y zUc``YPjr+IGI%EMo6#r=&DSxr)eIl_D`U%x57%RO8%i$m=b)gRr)LKgKNW}<;LQv? z`FOv&!9xhq`KM^v@9&|4yW?y(Y_if;k0f1;Ftj9C77D5w-c%HRv6Q08AO0dX?;HXW zl01Ogkd6F`95b2V7!(On8bes^2YE}7DYpvYkdgsp{fPW|*AId1Z<>aNX`d=@fSC;d z#%5cH_tWRZ46}fH9p=>Xd8b0-p}v2?ZP+^3&{YvHskkTO4BNZ;yt$iM{>;BLdEXLVKfH8++#s@8xMQ^J3O4e(JgZCa<@+c0kl+)l0`!E1q|;Jz70RjkGsObb!ab5Bf%fGm zcnCdu{IC{C-g-!kPBCR*m-t+@?pu+WN7O>{+lc{O`AnJnrrknP8dm{}U}5cl-`h#} zrpc!`F%^%-HKyIY=Z7{we|*r-E&TOD&FV!Gwkk_ASuzi-K0vu(eiN4rUcAwpuNdmM z9I%AHT+SopyvhH@F3&y*tgBLQvEQ0M>m+Xe$E!z z{tauBf=j|!^^KEx^$T$CjU+y=@rTt3$fux}tIbIex}ZVXT{^#{5Nmu+y3n%jCZ9CC zJ+R5U4P}`RsP{=Azry=EiK#y#V{4ViE_#UNbKGPA+J4Men3Om)kmVbiw3<}B`+K=g zu%tUc5Ml?8oRXR!IZKP}9vhjP>|6Iwo%QKRE}_QIS3RV+xw;aOY(#Z@${dZFIevrX z>2=*YY9ru_lrlrKHhYm8VC4TPrp{`WQSN1Lbj!LcUv3=~?rmc?mg`iz7+D8%p|hgv ztoj(_ZqWToE2G-Q?Dx~fCdHv+63_foaqV(fjp$Kz7~{B>MQE#k zdyqU%W|Er7x@P_2qxPaT5%FQ<-Na}TJs>?!3qh)D-{|VXC#v*GU{&s342o9lJgewW z*$?T1fdp)TLnjO5pk-~0?_B+Hf9Si2)i>|!N+>>GP9>2A-;ODjwpYOKEVfm6rdD=; zZS{wDY26&RO_okIO{WJC-`BNwF+Rrm>!IX}+EwEDhQVJ7g^BInK@j|kvFN7l62u?L zNJY=ne3&Gx=oOOgKBK${YzKIHZxZl zk?#HiZ%)$QgQzQ=f$_d4oo-kIi8&O=pc`ZYA*+9_W%!|95cjh+7GsEQF3 zgDiDDF`dsg#tJ!@+F>zV>2Lj}9PDPj)F8L$Ztwe?HRFWp0weAO2knV&7` z3RntT%X}=6O>r)rKgAxBj%S*|V5Ip+4_BG~astVdufpL(+M-W=FQ|AOQN$QQjgSvo zSAdGEFs&&!#HWvX;>BltkO|CkXG7}^t@0(jR-uYbe@y~bJM4qSdbyRp4Vwpvj9+=M z!4G$m@zN#H_(L{)O<3jMPCMNc4COSckafz6z$Yo4dw{z7#j@aF4)6rlo)ZdCr7{yW^i>tt=V zuoU-rn(lZl(>zh4oYs4#NooU4F7|c0k)D`edS2&|;5E?eL%r0c*|SuFdsyyEr`+$g zF{2%_S1aQ4-e_kZE3de*7pNk^H7Xp4FIFtCMdsGksim6n*aGm9Ko8lQk<|Umvzxbe z)5DAYbsG-k^znEH8ptyEa*#(l+1b}TKems7W^aT0yFd5@xZ%B8>v?So-pRAM&1Fq0 zBb6B^@D;b4{hLM<(Dk$22#4?0C6{)e)o!%Zq&g^fi&vl~b9sHCuT2sbbb6qC!;7U|dngO2;!HZEV;on%MPmKqg9{J)D*>ri98t-UOX>sw z4Igi*!vQD=&MBCesse+#*>-LLvyvb4TJL@KyYy}JF2IB7KtV5G6*xkFqN^rvB*=Tv zaELJA?Hm5Uye=qT03oX@%prZJt@~fO_S23;*3R|Lsf$j|H{btJR=MZSRIu{KP(b|% z{LNTr$y1>+v<~qfXa7i76k`ihz^?UheO`uXBZOrvGvo3KgwDk zmA_6CEtCBDAltUR43o5I479J;>SkFJ_)gBoPHz}#4y)9;JXP@t>s!8xUNH`I@SbDl z52n|hBoGV=J zgI7nAdp?x?fhBx75rYVu;}Gd*Ds;U&C7i~Wo!!+NQ6~15(bsG!FiQ{5v?zU_N+#bNm27 zkjGld(g!V=z3Om?^0+=g^X5~jgjXY`pF}_}5zYH;#xE#WYR)9(YM`jzl`1RTaqc&C zOD)l959Llf-RX5I{VgIdAI2hg$ywSQUCha~7LhC*GX975Pfx<@3X!Jr@+&%bo)BD6 zj$;@jE(>!DXncM8A7U?Yt$OEFtzgK^rbDRL2Wy!xT^d=V1J~$yv|{+TTIs`-g|sh6 zQj{mTc;Q?CH#PNh&DRNKs88@Ka-z4-N41=X@1Va0OH#?v2rv zpS6d;jU~*7cTT|?KCO#(U-ni&1ZCUk>KV6>k>r`wtLE}{DZGdUPlbRlWX5c=3&az_ zu5a*-bv=Z#Rrn{3rgi9c=f&|5O)|i(?Gw&zUu-RX1u>EJLBDh#M;jn?c*N+V4>wj1 zyzJ)cy|==Bzxa2t^`)!g7LArUFS51LaaFoI%N%k3nXjHCX;hjD#zp88FWw7#it4Wx zr-`dF%mxCGHB$`=SL$(wxC9X$s|_Oe4sHUb^1=jZY3JwQ$fdGPjVNCU7^DzE60<_J zo~I8B(Qbq38dDdp&i2VRmj5FxuHKOebyA0>@j+950wK2^-dG{0FVP|XCaryGgg&ks zAZZllKjZK1eEU5A>iU=M0szSl687ZI{L^#&#?ikDg)7u=URK`RLd&wd6%#=}U(Y3{ zSekHGC__gKaCh*Ed`q_`_~Uh zC7lP{Xpzjko$tKpg+5H9mc90$r?vnEKR!V9b;lmL(gZr3)52E2w>AsOA zZPVm`;6VM$HU5P{_1S~gmA;0W z_oh_z$eczH+aM|Bu3}Qx=Zf@wJ(zQ*FLDybeYX@E`Ng{ecw)}9`6(#uf+lJ328`6; zYs5{kRdFSxwVgKw15~P<)lm)e*YkRY7rpiIzE1y@ zs9xf6Vf7xX9XNNA)$xi`mwK6SN!!jts&yA1`wP_?mrX=$xCI&=zO*s;n`5dGg$k~| zFp!t?Cc?l&JJyct!e(%svXJGLA@yE z5@1!m^d3-?%xj!p3?`+NY$@~8Au)A`L6bu>4FMXvJ3^`>1p{Hx>Ngk81=2i!z1q)h zT8);8&gF(zOkaIc%gL4ADfd-A2QoH#S_c|_Q0)=7knybqi|m&bXJPHWA=T2`^L^9% zA&GGF*@vy_HZ^aaSIWp9lZmEOrDaAh#oE+(5E(+hZeCRa6n;zK`nx0g93$=Tu2C%x%wJ~=ubJ+=;>`(cHGHNPeMFmj$?ocSbG`tM zQvc!*EbN>}CQ`FTC#E3i*z7*!&C#*x_!G=Q+`Xulim}9$=@D3Dyx+*&l3i0#L&++% zaQUKz0*-{}X_d_TQ$TNiw=n3}jg6OTcYU^xNlk^ucg#BsyjEpGh9JL|_bk9j_Din+ z3$6XagQF|HXReP?+3s|Se1=GiQfcXWHBv@vo z!`9HcS2s}%@jasI1=nl^IflTPtOQ^!% z54g?9N;&6!&+Q?jB*uuzt>}ZJqY1x>GF~pmcPcHJ7hA{`>H9`p17O>HNRD zm;iJ%)A@V4Liy;QUej#LT#F5Q>M7hy%#$nTfkUo;0+UXe$llc`SPtQYbUocmK%h$k zD1@+MvRa%nw-n9)oKUyXf28WjtP0!iDRy=FCT@9nMunYO!XWu)VbhAR99NG?{k||b zKRadn5^^rxIq!~w1cx{n%0@r1d1Gh9Xx%sV0j+0Ep<} z2ifALcxv(UZU9Nqj_ph3Zf7XA|4Sm z&KM+mUf${(6LT0c;Ggb{AH^c-ZXd*dR$)(yrH9|bL9N?A-na9&j;eN5B!jWaSQ6a2 z7*ThyXr^h2F15;?NXXr>#&=QO^91M(Y%Cv4D;DqYL$6Ez|~VOa`U%q6nLdE z@ZdK9X}e~D$9vLug#9&($NUdhU&PUXC}ryHmhtp^QlqLc+&cm^^|^AqnbXlTu!=kR z?f^g(3Y$9qgI-}{j+kEsr|tm*$RRv*bv?pv9nlt$aeJ^TEw?bN3|~k=N$h>1BUy3n zXm^Ew@4mA$EC6kFC-9B71q6aD)nlZk23FUm2(=#MM@(dm5h&m zsYXNgNvTnK<8Oe#lv73td`(dAB|gnC?{@o$fj1eM8+m zJ=PWVC4R|_8u_k&ht+zvvI!Px|E`aUE6=_1Ejm1`DmsrnkXTr=D-Rs~?{Goo4oBE= z&wn2_hy67{LzC@Vb`u1_W>QlbekOuM`*Oq z=c4GxlOL3zW6JLt|MSvvZtpC>_i)tu%Mg%SDE`d+&8xHRMrd&L5xb(q*AYX5BKHcC zg`Y^TTzFo!a19#i>vt;;dd}pSyU<7X;DA$A*^SbB9SJ)O^Ea# z2@UY)dmJAM&ra=6&ixEsZJ6>Jq@Qvu+7NDwbJN*7=3E(?4-Ir{TBsMFVa@ix$V{(o z0MNBAm`RDjF1DUdTe&*1aJmEKpzLtxeT*7@nS(m9|ZpMcVlh(TMu#rSohxw=0Ah3-vNm1 zeEC0OvRt+Q5eVsjK!VPUyq92Lc3^TItQmnSx}r7sSQ<_{w)~~ zZkG6^H(&bwk4)>omCUTZV>d(Uz2~gVuw`}@iPxWKU&G$32iYX>1~OpiKe*M3cy~6&gA#oxOC6%Kmy&#^`j*TQ#Cd3idL)$e5Dv9 zdeVJnz9dhew@(xc5)aWf{1 zNkjRRm(S$#nNSTfKD@yq3;0mBbyX#Izbs%@Pdf%;iRdhU7n0xgoURc|CiBJm?v=q3 zmVLj#1v1*M3o-)b_QeeLI*JxXVeuO-D?>S&dMG3;owf2}*gnO9(5u~2lR!BBMvd22N=HPZN;^5GT_(S zQLOCOf6<(ig*(zr6>c@hr|5_O6JF*zY3W_Fmcfgh1u!LGww!sYc3n;Z5%uYs{yUT}OVk86ITxN8Gu;x(T+XSxVJJdgMD|4n2d)9mXnu2VYP8!&?tQ`#v_Od6L zu7ne%*f}{)S3jk%_*jaiT3@);94G3tyDyGlUe^kifxiD3`44KDMwMF`eTT`LNdQ@p z6B()?=Ekdf@n6ppEJ2mv=(4XGwdjNSTVshAtm^+ttcMrW?(toNF&A;D{v3*dR;#^m zg_f}BAeab}!sGxw)^fD+J$wO0!-b=V`sB|P70$E0gM*IpqR${9 z6}xl0Uz#egb%N(N{e=~1y;j}bTpeJC>y>N#-UCL2p?n6_ej|0UcJhrz5Tx>cYHePS zr?0TW?DE^wZ3DeTBEA5z{+Fk4YnytWO63q*WOKeC^R&BWe|Ac#@2?%StxChPHF#K9 zI!b@y(rX|V{|EB z`SbkWBjGOK&tN#H|KW$`ewm`2S99Ve;gc()cN(p{QS6}1g8fC_c|}3%p0$our2~h% zpP|th-5~R5YL`LHxNJFvSXx`-ts6Nc?DhX}^Dq^W;U*JbpR8nM?&4bTwhh zNVdI$L3Wy1t;x3-&HZArqyLMZ+;VR=yZ7w_b|GSasPh8r)gNSjFD3GWx5TrXQh5C6 zlOcn<@cr@nrz_QRr}Q?&eFq>(^$ReSr6|k{$zN`zgb-M*74S;WYLew&VC@Gh)!h`k ziNs#}*bctIX5kczUJe!4Y)T{0P^7h$-!7n=mU~A|6t$0tn*53xZBNP?rl4w;9K38u z=XA_Hv@kP$#;Cem&!7z4;I6_CYMDs3Ma|OuC0W%!_%}&F!?3x1@i}aHE%u95kbq~W z7gJ-7{9Z???h1+(qN82-$An*7WLtjH4|2qJ z09WRX=hjLYsUh#~d*;sp)PYwsZ|slX>Sgk&T%S5ALw&xCIr{O!IqO=LOMa17?6E&i+W?9}Ah2r?XqF%PJq@?M zv*iEKEktqupTva0dL3Nn^-S7aIZfjs6ZVp z)~m%WSa~t47a+p>^~>OVfa26#sme&w#zL}X4g8HBZ%X+=iE_PL^h~yTwrEev(fo=9 z)vU*+3M(m3hDO^=vEY3uw~8qLj|x(i!x}D+yyYPhwm6Lt?dRs1F-!P;JtXGl)#Bll zeKmK9*;nV=)pv}j#lZz}E8Lmy>tm~+$4^;m_vU5FBu~|TRp*(HI+5wR-->vS`Ubtf z6k~Y%z9B4w6sIIXSTd^ydiFrDtmQ#h52(RMW7fuE+W>91!F|34AIf@SdnCZPd@8@# z3`T@M!~GJfU`S-}y1*N)w;Ccgv6>>Z!U!qVeGhvi_wol_N+vaD4eg?O>S?+>@n#Ao z{TtAjkN=Lrmpali-~T1+)0I+n?^oPJbDd-tqu20_H&>)S5H)V93Pq2&lvnpu+T=+_ ztOT$wce$06pC*!>E92~%l7x&-p1bwbXoNKHlgT+j+8^>U?Ly`C&ZQ_j*W}NdU;RQT zj^D$nX5qh)aoGnlqZXT40A~3EzYTl^Ai7wM z-=}sAasK+k>WV+y-qrq+prrPuG2CK9Ky8PIoYFk{A)Fut#=45%g?f6tau*dVq~t!` zSiCwVgoSJckf@F}u|n*%<3OiFR5W@TH6ad2uJ=+(gC zB1C!I!3|5BE-^4-yWmX2fR;s-7xk3^Cr;yW;=aS%(H*PqdMDAMqbKaA5aa7 zTWoDb6!8R`-~Iz`KR|(R7bRe2ueW{9x-0J?H99lP`;i;>ex1CRgllJoF=mt2# z!>;M=C~ovw(tiBx!&M`Ly|t~-{@PvX-AwoTp??)pVw48#t`=XF-T!>QU?<wS3pawgqKC^+d?wgn0cj~g+dz6hC902kA%|temyZq_h9?@RPMC&hKjdyfz)YSrRPR(n{u2*^tv%!63v1wgv{X1+OAv9 z(y(5)rCGkWt-j|wKNlT8Pt; z`7;)hSFZ>mYpH4-;rc0x%32d8Q=auA)m&Y9RL3iW&sJy9qNWxY(&f3pGH4-Ho3y40 z#oxBfPp~)#d5oWBkx!&KgG}7HT521}-kKI-X%G$a?fxh2IoO+odsb>2tB%X%EFG7p z?L96~)%3+V1Y+)1w4-Y5hHQUATD>39)d}+{zy`XpVN%D@O|@1yre}mVXmDi?;mi$u z6j=v-K_cIG`lvWvM^|?&x2X6U+N8LssEJ@N(YAW%3iX5U<4<;8OvcJ0tu?$fi2CN` z3Pljs6*?cj_FkJN^CO#iUQsOJUNyJDtM&}P%Re}$KkvMJ_sQg2=kwMsI<`MJ%_P%* z=E*OG{kOk$EOJayXl55lBNOzDgaBGNkKjciEGVgA%{Tq2OwiJmy5(*TQWF;XOizLKgCXkf)#_)Bf$BX7 zvW2_%*8x9=#Z*7s8K^GekezerRYX^+F z`E0HKC}}~_ft6RcqUXRm-Il&)$Q%Plf!U+P_5pfltpl9xyvZcbQVbP;_*AB5z<@+i z3)ULewtFaYQK(C`ZLlSsy%5K!huBa|PDHY&3)gVY-4tNCNk9~hy#j;50;f9J%0Ua& z#G>NwJ9b;+4KL!CFJDlzj3ZTBD<8WC=46^}_MRc4VCro41cgnaluSP0Y{xVprCAg? zwmPd@H2tZ=#U72DOWo%60p8vRtN5%iLG_#Pg^AWhnoR*1)3CXbv2j9Uv3H}B@_m82 zsHe5gV;yuhS^GgK7|8EpLpg=KAR5Ke=a1hn8g%#OW-oG`xwZ~wLFG^58t9e*_cUDs z#_xEeXYQzB+%?renJAsq5xgBCG26z4HrGC8AT9DtXN6ShM2c1d3zgQ}u4LXZW!UyH zncrQsV0ilxj;VLdg=bCd!#fvd*1Czg^Ue$uF+z_`qfgY&PSx8JGHU_lowvhra>6gA zfUUe9;82xPVD*&MFg82baeLR0gRb`+LF(+gjj?03#)P^2hMqKYAvLCM-O4J<@BT)w zA7%RPvf)itOTlo5iz0cTiK#-o2{IKy$^UVb;6^ih(rD>-USzXAy&be^>s>k{%03>% zg0I*Obi;dgLNbvPE-A3^?09Ps7n7On@R)ql-N(z*#lH$7ku@_Cn|l>pU}Z%3;lIZX zT-ZGo)yjuq%&dJ-WS{7%XBSVZw<;&FCz3(W^pGpzD_Qhhqo|fR)_#3BrbgJneR6SX z$m8?O(6C5axPCX&f)s761ih6>NZ40{KRe#$^|5<$zwUlQl5s#ALvEgya;Qc?Kd|K3 zU!#^e$|tH87`57Br=M`l()FU$q;nW)Un*MOo0z5k+vA!^Mj|9|B>s&$KI`X=#TxM%I=1u3od| zvk1*@Ug{q(Z_$LH^U}f(t8%*+BIzn! ztG$!#TtLLtV3Y}7?)*`Y;zR9Q=JvaR#87$ZRI9*lF9k z8Hv5u@Ue%~8P^X&fX2McY~?iAz}-4iA~v<8xPA{oQLt3C?}}QT0zRsnHgz2o<8S&EO zc=a=JXWg*wYTs4l-H@XRu-Z1SA@Z0|cxh(e@oJtlJsz<*oEFU67n{`ZG^5v9fLzh3 zW^kEryry<+nxe$vWuRApa12<6hE_n$QYOmt#fwxc5Ro(4u*wr@bWvv=BB91BIdbE4 zw_2Jf=7*hob760nZ)1(NZ)?lfYueXbL&$RF)5O*HUSBLhhgI=dD!%nYe0#Pw!CLJ| ztu{U<$kiluX8<;O#wouT)oRMD7R2`lxsvma!CgI@{VvnW%P#TiqjR!i%C!!#a)OF2OMGa&q*=8L+;+~~dqY~z z+Zp!F1VWz0ZUmi-n;HHt*Pn|3!+$(JNa+Ydvv%SOC0y@Cr@*bF_Vuj%Ccg!0rfgMy z%?}qb@bAC6d|R@VRBI$F<^`XoW)d+FZPpKOtIVRJadQ@3+!lr0B+c>)OGmbU$ar9C z!iG^khA7de49j1-iKnG26P8=WN}On>+z>0kD63rzJZ|H4_F}nSiB*9C2G|Y}ZbfNJ zHn!&THtTXZ9S&$BG4K{y9y@ttMmu_UtN$-Uj)-BGFUndU9D>iuSsP4 z$%85D;i<*Sw0_c(2)deHpTSHRh_5#zSj_|$vlDMEUE#vWGhj=>mL;*>Esw3EL3-M&KjxOARF!Pkac!A>BPJv?I z#YwG?R0cyh?4v4R@0`!c$b8!^ayFFd+bM{$>bjrXa zndAW4FjL$7+PpAVij5mzPxFDEvzEwicYQLvva`e!@D?y3Rpz@Wtnu**&%fz__Lgg2 znNsq*`=;TwE1)m3K(kT&VOmr3TLv={P^bRrz|96{!o*;+1>kJlkdN=705(*yL^6^F zQS)?S-sXRUt%%wsB9I!{H@W!DZ9p9L5rL?3ECT}NJox_WlaQzZwGHbCH5!Opuk2L- zg0M66RnS>{|HO@@dP{JG{&yETm^0E2#IXd-e|W9Kq~VUW%wq6A}cmw8Z1~p z(EX&1GEmfWsG&2f66Wb$XtikCT|zT3fpBpaLR-mZ#s}NNb1K`a+XbUieUn^&>VY_g z^X%mukd(GGl3q(hMMp>bEp;oB1c_@}<;&LcJY=lp)6_!oICSTXW-mx3=mnXQdS&M*h|PNoQQJf@SeT_or1q(T!^rfM z+#+9-wDxL}P@945>gctW3hgNosA^QAn73eN(TjYqs!c_iN{28vzGwraEqwbqjrlP;bL`anOJ#xj< z=t0T=u<4YoVGnE-XbtfOcSXZS(xz-f#nM~^3CzZk3Of`Tn(FYQ2v%d;d~!-koxT=h>jWqTYneC zyRMxoKWmG&gz~R0Fl#ZM^gdc_GOMz(QX%O_20l2J5|{lxh*nRZXa}*}y(K%Ar1;`b zoJWrD2S3$A%o;3EVaQrFzHcJ!M?xv)D~M^Z7NXiCg;nz{6tUdHZZNs4-%pAfsh&5* z5|Hbi;JC~eu+b_mU>9IJZW?gKhYxL{F%0x1)n+&^-1jrrUOwMxl(8EH<9wYw0j@6x=@IPR1xhbLFm{?_R)HVn!J4R%X$0NvoHhFjr77$kDE%008LZezZ7L5963Q;4U=pO8>2<|E%7 zE3wsHIrn2~1-mNcANprcIZmDU8{3b^*G}h^$wl0K0#E)~?NEu8LjAP8pT~~>?4|VY z+mihHr~c|{t&Rr) zFTwXvevN06f{b^L&{v!h1XS&rqp62@g(*{TOjn<0fxH_SAQgMP960(8Y?;MfjHRjplP2Az>c?0h!njUc0RP&_AQ| zP8t#rxV68lxUsO&!^uFL2&TN++w3W2`vC}P1#4wQ!*F9kXU1v-C$@SeyP23h2MFAO zKY(-rVyv+@tWk~oOgLK8N^5((Sd>^KrXDmOxzHr1eO{(SwGJ~mJz3SMWh>Zp0Jz#0 zb&7xMiyPYKkZ2gIH^VPz0VB8-5`VtPl|YM`;9C<^3_RbUCP}x0MOdL-WggjZw`SXn zwD4UxD#j~zcM6{t5=Xq(`ZTuQR@R76Ctf+OzI~gi2V@WFN9e}KC)p|j0jUJ z-c1*E&wT0>b+&Xp1uJI@*#Fb$-8v|!|CHgznX2`QV&zkQOBd>OCdp&!XJ&D_E%W@H z_8`|Oa{ZK#rE|T{l7dBg4*DkDcEFFdINF)1IT_HmQTB1c^<4UTU8@(Knhx!x<|4CY zXfSo$9KF`l9|0m3e>0oDDUE@lmW=Uh%Ll1pFN$S02ZnD=#!KaWtWo>v3E8FO&rd|p zcs3Gr`j!dZaT{CDaatW8O1jH_Hl$7?6HYun)G{8bMJk+-vvF5OoOOoVYmG%PAnJVX zxdCZ7`#tj~q(Ro~xuAl8RK{f9$Zest+&JF>yNyU{ejHDFPJ1S8d3i}#G#{qPa}P&_ z6xB*b#&@Ef-gdrM=Pn;#s36aUH%DP3YmPP(qm(|Hl80ANSXv>rZ<3TWSvB8?;xtjv0_mkF z69uG_OO+3a9CJYo&JDA?<|2-|R|HTeLNktPX4>UK%`1zaz8XMD*SHcH%tG??a07-E z8cY!(@W{HKvX2aR#f?TrdTQX(OP@BC29>ESd$lj=4N7|jrMcqcBC^!SyjRF7{UcF~ z4d#6WTe}^dixju!Z#b+PRi2Ivuu_B9uwbuhwvtbyW;>Qr-Q3l54;^f&VIVC+rCX{M z@tEi0S{z*ovqjL3FE%%-+n>mkWfwpYGse0!T*~F5pqXO}`s(D?nLMU|*uk)ktBh3N@(YM`NKxiN=eG*eVoz@@C&x)@2ewsZfks=J27c#V8_=~hQy1N z1_ci-eI1+z|J~m+$Oj>(tk_8uSw;@6J6f3PBtSMsyaR*I<+P+>NAdb?Go2>+*x-Xq zMEyYd6K~|ly{n};{XJ$QBr8Q?ly z44LdM$!sb_*UThR?d*wZAoJv+Q>rM!A;a1Iw1RKqYv({eGKUk$thZ#NNG0XfLF{LK zdF3p_lwv4UC&NVd=-T3P45HK;qseu_L6^hy7D18J+0>h%wBhLK&pdX3)0g>{GDWY< zD^Vv`=;)nVGlZVhHNLsOH69+7>O>@(lVc)|is_>(%JJ8t)gK!#BUmRVefV#>zfgT2S#aB?G z{uRie6nMw%sXJ*JS$?T)F(ZnCNn1h9KHwbWmz&%1%gvSX3%g4Isf}JdXl*)%2p zC~MVePv<1xtJNTH`1WdMp&@?B5O4U9vWjZ!nGN95!=_gsR!vWlm9l|^HPisRB*gLp{fC~4kJ70Myo?o9d$ej zvJgGl*it_aF$mBYqz}yw3~EIZZjMnK*f14%;7UjJj;}d-B!df?bxNW* z)#Xf%B2-^{-O$Bm>^qP4T7^P?&r}?TKu)dMYwwNObmh>I%Ics9-X->RU;%>d0L`I0 zVAxtXQ}ZdEcu~Z+;y!^L4*9b33>3 z_WWO^z%i<~d-k6$6PZ~0?D44+cdG96q%H;KkAE?}r=1FS#_a$5MQiDqkMsToCRMJq zci*`__i|%-?YqkF`*&QKKK1v!zk(XTaM>^im@roG%ywor-p8V4vTU;Uxy#m}HJZf> zYEurq5#;SH{$u9GKjrcp(fAWGud}6D3yl{GE!%2eUnsfqYiWzy8!?z|PIN zi&DqaYk!t39eZ2nvxIGrHuk&$7?cZl;^3wUc zYt56z-={;@+RT8rx*3*mKs%)LVcjWTylxk?E5cB01n+-|G{SmYqb!Do(J&Yd17Ox3 zO$Vc404m}~)4^yMjHUxn2#ltK(J%lfgV8c^G%tV?!f4$%S|*N`iKAuW==i~CNjO>( zj+TU@CE;jEI9d{pmV~1v;b=)XS`v Date: Tue, 28 Apr 2020 09:14:19 -0700 Subject: [PATCH 114/149] exact retirement dates Now that change freeze is lifted, providing exact retirement dates --- windows/deployment/update/update-compliance-monitor.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 102ee54ac9..55e6f693d9 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -18,9 +18,9 @@ ms.topic: article # Monitor Windows Updates with Update Compliance > [!IMPORTANT] -> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. A few retirements are planned, noted below, but are placed **on hold** until the current situation stabilizes. -> * The Windows Defender Antivirus reporting feature of Update Compliance will soon be retired. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). -> * As of March 31, 2020, The Perspectives feature of Update Compliance will soon be retired in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. +> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. Two planned feature removals for Update Compliance – Windows Defender Antivirus reporting and Perspectives – are now scheduled to be removed beginning Monday, May 11, 2020. +> * The retirement of Windows Defender Antivirus reporting will begin Monday, May 11, 2020. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). +> * The Perspectives feature of Update Compliance will be retired Monday, May 11, 2020. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. ## Introduction From ffd466869c5604457b1c77fec296f8b125b24aaa Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 28 Apr 2020 09:14:23 -0700 Subject: [PATCH 115/149] Revision --- devices/hololens/hololens-kiosk.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 76a33a3064..10d45db90c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -52,10 +52,10 @@ A multi-app kiosk displays the start menu when the user signs in to the device. The following table lists the feature capabilities in the different kiosk modes. -|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands | +|   |Start menu |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | |Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled1 | -|Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | +|Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | > 1 Voice commands that relate to disabled features do not function. > 2 For more information about how to configure these features, see [Select kiosk apps](#plan-kiosk-apps). From 6724a11a055aaef5d03b44cef7958bc8c50a05e7 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 28 Apr 2020 09:29:14 -0700 Subject: [PATCH 116/149] Revisions --- devices/hololens/hololens-kiosk.md | 25 +------------------------ 1 file changed, 1 insertion(+), 24 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 10d45db90c..51466aaea1 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -72,7 +72,7 @@ For examples of how to use these capabilities, see the following table. |Use a single-app kiosk for: |Use a multi-app kiosk for: | | --- | --- | -|A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | +|A device that runs only a Dynamics 365 Guide for new hires. |A device that runs both Guides and Remote Assistance for a range of employees. | |A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | ### Plan kiosk apps @@ -144,29 +144,6 @@ No matter which user signs on to the device first (and goes through the Out-of-B **Example 2** -You use two groups that have the following members: - -- Group 1: - - User A - - User B -- Group 2: - - User A - - User B - - User C - - Device 1 - -You configure the kiosk configuration profile as follows: - -- **User logon type**: Group 1 -- **Assigned group**: Group 2 - -No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, the user experiences differ as follows: - -- Users A and B can sign in to the device, and they get the kiosk experience. -- User C can sign in to the device, but does not get the kiosk experience. User C can use the device as a typical non-kiosk device. - -**Example 3** - You contract devices out to two different vendors who need different kiosk experiences. Both vendors have users, and you want all of the users to have access to kiosks from both their own vendor and the other vendor. You configure groups as follows: - Device Group 1: From ea588f10f3758f9450e359a7b3cf600dfdad5a15 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 28 Apr 2020 09:55:39 -0700 Subject: [PATCH 117/149] Revisions --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 51466aaea1..482241ea7f 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -312,7 +312,7 @@ During OOBE, follow these steps: 1. Enroll the device. 1. Wait for any apps that are part of the kiosk configuration profile to download and install, and for policies to be applied. 1. After OOBE finishes, you can install additional apps from the Microsoft store or by sideloading. [Required apps](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the group that the device belongs to install automatically. -1. Restart the device. +1. When finished, restart the device. The next time you sign in to the device by using an account that belongs to the **User logon type**, the kiosk app should automatically launch. From 7400f912325a02f8341dbc790b016060669caf33 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Tue, 28 Apr 2020 10:05:49 -0700 Subject: [PATCH 118/149] Update manage-updates-baselines-windows-defender-antivirus.md fixing table --- ...es-baselines-windows-defender-antivirus.md | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 9cbd8b642a..057ae2c994 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Manage Microsoft Defender Antivirus updates and apply baselines -description: Manage how Microsoft Defender Antivirus receives protection and product updates. +title: Manage Windows Defender Antivirus updates and apply baselines +description: Manage how Windows Defender Antivirus receives protection and product updates. keywords: updates, security baselines, protection, schedule updates, force updates, mobile updates, wsus search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -17,7 +17,7 @@ ms.reviewer: manager: dansimp --- -# Manage Microsoft Defender Antivirus updates and apply baselines +# Manage Windows Defender Antivirus updates and apply baselines **Applies to:** @@ -32,7 +32,7 @@ There are two types of updates related to keeping Windows Defender Antivirus up ## Security intelligence updates -Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads Security intelligence updates to provide protection. +Windows Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads Security intelligence updates to provide protection. The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the Security intelligence updates occur on a scheduled cadence (configurable via policy). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. @@ -213,15 +213,16 @@ During the technical support (only) phase, commercially reasonable support incid ### Platform version included with Windows 10 releases The below table provides the Windows Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases: -|Windows 10 release |Platform version |Engine version |Support phase | +|Windows 10 release |Platform version |Engine version |Support phase | |-|-|-|-| -|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade Support (Only) -|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade Support (Only) -|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade Support (Only) -|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade Support (Only) -|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade Support (Only) -|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) -|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) +|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade Support (Only) | +|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade Support (Only) | +|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade Support (Only) | +|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade Support (Only) | +|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade Support (Only) | +|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) | +|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) | + Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) ## In this section From ae23ce79feca0f92eee469a65a46e0b5f030ec4b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 28 Apr 2020 12:19:24 -0700 Subject: [PATCH 119/149] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index c965ddd359..16ae7b5736 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -157,7 +157,10 @@ The advanced commands offer a more robust set of actions that allow you to take For scenarios when you'd like get a file from a device you're investigating, you can use the `getfile` command. This allows you to save the file from the device for further investigation. >[!NOTE] ->There is a file size limit of 750mb. +>The following file size limits apply: +>- `getfile` limit: 3 GB +>- `fileinfo` limit: 10 GB +>- `library` limit: 250 MB ### Download a file in the background From 3487798189a01355c9d2a9ac2fce8b64062f5ade Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Tue, 28 Apr 2020 12:55:33 -0700 Subject: [PATCH 120/149] Update manage-updates-baselines-windows-defender-antivirus.md update according to feedback --- ...es-baselines-windows-defender-antivirus.md | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index b05fb44dc0..8b55207b8c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -27,7 +27,9 @@ There are two types of updates related to keeping Windows Defender Antivirus up 1. Security intelligence updates 2. Product updates - +> [!IMPORTANT] +> Keeping Windows Defender Antivirus up to date is crucial to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. +> This also applies to devices where Windows Defender Antivirus is running in [passive mode](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility). ## Security intelligence updates @@ -39,9 +41,10 @@ Engine updates are included with the Security intelligence updates and are relea ## Product updates -Windows Defender Antivirus requires [monthly updates](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases. +Windows Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases. -You can manage the distribution of updates through Windows Server Update Service (WSUS), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. +You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. +For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) ## Released platform and engine versions @@ -138,13 +141,14 @@ No known issues
- January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) + January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) - Security intelligence update version: **1.309.32.0** - Released: **January 30, 2020** - Platform/Client: **4.18.2001.10** - Engine: **1.1.16700.2** - Support phase: **Technical upgrade Support (Only)** + +Security intelligence update version: **1.309.32.0** +Released: **January 30, 2020** +Platform/Client: **4.18.2001.10** +Engine: **1.1.16700.2** +Support phase: **Technical upgrade Support (Only)** ### What's new From 23aa7f69aaea4e5b1384032df78b2ab72fe30de0 Mon Sep 17 00:00:00 2001 From: martyav Date: Tue, 28 Apr 2020 15:58:03 -0400 Subject: [PATCH 121/149] some copyedits and clarifications --- ...d-protection-windows-defender-antivirus.md | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md index 97460bb973..aad6c18af5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md @@ -22,8 +22,8 @@ ms.custom: nextgen - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->[!NOTE] ->The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. +> [!NOTE] +> The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. Windows Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). ![List of Windows Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) @@ -34,8 +34,8 @@ See [Use Microsoft cloud-delivered protection](utilize-microsoft-cloud-protectio There are specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service. See [Configure and validate network connections](configure-network-connections-windows-defender-antivirus.md) for more details. ->[!NOTE] ->In Windows 10, there is no difference between the **Basic** and **Advanced** options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. See the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839) for more information on what we collect. +> [!NOTE] +> In Windows 10, there is no difference between the **Basic** and **Advanced** reporting options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. See the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839) for more information on what we collect. ## Use Intune to enable cloud-delivered protection @@ -51,10 +51,10 @@ There are specific network-connectivity requirements to ensure your endpoints ca - **Send all samples automatically** >[!NOTE] - >**Send safe samples automatically** option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. + > The **Send safe samples automatically** option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. > [!WARNING] - > Setting to **Always Prompt** will lower the protection state of the device. Setting to **Never send** means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function. + > Setting to **Always Prompt** will lower the protection state of the device. Setting to **Never send** means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature of Microsoft Defender ATP won't work. 8. Click **OK** to exit the **Windows Defender Antivirus** settings pane, click **OK** to exit the **Device restrictions** pane, and then click **Save** to save the changes to your **Device restrictions** profile. @@ -70,22 +70,22 @@ See [How to create and deploy antimalware policies: Cloud-protection service](ht 2. In the **Group Policy Management Editor** go to **Computer configuration**. -3. Click **Administrative templates**. +3. Select **Administrative templates**. 4. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS** -5. Double-click **Join Microsoft MAPS** and ensure the option is enabled and set to **Basic MAPS** or **Advanced MAPS**. Click **OK**. +5. Double-click **Join Microsoft MAPS**. Ensure the option is enabled and set to **Basic MAPS** or **Advanced MAPS**. Select **OK**. -6. Double-click **Send file samples when further analysis is required** and ensure the option is set to **Enabled** and the additional options are either of the following: +6. Double-click **Send file samples when further analysis is required**. Ensure that the option is set to **Enabled** and that the other options are either of the following: 1. **Send safe samples** (1) 2. **Send all samples** (3) >[!NOTE] - >**Send safe samples automatically** option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. + > The **Send safe samples** (1) option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. > [!WARNING] - > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function. + > Setting the option to **Always Prompt** (0) will lower the protection state of the device. Setting it to **Never send** (2) means that the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature of Microsoft Defender ATP won't work. 7. Click **OK**. @@ -95,18 +95,16 @@ Use the following cmdlets to enable cloud-delivered protection: ```PowerShell Set-MpPreference -MAPSReporting Advanced -Set-MpPreference -SubmitSamplesConsent SendSafeSamples +Set-MpPreference -SubmitSamplesConsent SendAllSamples ``` +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. [Policy CSP - Defender](../../../client-management/mdm//policy-csp-defender.md) also has more information specifically on [-SubmitSampleConsent](../../../client-management/mdm//policy-csp-defender.md#defender-submitsamplesconsent). + >[!NOTE] -> You can also set **-SubmitSamplesConsent** to SendAllSamples`, `NeverSend`, or `AlwaysPrompt`. +> You can also set **-SubmitSamplesConsent** to `SendSafeSamples` (the default setting), `NeverSend`, or `AlwaysPrompt`. The `SendSafeSamples` setting means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. >[!WARNING] -> Setting **-SubmitSamplesConsent** to `NeverSend` or `AlwaysPrompt` will lower the protection state of the device. -> -> In addition, setting it to `NeverSend` means that the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature won't work. - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. [Policy CSP - Defender](../../../client-management/mdm//policy-csp-defender.md) also has more information specifically on [-SubmitSampleConsent](../../../client-management/mdm//policy-csp-defender.md#defender-submitsamplesconsent). +> Setting **-SubmitSamplesConsent** to `NeverSend` or `AlwaysPrompt` will lower the protection level of the device. In addition, setting it to `NeverSend` means that the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature of Microsoft Defender ATP won't work. ## Use Windows Management Instruction (WMI) to enable cloud-delivered protection From 74e0d0222bba98bf583e6017225fb00867bdc249 Mon Sep 17 00:00:00 2001 From: martyav Date: Tue, 28 Apr 2020 16:30:55 -0400 Subject: [PATCH 122/149] one more heading --- .../enable-cloud-protection-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md index aad6c18af5..7fea389db9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md @@ -119,7 +119,7 @@ See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) -**Enable cloud-delivered protection on individual clients with the Windows Security app +## Enable cloud-delivered protection on individual clients with the Windows Security app > [!NOTE] > If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. From a5df7f867caba3d907691f97da8201cb3a7b866c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 28 Apr 2020 14:14:32 -0700 Subject: [PATCH 123/149] Update manage-updates-baselines-windows-defender-antivirus.md --- ...manage-updates-baselines-windows-defender-antivirus.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 8b55207b8c..fe28605d32 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -43,13 +43,13 @@ Engine updates are included with the Security intelligence updates and are relea Windows Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases. -You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. -For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) +You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. +For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) ## Released platform and engine versions ### Monthly platform and engine releases -For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform) +For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform)
April-2020 (Platform: 4.18.2004.5 | Engine: 1.1.17000.2) @@ -226,7 +226,7 @@ The below table provides the Windows Defender Antivirus platform and engine vers |1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) | |1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) | -Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) +Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) ## In this section From fe83c33355d045562627cbf25af12276eb8a5b99 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 28 Apr 2020 14:31:12 -0700 Subject: [PATCH 124/149] Corrections: punctuation and Acrolinx spelling --- .../microsoft-defender-atp/live-response.md | 44 +++++++++---------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 16ae7b5736..929b9ade09 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -23,24 +23,24 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Live response is a capability that gives your security operations team instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats –- in real time. +Live response is a capability that gives your security operations team instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats — in real time. Live response is designed to enhance investigations by enabling your security operations team to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats. > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4qLUW] With live response, analysts can do all of the following tasks: -- Run basic and advanced commands to do investigative work on a device -- Download files such as malware samples and outcomes of PowerShell scripts -- Download files in the background (new!) -- Upload a PowerShell script or executable to the library and run it on a device from a tenant level -- Take or undo remediation actions +- Run basic and advanced commands to do investigative work on a device. +- Download files such as malware samples and outcomes of PowerShell scripts. +- Download files in the background (new!). +- Upload a PowerShell script or executable to the library and run it on a device from a tenant level. +- Take or undo remediation actions. ## Before you begin Before you can initiate a session on a device, make sure you fulfill the following requirements: -- **Verify that you're running a supported version of Windows 10**
+- **Verify that you're running a supported version of Windows 10**.
Devices must be running one of the following versions of Windows 10: - [1909](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1909) or later - [1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) @@ -48,29 +48,29 @@ Devices must be running one of the following versions of Windows 10: - [1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) - [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) -- **Make sure to install appropriate security updates**
+- **Make sure to install appropriate security updates**.
- 1903: [KB4515384](https://support.microsoft.com/help/4515384/windows-10-update-kb4515384) - 1809 (RS5): [KB4537818](https://support.microsoft.com/help/4537818/windows-10-update-kb4537818) - 1803 (RS4): [KB4537795](https://support.microsoft.com/help/4537795/windows-10-update-kb4537795) - 1709 (RS3): [KB4537816](https://support.microsoft.com/help/4537816/windows-10-update-kb4537816) -- **Enable live response from the settings page**
+- **Enable live response from the settings page**.
You'll need to enable the live response capability in the [Advanced features settings](advanced-features.md) page. >[!NOTE] >Only users with manage security or global admin roles can edit these settings. -- **Ensure that the machine has an Automation Remediation level assigned to it**
-You'll need to enable, at least, the minimum Remdiation Level for a given Machine Group. Otherwise you won't be able to establish a Live Response session to a member of that group. +- **Ensure that the machine has an Automation Remediation level assigned to it**.
+You'll need to enable, at least, the minimum Remediation Level for a given Machine Group. Otherwise you won't be able to establish a Live Response session to a member of that group. -- **Enable live response unsigned script execution** (optional)
+- **Enable live response unsigned script execution** (optional).
>[!WARNING] >Allowing the use of unsigned scripts may increase your exposure to threats. Running unsigned scripts is not recommended as it can increase your exposure to threats. If you must use them however, you'll need to enable the setting in the [Advanced features settings](advanced-features.md) page. -- **Ensure that you have the appropriate permissions**
+- **Ensure that you have the appropriate permissions**.
Only users who have been provisioned with the appropriate permissions can initiate a session. For more information on role assignments, see [Create and manage roles](user-roles.md). > [!IMPORTANT] @@ -133,7 +133,7 @@ drivers | Shows all drivers installed on the device. | |`trace` | Sets the terminal's logging mode to debug. | ### Advanced commands -The following commands are available for user roles that are granted the ability to run **advanced** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). +The following commands are available for user roles that are granted the ability to run **advanced** live response commands. For more information on role assignments see [Create and manage roles](user-roles.md). | Command | Description | |---|---| @@ -166,9 +166,9 @@ For scenarios when you'd like get a file from a device you're investigating, you To enable your security operations team to continue investigating an impacted device, files can now be downloaded in the background. -- To download a file in the background, in the live response command console, type `download &` +- To download a file in the background, in the live response command console, type `download &`. - If you are waiting for a file to be downloaded, you can move it to the background by using Ctrl + Z. -- To bring a file download to the foreground, in the live response command console, type `fg ` +- To bring a file download to the foreground, in the live response command console, type `fg `. Here are some examples: @@ -176,7 +176,7 @@ Here are some examples: |Command |What it does | |---------|---------| |`"C:\windows\some_file.exe" &` |Starts downloading a file named *some_file.exe* in the background. | -|`fg 1234` |Returns a download with command ID *1234* to the foreground | +|`fg 1234` |Returns a download with command ID *1234* to the foreground. | ### Put a file in the library @@ -280,11 +280,11 @@ Each command is tracked with full details such as: ## Limitations -- Live response sessions are limited to 10 live response sessions at a time -- Large scale command execution is not supported -- A user can only initiate one session at a time -- A device can only be in one session at a time -- There is a file size limit of 750mb when downloading files from a device +- Live response sessions are limited to 10 live response sessions at a time. +- Large scale command execution is not supported. +- A user can only initiate one session at a time. +- A device can only be in one session at a time. +- There is a file size limit of 750mb when downloading files from a device. ## Related article - [Live response command examples](live-response-command-examples.md) From 43738897bb09fcaa1068303f08c622d499d5d109 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Apr 2020 08:40:38 -0700 Subject: [PATCH 125/149] Update live-response.md --- .../threat-protection/microsoft-defender-atp/live-response.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 929b9ade09..3cac9327c0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -284,7 +284,6 @@ Each command is tracked with full details such as: - Large scale command execution is not supported. - A user can only initiate one session at a time. - A device can only be in one session at a time. -- There is a file size limit of 750mb when downloading files from a device. ## Related article - [Live response command examples](live-response-command-examples.md) From 2307dd3c116f660911c57fe99b63f76ae5ae86e8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Apr 2020 09:02:37 -0700 Subject: [PATCH 126/149] Update live-response.md --- .../threat-protection/microsoft-defender-atp/live-response.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 3cac9327c0..8ab5475888 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -284,6 +284,10 @@ Each command is tracked with full details such as: - Large scale command execution is not supported. - A user can only initiate one session at a time. - A device can only be in one session at a time. +- The following file size limits apply: + - `getfile` limit: 3 GB + - `fileinfo` limit: 10 GB + - `library` limit: 250 MB ## Related article - [Live response command examples](live-response-command-examples.md) From f88df254db72eef46d349f7ba102c925ba8caae1 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Wed, 29 Apr 2020 12:13:54 -0700 Subject: [PATCH 127/149] Updates to Pro X --- .../surface/enroll-and-configure-surface-devices-with-semm.md | 2 +- devices/surface/surface-pro-arm-app-management.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md index 0147596761..80367c8e53 100644 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md @@ -24,7 +24,7 @@ For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Manage A streamlined method of managing firmware from the cloud on Surface Pro 7,Surface Pro X and Surface Laptop 3 is now available via public preview. For more information,refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). > [!NOTE] -> SEMM is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md). +> SEMM is supported on Surface Pro X via the UEFI Manager only. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md). #### Download and install Microsoft Surface UEFI Configurator The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. diff --git a/devices/surface/surface-pro-arm-app-management.md b/devices/surface/surface-pro-arm-app-management.md index f3d922c048..488eeca1a2 100644 --- a/devices/surface/surface-pro-arm-app-management.md +++ b/devices/surface/surface-pro-arm-app-management.md @@ -139,10 +139,10 @@ The following tables show the availability of selected key features on Surface P | Endpoint Configuration Manager | Yes | Yes | | | Power on When AC Restore | Yes | Yes | | | Surface Diagnostic Toolkit (SDT) for Business | Yes | Yes | | -| Surface Dock Firmware Update | Yes | Yes | | +| Surface Dock Firmware Update | Yes | No | | | Asset Tag Utility | Yes | Yes | | | Surface Enterprise management Mode (SEMM) | Yes | Partial | No option to disable hardware on Surface Pro X at the firmware level. | -| Surface UEFI Configurator | Yes | | No option to disable hardware. on Surface Pro X at the firmware level. | +| Surface UEFI Configurator | Yes | No | No option to disable hardware. on Surface Pro X at the firmware level. | | Surface UEFI Manager | Yes | Partial | No option to disable hardware on Surface Pro X at the firmware level. | From 332428dae3b023cc3cae5de4661d8c76741098a7 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 29 Apr 2020 13:08:38 -0700 Subject: [PATCH 128/149] Incorporated dev feedback --- windows/client-management/mdm/bitlocker-csp.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 3d9cf7a67b..78737dcfde 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1083,7 +1083,7 @@ This node reports compliance state of device encryption on the system. Supported values: - 0 - Indicates that the device is compliant. -- Any other value represents a non-compliant device. +- Any non-zero value - Indicates that the device is not compliant. This value represents a bitmask with each bit explained by values in the table below. Value type is int. Supported operation is Get. @@ -1092,7 +1092,7 @@ The following table provides the mapping of the bits in the **Status/DeviceEncry | Bit | Error Code | |-----|------------| | 0 |The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| -| 1 |The encryption method of the OS volume doesn't match the BitLocker policy.| +| 1 |The encryption method of the OS volume doesn't match the BitLocker policy.| | 2 |The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| | 3 |The BitLocker policy requires a TPM-only protector for the OS volume, but TPM protection isn't used.| | 4 |The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.| From 39c30d2e99388cb1f686526f246ca8c5b61baa89 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Wed, 29 Apr 2020 13:29:05 -0700 Subject: [PATCH 129/149] Update command-line-arguments-windows-defender-antivirus.md Update CPU Throttling parameter --- .../command-line-arguments-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index b42e1c8729..0483497ae8 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -42,7 +42,7 @@ MpCmdRun.exe -scan -2 | Command | Description | |:----|:----| | `-?` **or** `-h` | Displays all available options for this tool | -| `-Scan [-ScanType [0\|1\|2\|3]] [-File [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout ] [-Cancel]` | Scans for malicious software. Values for **ScanType** are: **0** Default, according to your configuration, **-1** Quick scan, **-2** Full scan, **-3** File and directory custom scan. | +| `-Scan [-ScanType [0\|1\|2\|3]] [-File [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout ] [-Cancel]` | Scans for malicious software. Values for **ScanType** are: **0** Default, according to your configuration, **-1** Quick scan, **-2** Full scan, **-3** File and directory custom scan. CpuThrottling will honor the configured CPU throttling from policy | | `-Trace [-Grouping #] [-Level #]` | Starts diagnostic tracing | | `-GetFiles` | Collects support information | | `-GetFilesDiagTrack` | Same as `-GetFiles`, but outputs to temporary DiagTrack folder | From 9adbbcaafc363c24cbbe7ad66258dc661e16d7c5 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 29 Apr 2020 13:56:35 -0700 Subject: [PATCH 130/149] Minor text updates --- windows/client-management/mdm/bitlocker-csp.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 78737dcfde..4d8c043a56 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1081,13 +1081,11 @@ This node reports compliance state of device encryption on the system. -Supported values: -- 0 - Indicates that the device is compliant. -- Any non-zero value - Indicates that the device is not compliant. This value represents a bitmask with each bit explained by values in the table below. - Value type is int. Supported operation is Get. -The following table provides the mapping of the bits in the **Status/DeviceEncryptionStatus** node to the error codes: +Supported values: +- 0 - Indicates that the device is compliant. +- Any non-zero value - Represents a bitmask indicating that the device is not compliant. The following tables provides the mapping of each bit with the error code: | Bit | Error Code | |-----|------------| From 9d82bfa6dca671e99de8826d753a05048d6fc425 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 29 Apr 2020 14:05:08 -0700 Subject: [PATCH 131/149] Applied [!NOTE] style --- .../monitor-the-use-of-removable-storage-devices.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index ee4ffad617..30ed1af8fc 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -49,7 +49,8 @@ After you configure the settings to monitor removable storage devices, use the f 1. Sign in to the computer that hosts the resources that you want to monitor. Press the Windows key + R, and then type **cmd** to open a Command Prompt window. - >**Note:**  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + > [!NOTE] + > If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 2. Type **gpupdate /force**, and press ENTER. 3. Connect a removable storage device to the targeted computer and attempt to copy a file that is protected with the Removable Storage Audit policy. @@ -59,7 +60,8 @@ After you configure the settings to monitor removable storage devices, use the f Key information to look for includes the name and account domain of the user who attempted to access the file, the object that the user is attempting to access, resource attributes of the resource, and the type of access that was attempted. - >**Note:**  We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event. + > [!NOTE] + > We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event. ### Related resource From 89777310578af1b4a1e59a5fe39606e90a1f512d Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 29 Apr 2020 14:17:20 -0700 Subject: [PATCH 132/149] Deleted duplicated text, indent content in a second-level list item --- .../enroll-and-configure-surface-devices-with-semm.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md index 80367c8e53..fd8f4626e5 100644 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md @@ -107,11 +107,11 @@ To enroll a Surface device in SEMM with a Surface UEFI configuration package, fo 3. Click **Finish** to complete the Surface UEFI configuration package installation and restart the Surface device when you are prompted to do so. 4. Surface UEFI will load the configuration file and determine that SEMM is not enabled on the device. Surface UEFI will then begin the SEMM enrollment process, as follows: * Surface UEFI will verify that the SEMM configuration file contains a SEMM certificate. - * Surface UEFI will prompt you to enter to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8. + * Surface UEFI will prompt you to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8. - ![SEMM enrollment requires last two characters of certificate thumbprint](images/surface-semm-enroll-fig8.png "SEMM enrollment requires last two characters of certificate thumbprint") - - *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint* + ![SEMM enrollment requires last two characters of certificate thumbprint](images/surface-semm-enroll-fig8.png "SEMM enrollment requires last two characters of certificate thumbprint") + + *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint* * Surface UEFI will store the SEMM certificate in firmware and apply the configuration settings that are specified in the Surface UEFI configuration file. From e673cc5c10197f3ec4ceb48d721c8682f763d847 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 29 Apr 2020 14:18:40 -0700 Subject: [PATCH 133/149] More text updates --- windows/client-management/mdm/bitlocker-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 4d8c043a56..ed78e1629d 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1085,7 +1085,7 @@ Value type is int. Supported operation is Get. Supported values: - 0 - Indicates that the device is compliant. -- Any non-zero value - Represents a bitmask indicating that the device is not compliant. The following tables provides the mapping of each bit with the error code: +- Any non-zero value - Indicates that the device is not compliant. This value represents a bitmask with each bit and the corresponding error code described in the following table: | Bit | Error Code | |-----|------------| From e3cd937cb6c111a889cf3102a6d61d94100a0b0e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Apr 2020 16:17:33 -0700 Subject: [PATCH 134/149] Update index.md --- windows/security/threat-protection/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 38daa97fbb..479b71f272 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -77,7 +77,7 @@ The attack surface reduction set of capabilities provide the first line of defen **[Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)**
To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats. -- [Behavior monitoring](/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) +- [Behavior monitoring](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) - [Cloud-based protection](/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) - [Machine learning](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) - [URL Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus) From 88916746edc38b90973fec1013ab6e654cb6d8f0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Apr 2020 16:21:06 -0700 Subject: [PATCH 135/149] Update index.md --- windows/security/threat-protection/index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 479b71f272..af978544ae 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -78,10 +78,10 @@ The attack surface reduction set of capabilities provide the first line of defen To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats. - [Behavior monitoring](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) -- [Cloud-based protection](/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) -- [Machine learning](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +- [Cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus) +- [Machine learning](https://docs.microsoft.com/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus) - [URL Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus) -- [Automated sandbox service](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) +- [Automated sandbox service](https://docs.microsoft.com/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) From e7e18f8c8c07da4764c63e52e6d5652849101e34 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 29 Apr 2020 16:29:54 -0700 Subject: [PATCH 136/149] Replaced HTML entities in body text and code blocks These caused two broken instances of [!NOTE] and invalid XML in the code blocks. --- .../client-management/mdm/bitlocker-csp.md | 166 +++++++++--------- 1 file changed, 84 insertions(+), 82 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index ed78e1629d..71c5bbf78b 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -159,7 +159,7 @@ If you want to disable this policy, use the following SyncML: **EncryptionMethodByDriveType** -Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". +Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".
@@ -212,7 +212,7 @@ EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operat EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives. EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for removable data drives. - The possible values for 'xx' are: + The possible values for 'xx' are: - 3 = AES-CBC 128 - 4 = AES-CBC 256 @@ -234,7 +234,7 @@ EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for remov chr - <disabled/> + ``` @@ -244,7 +244,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRequireStartupAuthentication** -This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup". +This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup".
@@ -286,7 +286,7 @@ This setting allows you to configure whether BitLocker requires additional authe > [!NOTE] > Only one of the additional authentication options can be required at startup, otherwise an error occurs. -If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive. +If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both. @@ -314,13 +314,13 @@ Data id:
  • ConfigureTPMUsageDropDown_Name = (for computer with TPM) Configure TPM startup.
    • -The possible values for 'xx' are: +The possible values for 'xx' are:
    • true = Explicitly allow
    • false = Policy not set
    -The possible values for 'yy' are: +The possible values for 'yy' are:
    • 2 = Optional
    • 1 = Required
      • @@ -339,7 +339,7 @@ Disabling the policy will let the system choose the default behaviors. If you wa chr - <disabled/> + ``` @@ -348,7 +348,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesMinimumPINLength** -This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup". +This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup".
    @@ -414,7 +414,7 @@ Disabling the policy will let the system choose the default behaviors. If you wa chr - <disabled/> + ``` @@ -424,7 +424,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRecoveryMessage** -This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" +This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" (PrebootRecoveryInfo_Name). @@ -465,11 +465,11 @@ ADMX Info: This setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked. -If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL). +If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL). -If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message. +If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message. -If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen. +If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen. Sample value for this node to enable this policy is: @@ -477,7 +477,7 @@ Sample value for this node to enable this policy is: ``` -The possible values for 'xx' are: +The possible values for 'xx' are: - 0 = Empty - 1 = Use default recovery message and URL (in this case you don't need to specify a value for "RecoveryMessage_Input" or "RecoveryUrl_Input"). @@ -501,7 +501,7 @@ Disabling the policy will let the system choose the default behaviors. If you w chr - <disabled/> + ``` @@ -514,7 +514,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRecoveryOptions** -This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name). +This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name).
    @@ -553,18 +553,18 @@ ADMX Info: This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker. -The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. +The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. -In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. +In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. -Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. +Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. -Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS. +Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS. -Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. +Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -> [!Note] -> If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated. +> [!NOTE] +> If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated. If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives. @@ -576,16 +576,16 @@ Sample value for this node to enable this policy is: ``` -The possible values for 'xx' are: +The possible values for 'xx' are: - true = Explicitly allow - false = Policy not set -The possible values for 'yy' are: +The possible values for 'yy' are: - 2 = Allowed - 1 = Required - 0 = Disallowed -The possible values for 'zz' are: +The possible values for 'zz' are: - 2 = Store recovery passwords only - 1 = Store recovery passwords and key packages @@ -601,7 +601,7 @@ Disabling the policy will let the system choose the default behaviors. If you wa chr - <disabled/> + ``` @@ -611,7 +611,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **FixedDrivesRecoveryOptions** -This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" (). +This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" ().
    @@ -650,19 +650,20 @@ ADMX Info: This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker. -The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. +The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. -In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. +In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. -Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. +Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. -Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD. +Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD. -Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. +Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS. +Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS. -> [!Note]
    > If the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field is set, a recovery password is automatically generated. +> [!NOTE] +> If the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field is set, a recovery password is automatically generated. If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives. @@ -674,13 +675,13 @@ Sample value for this node to enable this policy is: ``` -The possible values for 'xx' are: +The possible values for 'xx' are:
    • true = Explicitly allow
    • false = Policy not set
    -The possible values for 'yy' are: +The possible values for 'yy' are:
    • 2 = Allowed
    • 1 = Required
      • @@ -688,7 +689,7 @@ The possible values for 'yy' are:
    -The possible values for 'zz' are: +The possible values for 'zz' are:
    • 2 = Store recovery passwords only
    • 1 = Store recovery passwords and key packages
      • @@ -706,7 +707,7 @@ Disabling the policy will let the system choose the default behaviors. If you wa chr - <disabled/> + ``` @@ -716,7 +717,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **FixedDrivesRequireEncryption** -This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name). +This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name).
    @@ -775,7 +776,7 @@ If you disable or do not configure this setting, all fixed data drives on the co chr - <disabled/> + ``` @@ -785,7 +786,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **RemovableDrivesRequireEncryption** -This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name). +This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name).
    @@ -826,11 +827,12 @@ This setting configures whether BitLocker protection is required for a computer If you enable this setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. -If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting. +If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting. If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access. -> [!Note]
    > This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. +> [!NOTE] +> This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. Sample value for this node to enable this policy is: @@ -838,7 +840,7 @@ Sample value for this node to enable this policy is: ``` -The possible values for 'xx' are: +The possible values for 'xx' are:
    • true = Explicitly allow
    • false = Policy not set
      • @@ -856,7 +858,7 @@ Disabling the policy will let the system choose the default behaviors. If you wa chr - <disabled/> + ``` @@ -1229,10 +1231,10 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/EncryptionMethodByDriveType - <enabled/> - <data id="EncryptionMethodWithXtsOsDropDown_Name" value="4"/> - <data id="EncryptionMethodWithXtsFdvDropDown_Name" value="7"/> - <data id="EncryptionMethodWithXtsRdvDropDown_Name" value="4"/> + + + + @@ -1244,12 +1246,12 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication - <enabled/> - <data id="ConfigureNonTPMStartupKeyUsage_Name" value="true"/> - <data id="ConfigureTPMStartupKeyUsageDropDown_Name" value="2"/> - <data id="ConfigurePINUsageDropDown_Name" value="2"/> - <data id="ConfigureTPMPINKeyUsageDropDown_Name" value="2"/> - <data id="ConfigureTPMUsageDropDown_Name" value="2"/> + + + + + + @@ -1261,8 +1263,8 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesMinimumPINLength - <enabled/> - <data id="MinPINLength" value="6"/> + + @@ -1274,10 +1276,10 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage - <enabled/> - <data id="RecoveryMessage_Input" value="blablablabla"/> - <data id="PrebootRecoveryInfoDropDown_Name" value="2"/> - <data id="RecoveryUrl_Input" value="blablabla"/> + + + + @@ -1289,14 +1291,14 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryOptions - <enabled/> - <data id="OSAllowDRA_Name" value="true"/> - <data id="OSRecoveryPasswordUsageDropDown_Name" value="2"/> - <data id="OSRecoveryKeyUsageDropDown_Name" value="2"/> - <data id="OSHideRecoveryPage_Name" value="true"/> - <data id="OSActiveDirectoryBackup_Name" value="true"/> - <data id="OSActiveDirectoryBackupDropDown_Name" value="2"/> - <data id="OSRequireActiveDirectoryBackup_Name" value="true"/> + + + + + + + + @@ -1308,14 +1310,14 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/FixedDrivesRecoveryOptions - <enabled/> - <data id="FDVAllowDRA_Name" value="true"/> - <data id="FDVRecoveryPasswordUsageDropDown_Name" value="2"/> - <data id="FDVRecoveryKeyUsageDropDown_Name" value="2"/> - <data id="FDVHideRecoveryPage_Name" value="true"/> - <data id="FDVActiveDirectoryBackup_Name" value="true"/> - <data id="FDVActiveDirectoryBackupDropDown_Name" value="2"/> - <data id="FDVRequireActiveDirectoryBackup_Name" value="true"/> + + + + + + + + @@ -1327,7 +1329,7 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption - <enabled/> + @@ -1339,8 +1341,8 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption - <enabled/> - <data id="RDVCrossOrg" value="true"/> + + From 36f12fb400506adea0d6b7dbf0f96f19b9ff5b8a Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Wed, 29 Apr 2020 16:40:40 -0700 Subject: [PATCH 137/149] Update manage-updates-baselines-windows-defender-antivirus.md Final draft --- ...es-baselines-windows-defender-antivirus.md | 140 +++++++----------- 1 file changed, 55 insertions(+), 85 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 8b55207b8c..2a8874766c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -28,8 +28,8 @@ There are two types of updates related to keeping Windows Defender Antivirus up 2. Product updates > [!IMPORTANT] -> Keeping Windows Defender Antivirus up to date is crucial to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. -> This also applies to devices where Windows Defender Antivirus is running in [passive mode](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility). +> Keeping Windows Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. +> This also applies to devices where Windows Defender Antivirus is running in [passive mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility). ## Security intelligence updates @@ -43,70 +43,64 @@ Engine updates are included with the Security intelligence updates and are relea Windows Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases. -You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. -For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) +You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. +For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) ## Released platform and engine versions ### Monthly platform and engine releases -For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform) +For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) + +All our updates contain: +* performance improvements +* serviceability improvements +* Integration improvements (Cloud, MTP) +
      April-2020 (Platform: 4.18.2004.5 | Engine: 1.1.17000.2) -Security intelligence update version: **TBD** -Released: **April 30, 2020** -Platform: **4.18.2004.5** -Engine: **1.1.17000.2** -Support phase: **Security and Critical Updates** + Security intelligence update version: **TBD** + Released: **April 30, 2020** + Platform: **4.18.2004.5** + Engine: **1.1.17000.2** + Support phase: **Security and Critical Updates** ### What's new +* WDfilter improvements +* Add more actionable event data to ASR detection events +* Fixed version information in diagnostic data and WMI +* Fixed incorrect platform version in UI after platform update +* Dynamic URL intel for Fileless threat protection +* UEFI scan capability +* Extend logging for updates -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: - ### Known Issues No known issues +
      March-2020 (Platform: 4.18.2003.8 | Engine: 1.1.16900.2) -Security intelligence update version: **1.313.8.0** -Released: **March 24, 2020** -Platform: **4.18.2003.8** -Engine: **1.1.16900.4** -Support phase: **Technical upgrade Support (Only)** + Security intelligence update version: **1.313.8.0** + Released: **March 24, 2020** + Platform: **4.18.2003.8** + Engine: **1.1.16900.4** + Support phase: **Technical upgrade Support (Only)** ### What's new -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: +* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus) +* Improve diagnostic capability +* reduce Security intelligence timeout (5min) +* Extend AMSI engine internal log capability +* Improve notification for process blocking ### Known Issues -No known issues +[**Fixed**] Windows Defender Antivirus is skipping files when running a scan. + +
      @@ -122,22 +116,10 @@ No known issues ### What's new -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: - + ### Known Issues No known issues +
      @@ -152,22 +134,18 @@ Support phase: **Technical upgrade Support (Only)** ### What's new -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: +* Fixed BSOD on WS2016 with Exchange +* Support platform updates when TMP is redirected to network path +* Platform and engine versions are added to [WDSI](https://www.microsoft.com/wdsi/defenderupdates) +* extend Emergency signature update to [passive mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility) +* Fix 4.18.1911.10 hang ### Known Issues -No known issues +[**Fixed**] devices utilizing [modern standby mode](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby) may experience a hang with the Windows Defender filter driver that results in a gap of protection. Affected machines appear to the customer as having not updated to the latest antimalware platform. +
      +> [!IMPORTANT] +> This updates is needed by RS1 devices running lower version of the platform to support SHA2.
      This update has reboot flag for systems that are experiencing the hang issue.
      the This update is re-released in April 2020 and will not be superseded by newer updates to keep future availability. +
      @@ -181,22 +159,14 @@ Support phase: **No support** ### What's new -:::row::: - :::column::: - **Platform** - * fix1 - * fix2 - - :::column-end::: - :::column::: - **Engine** - * fix1 - * fix2 - :::column-end::: -:::row-end::: +* Fixed MpCmdRun tracing level +* Fixed WDFilter version info +* Improve notifications (PUA) +* add MRT logs to support files ### Known Issues No known issues +
      ## Windows Defender Antivirus platform support @@ -226,7 +196,7 @@ The below table provides the Windows Defender Antivirus platform and engine vers |1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) | |1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) | -Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) +Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) ## In this section From 0133de5d8f62666fee1e86b7acf722058b20ded2 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 29 Apr 2020 16:52:34 -0700 Subject: [PATCH 138/149] Decreased unnecessary indentation in some code blocks --- .../client-management/mdm/bitlocker-csp.md | 168 +++++++++--------- 1 file changed, 84 insertions(+), 84 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 71c5bbf78b..8611ab72a1 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -330,18 +330,18 @@ The possible values for 'yy' are: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication - - - chr - - - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. @@ -405,18 +405,18 @@ Sample value for this node to enable this policy is: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesMinimumPINLength - - - chr - - - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesMinimumPINLength + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. @@ -492,18 +492,18 @@ The possible values for 'xx' are: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage - - - chr - - - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage + + + chr + + + + ``` > [!NOTE] @@ -592,18 +592,18 @@ The possible values for 'zz' are: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryOptions - - - chr - - - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryOptions + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. @@ -698,18 +698,18 @@ The possible values for 'zz' are: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/FixedDrivesRecoveryOptions - - - chr - - - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/FixedDrivesRecoveryOptions + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. @@ -767,18 +767,18 @@ Sample value for this node to enable this policy is: If you disable or do not configure this setting, all fixed data drives on the computer will be mounted with read and write access. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption - - - chr - - - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. @@ -849,18 +849,18 @@ The possible values for 'xx' are: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption - - - chr - - - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption + + + chr + + + + ``` From b3aa78f00c417a6a13269ff8637887fd93aee301 Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Thu, 30 Apr 2020 15:37:26 +0300 Subject: [PATCH 139/149] Update linux-install-manually.md Linking to post install actions to as customers may not notice this. --- .../microsoft-defender-atp/linux-install-manually.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 5d6395cdf9..6dbfee2073 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -247,7 +247,8 @@ unzip WindowsDefenderATPOnboardingPackage.zip ``` > [!IMPORTANT] - > When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes. During this time the above command returns a value of `0`. + > When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes. During this time the above command returns a value of `0`.
      + > Please note that you may also need to configure a proxy after completing the initial installation:
      https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration#post-installation-configuration 5. Run a detection test to verify that the machine is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded machine: From f0119ca307c7d4be730967e8d922504c478307d7 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Thu, 30 Apr 2020 08:31:24 -0700 Subject: [PATCH 140/149] pencil edits --- .../enable-cloud-protection-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md index 7fea389db9..8c14c01d58 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md @@ -98,7 +98,7 @@ Set-MpPreference -MAPSReporting Advanced Set-MpPreference -SubmitSamplesConsent SendAllSamples ``` -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. [Policy CSP - Defender](../../../client-management/mdm//policy-csp-defender.md) also has more information specifically on [-SubmitSampleConsent](../../../client-management/mdm//policy-csp-defender.md#defender-submitsamplesconsent). +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. [Policy CSP - Defender](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) also has more information specifically on [-SubmitSamplesConsent](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent). >[!NOTE] > You can also set **-SubmitSamplesConsent** to `SendSafeSamples` (the default setting), `NeverSend`, or `AlwaysPrompt`. The `SendSafeSamples` setting means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. From e6acb452e9e90c7aa9d36cde434de68afc0ac801 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Thu, 30 Apr 2020 08:48:33 -0700 Subject: [PATCH 141/149] pencil edit --- windows/security/threat-protection/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index af978544ae..671528c198 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -79,7 +79,7 @@ To further reinforce the security perimeter of your network, Microsoft Defender - [Behavior monitoring](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) - [Cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus) -- [Machine learning](https://docs.microsoft.com/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus) +- [Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus) - [URL Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus) - [Automated sandbox service](https://docs.microsoft.com/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) From c59bd389b34f8930ea2cb6d09b39270fc0c7c246 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Thu, 30 Apr 2020 08:51:14 -0700 Subject: [PATCH 142/149] pencil edit --- windows/security/threat-protection/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 671528c198..f7ed889815 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -81,7 +81,7 @@ To further reinforce the security perimeter of your network, Microsoft Defender - [Cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus) - [Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus) - [URL Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus) -- [Automated sandbox service](https://docs.microsoft.com/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) +- [Automated sandbox service](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) From d7e05c006158fe6981e900372de1f7d5445d291d Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Thu, 30 Apr 2020 09:07:41 -0700 Subject: [PATCH 143/149] Update manage-updates-baselines-windows-defender-antivirus.md final --- .../manage-updates-baselines-windows-defender-antivirus.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 2a8874766c..4b1cb37db3 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -46,9 +46,11 @@ Windows Defender Antivirus requires [monthly updates (KB4052623)](https://suppor You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) -## Released platform and engine versions +> [!NOTE] +> We release these monthly updates in phases (aka rings). This result in multiple packages showing up in your WSUS server. + +## Monthly platform and engine versions -### Monthly platform and engine releases For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) All our updates contain: From 5a0b42a25433558621cbcbfbd2cc8227b206e728 Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Thu, 30 Apr 2020 09:38:18 -0700 Subject: [PATCH 144/149] Update manage-updates-baselines-windows-defender-antivirus.md remove rings and typo --- .../manage-updates-baselines-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 4b1cb37db3..8146772e45 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -47,7 +47,7 @@ You can manage the distribution of updates through [Windows Server Update Servic For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) > [!NOTE] -> We release these monthly updates in phases (aka rings). This result in multiple packages showing up in your WSUS server. +> We release these monthly updates in phases. This results in multiple packages showing up in your WSUS server. ## Monthly platform and engine versions From 0ab5e0a75c4871ed93427e78f644922da32977e5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 30 Apr 2020 10:30:47 -0700 Subject: [PATCH 145/149] Update manage-updates-baselines-windows-defender-antivirus.md --- .../manage-updates-baselines-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 8146772e45..26af9d3642 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -93,7 +93,7 @@ No known issues ### What's new -* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus) +* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus) * Improve diagnostic capability * reduce Security intelligence timeout (5min) * Extend AMSI engine internal log capability From d1e63d097bb94c903ae1a2a31e47f65899cba21f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 30 Apr 2020 13:25:53 -0700 Subject: [PATCH 146/149] Update manage-updates-baselines-windows-defender-antivirus.md --- ...manage-updates-baselines-windows-defender-antivirus.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 26af9d3642..fdd68a1bc4 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -33,11 +33,11 @@ There are two types of updates related to keeping Windows Defender Antivirus up ## Security intelligence updates -Windows Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads Security intelligence updates to provide protection. +Windows Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads security intelligence updates to provide protection. -The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the Security intelligence updates occur on a scheduled cadence (configurable via policy). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. +The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the security intelligence updates occur on a scheduled cadence (configurable via policy). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. -Engine updates are included with the Security intelligence updates and are released on a monthly cadence. +Engine updates are included with the security intelligence updates and are released on a monthly cadence. ## Product updates @@ -56,7 +56,7 @@ For information how to update or how to install the platform update, please see: All our updates contain: * performance improvements * serviceability improvements -* Integration improvements (Cloud, MTP) +* integration improvements (Cloud, MTP)
      From 89dfbfc5eb64388dd706549e1eec89af87a6b227 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 30 Apr 2020 14:07:22 -0700 Subject: [PATCH 147/149] Changed ordered list to unordered, corrected punctuation --- ...dates-baselines-windows-defender-antivirus.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index fdd68a1bc4..8eafa9113d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -24,8 +24,8 @@ manager: dansimp There are two types of updates related to keeping Windows Defender Antivirus up to date: -1. Security intelligence updates -2. Product updates + - Security intelligence updates + - Product updates > [!IMPORTANT] > Keeping Windows Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. @@ -44,14 +44,14 @@ Engine updates are included with the security intelligence updates and are relea Windows Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases. You can manage the distribution of updates through [Windows Server Update Service (WSUS)](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. -For more information see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) +For more information, see [Manage the sources for Windows Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus). > [!NOTE] > We release these monthly updates in phases. This results in multiple packages showing up in your WSUS server. ## Monthly platform and engine versions -For information how to update or how to install the platform update, please see: [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) +For information how to update or how to install the platform update, please see [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform). All our updates contain: * performance improvements @@ -173,7 +173,7 @@ No known issues ## Windows Defender Antivirus platform support As stated above, platform and engine updates are provided on a monthly cadence. -Customers must stay current with the latest platform update to be fully supported. Our support structure is now dynamic, evolving into two phases depending on the availability of the latest platform version. +Customers must stay current with the latest platform update to be fully supported. Our support structure is now dynamic, evolving into two phases depending on the availability of the latest platform version: * **Security and Critical Updates servicing phase** - When running the latest platform version, you will be eligible to receive both Security and Critical updates to the anti-malware platform. @@ -181,9 +181,9 @@ Customers must stay current with the latest platform update to be fully supporte * **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported.* -*Technical support will continue to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version. +\* Technical support will continue to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version. -During the technical support (only) phase, commercially reasonable support incidents will be provided through Microsoft Customer Service & Support and Microsoft’s managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a non-security update, or requires a security update, customers will be asked to upgrade to the latest platform version or an intermediate update(*). +During the technical support (only) phase, commercially reasonable support incidents will be provided through Microsoft Customer Service & Support and Microsoft’s managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a non-security update, or requires a security update, customers will be asked to upgrade to the latest platform version or an intermediate update (*). ### Platform version included with Windows 10 releases The below table provides the Windows Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases: @@ -198,7 +198,7 @@ The below table provides the Windows Defender Antivirus platform and engine vers |1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) | |1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) | -Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) +Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet). ## In this section From 843b8eabb5aedb41c269585c83e001aa5e6b8d54 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 30 Apr 2020 16:13:26 -0700 Subject: [PATCH 148/149] Update linux-install-manually.md --- .../microsoft-defender-atp/linux-install-manually.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 6dbfee2073..747252643a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -248,7 +248,7 @@ unzip WindowsDefenderATPOnboardingPackage.zip > [!IMPORTANT] > When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes. During this time the above command returns a value of `0`.
      - > Please note that you may also need to configure a proxy after completing the initial installation:
      https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration#post-installation-configuration + > Please note that you may also need to configure a proxy after completing the initial installation. See [Configure Microsoft Defender ATP for Linux for static proxy discovery: Post-installation configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration#post-installation-configuration). 5. Run a detection test to verify that the machine is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded machine: From d662874d5c55f1fd2ef9708627a4866663006f3a Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 30 Apr 2020 17:07:15 -0700 Subject: [PATCH 149/149] Indented (or further indented) content in list items --- .../linux-install-manually.md | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 747252643a..1c83c3447b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -204,19 +204,19 @@ Download the onboarding package from Microsoft Defender Security Center: 4. From a command prompt, verify that you have the file. Extract the contents of the archive: -```bash -ls -l -``` + ```bash + ls -l + ``` -`total 8` -`-rw-r--r-- 1 test staff 5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip` + `total 8` + `-rw-r--r-- 1 test staff 5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip` -```bash -unzip WindowsDefenderATPOnboardingPackage.zip -``` + ```bash + unzip WindowsDefenderATPOnboardingPackage.zip + ``` -`Archive: WindowsDefenderATPOnboardingPackage.zip` -`inflating: WindowsDefenderATPOnboarding.py` + `Archive: WindowsDefenderATPOnboardingPackage.zip` + `inflating: WindowsDefenderATPOnboarding.py` ## Client configuration @@ -254,21 +254,21 @@ unzip WindowsDefenderATPOnboardingPackage.zip - Ensure that real-time protection is enabled (denoted by a result of `1` from running the following command): - ```bash - mdatp --health realTimeProtectionEnabled - ``` + ```bash + mdatp --health realTimeProtectionEnabled + ``` - Open a Terminal window. Copy and execute the following command: - ``` bash - curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt - ``` + ``` bash + curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt + ``` - The file should have been quarantined by Microsoft Defender ATP for Linux. Use the following command to list all the detected threats: - ```bash - mdatp --threat --list --pretty - ``` + ```bash + mdatp --threat --list --pretty + ``` ## Log installation issues