From 784a8bae51d4dc42bded73bbd540ad1123b56a61 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Sat, 12 Jun 2021 16:01:10 +0530
Subject: [PATCH 001/119] Updated
---
.../mdm/policies-in-policy-csp-admx-backed.md | 2 +
.../policy-configuration-service-provider.md | 10 ++
.../mdm/policy-csp-admx-networklistmanager.md | 162 ++++++++++++++++++
windows/client-management/mdm/toc.yml | 2 +
4 files changed, 176 insertions(+)
create mode 100644 windows/client-management/mdm/policy-csp-admx-networklistmanager.md
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 6c81fd4df2..7d4bd55974 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -733,6 +733,8 @@ ms.date: 10/08/2020
- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui)
- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics)
- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation)
+- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints)
+- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2)
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index fbe229c166..f04ef812f9 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -2573,6 +2573,16 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_NetworkListManager policies
+
+
+ -
+ ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
+
+ -
+ ADMX_NetworkListManager_ConfiguredTLSAuthenticationNetworkName
+
+
### ADMX_OfflineFiles policies
-
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
new file mode 100644
index 0000000000..3bcfab9825
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -0,0 +1,162 @@
+---
+title: Policy CSP - ADMX_NetworkListManager
+description: Policy CSP - ADMX_NetworkListManager
+ms.author: dansimp
+ms.localizationpriority: medium
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: NimishaSatapathy
+ms.date: 06/11/2021
+ms.reviewer:
+manager: dansimp
+---
+
+# Policy CSP - ADMX_NetworkListManager
+
+> [!WARNING]
+> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
+
+
+
+
+## ADMX_NetworkListManager policies
+
+
+ -
+ ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints
+
+ -
+ ADMX_NetworkListManager/ConfiguredTLsAuthenticatedNetworkName
+
+
+
+
+
+
+**ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints**
+
+
+
+
+ Windows Edition |
+ Supported? |
+
+
+ Home |
+  |
+
+
+ Pro |
+  |
+
+
+ Business |
+  |
+
+
+ Enterprise |
+  |
+
+
+ Education |
+  |
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Machine
+
+
+
+
+
+List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+
+
+> [!TIP]
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+>
+> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+>
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+
+
+ADMX Info:
+- GP English name: *Creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure*
+- GP name: *NetworkListManager/AllowedTlsAuthenticationEndpoints*
+- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
+- GP ADMX file name: *NetworkListManager.admx*
+
+
+
+
+
+
+**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
+
+
+
+
+ Windows Edition |
+ Supported? |
+
+
+ Home |
+  |
+
+
+ Pro |
+  |
+
+
+ Business |
+  |
+
+
+ Enterprise |
+  |
+
+
+ Education |
+  |
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Machine
+
+
+
+
+
+The string to be used to name the network authenticated against one of the endpoints listed in *NetworkListManager/AllowedTlsAuthenticationEndpoints* policy.
+
+> [!TIP]
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+>
+> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+>
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+
+
+ADMX Info:
+- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks*
+- GP name: *NetworkListManager/ConfiguredTLSAuthenticationNetworkName*
+- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
+- GP ADMX file name: *NetworkListManager.admx*
+
+
+
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index 8680bff0db..d6032a06af 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -519,6 +519,8 @@ items:
href: policy-csp-admx-netlogon.md
- name: ADMX_NetworkConnections
href: policy-csp-admx-networkconnections.md
+ - name: ADMX_NetworkListManager
+ href: policy-csp-admx-networklistmanager.md
- name: ADMX_OfflineFiles
href: policy-csp-admx-offlinefiles.md
- name: ADMX_PeerToPeerCaching
From 19b71ff2ef545a4831b2f79fa8f93db6dd696f93 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 14 Jun 2021 15:00:58 +0530
Subject: [PATCH 002/119] Update policies-in-policy-csp-admx-backed.md
---
.../mdm/policies-in-policy-csp-admx-backed.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 7d4bd55974..557e212d5d 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -733,8 +733,8 @@ ms.date: 10/08/2020
- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui)
- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics)
- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation)
-- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints)
-- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
+- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints)
+- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2)
From 6b05bcc9a7d8dde988e85d7aec658654870d3472 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 21 Jun 2021 15:23:20 +0530
Subject: [PATCH 003/119] Update policy-csp-admx-networklistmanager.md
---
.../mdm/policy-csp-admx-networklistmanager.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
index 3bcfab9825..2f0f6cead2 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -24,17 +24,17 @@ manager: dansimp
-
- ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints
+ ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints
-
- ADMX_NetworkListManager/ConfiguredTLsAuthenticatedNetworkName
+ ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
-**ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints**
+**ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints**
From aef01d2991f0620c8ae8e598e84f883119d275f8 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 21 Jun 2021 15:31:38 +0530
Subject: [PATCH 004/119] up
---
.../client-management/mdm/policies-in-policy-csp-admx-backed.md | 2 +-
.../client-management/mdm/policy-csp-admx-networklistmanager.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 557e212d5d..3cb809553f 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -733,7 +733,7 @@ ms.date: 10/08/2020
- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui)
- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics)
- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation)
-- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints)
+- [ADMX_NetworkListManager-AllowedTlsAuthenticationEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticationendpoints)
- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1)
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
index 2f0f6cead2..40de373e96 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -24,7 +24,7 @@ manager: dansimp
-
- ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints
+ ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
-
ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
From d6af85097ef258da0393fe6fdf13a7a95b56fd55 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 21 Jun 2021 19:15:48 +0530
Subject: [PATCH 005/119] Update policy-csp-admx-networklistmanager.md
---
.../client-management/mdm/policy-csp-admx-networklistmanager.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
index 40de373e96..7d7619c1d7 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -34,7 +34,7 @@ manager: dansimp
-**ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints**
+**ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints**
From ccf432d723a0d0ac2ed36cd30de854d04075580a Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 21 Jun 2021 19:27:41 +0530
Subject: [PATCH 006/119] Update policy-csp-admx-networklistmanager.md
---
.../mdm/policy-csp-admx-networklistmanager.md | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
index 7d7619c1d7..5901b7e3e1 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -25,11 +25,9 @@ manager: dansimp
-
ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
-
-
ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
-
@@ -99,7 +97,8 @@ ADMX Info:
-**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
+**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
+
From f7d9f560f4850071180dbf979c9fc3b70884532a Mon Sep 17 00:00:00 2001
From: Kim Klein
Date: Tue, 22 Jun 2021 14:42:40 -0700
Subject: [PATCH 007/119] Added the NTSATUS section
---
.../event-tag-explanations.md | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index 2ae5aa34a4..a8d2a29659 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -120,3 +120,7 @@ The rule means trust anything signed by a certificate that chains to this root C
| 19 | Microsoft ECC Devices Root CA 2017 |
For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file.
+
+## NTSTATUS Values
+
+Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details.
From 89ef49a2a467f46296f9a00b87e25e1582ca4814 Mon Sep 17 00:00:00 2001
From: Kim Klein
Date: Tue, 22 Jun 2021 14:59:45 -0700
Subject: [PATCH 008/119] Updated the section name
---
.../event-tag-explanations.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index a8d2a29659..1d237cd396 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -121,6 +121,6 @@ The rule means trust anything signed by a certificate that chains to this root C
For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file.
-## NTSTATUS Values
+## Status Values
Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details.
From 227442b0184fa827a9b27a987f3e19846275dea2 Mon Sep 17 00:00:00 2001
From: Kim Klein
Date: Wed, 23 Jun 2021 14:58:51 -0700
Subject: [PATCH 009/119] Included suggested edits to Status values section
---
.../event-tag-explanations.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index 1d237cd396..d19f762683 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -121,6 +121,6 @@ The rule means trust anything signed by a certificate that chains to this root C
For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file.
-## Status Values
+## Status values
-Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details.
+Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details.
From 862685107a8767e4d07af0691a39146d429cdc76 Mon Sep 17 00:00:00 2001
From: Oscar Beaumont
Date: Sun, 27 Jun 2021 02:48:57 +1000
Subject: [PATCH 010/119] fixed invalid MDM Federated enrollment example code
The example is missing a closing s:Envelope tag.
---
.../mdm/federated-authentication-device-enrollment.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md
index 858a51a88b..27a1b064ae 100644
--- a/windows/client-management/mdm/federated-authentication-device-enrollment.md
+++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md
@@ -119,6 +119,7 @@ The following example shows the discovery service request.
+
```
The discovery response is in the XML format and includes the following fields:
@@ -627,4 +628,4 @@ The following code shows sample provisioning XML (presented in the preceding pac
- Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document.
- The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique.
- Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate.
-- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it.
\ No newline at end of file
+- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it.
From 025f819512f0a9fc772ffae451615af987a20de0 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Wed, 30 Jun 2021 20:18:05 +0530
Subject: [PATCH 011/119] Updated
---
.../mdm/policies-in-policy-csp-admx-backed.md | 2 -
.../policy-configuration-service-provider.md | 22 +++---
...er.md => policy-csp-networklistmanager.md} | 76 ++++++++++++-------
windows/client-management/mdm/toc.yml | 2 +
4 files changed, 62 insertions(+), 40 deletions(-)
rename windows/client-management/mdm/{policy-csp-admx-networklistmanager.md => policy-csp-networklistmanager.md} (53%)
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 3cb809553f..6c81fd4df2 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -733,8 +733,6 @@ ms.date: 10/08/2020
- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui)
- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics)
- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation)
-- [ADMX_NetworkListManager-AllowedTlsAuthenticationEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticationendpoints)
-- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2)
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index f04ef812f9..57262a6ce7 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -2573,16 +2573,6 @@ The following diagram shows the Policy configuration service provider in tree fo
-### ADMX_NetworkListManager policies
-
-
- -
- ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
-
- -
- ADMX_NetworkListManager_ConfiguredTLSAuthenticationNetworkName
-
-
### ADMX_OfflineFiles policies
-
@@ -7077,6 +7067,18 @@ The following diagram shows the Policy configuration service provider in tree fo
+### NetworkListManager policies
+
+
+ -
+ NetworkListManager/AllowedTlsAuthenticationEndpoints
+
+ -
+ NetworkListManager/ConfiguredTLSAuthenticationNetworkName
+
+ -
+
+
### Notifications policies
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
similarity index 53%
rename from windows/client-management/mdm/policy-csp-admx-networklistmanager.md
rename to windows/client-management/mdm/policy-csp-networklistmanager.md
index 5901b7e3e1..d8d7be2137 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -1,38 +1,40 @@
---
-title: Policy CSP - ADMX_NetworkListManager
-description: Policy CSP - ADMX_NetworkListManager
+title: Policy CSP - NetworkListManager
+description: The Policy CSP - NetworkListManager setting creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure.
ms.author: dansimp
-ms.localizationpriority: medium
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: NimishaSatapathy
-ms.date: 06/11/2021
+author: nimishasatapathy
+ms.localizationpriority: medium
+ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
---
-# Policy CSP - ADMX_NetworkListManager
+# Policy CSP - NetworkListManager
+
-> [!WARNING]
-> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
-## ADMX_NetworkListManager policies
+## NetworkListManager policies
-
- ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
-
-
- ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
+ NetworkListManager/AllowedTlsAuthenticationEndpoints
+ -
+ NetworkListManager/ConfiguredTLSAuthenticationNetworkName
+
+
+
-**ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints**
+**NetworkListManager/AllowedTlsAuthenticationEndpoints**
@@ -46,11 +48,11 @@ manager: dansimp
Pro |
-  |
+  |
Business |
-  |
+  |
Enterprise |
@@ -58,7 +60,7 @@ manager: dansimp
Education |
-  |
+  |
@@ -75,15 +77,15 @@ manager: dansimp
-List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+This policy setting provides the list of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
>
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
>
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
ADMX Info:
@@ -96,9 +98,11 @@ ADMX Info:
-
-**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
+
+
+
+**NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
@@ -112,11 +116,11 @@ ADMX Info:
Pro |
-  |
+  |
Business |
-  |
+  |
Enterprise |
@@ -124,7 +128,7 @@ ADMX Info:
Education |
-  |
+  |
@@ -141,21 +145,37 @@ ADMX Info:
-The string to be used to name the network authenticated against one of the endpoints listed in *NetworkListManager/AllowedTlsAuthenticationEndpoints* policy.
+This policy setting provides The string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy.
+
> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
>
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
>
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
ADMX Info:
-- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks*
+- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks*
- GP name: *NetworkListManager/ConfiguredTLSAuthenticationNetworkName*
- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
- GP ADMX file name: *NetworkListManager.admx*
+
+
+Footnotes:
+
+- 1 - Available in Windows 10, version 1607.
+- 2 - Available in Windows 10, version 1703.
+- 3 - Available in Windows 10, version 1709.
+- 4 - Available in Windows 10, version 1803.
+- 5 - Available in Windows 10, version 1809.
+- 6 - Available in Windows 10, version 1903.
+- 7 - Available in Windows 10, version 1909.
+- 8 - Available in Windows 10, version 2004.
+
+
+
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index d6032a06af..f9a7d7ef62 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -727,6 +727,8 @@ items:
href: policy-csp-multitasking.md
- name: NetworkIsolation
href: policy-csp-networkisolation.md
+ - name: NetworkLinkManager
+ href: policy-csp-networklinkmanager.md
- name: Notifications
href: policy-csp-notifications.md
- name: Power
From d98ebe6e68ebf891177a768ecdc307d9cfd1f31c Mon Sep 17 00:00:00 2001
From: tramcrazy <81013186+tramcrazy@users.noreply.github.com>
Date: Fri, 2 Jul 2021 18:48:00 +0100
Subject: [PATCH 012/119] Add capital letter
Minor capitalisation fix
---
windows/whats-new/windows-11-plan.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/whats-new/windows-11-plan.md b/windows/whats-new/windows-11-plan.md
index 17d61a7125..5af0900b7e 100644
--- a/windows/whats-new/windows-11-plan.md
+++ b/windows/whats-new/windows-11-plan.md
@@ -39,7 +39,7 @@ If you are looking for ways to optimize your approach to deploying Windows 11, o
As a first step, you will need to know which of your current devices meet the Windows 11 hardware requirements. Most devices purchased in the last 18-24 months will be compatible with Windows 11. Verify that your device meets or exceeds [Windows 11 requirements](windows-11-requirements.md) to ensure it is compatible.
-Microsoft is currently developing analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. When Windows 11 reaches general availability, end-users running Windows 10 Home, Pro, and Pro for Workstations will be able to use the **PC Health Check** app to determine their eligibility for Windows 11. end-users running Windows 10 Enterprise and Education editions should rely on their IT administrators to let them know when they are eligible for the upgrade.
+Microsoft is currently developing analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. When Windows 11 reaches general availability, end-users running Windows 10 Home, Pro, and Pro for Workstations will be able to use the **PC Health Check** app to determine their eligibility for Windows 11. End-users running Windows 10 Enterprise and Education editions should rely on their IT administrators to let them know when they are eligible for the upgrade.
Enterprise organizations looking to evaluate device readiness in their environments can expect this capability to be integrated into existing Microsoft tools, such as Endpoint analytics and Update Compliance. This capability will be available when Windows 11 is generally available. Microsoft is also working with software publishing partners to facilitate adding Windows 11 device support into their solutions.
From aa62b6e5391931a44bc607367692416ddee2e5f3 Mon Sep 17 00:00:00 2001
From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com>
Date: Sun, 4 Jul 2021 21:04:33 +0530
Subject: [PATCH 013/119] added MECM and WSUS links are added
as per user feedback #9778 , so i added below two links
**https://docs.microsoft.com/mem/configmgr/**
**https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus**
---
windows/whats-new/windows-11-prepare.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md
index 5ccbff2c5b..a1176e6d14 100644
--- a/windows/whats-new/windows-11-prepare.md
+++ b/windows/whats-new/windows-11-prepare.md
@@ -33,12 +33,12 @@ The tools that you use for core workloads during Windows 10 deployments can stil
#### On-premises solutions
-- If you use Windows Server Update Service (WSUS), you will need to sync the new **Windows 11** product category. After you sync the product category, you will see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well.
+- If you use [Windows Server Update Service (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you will need to sync the new **Windows 11** product category. After you sync the product category, you will see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well.
> [!NOTE]
> During deployment, you will be prompted to agree to the End User License Agreement on behalf of your users. Additionally, you will not see an x86 option because Windows 11 is not supported on 32-bit architecture.
-- If you use Microsoft Endpoint Configuration Manager, you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well.
+- If you use [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/), you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well.
> [!NOTE]
> Configuration Manager will prompt you to accept the End User License Agreement on behalf of the users in your organization.
From 410525fef1cb81c15a0176ab0393acefb2d8922d Mon Sep 17 00:00:00 2001
From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com>
Date: Mon, 5 Jul 2021 13:08:19 +0530
Subject: [PATCH 014/119] Update windows/whats-new/windows-11-prepare.md
accepted
Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
---
windows/whats-new/windows-11-prepare.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md
index a1176e6d14..81b9b3d6a9 100644
--- a/windows/whats-new/windows-11-prepare.md
+++ b/windows/whats-new/windows-11-prepare.md
@@ -33,7 +33,7 @@ The tools that you use for core workloads during Windows 10 deployments can stil
#### On-premises solutions
-- If you use [Windows Server Update Service (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you will need to sync the new **Windows 11** product category. After you sync the product category, you will see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well.
+- If you use [Windows Server Update Service (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you will need to sync the new **Windows 11** product category. After you sync the product category, you will see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well.
> [!NOTE]
> During deployment, you will be prompted to agree to the End User License Agreement on behalf of your users. Additionally, you will not see an x86 option because Windows 11 is not supported on 32-bit architecture.
From cc5d8b7d7692fe93b019054569af3d6c085cb3b8 Mon Sep 17 00:00:00 2001
From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com>
Date: Mon, 5 Jul 2021 13:08:55 +0530
Subject: [PATCH 015/119] Update windows/whats-new/windows-11-prepare.md
accepted
Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
---
windows/whats-new/windows-11-prepare.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md
index 81b9b3d6a9..b114202776 100644
--- a/windows/whats-new/windows-11-prepare.md
+++ b/windows/whats-new/windows-11-prepare.md
@@ -38,7 +38,7 @@ The tools that you use for core workloads during Windows 10 deployments can stil
> [!NOTE]
> During deployment, you will be prompted to agree to the End User License Agreement on behalf of your users. Additionally, you will not see an x86 option because Windows 11 is not supported on 32-bit architecture.
-- If you use [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/), you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well.
+- If you use [Microsoft Endpoint Configuration Manager](/mem/configmgr/), you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well.
> [!NOTE]
> Configuration Manager will prompt you to accept the End User License Agreement on behalf of the users in your organization.
From 42de6f1f5288d164f0fc07e071ca322a5d6bc746 Mon Sep 17 00:00:00 2001
From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com>
Date: Fri, 9 Jul 2021 21:39:42 +0530
Subject: [PATCH 016/119] fixed typo error
as per user report #9790 , so I have corrected the word **Havens** to **Hagens**
---
.../password-must-meet-complexity-requirements.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
index c40865f9da..adc677996b 100644
--- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
+++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
@@ -31,7 +31,7 @@ The **Passwords must meet complexity requirements** policy setting determines wh
1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks are not case-sensitive.
The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is fewer than three characters long, this check is skipped.
- The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Havens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "havens" as a substring anywhere in the password.
+ The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "havens" as a substring anywhere in the password.
2. The password contains characters from three of the following categories:
From 061c07a4bc3658368ff7152de2bc9532b265d910 Mon Sep 17 00:00:00 2001
From: Maggie Dakeva
Date: Fri, 9 Jul 2021 15:38:31 -0700
Subject: [PATCH 017/119] Update
enroll-a-windows-10-device-automatically-using-group-policy.md
Removing a note since it's not accurate. The note below which states that Device credential is supported for Co-management and Azure Virtual Desktop is accurate.
---
...oll-a-windows-10-device-automatically-using-group-policy.md | 3 ---
1 file changed, 3 deletions(-)
diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md
index 775e72cacd..1274fdb476 100644
--- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md
+++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md
@@ -117,9 +117,6 @@ Requirements:
4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use.
- > [!NOTE]
- > **Device Credential** Credential Type may work, however, it is not yet supported by Intune. We don't recommend using this option until it's supported.
-

5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**.
From 551d62f8d74e9ba3ab19cbe963b610673c5c563b Mon Sep 17 00:00:00 2001
From: gkomatsu
Date: Fri, 9 Jul 2021 17:05:29 -0700
Subject: [PATCH 018/119] Update diagnose-mdm-failures-in-windows-10.md
Removed Windows Mobile specific content "Field Medic" section
---
.../diagnose-mdm-failures-in-windows-10.md | 68 -------------------
1 file changed, 68 deletions(-)
diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md
index 3bd7186d4f..6043b61d8c 100644
--- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md
+++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md
@@ -133,74 +133,6 @@ Example: Export the Debug logs
```
-**To collect logs manually**
-
-1. Download and install the [Field Medic]( https://go.microsoft.com/fwlink/p/?LinkId=718232) app from the store.
-2. Open the Field Medic app and then click on **Advanced**.
-
- 
-
-3. Click on **Choose with ETW provider to use**.
-
- 
-
-4. Check **Enterprise** and un-check the rest.
-
- 
-
-5. In the app, click on **Start Logging** and then perform the operation that you want to troubleshoot.
-
- 
-
-6. When the operation is done, click on **Stop Logging**.
-
- 
-
-7. Save the logs. They will be stored in the Field Medic log location on the device.
-8. You can send the logs via email by attaching the files from **Documents > Field Medic > Reports > ...** folder.
-
- 
-
-The following table contains a list of common providers and their corresponding GUIDs.
-
-| GUID | Provider Name |
-|--------------------------------------|--------------------------------------------------------|
-| 099614a5-5dd7-4788-8bc9-e29f43db28fc | Microsoft-Windows-LDAP-Client |
-| 0f67e49f-fe51-4e9f-b490-6f2948cc6027 | Microsoft-Windows-Kernel-Processor-Power |
-| 0ff1c24b-7f05-45c0-abdc-3c8521be4f62 | Microsoft-Windows-Mobile-Broadband-Experience-SmsApi |
-| 10e4f0e0-9686-4e62-b2d6-fd010eb976d3 | Microsoft-WindowsPhone-Shell-Events |
-| 1e39b4ce-d1e6-46ce-b65b-5ab05d6cc266 | Microsoft-Windows-Networking-RealTimeCommunication |
-| 22a7b160-f6e8-46b9-8e0b-a51989c85c66 | Microsoft-WindowsPhone-Bluetooth-AG |
-| 2f94e1cc-a8c5-4fe7-a1c3-53d7bda8e73e | Microsoft-WindowsPhone-ConfigManager2 |
-| 331c3b3a-2005-44c2-ac5e-77220c37d6b4 | Microsoft-Windows-Kernel-Power |
-| 33693e1d-246a-471b-83be-3e75f47a832d | Microsoft-Windows-BTH-BTHUSB |
-| 3742be72-99a9-42e6-9fd5-c01a330e3625 | Microsoft-WindowsPhone-PhoneAudio |
-| 3b9602ff-e09b-4c6c-bc19-1a3dfa8f2250 | Microsoft-WindowsPhone-OmaDm-Client-Provider |
-| 3da494e4-0fe2-415C-b895-fb5265c5c83b | Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider |
-| 3f471139-acb7-4a01-b7a7-ff5da4ba2d43 | Microsoft-Windows-AppXDeployment-Server |
-| 4180c4f7-e238-5519-338f-ec214f0b49aa | Microsoft.Windows.ResourceManager |
-| 4637124c-1d40-4b4d-892f-2aaecf24ff06 | Microsoft-Windows-WinJson |
-| 4d13548f-c7b8-4174-bb7a-d7f64bf22d29 | Microsoft-WindowsPhone-LocationServiceProvider |
-| 4eacb4d0-263b-4b93-8cd6-778a278e5642 | Microsoft-Windows-GenericRoaming |
-| 4f386063-ef17-4629-863c-d71597af743d | Microsoft-WindowsPhone-NotificationService |
-| 55404e71-4db9-4deb-a5f5-8f86e46dde56 | Microsoft-Windows-Winsock-NameResolution |
-| 59819d0a-adaf-46b2-8d7c-990bc39c7c15 | Microsoft-Windows-Battery |
-| 5c103042-7e75-4629-a748-bdfa67607fac | Microsoft-WindowsPhone-Power |
-| 69c1c3f1-2b5c-41d0-a14a-c7ca5130640e | Microsoft-WindowsPhone-Cortana |
-| 6ad52b32-d609-4be9-ae07-ce8dae937e39 | Microsoft-Windows-RPC |
-| 7263516b-6eb0-477b-b64f-17b91d29f239 | Microsoft-WindowsPhone-BatterySense |
-| 7dd42a49-5329-4832-8dfd-43d979153a88 | Microsoft-Windows-Kernel-Network |
-| ae4bd3be-f36f-45b6-8d21-bdd6fb832853 | Microsoft-Windows-Audio |
-| daa6a96b-f3e7-4d4d-a0d6-31a350e6a445 | Microsoft-Windows-WLAN-Driver |
-| 4d13548f-c7b8-4174-bb7a-d7f64bf22d29 | Microsoft-WindowsPhone-LocationServiceProvider |
-| 74e106b7-00be-4a55-b707-7ab58d6a9e90 | Microsoft-WindowsPhone-Shell-OOBE |
-| cbda4dbf-8d5d-4f69-9578-be14aa540d22 | Microsoft-Windows-AppLocker |
-| e595f735-b42a-494b-afcd-b68666945cd3 | Microsoft-Windows-Firewall |
-| e5fc4a0f-7198-492f-9b0f-88fdcbfded48 | Microsoft-Windows Networking VPN |
-| e5c16d49-2464-4382-bb20-97a4b5465db9 | Microsoft-Windows-WiFiNetworkManager |
-
- -->
-
## Collect logs remotely from Windows 10 Holographic
For holographic already enrolled in MDM, you can remotely collect MDM logs through the MDM channel using the [DiagnosticLog CSP](diagnosticlog-csp.md).
From 00d2ef396b1bcb34f2b70bf5dcfb72b763a6d403 Mon Sep 17 00:00:00 2001
From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com>
Date: Sat, 10 Jul 2021 17:22:22 +0530
Subject: [PATCH 019/119] Update
windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
accepted
Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
---
.../password-must-meet-complexity-requirements.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
index adc677996b..2167a3d000 100644
--- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
+++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
@@ -31,7 +31,7 @@ The **Passwords must meet complexity requirements** policy setting determines wh
1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks are not case-sensitive.
The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is fewer than three characters long, this check is skipped.
- The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "havens" as a substring anywhere in the password.
+ The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password.
2. The password contains characters from three of the following categories:
From 269c72b0590e8e4deaa754a5cd70f138ed212ebc Mon Sep 17 00:00:00 2001
From: Kim Klein
Date: Mon, 12 Jul 2021 10:50:43 -0700
Subject: [PATCH 020/119] Corrected cmdlet misspellings
---
.../select-types-of-rules-to-create.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index 29cd125c84..33529a500c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -27,9 +27,9 @@ ms.technology: mde
Windows Defender Application Control (WDAC) can control what runs on Windows 10 by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted.
-## Getting started with commdlets
+## Getting started with cmdlets
-Some of the [SKUs](feature-availability.md) that support our PowerShell commandlets [(ConfigCI Module)](/powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box.
+Some of the [SKUs](feature-availability.md) that support our PowerShell cmdlets [(ConfigCI Module)](/powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box.
**Steps to install the module:**
- Install-Module "ConfigCI"
From 77ed05c3409eb6a5ea1d4305dd3db2f8adb14aa8 Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Mon, 12 Jul 2021 12:23:32 -0700
Subject: [PATCH 021/119] Update select-types-of-rules-to-create.md
---
.../select-types-of-rules-to-create.md | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index 33529a500c..e6b9a0016a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -14,7 +14,7 @@ author: jsuther1974
ms.reviewer: isbrahm
ms.author: dansimp
manager: dansimp
-ms.date: 03/04/2020
+ms.date: 07/12/2021
ms.technology: mde
---
@@ -31,7 +31,7 @@ Windows Defender Application Control (WDAC) can control what runs on Windows 10
Some of the [SKUs](feature-availability.md) that support our PowerShell cmdlets [(ConfigCI Module)](/powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box.
-**Steps to install the module:**
+### Steps to install the module
- Install-Module "ConfigCI"
- Import-Module "ConfigCI"
@@ -54,7 +54,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru
> [!NOTE]
> We recommend that you use **Enabled:Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. To allow these applications, you can capture the policy information from the event log, and then merge that information into the existing policy. When the **Enabled:Audit Mode** is deleted, the policy runs in enforced mode.
-**Table 1. Windows Defender Application Control policy - policy rule options**
+### Table 1. Windows Defender Application Control policy - policy rule options
| Rule option | Description |
|------------ | ----------- |
@@ -96,7 +96,7 @@ File rule levels allow administrators to specify the level at which they want to
Each file rule level has its benefit and disadvantage. Use Table 2 to select the appropriate protection level for your available administrative resources and Windows Defender Application Control deployment scenario.
-**Table 2. Windows Defender Application Control policy - file rule levels**
+### Table 2. Windows Defender Application Control policy - file rule levels
| Rule level | Description |
|----------- | ----------- |
@@ -172,7 +172,7 @@ File name rule levels let you specify file attributes to base a rule on. File na
Use Table 3 to select the appropriate file name level for your use cases. For instance, an LOB or production application and its binaries may all share the same product name. This option lets you easily create targeted policies based on the Product Name filename rule level.
-**Table 3. Windows Defender Application Control policy - filename levels**
+### Table 3. Windows Defender Application Control policy - filename levels
| Rule level | Description |
|----------- | ----------- |
From d30945490824ae56b5d8f7aae799c0e70b923ba9 Mon Sep 17 00:00:00 2001
From: gkomatsu
Date: Mon, 12 Jul 2021 15:11:40 -0700
Subject: [PATCH 022/119] Update configuration-service-provider-reference.md
Corrected support of UEFI CSP. Professional cross mark -> Check mark
---
.../mdm/configuration-service-provider-reference.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md
index 4dc856f036..a780da0495 100644
--- a/windows/client-management/mdm/configuration-service-provider-reference.md
+++ b/windows/client-management/mdm/configuration-service-provider-reference.md
@@ -2156,7 +2156,7 @@ Additional lists:
 |
-  |
+  |
4 |
4 |
4 |
From a5cabf972ee453c68bb15477aaafaa5ba71010b0 Mon Sep 17 00:00:00 2001
From: Gary Moore
Date: Mon, 12 Jul 2021 22:04:04 -0700
Subject: [PATCH 023/119] Changes to raise the Acrolinx score
This work is so that sync PR https://github.com/MicrosoftDocs/windows-docs-pr/pull/5382 can be merged.
---
...sword-must-meet-complexity-requirements.md | 38 +++++++++----------
1 file changed, 19 insertions(+), 19 deletions(-)
diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
index 2167a3d000..1a74bf2b3a 100644
--- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
+++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
@@ -28,10 +28,10 @@ Describes the best practices, location, values, and security considerations for
The **Passwords must meet complexity requirements** policy setting determines whether passwords must meet a series of strong-password guidelines. When enabled, this setting requires passwords to meet the following requirements:
-1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks are not case-sensitive.
+1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks aren't case-sensitive.
- The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is fewer than three characters long, this check is skipped.
- The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password.
+ The samAccountName is checked in its entirety only to determine whether it's part of the password. If the samAccountName is fewer than three characters long, this check is skipped.
+ The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens aren't checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it's ignored. So, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password.
2. The password contains characters from three of the following categories:
@@ -47,7 +47,7 @@ Complexity requirements are enforced when passwords are changed or created.
The rules that are included in the Windows Server password complexity requirements are part of Passfilt.dll, and they cannot be directly modified.
-When enabled, the default Passfilt.dll may cause some additional Help Desk calls for locked-out accounts because users aren't used to passwords that contain characters that aren't in the alphabet. But this policy setting is liberal enough that all users should get used to it.
+When enabled, the default Passfilt.dll may cause some more Help Desk calls for locked-out accounts, because users are used to passwords that contain only characters that are in the alphabet. But this policy setting is liberal enough that all users should get used to it.
Additional settings that can be included in a custom Passfilt.dll are the use of non–upper-row characters. To type upper-row characters, you hold the SHIFT key and press one of any of the keys on the number row of the keyboard (from 1 through 9 and 0).
@@ -64,7 +64,7 @@ Additional settings that can be included in a custom Passfilt.dll are the use of
Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 218,340,105,584,896 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible.
-The use of ALT key character combinations can greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements can result in unhappy users and an over-worked Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of that range can represent standard alphanumeric characters that do not add additional complexity to the password.)
+The use of ALT key character combinations may greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements might result in unhappy users and an over-worked Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of that range can represent standard alphanumeric characters that do not add more complexity to the password.)
Passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and meet complexity requirements.
@@ -74,16 +74,16 @@ Passwords that contain only alphanumeric characters are easy to compromise by us
### Default values
-The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
+The following table lists the actual and effective default policy values. Default values are also listed on the policy's property page.
| Server type or Group Policy Object (GPO) | Default value |
-| - | - |
-| Default domain policy| Enabled|
-| Default domain controller policy| Enabled|
-| Stand-alone server default settings | Disabled|
-| Domain controller effective default settings | Enabled|
-| Member server effective default settings | Enabled|
-| Effective GPO default settings on client computers | Disabled|
+|---|---|
+| Default domain policy | Enabled |
+| Default domain controller policy | Enabled |
+| Stand-alone server default settings | Disabled |
+| Domain controller effective default settings | Enabled |
+| Member server effective default settings | Enabled|
+| Effective GPO default settings on client computers | Disabled |
## Security considerations
@@ -91,21 +91,21 @@ This section describes how an attacker might exploit a feature or its configurat
### Vulnerability
-Passwords that contain only alphanumeric characters are extremely easy to discover with several publicly available tools.
+Passwords that contain only alphanumeric characters are easy to discover with several publicly available tools.
### Countermeasure
-Configure the **Passwords must meet complexity requirements** policy setting to Enabled and advise users to use a variety of characters in their passwords.
+Configure the **Passwords must meet complexity requirements** policy setting to _Enabled_ and advise users to use a variety of characters in their passwords.
-When combined with a [Minimum password length](minimum-password-length.md) of 8, this policy setting ensures that the number of different possibilities for a single password is so great that it is difficult (but not impossible) for a brute force attack to succeed. (If the Minimum password length policy setting is increased, the average amount of time necessary for a successful attack also increases.)
+When combined with a [Minimum password length](minimum-password-length.md) of 8, this policy setting ensures that the number of different possibilities for a single password is so great that it's difficult (but possible) for a brute force attack to succeed. (If the Minimum password length policy setting is increased, the average amount of time necessary for a successful attack also increases.)
### Potential impact
-If the default password complexity configuration is retained, additional Help Desk calls for locked-out accounts could occur because users might not be accustomed to passwords that contain non-alphabetical characters, or they might have problems entering passwords that contain accented characters or symbols on keyboards with different layouts. However, all users should be able to comply with the complexity requirement with minimal difficulty.
+If the default configuration for password complexity is kept, more Help Desk calls for locked-out accounts could occur because users might not be used to passwords that contain non-alphabetical characters, or they might have problems entering passwords that contain accented characters or symbols on keyboards with different layouts. However, all users should be able to follow the complexity requirement with minimal difficulty.
-If your organization has more stringent security requirements, you can create a custom version of the Passfilt.dll file that allows the use of arbitrarily complex password strength rules. For example, a custom password filter might require the use of non-upper-row symbols. (Upper-row symbols are those that require you to press and hold the SHIFT key and then press any of the keys on the number row of the keyboard, from 1 through 9 and 0.) A custom password filter might also perform a dictionary check to verify that the proposed password does not contain common dictionary words or fragments.
+If your organization has more stringent security requirements, you can create a custom version of the Passfilt.dll file that allows the use of arbitrarily complex password strength rules. For example, a custom password filter might require the use of non-upper-row symbols. (Upper-row symbols are those symbols that require you to press and hold the SHIFT key and then press any of the keys on the number row of the keyboard, from 1 through 9 and 0.) A custom password filter might also perform a dictionary check to verify that the proposed password doesn't contain common dictionary words or fragments.
-The use of ALT key character combinations can greatly enhance the complexity of a password. However, such stringent password requirements can result in additional Help Desk requests. Alternatively, your organization could consider a requirement for all administrator passwords to use ALT characters in the 0128–0159 range. (ALT characters outside of this range can represent standard alphanumeric characters that would not add additional complexity to the password.)
+The use of ALT key character combinations may greatly enhance the complexity of a password. However, such stringent password requirements might result in more Help Desk requests. Alternatively, your organization could consider a requirement for all administrator passwords to use ALT characters in the 0128–0159 range. (ALT characters outside of this range can represent standard alphanumeric characters that wouldn't add more complexity to the password.)
## Related articles
From 1e90e9f4c81e499d996cfaa5e30825b0c964b236 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Tue, 13 Jul 2021 22:03:30 +0530
Subject: [PATCH 024/119] Updated
---
.../mdm/policy-csp-networklistmanager.md | 17 ++++++++---------
windows/client-management/mdm/toc.yml | 4 ++--
2 files changed, 10 insertions(+), 11 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
index d8d7be2137..13da8d30a4 100644
--- a/windows/client-management/mdm/policy-csp-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -1,13 +1,13 @@
---
title: Policy CSP - NetworkListManager
description: The Policy CSP - NetworkListManager setting creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure.
-ms.author: dansimp
+ms.author: v-nsatapathy
ms.topic: article
ms.prod: w10
ms.technology: windows
author: nimishasatapathy
ms.localizationpriority: medium
-ms.date: 09/27/2019
+ms.date: 7/10/2021
ms.reviewer:
manager: dansimp
---
@@ -15,7 +15,6 @@ manager: dansimp
# Policy CSP - NetworkListManager
-
@@ -48,11 +47,11 @@ manager: dansimp
Pro |
-  |
+  |
Business |
-  |
+  |
Enterprise |
@@ -60,7 +59,7 @@ manager: dansimp
Education |
-  |
+  |
@@ -116,11 +115,11 @@ ADMX Info:
Pro |
-  |
+  |
Business |
-  |
+  |
Enterprise |
@@ -128,7 +127,7 @@ ADMX Info:
Education |
-  |
+  |
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index f9a7d7ef62..0b96b10953 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -727,8 +727,8 @@ items:
href: policy-csp-multitasking.md
- name: NetworkIsolation
href: policy-csp-networkisolation.md
- - name: NetworkLinkManager
- href: policy-csp-networklinkmanager.md
+ - name: NetworkListManager
+ href: policy-csp-networklistmanager.md
- name: Notifications
href: policy-csp-notifications.md
- name: Power
From 6d86539e91a7d9ff4a09cc75250d80242928fde3 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Tue, 13 Jul 2021 22:14:57 +0530
Subject: [PATCH 025/119] Update toc.yml
---
windows/client-management/mdm/toc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index 0b96b10953..51a0630b08 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -728,7 +728,7 @@ items:
- name: NetworkIsolation
href: policy-csp-networkisolation.md
- name: NetworkListManager
- href: policy-csp-networklistmanager.md
+ href: policy-csp-networklistmanager.md
- name: Notifications
href: policy-csp-notifications.md
- name: Power
From 94b4379cd2804c471a49451ffe7d129e50934136 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Tue, 13 Jul 2021 23:18:17 +0530
Subject: [PATCH 026/119] Update policy-csp-networklistmanager.md
---
.../mdm/policy-csp-networklistmanager.md | 47 +------------------
1 file changed, 1 insertion(+), 46 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
index 13da8d30a4..4328d1b831 100644
--- a/windows/client-management/mdm/policy-csp-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -78,23 +78,6 @@ manager: dansimp
This policy setting provides the list of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
-
-> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
->
-> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
->
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
-
-ADMX Info:
-- GP English name: *Creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure*
-- GP name: *NetworkListManager/AllowedTlsAuthenticationEndpoints*
-- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
-- GP ADMX file name: *NetworkListManager.admx*
-
-
-
@@ -144,37 +127,9 @@ ADMX Info:
-This policy setting provides The string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy.
+This policy setting provides the string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy.
-
-> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
->
-> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
->
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
-
-ADMX Info:
-- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks*
-- GP name: *NetworkListManager/ConfiguredTLSAuthenticationNetworkName*
-- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
-- GP ADMX file name: *NetworkListManager.admx*
-
-
-
-Footnotes:
-
-- 1 - Available in Windows 10, version 1607.
-- 2 - Available in Windows 10, version 1703.
-- 3 - Available in Windows 10, version 1709.
-- 4 - Available in Windows 10, version 1803.
-- 5 - Available in Windows 10, version 1809.
-- 6 - Available in Windows 10, version 1903.
-- 7 - Available in Windows 10, version 1909.
-- 8 - Available in Windows 10, version 2004.
-
From 1fcd7ee99724df028de45624a918fee8c48578ef Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Tue, 13 Jul 2021 10:55:15 -0700
Subject: [PATCH 027/119] Update .openpublishing.redirection.json
---
.openpublishing.redirection.json | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index dc1dd3eca7..2f10e7426d 100644
--- a/.openpublishing.redirection.json
+++ b/.openpublishing.redirection.json
@@ -17957,27 +17957,27 @@
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration-configuration-manager",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration-configuration-manager",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration-group-policy-objects",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration-group-policy-objects",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration-intune",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration-intune",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration-other-tools",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration-other-tools",
"redirect_document_id": false
},
{
@@ -18022,22 +18022,22 @@
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/mcafee-to-microsoft-defender-migration",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-migration",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/mcafee-to-microsoft-defender-onboard",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-onboard",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/mcafee-to-microsoft-defender-prepare",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-prepare",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/mcafee-to-microsoft-defender-setup",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-setup",
"redirect_document_id": false
},
{
@@ -18367,22 +18367,22 @@
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/symantec-to-microsoft-defender-endpoint-migration",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-migration",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/symantec-to-microsoft-defender-endpoint-onboard",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-onboard",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/symantec-to-microsoft-defender-endpoint-prepare",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-prepare",
"redirect_document_id": false
},
{
"source_path": "windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md",
- "redirect_url": "/microsoft-365/security/defender-endpoint/symantec-to-microsoft-defender-endpoint-setup",
+ "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-setup",
"redirect_document_id": false
},
{
From b8bbf43577e4f6dd818235c4db3c3350cba97b0e Mon Sep 17 00:00:00 2001
From: Daniel Simpson
Date: Tue, 13 Jul 2021 12:03:19 -0700
Subject: [PATCH 028/119] updating check marks
---
.../mdm/configuration-service-provider-reference.md | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md
index a780da0495..c22595460c 100644
--- a/windows/client-management/mdm/configuration-service-provider-reference.md
+++ b/windows/client-management/mdm/configuration-service-provider-reference.md
@@ -1270,10 +1270,10 @@ Additional lists:
 |
-  |
-  |
-  |
-  |
+  |
+  |
+  |
+  |
 |
From e9582816ae06af226dd38472e52c4c45e602bf4c Mon Sep 17 00:00:00 2001
From: Daniel Simpson
Date: Tue, 13 Jul 2021 12:34:00 -0700
Subject: [PATCH 029/119] updating UEFI too
---
.../mdm/configuration-service-provider-reference.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md
index c22595460c..cce8060fe3 100644
--- a/windows/client-management/mdm/configuration-service-provider-reference.md
+++ b/windows/client-management/mdm/configuration-service-provider-reference.md
@@ -2156,7 +2156,7 @@ Additional lists:
 |
-  |
+  |
4 |
4 |
4 |
From 7d71012f2c43aeac083218ec17953e311d4f8ad8 Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Tue, 13 Jul 2021 13:24:31 -0700
Subject: [PATCH 030/119] Update select-types-of-rules-to-create.md
---
.../select-types-of-rules-to-create.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index 5f12576ef7..a05bd37d01 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -14,7 +14,7 @@ author: jsuther1974
ms.reviewer: isbrahm
ms.author: dansimp
manager: dansimp
-ms.date: 03/04/2020
+ms.date: 07/13/2021
ms.technology: mde
---
@@ -121,7 +121,7 @@ To create the WDAC policy, they build a reference server on their standard hardw
As part of normal operations, they will eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they will not need to update their WDAC policy. If the unsigned, internal application is updated, they must also update the WDAC policy to allow the new version.
## File rule precedence order
-<<<<<<< HEAD
+
WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md).
## More information about filepath rules
From eb90c7fec69f8f95879d5886da983516b58d029b Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Tue, 13 Jul 2021 13:24:49 -0700
Subject: [PATCH 031/119] Update
windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
---
.../select-types-of-rules-to-create.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index a05bd37d01..0f5ed1558b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -122,7 +122,7 @@ As part of normal operations, they will eventually install software updates, or
## File rule precedence order
-WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md).
+WDAC has a built-in file rule conflict logic that translates to precedence order. It will first process all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md).
## More information about filepath rules
From 39a975e9dc090d4c264258237b627d227a7ffa5d Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Tue, 13 Jul 2021 13:25:19 -0700
Subject: [PATCH 032/119] Update event-tag-explanations.md
---
.../event-tag-explanations.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index d19f762683..9eb35220b5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -14,7 +14,7 @@ author: jsuther1974
ms.reviewer: isbrahm
ms.author: dansimp
manager: dansimp
-ms.date: 8/27/2020
+ms.date: 07/13/2021
ms.technology: mde
---
From 40ce58718de251c57979f41d87ae4f77a6c617c3 Mon Sep 17 00:00:00 2001
From: Gary Moore
Date: Tue, 13 Jul 2021 18:51:12 -0700
Subject: [PATCH 033/119] Applied proper >[!NOTE] style and made other
formatting changes
---
...erated-authentication-device-enrollment.md | 33 +++++++++++--------
1 file changed, 20 insertions(+), 13 deletions(-)
diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md
index 19f9e8481a..5a31b4587a 100644
--- a/windows/client-management/mdm/federated-authentication-device-enrollment.md
+++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md
@@ -152,7 +152,7 @@ The following are the explicit requirements for the server.
The enrollment client issues an HTTPS request as follows:
-```
+```http
AuthenticationServiceUrl?appru=&login_hint=
```
@@ -235,16 +235,18 @@ Policy service is optional. By default, if no policies are specified, the minimu
This web service implements the X.509 Certificate Enrollment Policy Protocol (MS-XCEP) specification that allows customizing certificate enrollment to match different security needs of enterprises at different times (cryptographic agility). The service processes the GetPolicies message from the client, authenticates the client, and returns matching enrollment policies in the GetPoliciesResponse message.
-For Federated authentication policy, The security token credential is provided in a request message using the <wsse:BinarySecurityToken> element \[WSS\]. The security token is retrieved as described in the discovery response section. The authentication information is as follows:
+For Federated authentication policy, the security token credential is provided in a request message using the <wsse:BinarySecurityToken> element \[WSS\]. The security token is retrieved as described in the discovery response section. The authentication information is as follows:
- wsse:Security: The enrollment client implements the <wsse:Security> element defined in \[WSS\] section 5. The <wsse:Security> element must be a child of the <s:Header> element.
- wsse:BinarySecurityToken: The enrollment client implements the <wsse:BinarySecurityToken> element defined in \[WSS\] section 6.3. The <wsse:BinarySecurityToken> element must be included as a child of the <wsse:Security> element in the SOAP header.
As was described in the discovery response section, the inclusion of the <wsse:BinarySecurityToken> element is opaque to the enrollment client, and the client does not interpret the string, and the inclusion of the element is agreed upon by the security token authentication server (as identified in the <AuthenticationServiceUrl> element of <DiscoveryResponse> and the enterprise server.
-The <wsse:BinarySecurityToken> element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the <wsse:BinarySecurityToken> element. wsse:BinarySecurityToken/attributes/ValueType: The <wsse:BinarySecurityToken> ValueType attribute must be "http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentUserToken".
+The <wsse:BinarySecurityToken> element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the <wsse:BinarySecurityToken> element.
-wsse:BinarySecurityToken/attributes/EncodingType: The <wsse:BinarySecurityToken> EncodingType attribute must be "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary".
+- wsse:BinarySecurityToken/attributes/ValueType: The `` ValueType attribute must be "http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentUserToken".
+
+- wsse:BinarySecurityToken/attributes/EncodingType: The `` EncodingType attribute must be "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary".
The following is an enrollment policy request example with a received security token as client credential.
@@ -381,7 +383,7 @@ This web service implements the MS-WSTEP protocol. It processes the RequestSecur
The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on match the certificate template), the client can enroll successfully.
-Note that the RequestSecurityToken will use a custom TokenType (http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken), because our enrollment token is more than an X.509 v3 certificate. For more details, see the Response section.
+Note that the RequestSecurityToken will use a custom TokenType (`http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken`), because our enrollment token is more than an X.509 v3 certificate. For more details, see the Response section.
The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration.
@@ -611,11 +613,16 @@ The following code shows sample provisioning XML (presented in the preceding pac
```
-**Notes**
-
-- <Parm name> and <characteristic type=> elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase.
-- In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML.
-- Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document.
-- The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique.
-- Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate.
-- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it.
+> [!NOTE]
+>
+> - <Parm name> and <characteristic type=> elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase.
+>
+> - In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML.
+>
+> - Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document.
+>
+> - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique.
+>
+> - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate.
+>
+> - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it.
From ce6231a2037e7b1204b74d603d41a2c97be2cf44 Mon Sep 17 00:00:00 2001
From: Gary Moore
Date: Tue, 13 Jul 2021 20:59:31 -0700
Subject: [PATCH 034/119] Removed unnecessary indentation in code; added
missing
---
...erated-authentication-device-enrollment.md | 575 +++++++++---------
1 file changed, 288 insertions(+), 287 deletions(-)
diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md
index 5a31b4587a..3a32b79699 100644
--- a/windows/client-management/mdm/federated-authentication-device-enrollment.md
+++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md
@@ -89,37 +89,37 @@ https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc
The following example shows the discovery service request.
```xml
-
-
-
-
- http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover
-
- urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
-
- http://www.w3.org/2005/08/addressing/anonymous
-
-
- https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc
-
-
-
-
-
- user@contoso.com
- 3
- 3.0
- WindowsPhone
- 10.0.0.0
-
- OnPremise
- Federated
-
-
-
-
-
+
+
+
+
+ http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover
+
+ urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
+
+ http://www.w3.org/2005/08/addressing/anonymous
+
+
+ https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc
+
+
+
+
+
+ user@contoso.com
+ 3
+ 3.0
+ WindowsPhone
+ 10.0.0.0
+
+ OnPremise
+ Federated
+
+
+
+
+
```
The discovery response is in the XML format and includes the following fields:
@@ -196,37 +196,37 @@ The server has to send a POST to a redirect URL of the form ms-app://string (the
The following example shows a response received from the discovery web service which requires authentication via WAB.
```xml
-
-
-
- http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse
-
-
- d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8
-
- urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
-
-
-
-
- Federated
- 3.0
-
- https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
- https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
- https://portal.manage.contoso.com/LoginRedirect.aspx
-
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse
+
+
+ d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8
+
+ urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
+
+
+
+
+ Federated
+ 3.0
+
+ https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+ https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+ https://portal.manage.contoso.com/LoginRedirect.aspx
+
+
+
+
+
```
## Enrollment policy web service
@@ -251,44 +251,44 @@ The <wsse:BinarySecurityToken> element contains a base64-encoded string. T
The following is an enrollment policy request example with a received security token as client credential.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies
-
- urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0
-
- http://www.w3.org/2005/08/addressing/anonymous
-
-
- https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
-
- B64EncodedSampleBinarySecurityToken
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies
+
+ urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0
+
+ http://www.w3.org/2005/08/addressing/anonymous
+
+
+ https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+
+ B64EncodedSampleBinarySecurityToken
+
+
+
+
+
+
+
+
+
+
+
+
+
```
After the user is authenticated, the web service retrieves the certificate template that the user should enroll with and creates enrollment policies based on the certificate template properties. A sample of the response can be found on MSDN.
@@ -301,80 +301,80 @@ MS-XCEP supports very flexible enrollment policies using various Complex Types a
The following snippet shows the policy web service response.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse
-
- urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598
-
-
-
-
-
-
-
-
-
-
- 0
-
-
- CEPUnitTest
- 3
-
- 1209600
- 172800
-
-
- true
- false
-
-
- 2048
-
-
-
-
-
-
-
- 101
- 0
-
-
-
-
-
-
- 0
-
-
-
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse
+
+ urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598
+
+
+
+
+
+
+
+
+
+
+ 0
-
-
- 1.3.14.3.2.29
- 1
- 0
- szOID_OIWSEC_sha1RSASign
-
-
-
-
-
+
+ CEPUnitTest
+ 3
+
+ 1209600
+ 172800
+
+
+ true
+ false
+
+
+ 2048
+
+
+
+
+
+
+
+ 101
+ 0
+
+
+
+
+
+
+ 0
+
+
+
+
+
+
+
+
+
+
+ 1.3.14.3.2.29
+ 1
+ 0
+ szOID_OIWSEC_sha1RSASign
+
+
+
+
+
```
## Enrollment web service
@@ -393,83 +393,84 @@ The RST may also specify a number of AdditionalContext items, such as DeviceType
The following example shows the enrollment web service request for federated authentication.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep
-
- urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749
-
- http://www.w3.org/2005/08/addressing/anonymous
-
-
- https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
-
- B64EncodedSampleBinarySecurityToken
-
-
-
-
-
-
- http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
-
-
- http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
-
-
- DER format PKCS#10 certificate request in Base64 encoding Insterted Here
-
-
-
- 4
-
-
- 10.0.9999.0
-
-
- MY_WINDOWS_DEVICE
-
-
- FF:FF:FF:FF:FF:FF
-
-
- CC:CC:CC:CC:CC:CC
-
- 49015420323756
-
-
- 30215420323756
-
-
- Full
-
-
- CIMClient_Windows
-
-
- 10.0.9999.0
-
-
- 7BA748C8-703E-4DF2-A74A-92984117346A
-
-
- True
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep
+
+ urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749
+
+ http://www.w3.org/2005/08/addressing/anonymous
+
+
+ https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+
+ B64EncodedSampleBinarySecurityToken
+
+
+
+
+
+
+ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
+
+
+ http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
+
+
+ DER format PKCS#10 certificate request in Base64 encoding Insterted Here
+
+
+
+ 4
+
+
+ 10.0.9999.0
+
+
+ MY_WINDOWS_DEVICE
+
+
+ FF:FF:FF:FF:FF:FF
+
+
+ CC:CC:CC:CC:CC:CC
+
+ 49015420323756
+
+
+ 30215420323756
+
+
+ Full
+
+
+ CIMClient_Windows
+
+
+ 10.0.9999.0
+
+
+ 7BA748C8-703E-4DF2-A74A-92984117346A
+
+
+ True
+
+
+
+
+
```
After validating the request, the web service looks up the assigned certificate template for the client, update it if needed, sends the PKCS\#10 requests to the CA, processes the response from the CA, constructs an OMA Client Provisioning XML format, and returns it in the RequestSecurityTokenResponse (RSTR).
@@ -495,43 +496,43 @@ Here is a sample RSTR message and a sample of OMA client provisioning XML within
The following example shows the enrollment web service response.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep
-
- urn:uuid:81a5419a-496b-474f-a627-5cdd33eed8ab
-
-
- 2012-08-02T00:32:59.420Z
- 2012-08-02T00:37:59.420Z
-
-
-
-
-
-
-
- http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
-
-
-
-
- B64EncodedSampleBinarySecurityToken
-
-
- 0
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep
+
+ urn:uuid:81a5419a-496b-474f-a627-5cdd33eed8ab
+
+
+ 2012-08-02T00:32:59.420Z
+ 2012-08-02T00:37:59.420Z
+
+
+
+
+
+
+
+ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
+
+
+
+
+ B64EncodedSampleBinarySecurityToken
+
+
+ 0
+
+
+
+
```
The following code shows sample provisioning XML (presented in the preceding package as a security token):
From 6dbf6d1cee21a1ad1cf2924d7f6462672785379c Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Wed, 14 Jul 2021 11:54:45 +0100
Subject: [PATCH 035/119] Update
changes-to-windows-diagnostic-data-collection.md
---
.../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index f582ab8f63..5064e1663c 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -72,7 +72,7 @@ A final set of changes includes two new policies that can help you fine-tune dia
>[!Important]
>All the changes mentioned in this section will not be released on versions of Windows, version 1809 and earlier as well as Windows Server 2019 and earlier.
-## Configure a Windows 10 device to limit crash dumps and logs
+## Configure a Windows 11 device to limit crash dumps and logs
With the Enhanced diagnostic data level being split out into new policies, we're providing additional controls to manage what types of crash dumps are collected and whether to send additional diagnostic logs. Here are some steps on how to configure them:
From baac5ccf496c86c12b65c9a57fd44009f1ee6e40 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Wed, 14 Jul 2021 11:57:45 +0100
Subject: [PATCH 036/119] Update
changes-to-windows-diagnostic-data-collection.md
---
.../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index 5064e1663c..86e8ebcf13 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -50,7 +50,7 @@ Starting in Windows 10, version 1903 and newer, both the **Out-of-Box-Experience
## Behavioral changes
-In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be evaluated to be at the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see [Configure a Windows 10 device to limit crash dumps and logs](#configure-a-windows-10-device-to-limit-crash-dumps-and-logs). For more information on services that rely on Enhanced diagnostic data, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data).
+In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be evaluated to be at the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see [Configure a Windows 11 device to limit crash dumps and logs](#configure-a-windows-11-device-to-limit-crash-dumps-and-logs). For more information on services that rely on Enhanced diagnostic data, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data).
Additionally, you will see the following policy changes in an upcoming release of Windows 10:
From 32cbdb5c1447644f8f8fd730b0eea74da2864ced Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Wed, 14 Jul 2021 18:09:46 +0530
Subject: [PATCH 037/119] Updated
---
windows/client-management/mdm/toc.yml | 2 --
1 file changed, 2 deletions(-)
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index 51a0630b08..1d385366fb 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -519,8 +519,6 @@ items:
href: policy-csp-admx-netlogon.md
- name: ADMX_NetworkConnections
href: policy-csp-admx-networkconnections.md
- - name: ADMX_NetworkListManager
- href: policy-csp-admx-networklistmanager.md
- name: ADMX_OfflineFiles
href: policy-csp-admx-offlinefiles.md
- name: ADMX_PeerToPeerCaching
From 2d5392a9db828752bdcd0a95e4b2eeffe1ffe47b Mon Sep 17 00:00:00 2001
From: greg-lindsay
Date: Wed, 14 Jul 2021 09:19:45 -0700
Subject: [PATCH 038/119] clarification
---
windows/deployment/upgrade/setupdiag.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md
index da30d6f337..98e9be1e49 100644
--- a/windows/deployment/upgrade/setupdiag.md
+++ b/windows/deployment/upgrade/setupdiag.md
@@ -49,7 +49,7 @@ When run by Windows Setup, the following [parameters](#parameters) are used:
- /Output:%windir%\logs\SetupDiag\SetupDiagResults.xml
- /RegPath:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupDiag\Results
-The resulting SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\SYSTEM\Setup\SetupDiag\Results**.
+The resulting SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\SYSTEM\Setup\SetupDiag\Results**. Please note that this is not the same as the default registry path when SetupDiag is run manually. When SetupDiag is run manually, and the /RegPath parameter is not specificed, data is stored in the registry at HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag.
> [!IMPORTANT]
> When SetupDiag indicates that there were multiple failures, the last failure in the log file is typically the fatal error, not the first one.
From 704bc15a2b571da34792e3f3353c947663eadb1d Mon Sep 17 00:00:00 2001
From: greg-lindsay
Date: Wed, 14 Jul 2021 12:48:35 -0700
Subject: [PATCH 039/119] add link
---
windows/deployment/deploy-whats-new.md | 8 ++++----
windows/whats-new/windows-11.md | 7 +++++--
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md
index d2e0935b7d..6c5df77f39 100644
--- a/windows/deployment/deploy-whats-new.md
+++ b/windows/deployment/deploy-whats-new.md
@@ -35,12 +35,12 @@ Check out the following new articles about Windows 11:
- [Plan for Windows 11](/windows/whats-new/windows-11-plan)
- [Prepare for Windows 11](/windows/whats-new/windows-11-prepare)
+The [Windows ADK for Windows 11](/windows-hardware/get-started/adk-install) is available.
+
[SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later.
-The [Windows ADK for Windows 10, version 2004](/windows-hardware/get-started/adk-install) is available.
New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).
VPN support is added to [Windows Autopilot](#windows-autopilot)
An in-place upgrade wizard is available in [Configuration Manager](#microsoft-endpoint-configuration-manager).
-The [Windows ADK](#windows-assessment-and-deployment-kit-adk) for Windows 10, version 2004 is available.
The Windows 10 deployment and update [landing page](index.yml) has been redesigned, with additional content added and more content coming soon.
## The Modern Desktop Deployment Center
@@ -186,9 +186,9 @@ For the latest information about MDT, see the [MDT release notes](/mem/configmgr
The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows.
-Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](/windows-hardware/get-started/adk-install).
+Download the Windows ADK and Windows PE add-on for Windows 11 [here](/windows-hardware/get-started/adk-install).
-For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004).
+For information about what's new in the ADK, see [What's new in the Windows ADK](/windows-hardware/get-started/what-s-new-in-kits-and-tools).
Also see [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md).
diff --git a/windows/whats-new/windows-11.md b/windows/whats-new/windows-11.md
index 260967a467..2d7eae37a6 100644
--- a/windows/whats-new/windows-11.md
+++ b/windows/whats-new/windows-11.md
@@ -1,7 +1,6 @@
---
title: Windows 11 overview
description: Overview of Windows 11
-ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C
ms.reviewer:
manager: laurawi
ms.audience: itpro
@@ -83,4 +82,8 @@ When Windows 11 reaches general availability, important servicing-related announ
[Windows 11 requirements](windows-11-requirements.md)
[Plan for Windows 11](windows-11-plan.md)
-[Prepare for Windows 11](windows-11-prepare.md)
\ No newline at end of file
+[Prepare for Windows 11](windows-11-prepare.md)
+
+## Also see
+
+[What's new in Windows 11](/windows-hardware/get-started/what-s-new-in-windows)
\ No newline at end of file
From cfdbcd4f76f95b3ae1fe71d4c1602c4f8e0135ee Mon Sep 17 00:00:00 2001
From: Barak Manor
Date: Wed, 14 Jul 2021 13:09:58 -0700
Subject: [PATCH 040/119] Creating a new page for Device Installation under
Client Management
---
...eviceInstallation_ApplyLayered_Policy2.png | Bin 0 -> 83277 bytes
...eviceInstallation_ApplyLayered_policy1.png | Bin 0 -> 245699 bytes
...Installation_DM_Printer_Compatible_Ids.png | Bin 0 -> 42744 bytes
...ceInstallation_DM_Printer_Hardware_Ids.png | Bin 0 -> 37272 bytes
...eviceInstallation_DM_Printer_by_device.png | Bin 0 -> 123239 bytes
...Installation_DM_Printer_details_screen.png | Bin 0 -> 33695 bytes
.../images/DeviceInstallation_DM_USB_HWID.png | Bin 0 -> 43507 bytes
...eviceInstallation_DM_USB_by_connection.png | Bin 0 -> 206435 bytes
...tion_DM_USB_by_connection_and_layering.png | Bin 0 -> 207551 bytes
...tallation_DM_USB_by_connection_blocked.png | Bin 0 -> 98870 bytes
.../DeviceInstallation_DM_USB_by_device.png | Bin 0 -> 47760 bytes
...ation_GPO_allow_device_id_list_printer.png | Bin 0 -> 20306 bytes
...tallation_GPO_allow_device_id_list_usb.png | Bin 0 -> 46437 bytes
...iceInstallation_GPO_prevent_class_list.png | Bin 0 -> 26422 bytes
...ion_GPO_prevent_device_id_list_printer.png | Bin 0 -> 28667 bytes
...llation_GPO_prevent_device_id_list_usb.png | Bin 0 -> 26746 bytes
.../DeviceInstallation_USB_properties.png | Bin 0 -> 27834 bytes
.../images/DeviceInstallation_flowchart.png | Bin 0 -> 67266 bytes
...ge-device-installtion-with-group-policy.md | 543 ++++++++++++++++++
19 files changed, 543 insertions(+)
create mode 100644 windows/client-management/images/DeviceInstallation_ApplyLayered_Policy2.png
create mode 100644 windows/client-management/images/DeviceInstallation_ApplyLayered_policy1.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_Compatible_Ids.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_Hardware_Ids.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_by_device.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_details_screen.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_HWID.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_connection.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_connection_and_layering.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_connection_blocked.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_device.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_allow_device_id_list_printer.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_allow_device_id_list_usb.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_prevent_class_list.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_prevent_device_id_list_printer.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_prevent_device_id_list_usb.png
create mode 100644 windows/client-management/images/DeviceInstallation_USB_properties.png
create mode 100644 windows/client-management/images/DeviceInstallation_flowchart.png
create mode 100644 windows/client-management/manage-device-installtion-with-group-policy.md
diff --git a/windows/client-management/images/DeviceInstallation_ApplyLayered_Policy2.png b/windows/client-management/images/DeviceInstallation_ApplyLayered_Policy2.png
new file mode 100644
index 0000000000000000000000000000000000000000..8cf3edaff44944fd0528b44534075a8faafb8897
GIT binary patch
literal 83277
zcmeFZcT`hb7cYuO5fwo>s7Q?(6&2~dC03BGprEvf^xjKo@z@XrBE1voNR>_?5RqOZ
zHPj#w5~-0;LI_D-Eay9C-1ogP-o1a^`_J8DFtYYyXRkTen)Nr=O88xUO|ByXN7&fd
zxU}xvGGt?8H)mrzuyg1js|O!=c%AjJ&)ZP*23u*r&?4*RfcuhZ0aLzp|cGmr2
zk2{aN+1P}`e*Eo&FRa_Lu`zSCZe710V7Wr)j5~o%{z?mNyZL9#arT&!u-m|Ww*J;%
z9^Qy?{aR&ak>_xJEhc#1MB+YNDe}*XVO?96aj^2?x1_SCs*t^Eb9_W{QTa6c*u$JawRcl_1|NgXTjna#nnmS`H;Ngk)T$P1v9B&MTghQDDC)+jt{Eo$z6j
z7;+m##efr5-8(KxR<2C$+AIbKF3hSoh2UhUrd>C*ObwJLBht|G7a)SC&Dq_ovGC;ukH)z%Q&v3a6o&guc`B@4)Psx77DA~oth$qnAIL%T=c_J$v;
z^rEKTiImhF_abMAAy*$GlZbHgmho-qi&f3)4tM<4M8~X>`$UJ8_5#q%z>YkXE->
zzk-pT`1@+!zk;cy5L_OWrT`
zus;o~YmE-UsUe}X?YUKU=vDtvZn4^T^Orms`)=LmAUdcNc9yJigT
zxGXPi?xXE3VU{o@W?Qz@BMFYvPKjS2Ic8f(uXWzeaG&;N^G&A-{o2r)$7ZH>9D_w$)Q{we6ibUFgUYg+
zD4E-qox^(H>%YrrJv6Y(h89I6fnBYUH21kmg#4t!WcUTg2HDRO;RJE}^pR?&R4C)d
zg#O18OhWO;LD!s%)Y6BfHF!q=ZT2y(*;5DzzkQIp$7AXKAVISvYUVt#+@bDN>FtE$h`GJc2tMDn2IYQB!`KA?U!Cqjj2z<8ZrHf>z
z^+WZ8Pee4eHjbTnqoNGi&vuu?1yU5{VSx%LhaTI{(y|}d`D)L34gOj156%2>-4EwB
z`PE|cc=3O#nUh&rDccyZ{)DMnJGfYN^ysDz49&OgdEO3bcm(0<;P8>@6u4TAg&O?v
zi`Gxa$Lc(-T~*C#G|8@)8^nb@YNglO)FY(N2Mkm1@I-3LDAOg(*)y?-Y5s-ZIp!4)
zP&Xoh=OX<%xNay&6jGxkI)p-juJ<>P
z98t728kshOmLxSYGlO@m%7jSjR&zO{6KJ!Z`z*AvL3k-hSKv}X)qoe_s`@MEI`Jv3`l!aP!h-TP)992_?o_
zrlvIYp!O)ecnYrJ`Zfu1iG-ruQ$~o0CJMB_i9qSQHHM`1qL>;;;+pe<(U2fM@9;UI
z9+I-N+mvlnD%D~zH=7P?{>vDikol=CC29WcfaK1TgYTTHtF(*|CGFG1tJo^6SX0&F#aplV6N}#zWYjStMq2yS^CPI77kTs*qA*P{}
zepT{X13I1(N-50=1P?2lW75?{^ZQ8s84c&TfSNt82TZ!Cj3WG#z^cxXY<#_E_Cnq|
zw$l~Be?gB|5T9_E%d78F^m6Gbq*X*`o%8C6Kh9bA%}d)wFKa;FNdpbuY$D<}_;&Gw
zxuMh@QN|Zcmxtf2dR2vP3?;|rb8nXn4mMiSJl5_pD(3FGi^hXVLfi|oX=GDNQnVYi
znntYfCW?&9x=dc|NYF|2Pkmo<-kX}XQ7SY%z7XzhM$cS{9)2u>L5aR+tc+J`4kgPL
zH5_gz+A=?^5hZllC{H)q+8tdYoUc#~o+S40>!+6(8yLVFF0&upmDJiDgla*QE@w+-
z#0hFx#I0kGcJ35$*z|Vlc&$(IBRw)rO6zxTBDd=;`Q>+u}p{wehX|(U!3yU`IpV%d{!SXj$TI39hkzV`=F#j;b@)
zY&7xT&oXB-TL_|TH}g$!6V}H%4|~nb-L5D=K1$(}?@7l=@|ci#phZEkE&`(_x3+$=
zSJN9NOWUW{vKO$oa~5jdp`p@W(la;pSH&wc;h~HB*y@UJulfj=rk5mCa$|j%xA~*j
zVx_r4yjmX6y*9YA7i!vz77_$Cy7jCFy`~FvydFG_=)CaD~ea>?^om#OO>WK+D^!f+F(@sQqWFe(QJu8u%
zm(@E`Aw*E&Jgw4*j=tHUr(*SHs+sbpaFmv+PJVUD;j+K>MwYRotHpVLtoI`#~Z3H^@O5sIGEBfy2i0j`U?
zw!?>1KX0XNLX?0+Oj-=f&!j$6v;V9w?V;75)^tAKwPRU}H-C`eIgzv9Yi;G}CS>q1
zyN~uh!GX9g8CN>hFr`Voq2OL8dN1%;T_-2Tae(IZoOFS&Aa@xi!
zy|ksVazwyNLe|ENX2|ToA3V65TUKTukp>neVi5A4{U^RawT^9eedF2h)gph+x{UvF
zwx;C;pk`FUK(d^Q5f%c{AzXvZJ!al|i$8~uTcT`c(eQ-d`j7K~>Tfqy;yB^Gr1}RUN@Z4M*
z@x$^-C29NCb5r__i)Lr~Xg0fGS0?dv_AMRNb)2;F#;hut20=>@17Tu70Rff)0xA0w
z;)2IgV_?+jFtQ}T@&eP#DQj$-&HJ+ea2{x#6FTZ+)Dx3@)oG!n~tygDoO0s@(Zzo}8dgGOUvupAj
zgiPglagoRPmBdO&h|3n?YL%k>xM%0pKT|a4@6`H?@#!UtmH2gZU%_b@mvt>!j(d0F
zirZn@x|XEW%ao}QdxCz<$U@glyP%yQLpF0^fR^AgvGYm@>noS?z%O;x$zAh0&bnCk
zG4bGJD$}?6u$^k3oho{~>K;zXvM~6{WsA`5Jg_VYY4)b#PhaMr#OhPF7WxtNV>Lu(
zQjtr;l|Nkpv9;rawEF?N0XL#bP!-}2VnzV5&B)@o6;R@2)X8kdea5c9+kS5&d{Z)|
zbGnT);Z%`cYj08PcDgumjCA()q^Aj=?Z)wyTBcf7
zVZEVl6R9E3;Vq?=Etrn=$LZT*9fX#_OhucHc0I$jrmLB>M5VIoOUp7(NHA*!gDVZa
zaT?4IZ?Z_%6$*m%q=LxPlkS^65=LnZj6znNef+AT5@yS;-;7Xi<8}}=P$fmNX7w~7>C&F-_XY=&U>E%5m@9ByS@J`ixX85ehnsC}
zL72NJdkqPS6Gqs0PDL<6=IFd@&^&jgYpN>@(Kx?yx4B>ozxD1G%DNrjmm#S;4mh^d
zKl~R#e1RxtD2&~uuW1K?d-#fF$<^25X~!+n=FjL(%>!?wmR!;bibR*$f>S$65iIez
zzcByh3`&&klZQ09>!cWCzJ)m{N(aOWenX$<>(7Y6`NM#saI`2Z7x*$z62d3ZO?{h)
z-+Z}GIn=Hg6|!f2QCO0`KN~-I?Ya54N~1sI?wD$He;dfgPdICK7YuO8Ji#AA4!gU*
zlYg9G&~tmEUe;c+Ydw}|Gu&AzvkoLKOcY6Wj#u*GvmP-m{HGU)=Ubzv$q43nT0#Dl
z7y==*_tFI=m$ThD>yL}(9-pl9iz^
zgchNiQRod-eragRluA3Kcw%8CH3HgbXWuLDHG2n+^4>$4CsHOp@r={FD|=ti@Eeux
z@mUbQ%jI0YmZ6k2b}F9eYMBp(%1@@+S;~HPW2WC%C<`as%
zbYwC^fm`^>CHMw9R>Vl3C}0>9Xdj^q*>ksPPD|bml$<#{>NwNOEMs0IC21NFBof*x
zITIGgKP<~SU%iCzIxX$L<3;6uQyTN`WJPXsH;f};<4hGkE`ch(8*g{-KxZn&Ja#Uq+IIEa>Y=u
z7Z8Qo%+p9h0Mk;>Rfn4jJM-M%5HY+@;9h>x3x#4!i)u69hXyXdRwsaYM>aigUT1{b
z_XEO$@;e(5aKnRI@RxP2z(wV#1XJQ~$B>QfN{fhHnPL#7w>8;A#=Zb-I>pZ!A#;0l<+sCkVh(6$`
z!7yDUg&aQV*Ug_pc_H?x8f&>Mciat=p`Ow&*Wn@m!}b{~*)N~=?yrQy8|gI+9y@$z
zG(#*bEF&Z1Yu+P{#+)PB8W8d9GNgW~Ku~NF48NJY5woP%wP=)&pBk_9`ap__5Rkv&
zhVqQil_EKC*(JXvN_Ky`y>Suie|?azzlVLJ9*2`9<7oDHe>B*2E@F?N&U=wQOrXOy`sTIY1j6UYCKN@tRC-X>cN`_1=a%cJMJSl-dyO_k$u@Kpq
zn`lsPJ{o`w%8SapLY?RpuFRj}S&x*87}xg>N2L%+A7K`9lNj#z+VAp#LATLo?Lgm7
zz=S{U?XEx+Ixym%_QMC3kCN>YFEgCpi0^klp(nI}bsP<}ue>_C3pyX9P4`u>`Rz6}
zMrepzD3Zc5Z?T7Rr|FkFjwz?kR~dJho)~Eg
zyA|!iTstAj*+@_~L44oY=+j4HR1G#yMZ6!FmIl~laXrz+otm$TY$c-32dIZ!GwOp*6~L`4bkn)ImDO&o)ug^f2dXjp)5`XnJUXV;`k^7tF?)2U
zeGWCP-1Hsk+qM+XNoOxF$njTIs-3og8xOtI%+
z=sB!RPL10mIFz-|0vicP%Z-NEn2Me)E(gV;RhJSqW--ju5hQUkWN4+o3l~;!Gpw)Z
zbKJvzzTosB^S+dx=^I*!V#iZD(p2sE8kH~DO5A{>F1Y*p>rnFaDjbc%VAoC0*kz#l
z->?!D^|S1M7MIed-(iznEm<2aIKdJZUl4$quZiR{IO>Vyc(*f3)VKSLqbnqG?u
z={1*X14W$^;gvUz%S`6osWM&6ZunbkiMZ30`JL8%U~`DVQxHXKg$Q2z@}h?ga@sfknD
zMs(0EUZT>WSp1I1q+ND({w-R{W+n1oVQAJG{U(
z@~(OOXt+sFj+RN+rlYkD0bSu4AM7-7huU)45xKD)ilh_XdM)b_7i!>RO3osPXm|)d
zZOZd4l+mu^)%Re3P3?%_oM|{~DRE6?$vU|eo3A+14US96N4SOAPfX3$#pU#zJPi7F
z5-&}O8pp{#kaF*yPSu4bz5OEW-YFQy4Rv>zU!A(X`|J--@`(tPiiEq%)vL@i&jMdx
z=~8)a+paSJh~j-)*Z*+K^+KPscz1o8=_*WFiz1!VXU8bC3=nElzi2KPv3l$_{et`p
zXvwzv`Isx)81(Tj%PFex-HALpkGL|h5;aiDYtt=!Pp2?y;)#53PzC){p0w?oDSPx<
zT>&!Sfb*m0o(!$}$mWD!ruo1mH|ao6Av5qa%)hdC3r-SNfTylZMW-w#IfX<(no0KM
zrR)ct0dqneRx!c=w+WZDZTu6+{;p-wrO;!c)VdSp!Eeqx>##{2vq~@dYZkYta>FLi
zWqO*xOq$AN=nRT-dD*pAd#x>{o)2kR9rT#iY!oz0o`H-6q(;;`7Mj;Fj^US5-J|&t
z8E1}xyt0G01|}EE%M9YmBs9)kaO9AHUq)YZ5u-ug{3^Z)YcLu
zlM&3#p>u!{#iQ=i@fvjpVdGVRKp8$W=q!Dr&E$sjg*vNSZX)oNkQS7DJX6g1zF+?t
z_bNu2h}b{OifACvz$X7~H0_42CE96h&|i$kzeC)}M1TaSYqbRmSsyUUB>DPNQf)Ra9zaX6DN22pONu&}A#s)Hv#nDIX?&N>JL@<&C0B
z>1c-%$v&|*phI)Z)$i^^>;|Ug9wjI#&LGl!jRa*QKUi|%I!e?xfpKG((v^a=4OxI_
zSJQx(=jH+A8qmLU2d)?IS*xE=UaQcR1lLO}a$^AbeOo&4yQ!dau^`VPxxSs(d)J3f
zC(GI9>572WPiuZ6r*bpuQKhpwQe*2}%UI$VjH>zW;q<64Ns
zrnhvNz~OIX-s_a63qhNeJ0TTgP2+J#H}dQtK@RZN4DQQ2PB*6%33WZ}kmksGMq1c@sd9i6nmJBOn;PVD7+Khs6#KT7En40V{YP^&d`94VIF(Q&%W5H7M7
ztJMcOs)nayP2+q|R8KGs3&%QiQ@NtHJ}RVsPx7$)SPM?tGAX&@M@vI|i`
z#BNtvVh@)dGu50{&M)KlS$uFTAX^S6qlKSgzS6r$|L!I<=~Cq!~L*CVuLXa`&=|
z#RmaZ`gZBjx1cc+CWca0b>PDd%#+y5vLwIn?M7?oYNk@{Hr1fsf4+=!zp;+xM`b2H
zy0|eiTTsFKB{8*AeTdt7*nbc;npNB~;>7IHX@ZaMP1ru~qQ9MV8MMxd_^1rh8MWrB
zfed~bhREEEH4$ayJ@;#2&1s%BMh`Ui7JRQ!sg-1?8~F!n00G3gl(DSmkOH2U)l=7|O8(NR#VD);9)WzbyB
zc-?AOUsIs@j}Wiams%%hUTVR1w7Twxu^C$|1e&XgxO@Q=t~cO@$g^D=UP~@$b8UEn
zbI0^0MI7k1n@hck04v47PEDQ9cHb#5_wJKt+4F3CiZu33M3cV0rI0uYA@J^)L7FV~
znW(&en$m@QeMCGbpG4Q|Xp>~Dr6ktU|9OP)g%h_yd$y7mc-BvYr#Rertd;2@&Ym{pnzc9g
zkL@#?!JXe)Us83nbiOybFw9z<4|V|A9+3&LAo@MFHrJXr)>(I@&h-=*eT({>x%F^*
z8{SbzU%5LBF?^0NF(I8DxL*ysuDU#(4fNtveZAFgO85*TSvBC4NW$Fkmq(mDLrY&y
zAYg@)8uD{#s>PWBh&QIMte!2jz$#h@4&8
zhuq$Ew)L6s8w3+BDyvIr>~aX$`0TP!R7hM?(_63gCkXR8n?!w`mNp}=^%X5;|FvSO
z1wu|vuG1F_5d}1?`ccPL0kLN8jSt)!7mSfqLMpxP_K=`E>Rx-Kb6inblj%luJ_XiQ
zs!r-;j-miRtA?8zb(?=x2#Vk;wJG;Gy%NuM#EtvJMDEs7Qqpvo1u0iYBLEdycVq<
z6xA6$+(0g+J}&nsVQh*0BFa;fX8<&tyW8#587(-Jjyz1b`L@V6N_y4d#WZ%Ftd9{H
zx3)|Tq*y3Fv1EE1NpMm6;und>QbP_GJvXeNDlzo0gStojbLl#1KTNOkVam*r8dZWd
zxy$in)PUOIZE2uGW#gdp#L5dANV4*+WgI@~kZNd0l3GrcQ2#i&Yk1z$2+nj_S_dKf
zguoI}UD8OH!8|klmNBza6$%{@t#VGEgtWN+sD6Vq3^2=&VMy#`5JA~F6h+3+pgEcs#Qm2m|puh7!8#B(PnbxJT`
z;~3ZT;EO#7)$Y^1ln)UFwn>{xs))*IC-NihhZ!-$(@?4&1(qPJjF5&4Nt49DO#4a^
z?<9=HRSLfN5-O@gRjpk|9hTdKpe{#*h<^J=tdrenkwXChPgYiH>e5yP0wwv^NG(5OfP0`Y=ZuTIvnwk}I
zQtll+<<5sP*{K24Ljq2*ZEyFTkjjZ-tiDE5!HRHHtOVc1ou165WL4Dl)}02vt~n&m
z#1Kw{o{Yt`mGpUqQDW{!Z^$v+9#sXDPT6-upIr{0w-YqI*wKg4>N(%6(iqZ+5#;il
z8m_fyzv>F^yjrh1i>;Ic;M8=W)TGCw&LH!vZhFQu;XlEUd<`1J_#~|$n;zE%>FjKC
ziV8pHuaH=vNow(asD5#xNjw&1+siMi9V_x?SI6o2#u8cme8rV*NmadT->aL1lA}lS
z_}loo9hB5hT`B0IB2PI5GwwZb0V*_KHd4D)lx|PTD&DR+-o<
z=WExkt|Z~wsFx(whIcHN;}ap+{>Q}8ewet-DZeA|=Th}i1s$5b3WDc6g9`m1`^$eu
z!d6rzIVIBJX8Y19jKe*|e)70r5Ax`JzxhaBd@~0?cX(XjW6y-|nD0pCtN#A}%_rV}
zmW|H1hThbOLTQ&aITc4V60T4?ld2*_vq)BwK
zZ%jc28%f>CwM?y2cO{@dquEu)ZN*ncO6su}_Dr@WL|k!7idCrHI<@i2JKL``L8#A^
zS2L%0QBWHS4n=h=mMq5+f-S`Q9`gr1RlFQ@vTW26kmnLROBx#XDJh+K&RMR{qeFKambu2HB8ZnnZVQ6X!(<
zZ8R0y`kF_^Yxqv|!3|myNEu3g5xg_YLB<7*rG$0=(2yP{b{wR#F
zu|2+|wCs^CV-+{$HT|@c8tWyql^OiKIgD(zlw)2uCQ5kZcv`x<)q&sPw0NRT+-A?6
z#fD)?dxL!ZTr#grVC&PdP-E4wfGqn+P8FfR+kko$|FHlNt8Nq#D+H2GCBKNW@`x4U9
zl!NpG4KflaQHXa#LknVPj|f)KA-$G{cNQ+`kHlrZ)=H<`aiV==fCg$`MEL26;M@G^^Ny8y-x$`>+9ug
zUx@v_SGp1Q-mlLN|KH8d*MLU9DcGUkUnppQU0Yig>mIVK
z$$eH8{rKQ0*p8rhJoe`k9*$h%^
z=u?$r?Jj(3X%UKr;h}3t*ecj-A&JpoHG5PK0u4aqr6%eQ`+Qp+h9O+1N*7VX+Iqxq
zXbG-SzgMa6Lw0~glZwuUihV%qI(+3bYeBh3O4i7{=?dK;@s>RGQJUuoy!&5yd5`5E
zJt|{2t6e?2M$>rM@D*j2ogbybB@FqTx_;00t##p5ZiNXz@o<85b}`{J_<3qXFg=fYqm6$gSh91M3s$*ki-hwAHytX
zLozdl86j2yvmqQ>|01WTzNLD;=9t_c7%-DLm;`3Z>YsZEdG8TaDnx4&6Br_t3@6pP
zq_=OUXYG6ZT`yJb-u{nECFC2sSAX`!+&nayZ`ynfA-?#EGe7sZ#FM&
zjAd#K6@&&ebr{)${Zr(sJlII++q~v)qxVz69Xcb=l&w|d(oy3GGaF)Mih>&=-?7l4
zBI=p4R*l0s&Qm+FJM0Nibf*N#0eQbDFO1$G1_-FwOgq=1aCO+H{V!2@aUA@{%gMt8
z)5G1D@oxRed-{WN0TwI4C#NIT?gp5U_ktBlRtJ2LwGX#T2mka9X?l-)yJTH*(K*O+
zK#n|hBa=4&$k>O{{F>$~X9coIESskvBXnM#Dw&%6J5boLaB}0x9
zqsF9ghC_~idvIRW1uTQ{(IAV#{lTbIQIc))+WPlsq!0L*|JeHbjBcH>OM?F{Oiij
z)-I5{x6_@&Zl9jh1Ce_hJQVt$TR*+hPs8-7ycKB9+`}-ZVE9o?=(en$BqOm%u7r9B
z`-Mj$mb+~MS+>&S>;KNE*!7q_RND)&X++<8Aha)$s$b2%sj+XSq|e3|AB3hDH`e;E-U
z3dso$ZRsh$!6e`mN{Wqx?6T~oA!>#yEd~Q
zeM$YCjBG`VS-Nh}U{Hu3UU%3JqLn*;&QA5ieePzjdl(G=$!*oDX#z=egar1)XgU?E>{hA2-k-$m
zht$B
z6a~5%iLzK_caxRmYz+SO*I%g3xwf|{j4s4pc-~0iW+HtIriF!7KEa%vf7@h!2Xuwr
zcH#a@diNfCg@+8Ufgg8561DInE~3EOx6NWE7MJ!)_6C!DdPDNgZP>sSbA+fLt)LF~
zF8Ea+)%23n&sA;wqr}Jjl;=q3v+eO&dZ_p8D=`;QPZ|~$Spd6SQWv7v9cO)q@h8?S
zcf<7MhBkX9?Ox?x0+A8Y;u)g$ol~!J^-|K?0fhHx>N#y=z&3%cC$8g$dk)MQPvL}A
zcf4dcUl0$=fz2LE;7sNf^XacXLc5o#CKHnZH!p!OtGh`Ca~qyhyIxzMlYt^-Yf3$@
zEg11p`5(z;U;00X0#;ythvF`d^T<)JjJm(1mjnl!jKMpXu{pY-H*0vyL!FsTr&hOa
zQH3t1op&%v`%%l$Af`WzE%>Ztr
z^56i-_xsrX8yI->vPEq7vZwFVaIyNyLJ5FYk9@WvZ5USadJ9l4B3*TQ_Q&ytA6Hc5
zab*b($Od8P&Roi0JOa$6A;fUq)?dqV2iSrt-4>p^ivrzu58RQogqrZEq{j_M5K)2UQ*usn3WPBF{%4WClm1S_
z0Geoo@?d?9W{cfGdpQJ^CB52pL10_b;V{#9r5tuo+KTwFyj(JV@D8=yHrc`ELT_UF
zWZSKexU4bMEg+e3%N!xJww~25EDNoQPFg0HC`MDPQIWcw=9`oGcX*akSkWmlXuc)RK#J)4xpi=F&FaV
zY>SS;YTJGTOo~j!54f3hT?KX~r4T-O;~xCjkg@AgzaZZxwAO8P%j_nJ-s1rG2Z{dp
z4RI1DR0tb1vi0pwBOaJNx&>Pi~pc&s}@2k-7PaJ@PLdQPelu-T6pGii1+6cf+ejvy4a-
z`Ud_befrd+8n^29SJqk4)%w=e&_Rs^y6n9E;zJ36V_>O!K(R%yT)p70R*@O2f^wnj
z-Ev$sP1GS+XVImN#2m+1`3hL(I$1Dc=gJ9XNNkE+iXQ*u$J;R`S3TRzA@48*-${8?
zV|RJw&6fUk6EzIv@X1<;g?dN7eJ{DdG;$k!|1&*xsNOi+o>nO^88qrtl~Usfd{;&1
zOLj<5lrEv2jD#eqO&mG^{Ny^aV2r3-HIW(HGA?QEFRP?PzW$Sh;3M46^n7pKpt0S$
z+=g;2bEqm=8+dI7dOjkNjzBnz^XBhtQNu-ws23A5>*t8?s=c=_&n;UW=5b
z9ay0Mdd%k2#5Y|D>+Yv!N*8BBn0k6;I;7Ff841!CxessrZN-nHLVb-qOgi@(U_V0{
zX!G}!xrR0<3{&KXoNJhX!t@WX)$Db*XpzYLHR)fe>?wB4*K>NOD_oM9y7!>%ES1V`
zJ=8$6^d^+1@sMOhpdpr_&lP;we_)F^r?43-|9B!~tajzYi@J)KN+6)cV
z@uoLLPrJR`JFga1;V%z*zZh$^Y_VEh+wE^8d7{?B7^|O#K(wsAG518iUd_MJcmWKc
zo-0ESQq}BeMFEMn2CFmqa|vd>^xp5R9iyFPloLc*-G@zAsw>~km^1)xlXyo&X5ur@
zhBz!40-$f8F^?ExcvUZ&R=tP;VJB(D0`mZ8dEt6!p^E{(G)3`vZAO+G*bCIsDvtO_
zk9^2|HULtv*>qeQeAb^R$w(8Z#mQgB!9P>zoePE^8t-E>vakm6)H~)P87_^YbhT4z
zfJzbRocekcqmPH9cJEHpR>@%G-^WpoTeOIRsa;i5AOk=8Ci6Su&BfER^^5uGDcvu1
zQgT>bG)Rr(E|WUIG#i4^s?lG3*5}$%7`4pp8M$=tne>!Ant`**7k_Odex>;fbbEO^
zgGm?DV@`L)rsPfR@m#)naS>v}ssm{aMypgCmr;Mn-ocwCAm)Cyr-8BjvsYw{n#k3d
zZ@*7Husy|V>^MFl0Sp`?>KFo%(TbL3(hL2L0)93{k>I_6*mf9$Z$OE)GqC;IjAtYt
zlT<6Gu($b?FWuc)&V2Xo{*wp%{o}&qS0W{Or*eiH1N-=XIt{kF`+>K%JDDoqmRPp>wlAmU#N~bUyVsQ@G`>8N&&~KJbKe4c|NHGo>y8650
zY5o#7b~rq)ofB-H8?D_~Dy=Obccc-`42c{cl5`5TTS7bRbwyZ4BK=|SJ$HNgBU9Z4
zveze^Y4X3{@ZM7TpWN?5AUC#d4Yi@KXRzyC9(8(li<&o-!lmp@h{&_@Q-liPp#R)y{)3|M
z#Y0$iFeBk#reAl`%ozl>t;IO+;zbG84$Fz`N)Jf?!fIC$@sl&lmsvo52?iz;WJ-TVZXsJvS
z{W)D)beb7mv&+Zd-#L&q`A#aEN1`ST_U;d5XP)F8&aMUYX_`2gQo=Yp+CF|Kq`Esz
zOidME{z=)*%%UP4Be#^_;>#8_Ja7oheE(t3wfS{VidQ=!^dH
zpLHh}gBIoS4DW8&ZNPyf`xK
zB$;L*xb|f;H_J;RiFdd`t10-yZifn_JBb1q3q;0T%*kWdigsYuy=@$+qFgCm3qF`b(Vv%na}U
zkG)~*Sc1K9mYQ4QFp}$wx>F?eN6Fypfya&0xYq^QeYn>jdokmg`Md79JT=KYcF8<$
zxH}&?o=4Y=b1kD^0@r1Lo-Jg-8t_XR4=Aqs*&xu?8s5s)Wk7By4~z4@PWP`0yh)Xz
z0Y=@fj2L{JN<{GtB}We?3r7&Ng=bULC5}w^=gwd73L=N{DpZWpry0r;aoO`(#=o__
zfa4$Y(6Qw3!g*2o4kr=R%gx3qIJ?jj(Rn59K>4*?WuE8J5J@O{<{kf&Qx)`g(Jn9F
z5MHEL8V!Bn@v;JblK~E)lmQo(%wtb3z~f|3zVA8`ZdPgunkgN>)AVlFz#MD^RFn^2
z=@ySFup66%f+uV(@a6fj$+5zxs}KQ1EONXZ&~89R8M@rF}paF8}lTRIak*
zK~HP<_ZJ>f3Y2?&Qos-OU^c1f&Pt~u@A%fq)>o3wQ*NVf*~sdf*);iqfYn@<=-%3}
zms{#zg^Z3p-fnB3SxOpbo{7DvH~7$YyICXHGQ4cZu}CBA@=-zl=pK3dI5*({nj(7e
zT4V^JNMMFOk|=kjrloFmaa&amWF<0jTJ5)BzgPR0U?;kVEw38Mfw1fQBM~TZf%srT
z(agxs1Im@iHAslbd=Y{t^34@DY}BhDJQG^s2hH38oXA(<8L*ZE?mV1deYK3PZ+0~Yk>d%dGR%g?R+
z>17}3MhaBk-3vvJ
z1vvNwyS;gpo>ifr_u;^+qaD92^T5DAn1EE6SgBOAc^qW0YR8gXvgF+S)y~w{{+fHiN5Qe8JGKg3@P?jVYHF(dPo5rM^6~X`?EVLbe!(K}
zjEDT^lh>4f>%gl&|D~jb|E^vAQ*}7~KT)Om?^Tcg+xt^=zy7=W!#d^{l@YY2{JT
zpibW$Vq`DZL%WEVqMNvbJN+kteuWE`g2}8C+Ju=YD%Z`P0fre|)jd
zJWa{-NoV#bOF4eMh)t8#y!%Sn7-^)EU@$ZmWBNh5L(Mt+OWFk;xr-?s3ctsb``36}
z>FMc?wD-BWw-E*LbQ;BZm)s-iT<<;u(t8f&ZI2YpUyR_Fl?%Z~vvPk>NPQmLt55y*
z@+>sRU}(78aNe{>spfj@OW6eHi4vxr_+-qWT!X25)}Xy$t+R^z+lv*Cn^j1ET^)ke
z=9tQ>qrRv@t{yX>So85e!E9p9^RKIiIc
zIboTE78~})sEZaEmymzq6~o!hNjIxw-U9|r%b&bd`!V+hBa8n-wXIL1ZkxhlhE9S(
zhO#x`PW280=k!QOqKIAx98l)y?p~G`L|Gg08Oqa3(NB@n8tMSR%!lq}Yd9Wxza8cJ
zu)r}j;N}%Y$#A7tGO~Ycp40>2Y99@)%r$pnMp6`PLjh{&YeT+0sI!^PofBukj8BG-
zQXj1)i}+Ad(9Dp}%2;{Ik5lo(RhgOBhqMPB`;6_>MGZ2BHw9;QUggCv
z!0(!YN*>!hihhPXCF?E4T|Vahn7bltkDYZ~3Ak571JZhVQ;t3Yap-+nleu|JK3qkr
zYVCY_i~O8d8_=OK`g>-F)yu6@@IxgY<{cJ@oifQ3^XhAMYuK(7zZV%M-9$;B7h>AK
zebzAeKi-$^oHuT^9>xrfoMCL&3K*zw#k~?9cVeY}!UB-JIX-#T4}4&p4uCn($1L47
z+b0f<@)d(?d^zPZrY{RTZ;QHH$>ZPPhet%V^K-~$=;q29vP+Y`ALLRk9TYTEuJiM|
zihWm2lQaAfFW|k$G)_@->b3I0eU$s4l?|Qt0
zHlYuG1}$}i|FYknxY^xqu`-9Nrd4-(WQos|nQt>P3nUM@L?N=|)Mv5bnu$bkQmq{`mZ+4%hMYN}KTZyYQS;1!&em
z30dAm2Q?(CsQB!qpxhfcfRxOIar>gA@RLlZNG<|aq2ig}FPJiW%~oUY)hhN(xwmNQ
zLx-i$uS|A->f^uM&9&*E<&xSx&8?CjKg997-am3gqng3mqxCDPo}fMwSA8S@rYp9w
zAt-gvahE|OIq#M+x6q?<0iZNRT+w&8^;lI@Lui@XME)Y7cXhro`SMMYou!W=Be>_t
z+GoI&1?rm}A-N$@a-hmV7t-3$5cVb+lSRj6ge1_&J!n$!Rxv=AT=!g;|NXJ)UxzrEI3-}%n^*4p_6S!wV6JkMRO>$>kZnnN{N
zCpoS;k7BYffM_drW0X~Vx4N|I;~#GsLyv)5gR)CXpdF7i?o@Jl2EHU5$H5>P8A8k6
zRkszk$J|TphWHPTlsPvQZ)>`p{QH|eCvnolmP5OuG}Hy
z@n=a*LvwSSpB-bg%59Pab8&RqQm#3wxKAGKOFNu>*wf90zIf{P0d-Q6A$o5{iE5#7
zu+DYxXuu^?rAj#N!h1gBLR%f{yQb~;%evk?a{fBq9L&8V#yxmyBwKZduKH{vU6a)M
z>tZXF@A@BPQW}Z$5+*ShQ>C=7wt0W+atk8|PCFQHC)cm}VFU;A+WfjFQD@;{t>SD<2T_k*6-uyAtC)jHNXD#
z6n7)ZVX4s9pb4sit&}x4cf01cTiC_0FxIeJf{$_CDL_Z$Of0l8tP!nrw2i++aTk<%
z%6R2^)u&LdYJie$cNzJ34CWeH_XNXTdrzhZhmuym~v3pI!Pr=+KoYRNv!G0Vf}Og
zX96bs`_s+|autX?4kRsqO<=N8-7^YH9?Gv5MbC$sb-kA{DJ+?awXuX+Xn~?bTbmgl
z4BmH`{ymI0rf}eKvCGTX}Gl>*g>5i0XafHkpYRXuri-lVpeVtWjKxvGYQJ5V7;wA>4j`*!Y`U
z_pRCm+x`p%orb6_v_a}v{K(3HM_Ecl2ANh1gjU#2EHJ9*JoxQ!pJ>4VUHg<0tK3X$
z7?JC3!Q+zK$pO2z2iZsI(?1g43~O$%h)GSxB4fbXF%1}}Lf&H9y-Z-?`3nG>9Tqf5j0(zRz~&?vwK*x&HGb+6&yO&9bKl}8uyaXF4t%41Id(|4R1Ba9nOoEt
zR`rgK4b7Le|8HT;{~v$bKMQ6f3^EXzC4!`sX6TMhxx^ZuOt`)bQrWAI?YGYK@o-d2@+eG+N_QDu|lZ3>GR9rVxCfN
zZ~DW4Eju>zSBZ-I5But{u9R}bX50`J{T!iN>{r}izE7I|HpR&hCuP|DFl0&NZHAVx1n!fK7EYQUIIQ^H03DN)^jFoZanSJ
z-F!*zABVdK1kTn>DROP&@Uo#~A8e*b0Hf}dbsO<7=U$Rd;9)&y29~4e#91Z9yjHg@
zre0gHs%n5YGFnT4@}(3%QFIwX9scNE<%9HojFl)wVLS!TVoD7yI_~z-NxHsmofjIA
z;9to;*xjm7V5RR`b+9z8tyi^hEc>~I!+*Mkqb;0$2IP3CDFs&pGv~6Db{ZKa6nr*w
zvO>=b^?S^B#l>SEMMc*~HdH)Ab7~O$3WqaPBPIMP>ur)8l6If64hMU#RO2j%^7N>h
zho|JZkH_@a-wyhEFG@Ql9^AM5e{^$3HV4%G_y)=bDjqnf$idB7fUli!X=aF@0J5@p
z#f^6E_|^nCGmT5;e^vz^MnD>x!9S6xe^s#;{|9Xhx$K3tsE8Jhly)kdivi=e748EV*G@QTxVLz
zu)F#Nk1uN~?Ux_uc>YVD{=7!#TijAwnWyNW!z=uD!?uD302bsgN+Zb{8f>hr5`|Zj
zh8?Vi-8W`cf8@AEm>c_Ef4c3AS5~{L(Lbcn!$+a;M0`ApO{v)4uWdmD#}N~Ly|9xrzW5hb{QaHYw`wCexA8H+BWwdX
z;ri$#RevToJGsA@+c-VksUm1(G@?W*=+G$~0t0~C<&Wap1Ik`O8*t8HQQ&QH7uT*v
zWMv>)5R@zbRMXHgd6W+OKFe?U3Ep}-%XlD+fNwE_&M}AG3q5aJ_4^ON!NqF&V>j#G
z@VnNH@FdnBi%D~q<=-K7tLTZ8;{KwheU;lGfk`<$r!J01&TgB1ScV5Ane6DN-y9Al
zwbo;QGlg}$4hE{UF!Fi$f7*mBKsjr%r=O=zb7q
zSjC<;YupGL^tq(Y_)j#H=8wPAW|`@_W>3n_IxB$LjksL9U<++#0Faruqx$f?jo_He
z18&{FL!Asit077PQIMD(Va0`x7_R7MRS1FEzLN8~nO^H#-FmvrkuAVM=-W^l6)`%tu8jQs7WN|G2kIKi$9MZdeYFFs2{^Tl&Cad@G5y?aa1KdwB;d
z=3JQ^MGpaI3VXWM;aTd_d?QTISr$Y$!uAIAh+EgX2s6YA(VNSPPuls?d{kO{8>0Zl
zn+3G;uc*Y=`uFnxv)iPoz!=9cSvMbVFR|Y$-H>W~=g!NlsEmPlA@am_L-rz>h?6uy
z2rhlio^a`5pnqn=D#t(2<7$@yU|GZtZU4K4s3^_ge}ITTmof|Jw-0D45e{^dii(6aeja*&!w1|?rh1IT
zej{VR=f%Es6-kqFn}{s&XFY?16PU?Tudd3iWlVZ*5_~9L!uDepOo>{RbqE&xLGv8^
zXDaknFZ5i|A&4$akN80fJ+FGL5n`YE6F}cZnNhU|fEj~!K8IV@XT-$I_McVB(NPB^
zHGivJq-=hk`tNRk`wo})|A#t}{<+9BG^bS#6V)H;&F2e875Sqh2c8LBpNkd
z{>ZvOO<<+=3r!TkPd~k+q~y|hI|msa)(Z}Z-b4SBb;d#K2dr^gR_-U2d@kz`nzJk4
zPHLR*0UAakbED#W`T`4+c2{3BL`s;HTBc}vc?)dr$4zq)s^_0;?YW(ZWU
zp3441<`4xuY7o+51jq>kmJvHCu3v!9{qcA%2k3{MyQnbQc!(rqKcTgoXB^&4F5x!5
zIQ~O5eDiOEH?tSfbgs?Y_#<3jWGUEh+t$cBNZ5nn-L8MmFHY7j=1;;yTZY!2y7dDLH3r8g)JuA>6y+R3Dna`U<11qO
zUg}feYEa5hMu`owj#NZ|-WzCluhOrcd@=_v2WM`5zwm>LyyFTyRf@Qi73b4Rw?yC#&kiLgr%=vm|6@w?eA?i)!u7feZ)$nARCI$A&(kv
z_UdBinBH5C13Zl`&|q+f7Xrh7p)-uqR)l8Vg~dsc%5+j%=I4-wg!pkuvwlKwxC=u<
zXoZ$24j)M?k#sH|Z9eOobyM;;jwvIVpkYjaNRj12q4L`5lP2}?(#?Ra{v@k`xK{$%SFs($FQ*eZ{MsrQ>pCHEJit8pBr4jztTLP
z3OTfy+puplR_(U-WTiZyEh$8@floB)YU`G&WKzDUUUv5LJq>LzSUKTAD8mz+Qh<<{l7#2xI;s2LPAc
z7Sontw&QRc0C}}J9u6RXVNS$v$~Qoji*knbQ?bg?<2(OQGS9mm3Y13*hl@jJh4fv0
zf72UtYB&TF`|6x(U&rLLgFq6|2~FjX`pj1=lgdWEHU*o0(}=>1%azc0JczX4dHE
zgZ4QMDP5r(HP?!C9flQynwSQ43!xa?
zYjlH|;?%2WyikjJG
zjwO5@r{)`zWS6eanGWau#l0^8EuOX9ePXY*Ue4-m(pR(Qhi0W->3+CA%^i6CNA`ZD
zg0X|7u+oueRo~k3%26?l09(ZkBwr}K@)p6ySa7Sj>Hw6*u0gICwR$i*mQPw0IR7n{5Eiy%u+m({k8dg2>1$bmIiPtzsFtT92=|
zVX}GN_7?L2CDjf*`4G)TqlKIB!3!Nc@(1(=H>-ejL?fR~(hZqxY0(NGkjuuhD%`Q7
z6`qAQf+>AD=js{=UnIh;iTrFW(YEq}j;t6*q23QdfJ)3{hq(Hc%f0%ox`dQ-T-Kvl
zbmypmb5EVskB$c6F#w}>7*O7U)IY8QcHal|zpK>3>krtN$@u)C0LH+^oMe@`TrQvV
z7p8v6@F_hh1I`T}$gIKTJ2q!*VPPDGw!q*xDUj(*L1
zKEgccs5UHD?G=%)T-Yju8qNd(a;BK!Ji>WXj^AD7SI&T2$=j#210MGtlYp+ck;4)A
zXO@mmT&OcdQxEjhRluZ5{A|c{dxmGG$j2a8wK;*`!cjHnv;D8y2HxXA$-~=*BnTS{
zMYmKa`;&$bc}?Ct#xdp(lL!>bFEk{91qY5ZNk=i-{6xABr~m!=lj$!y-=DcN42D1B
zoxMGgk~KvYX=m9q?#Wbn%%QlTq3L$OGVfZla9=BnPr_h6dg-~o&McEDQdc?aSf1r*
zq99Cxxu3cksM}zna^9-~HI_?tzs3>GQXVq*2--RIK`|U9$5P^d)hX~qnufqx%G7!Q
zxk=uxuG||3dmlgK@CF#nWU?d>O6evEJVN?=I2E$1oRS5)9c0uy?Ymrcmg8reCEIk0;+
zPvS`%U(WD|t1PeA^5Bk~W@DI>alq+GqM~aeRM%>|475=r#w?#xg1S)oF`BC+
z$Nu?AzaodxlJo{K6fQ4d@7z1yyKBt51?E?6Y-n|Jx0EVPK>D2YgxHRVy*AF(i_$W}
z_>C&v8(5XJEd#YrwkLuR-UlpKYh`2FEIzr>+nc>uAQ5s)ObGaAhJvALLg-kOB!KH%u-QX?;!NGlM*!2f~smpu_wXS=q^{TJy
zt0SrtH->Gco;o{}?<5DE`PJ9`{qzVn0aCZq^|U%W=NQV=<)rlYHDbPWzqd)i`7y!l
z_4@@XG@R$HXkLpbb(G-J6m;ZZ-d>hF@Xu*Rv;UBFk<%U*@HM{=9gBW6JlnB
zuIQwR-xwD{pyD7WqZYosdpA?62tz#vBaofxPrM2$+!Yh}+us*?K;`B5
zDq~3|e307r`3sbD20^<;L*!#LOZT5-FO7Rm5|lOu?SB|``7wU{hRo`fj+A31=0)Wl
z?pyj&5+F9TqoHVAy_CDSX#FoLTgt4Eam{X`sm^#na2TENa{Ct2$?)4Re{?Zj+`BRa
z<~w*W3pncz0=fj*fItA3~qofTv@z@0~{%<{Wpr^&)Hv1rm4M|=Ejr2wi
zzm(Q)sNX1O4=E%5A&l0oX(sF;-?cd$-~$wV8HVXDmguWBfnGez3h=Jb0CAX|mitKQ
z;TtW{lRqVMDqOvGmE;9(ovPYDk%YgN&AgT!CkkI{h+osVBilX~FkOs*Y+-dpH14PzlZ{+l8|O2*=U#jw{iA8jGcg6^ysUf4
z<1xl~f_VqWmpRY#JL#B>2U7T)!8lfpc|5+FO?WrYVv%x!<-Mw~HkW_i&corxh1sSv
z8Q+5@qutjvG9JWHd)cB4b0}`s9n}Qty}i&4zpU-cRkn{{vkVg(sM)?%@6n}>Ju6Xo
zmeR`TKIW*(R;-&}88BPW%BWJx>KYA7%>RsZyZzX_vV({G?kOey!fDA(CS$Mr2a}Ie*2u
zjeg^{aYA`T`9dP3k-eZgYsYKdd!3AUVaS=W$k=2>^ZgxO1=<+zD?xNL5T+5bo^
zeWNxQcS??V1Im(R)hR39_N3t*>S7$6ALkc5fiFgLnJfU~!Tprx9R*eewq=QSSjAsr
zNY)_kWx552Hay@4O0GG37)?WBrPU+_1|rVM#fx50#ktn+w{O~4ZRPhs^tOa2qd-U@|s%)u=9w&H|w(ekZh%0ga<)b+rbxtkZ*+KMMbqRrgc+!x~QoCwZ)rIcHvcWUn
zprYbc`X)z~Tac4)Gr8L-kAh{>^Xkq8V>aB(oFm0K;5DX>?u{ePk>$;5x0MH?5}VS`
zkHVMN!V}?BPJ%;*+Ve#-!IX0!ROcYi=YI>2yQ_2F1w4G^lulnB77%kMZ$7
zQ4E^N+Q}bwasi*u8<{C(k0FTU;1eG;G;(ngsdUq>Uh-$|RS!L^BdUP=@U_D@Mw$zD
zk3c&3lA|2qOBCK^t5w0*F~q8aZvG|;c`gbR*|I0Ky1x-TM-7v2n!W*|^6%uWrk9rB
zOVXg=dbr8!VlxqmJxgcpj~8t>J-y7tyY}Rs#XY21{k5<58>3tu?dsE#uHb^nb#0^S
zx%VIU@UUp6K#x?2-Ryh8O%+aPQba(uX6~6H)*<7yp{LFPK+~LP+IRf-xEbDpX1MYw
zV`|bhbe-_FQcWK)S)uKb{s%aPtU>&=^DcnBaRk7F7=$iQ(HVuSTU_9XA=?d5gOpw!
zPxlKwpwn)iDamtF*PdLtrxf^=8QEa(4>W~bRXNm5zSG-iRk)}2{-m2=WqNw4TM}dA
zh_FBjcUVADZjYTv#v^nHN>PtrC(^r
z`TLuKBu|01Nz=Qeln$(cBcp*6twE^|%5x`J%2BfgFDkZ|;CKKS!y}GFbto(#sXU8W
zYR@0qqCb%&7O~o(fvrxUHOaQn7$THmh|bOzYW3`
z*DE-5UVWyjAbUm(0hq;sb{^fZ;-!85(~HrWl3lm_yatYU{?s=D5dSv$K%nQ3;m9fj
zQ-px*+fxP!>g{X{f5^{;edrHGMoZb++eaYUIW7gytL>Qv7O8`>O)NsoW9czcK)t>-
ze|76jdt>j=_uH5TMBgL=n$%z&@24VCx542zF%hA-XOuAV{WUMl$wAr}od-b%kr~ZI
zj1klvDdLq?t2yNhAPMpfa%wazko$t~zfozP4p2cR2hvl37N+%!(Z=XCKg)irm3qG
z(bXmeAJF?|t{XeMq0<@)b@EqNE3g3#=GZV67ThP*TpN07+6_a_y(bSFx>keaZO11M
zavU7sV79q$Y^P2n32qt0gy|XPTrV0pV$H1YmW}YKmGf4%
zS&-)RHT-Lt4uGvj*$sCG&d_PjLzK-RqsxGi+mnCx{mIVFDn%X>HZGDd)j{QBy{Jf)
z*L^{Vzpr$s7iaxs0nrn>f3LQOrMspZ4fBznqZ5whQ5wGHOGG#d=XTj|Wnrz7w?DG;
ztZK%M#Iw-CE1>n0rsafjfqNs1Ln{U@DwgSB%t^BZLH|@UkSWGrWqI(0HEsQdD0FQ_
z)WljoWf&%nGdJCj4f5Xvv1wpJ%z96{FRSK)9B7ls%G5Wxu_XPbS*RwI&{6bt9s?1^
zh${Iy^6U8-5H1iz!`n$F>4cbQ9iGglz^KlS7_!yF*bHY(~?fR&0TQ|xTWI>!9QO3+9LNca7LGxAcLEhb`BVL0*
zOfeVz(QbAOxY+^?&FlQ1%+^)6L*n!t4Okd*KY@dJXF*xDFBD*PUZ(=w)=*1De7B1E
z-)w5zgg52~Co0Om6q)X5dh-ZFbE$jAm|A8C8Q-h305a{zKUwS;_)rPjR
zZURr{aQ@`_{#%Ohe_j9>40!yvcKC0&)Sp6mt(Yb`J$yykP}*ND9Y6Wf(4QEr=iEx|
z>J}F?=;3fv&v4Vo(6OIL_Fz)+!;zZ`5QNcBC4G+ipA_uRUX;&H%n+cse3pOjFUxo4qQPYY(5&v
zstjO9a}N|pt8VIGKK5JoN&%#dmV4XgBm@0Vo?JEJJJBei+`dM3IhgrGN*Urv;iRKz
zeYl8M{w1oWVOJfSvQts}7Q5cr%(|z2JxuqOL&OQzF!aixixsXcj1>|^&abc#oNrev
zb7UZL|J0M6KKT>!f6l!Q0>d18ZHyH)el*PU6l<5g=r*j@v~WZNs`<9Ne~HV4rT-=*
zRQ_?HkNW;N8Oe|RYipa>6Xi7peT%EN(M1w_u{z`!j!1XDrwnpOW%!wIiF
z_8epz47xq?_-JU_uJdrI&~=TnT0IwOU=q)H5tcCp@7GxzqglZAymiR124xDAEG9
z`!3cyG?aP$C#&}*;u|+uAp8T}qdKr?)1hYcl#0BivYIzCCg@y7#zp?#&4)=?T7~m_O3LI#}i+0<;bY>-|
zNbvigxxOo(uDXsZ2tqqXD2=RZ9ClcPmH#2RV!*N&HPVfQcTBYRMY-QrPFq46KH;{r
zfVqUluC7H?Jt3dQm^OlKv}MwO#_&rwRNSjhroi6uw25fB7EzWIM-Ded%(1^0(*jsb
zUP;?S+0~Oaac>LOrf=siw9T@>-zX1U6%qCYIwTw(W=dc^1yvFxq@?WR?N4UC4#kGY3Zo^#y{sq7Oho!ErxFnT{WtOZ?8Aw=5NZB2C|0E^V)9XDq
z<XJD0)gj&OLZjz2BS^tWZX|IwOtL4HDL_vbvoi$p+5EjqSV
zeFpfHg@1QG{nH!&biMyY;QV(_8}M1cWBot&9sZ1m|MzZ7`=8Im{GVr!7VN)RmVeUw
z!42eY=Uo`^@(*7p5B4YbU>~Q57l40@?jEc$9$Y$)?{@&t2`I_HN7WZJ@O<46p>^VZ2
z+$S@|P77~2K6`5&=O_lfy`q>IenBqw?K{DTyY@NiYolaYH?7@Xs+?L^v?T5R38oud
z-$}m~V@ZSgDF1`Jd;7;+!e)vTT^qRUMx(KmxW{TSw!b?%I#Sack8-pxRu(l~@sa{c
zl*u>HPY1P&RASXrjxiql=$>fI6NA{O0LH;%*u}Nm{=eLCjEn(MLO4VcQqHRMV&wk#
z!9LM|d9oBsOd$kp6pKiOuSrp%F)?Mb!oFVqhF)M)ub&}OKxlEZh<`)}F1)?ZB)hXz
znOSI2d7x9Wfy|~p;^MEc7>p6vs}lnQKT?f$#Lw6vFn`~oI#xwwV20K32`}FK2MTz!
z83vPAS@_R+K)%h`SVQ%-H(dr5!tIOUoSzv#HNgueCI?KqUcI2wq+%$SM
z7Fr*@C}oU|SncPSMOu=%z%x-{lMNfkkpptMx(7wCD$}(y|5)|r^A{A9WXSe@o0?bI
zNsxR{4v808CtvmU+RyUg+IV7xaz)5NlBbjLk#4Q`F__IS?L_lN691z>R`42W(;Xn_J*eA2%VO7m82LWbv>y_xWxG`O^5Nd4k9N{BlHmFPc=F
zIn$W6kwgPs4pxtp|5joQL7y77(6<~OAmhDR=xE<<%oOrUDDA$OaHuV8u5*a4eE-&P
ze%jJYB|-k1rHBt@M89QuW|=2ax|Sot5IVZ}2Q1!`P@wvN~BI179}Mtf(JLOmSOQHi`y
z-(r$O(0lpW#gP?jxOn_wYyJI9?Q1h4)M=4J1>srEHQBtuX9Y5kx^X4P2xa~A+-5bN
z`3H9+3T=r~CT14G*ZK*xlx+XTjd_bws8x}9H3j!_1kDeAw0qMB|Dp+}*3k_!^y;(2
z4$L<$|@%cdKXY;?>tIzTJjVEs);kr(cgU<5oG=H?P0XPujFEC+xJqq758h%jjY;V6J
z7PTd^M1115Bv8(QQNg&q_411+RmS5^86;wycGksZNYP~n_Xq-lu*`e**_k5-2uk9t
zNRJPHfwau_+|Ua{o<|BS%g)6sz0&VK%sq9UbmCX@XLia4gT(O#-T~6*@=ZciV_^@*
zyTxpCcZDh^J`1WBNaMUBu(mCJuX4d6Lov?Zq};ZZmY}1`ag}c$aPOS|`oWF$KAXTUmj1Yx+nXE9#(k<$>dP&4l30!P(f|S9KW|u|kgM
zXCWrXz1Ah^J9g88yPgt9LaP^Uz~p8}OH|@!zirhmNI&g{KnhcwxA-Rq$(joRit8iu
zA2Tk&UUYGUAa}I-HiECjJacMz=Trt(RI2FT9m&K-O3P)toT=F$J=-|=D7`BZPu_Ur
zl<~QH*L|u2;fu$nY@;00UeZ3(h~!y)i+wj3PT}%f57*SO#;da{&6B?i
z^0E!Qq!X=2eOkzCEPV~lMx`sE5S0NrgoO)Yb(+GNZ4#0z$5rcv+Wej1(hE!f;HR6u
zyW#0O0a=G;ZQ&L-ni_r+pA_I*^scTUT9j_dpPn!aQ{y(Iwa+->o@qo&%?we}dWwqU
zffsHKNYv+j2zM3A)=R4g+oRmursxc6AE5?N264a)pGY0+3TFMl#ulT7cO;fE!K+tRgCqizLGb3z
zS^RI#CQyR;D9UH*VkXmAa65sIdvP7Ag>W?HwvQH$$}D?^XZP2@zC3H~vgEinYG1eE
z9)+yJcX(*EC^~;Fd^TcNyT629T?ab>o2UuNEwnwlulUhjr(vaMbUl1q^rcs_
zaLa0jU`5Yo)6gEK^{b9(5|zqYA?_*qmva<{Ty4`&QYyN`=};=IdEdM2jT`sntN`!^
z+~iCre0$WR<`0JB-FoF@i3$=-l3}_{fmCc4SGPKT_Cqh2yy4*?Rfvz=5+2R+@
z!r$!6o=CcH0{HJKCX@VVW?78d~t#)UQJ;M|sSlJxuo;2HYlH&qi?im&n
zsyPR5)^uS?9E0yW`ZjcfIb*mUeH1Z;o|N9C3zPAxXC02eOH2FAX~Om9vU#%MK%EmM
zS8j}Nr=~2hL_+`v>ZGtOb}5%75+9(tPv-
zw%X3>i6PB5fszzIaHNulB&jxU_&F#QO7HU4(n^{rHmRr-$ccl*zA@ck3S*lSg5
ze8$O*Bh1e_SW=8c@FOvAdEenu^SS0ahiX5E3di2*=lUfhJ=jh8+YYx!U8vr{Q`Zj-
zE3wSZipT{DJ-95y*ozr`W5GXcFtduJze*U=qyApR>proA@E+iKog{s-Hkp1%2PB@D
zG%1j)rzl)G!}r!l-g#t6-lVlra>G$!esu2n{xRi_Z+TV`3Yu4=G87m?wnuh<=sfM(
z!+STKFGO5qICm>9!NEKIZa1xWpv1kc=7W_|>5`5y51ukGxDOG@JXZb{IrZv*xp5d7
zkoJxq)<3t{O^R2_#;%?7VE@zs$PuFYPPn5np^6+rpGKa{1$vJ5I4;0zcUmngey`+c
z(aUq^IqMfT7(DyuReUVu9aUU*YYcOIhh~$^!4=D1Rv(`EUQyO4i!{*A_X9VyJ^G#G
zK2b!1%7L>Oq6itMv$#}^4u&dlyZ(WNB1gdDmvg=|pB(2WZ_f#LHOGcNho290q<%+a
zZhSU{&QHqo_?E@dT0!1UaYAHQd4&6%^qI3ZAj7jTsg5|jL)aO^x8hvj&5hF=6}5%e
zEqlPAk?H=A+)p3|Rbk$lleNI__3;`t2qk*EBnXoD6_U*}zEhp?HmOaa2KDQ0KuSop
z8WoqQB5t-gsg&%PZA-*d%YET%M!bOgxWAD5SU!`5NVBc)Lw-6DGPheaFVDeqK{i?Zsl?r^
z@!5&b{IBz{?i@(uFw+qT`n?N|-2W^gDbc=+QMbyi?lsPn)?Ig6>#gyuzf0{>$Tz`e
z`%1q%H7q$=P^l^+4>-mbO`hE`B-)_RVV<&XjF@qynQe6yzhm}*ui&=Oq~h!E_qUdY?@&CXK1ECOwY)U$p0mhcio
z8Lg96;M*Im^hx)zSXWtFo^TvCnx3w(jfX;j8;r~HSq!U_rV;5fK@sYRB{vw?=*cW~
zUrNyFn5v2C$`R2D+w7u^7!QR;X!@PH>)I(|=s(;H(Tz5KNCoSqzC`D8&e8htIQb4l
zN9QsA()Sxvq9dfUC+SfAU1pDI3K=+O+jMV=Z!pDG>JkrQaUQW
zo^#J1tE#q1$xLYkb5#?5xNZ_svV7Y
z=F>c5FyTovg8{vhg`?7_xYHH!^uxy%Kg><@S0)vTFq>RGk*>AbG?yzAe6~zp(rmt|
zPSmWn8=cwN-4Kv(h=eW_PJVJ(sn_G*pD4-IT>f~>c(lGYVf4^m35AtT3YTh=?{7&y
zS)J$5e+#BvAXb&I{_K+hI
zxdM3NHz`9q6_=&%D|vDF@^E%AcUc0q>qM7Tx#r6rXO@0`;{iPUTc21nBk3f~eV!e5
zN2P;g8Q0rfjI@8(%{i&xdCZ2!1@Wg?#;!w$B~+z`nePPo9HRlJ{-}}dtP{Sm?Q}Bx
z4bZU!!3{e%VFR`b@3ou(nwa?rt+^S-4kkJ#(Uxp#IDe?n7#1|)&U7kIs@HKFlXZFI
zJIF>uli7RJ!Bkb=J#iUZt6mO~>9&iBc|B^P{`#gSP$0zmhOA_k5m!Eq)p+iVQ|8oe
z*8f6dN9awxbB9&+$9rY0R~za_w<-`$bIOJhT`}34XU5Ac^<6?%!pBREOTDnB=t~`P
zcY*h5ojUqiIow1me>tJWsWDaA!1@e=V(hny0L7%ja~eqpuL>qB)FEUmTre5B&m@*|
zyTJJHXSV#mj|$vmVE-gp#+H%#B-eqM(m3akAn5qH;f43>-KvYrL-CIX=
z%hFAkUkupGo{23+V$IB?M?A|9&me$giu
z^sRqqhOT?94LPeDw>ceTPgyqWT{nl_Y#*c
zu}iB?cufykEczF9;3Bndpz4?WuEH5lJ0C?*u)afx8c<>nU#_)^1_qDB7fYvLg*Y4;
z)pXv5PJDrP2kQ^KbSyPn7US6jQ6?Dj)r74@sPUYe^U#E-@!^#-Wl0#cI_yA9`pkV;
zJvBj6BfgGT3?U@BXY5ua>pNu(K3_WeDHxOeecF|(69pJ?%Pl0U5Y{y^$mF;WR3yYU
zWbA&uBr34}tw_LFpm5MJ>Xw|?X#NM4`W&De)2rC55c?Y9Ro?MZW9xQbprc;hhP_X(
zQ`?H^3PkQ6r>c=i<~Mq4c+&Ej&OVWl9y69Ag{OdJxl~BF`Kt2JPaxr$Pny>|(4Zks
zczAR87;sDZd9vY0
zDFe;Lt-47^jmmfa6JHCOCgU=(&&Wu7Y5VpllcEY6i$;V)Y~2nznxz1~iGS(WbxO?p
zvx1|rp#*x~t&nfB8rm)x`RMWaCss2k2Z74d(*=`iMm?BGX6Nk0L;^-k$TYW7(+YdX
zwLZQDfv_G~RKoq1k1WQycfvjG*A<-|rJ+SyB8@fbpA1vi#Nb`6iZ)m#kY_%#d6M2Mj)4hnjl
zyJ^+Bk>lD=pMSL5$4`TvYWh#ZTfjE4Epl^1i7zf30)rk7Pw@JNX5}{`Lt^Us-s*uC
z{2lxEd@S-Qo=;ACtwt{ztB-Z~juNMZO7$Sj`~9=4aDpiz8i6Bx_~d}`R>ILM+jQ?v
z-7qkTbGdWEnslG3daV)PI-PddUBVHaU&f@
zfev@F+v$yX1Ch&T7S?Pc7P&;QADwv9-}w|qHOdHc$7u4Etz5-%@U}V2{zkO=D(mES
z%|!TP?A-L0yn-2LpK_(y#z_S(KRr2(WTVk~PXc;xPO9(L!nKCDUZb>$Y{m7DHaD1^
z(w%xL%QE&edArWL$JPvW8<%0{GK0cSaKFr)vC?5p&O?_;DmkTv>cONKU#^j_z7O55
zd`!-1-ex*2e3VrRtJ7MIN`V;XwGHKb5j}e6yE^oZ@;_1aAubU~X#D3JEGe47eo?+l
zcYyKfC7$gstBHw{WV3|CA$|gFS8)76-f8z2#{BdX2HmJxXDau^iGHdXeq>0T<$)|q
zOY+N&Jc5QOvYW6RR!c4Lo&(nx6EOT6pkLiK9+#Mgbs2=B{DzPp+jV|9K6jzSv`K=@
zMC0Y>Ym1S!i5#&nJl*4ZvBHl(6guJRLD8RI@_W2n)uC1cmT*P2kf1&dQZ?iKaRd3Y
z`?ormfw{Uh8$I-+ro(57rj_2kiW<-*S50u-FxyXb&Q|Z6y!!t8&UJEI%J&x5-()*E9U>9oXE4qw$t!5d`LDOg
z6_x!TSyJ>8BvF)A75n^hXN60&kU|m8ZYKWrNhe$T&c(WJdJx*Q=zCD^9n&5H2K8PG
z`nB%L2h06C8DHB=-=~E?e?u}#J9atQ9Q1?*UVVG1g-b8SOk`^LO@5)AvuTLD4ZdKO
zLH+fk`shDOsA_NY73ZqtSE~v_UXkBF>J`3&InV>(#h*rwh0`J{82^M!T#W$PsGftWFB4_Nu>mes!_5J<<8`(^X-UJhS!A
z{1NXt9lmvF+tj*o=b92%w3G*7U{$_rj2%@QH&tM3Dm|;qF?_*KXl(U;66s!U9#WDP
zXKWS*OE9Vi!`jqrDh>YJvuqf+q4T&E?#pH}gST0>d#+0W0z47C(@WRTBLi4q(8thO
zc>eax+eGr6m+%pY-zYNOL-fG>Nyx1x(n!KfkO+irCNlZ
zGLp%|mn8DlF7tY%m5C|g{EuAO1w%LgP9S!*AKc|&ysPIdtgR9Rhpsy9@CUt0@lsd?#H*7iGRj#l
z(`G9pO-K#URXn%`LJy}UjwMx|Tm@FiD9Se$RXBb{@rQe4Yot5ltI&7pFmpao^7Voz
zAxcl0?+_~-?nlfCob@06RXTSpOZDz=_xdwEV*b#&&0nc&`>TDX%DAGQ{<|;tEX`i@
zQ0`y)@Jiz8mkUU=>?x`H@n#+Ul`RjS(@J8KSK^C
zMhVik1#+y~6uuBNaKD&)dWq&{1~EIDPaByp7YC2l-aH!$y^Z3dm_ZOhaFcD_88={;f6v#(DH7RQOc2PSMQ@f=$ux$2Pa9O!2_3Fm$|P;WMWL@c~SBhgHN>xBQ#I8t_-iZ!Pq=XKEkXXh_8wn60
zgoqGAXQYLeL`6heA|(U}5TwNrLWGcnBm{l|=RM!~opavztZ%K4KUgeQNbYApH}~Gx
zzOHLO2=9O&b%;2dx2k!mZSM9;;+89Crw!jh2AoY<(pWPvddlR>tOMU`W>~C|Gt%W(
z?Xvc5ruzu*BQaGOm`wvSh*`3T$o2ESv~1&v`D|z2@LrmCDE?0(?Bdy*`qiD@AB_k{
zWnh2!Qj|CJimy>q0qFWEUhD+xbVXqAQhmew$z5`}E^&(GmGCv$c&;oArUSUPf>?3j
zFe#Xs48Vrj+@m?NH*Zo!*4geoRR53`{sZOJX1UPXe{77|tq<$0%
zOuF-y@*m_3e%rM1tVYe@xRqNfp{ke`C=CnAga#XL#a-Rdc@Uja8J+HZU})3SGy+}q+`HsA0$T#y$uI?a){
z0pRJKeio_d#m<+(XziC-@d-pHom_7vGH!}KgV8t
zyH4V+f0_I?{@nsECzt#4#>&=zYx6xOvY+k&wyei4^#1-{Qo{=riYPu^Iw!RVV~I9<
zc-(+nFZLYjG=kuAdDC#hR|{Nz-^4Nr7I+9%SBTc4Ph<3-dv-t$v>jXjkWk0|M~w}?
z%zYZ;U-iJ+r@-wkzf;
zwK1^YmkAu$c}Qs7`{l-(Z^>P_cw0rU+edkO{^3t|YSX8Ejv=NmHwrF|`)=RFUwd#;
zba4Bs67e4!>#w-sJUZ9*Yn#QPnlwDwM>=`oao;J?uBO}yPcpVdDi4RT_z_YL^Ral)
zW$n+b`GI$Y5yCR@0?9zu9An&^kp((2bNkx%V{BcTg#sM;_+Q5|)N%jGYWh5pQY2cl5nAULhZTg+31Cjl1)8z)}Fvcn@v`oLYe5i2X!-*&K2xq%h
zLR58>6Lpm@ZaXb5PfJ4JT^aqw^Wci=B;~t6q*#3-+(VZ`vBIlG6q(g5t~Oh>Vn>=%
zDDaX-IMOYZ6V1tcnX9-9i=I0UFWZl-T{20Vrz=qE;6uT)OSBn&_9S#=O42$}#B&}M
z3|Y}cCblZhFvs2YtEyB{h?ACCig9@eA-Cf!huRDWy@%wl@_U`6P~}-=RmwFf`r@9A
zyWsT_IQxJ!dZa^Z`$0?$&|5rKKl#LtUOsiJ?TKn&`;Tj-5)P~;
z(zJGjbYsl^fMhadm=db`VoN(S?pX5m!j{|`-u8I>jSkb%bb6+DNrz`_zV`zq^W1!0
zN?v<}uHuc#a&TN)RO;(l7iuzk+QS*7htB#$e~}e>B3pWjkmmuVAp}qV0GEDjFYU=a
zq6d-$XO>o%2r8+-k_Nu}6+EcPzpdTgwby7)t
z$0DsWh8K6*o>||Q!V$t6YH9m&^cB{W3i;LD__#hp#`lnUR}ZNVbTUZrok-ajBGme%
zw2)qQ(d$5UWGg2wNU1b_!e#VzF{Y|lNd0xo!kvs}v`g}XscPFC>8S+ZAme=bIS_~F
zOsuGTel4%Ve*QQg_KH`F!Igy1kw7Z;Aq1<6gZVC_(F)f=6K622*mLrDiRDzgiRfUD`#bg+9JG|u-q
z&zWS_S=6j+q?y({l~z7a>8_(!;;Mu?(!v@b3Pbjo-z*v#J%76M(lcGo`$;egjN^Us
z!`zQ6&ysJc_3BjU5Z2Al@)Mue>|}#cR|$glC3zh0a#rDVOnZ#2q4o|owg^^h+348j
z$ysR_oX5uwG5q@kb}Wx}Nd6e3WkMP}3qX=4pvr48vn(H3CXfml0MF+Yl+H|Da>t(a
zgIvpU*%0_JIPjaR>@2#Tp785cA3oj8HA-?9-a*fdbl2<~uk$&RRTP{C(sv7wsSJUf
zNMoo;$i;u~9xSQgT}jk%alT{k-w&5cH@?VQ=$RVN3%@NDZL`5ySfwmC2Oi`Xzb`2e-I(2cu~`
zu+VmmH~Ah5^glORk?AHKT8R{da}Dg*%)}(#0y_xw2WE2FU*pT*T}rJ!?l5!o
zHV3I^+q>^Y$bpmT6JS8}ba_L|5ET{-R>R3Bw4Jr+Ec1PHu(O_lgyFnD-nMAdHZHFU
zFLh68ijU{5uqiX8Xu;N#fA-)OE5i%visBo0GKN8iIK*20SAE>7cr|>cvQEUdQC{QVzB?R`>9MGa)r2L;
ziG%I;t>g{nP1usT=LvFb8eQLi%oAhgb7k52=dwwmlPd2p(DEP9!JRg31=_D
zGKf|mPZ-yZ*VZ7EBit%|gk!!M@SvF!!t>XiLX4dQjHdM;y0dnDbs+k4yJ)}u{A}A;`H(}G
z$(*3TZWvHwCKt+tukRE$>IR3vDBss1K@+jH33d~sF0-DcV3Lv{sLGH*wjCK*F%5pn9p>9%
zXY1qVnS5mQn8E%0ipkGgHkN4c+2+QHJ$jc()L?(bCn4m%N)~$Xe!JbA{p(r1*(fo#
zr3H~ypoho~s*7;cLYGI{rT9ERx5n`Jt>1X#Pf<-1f*Nn)741@;mabNFaFYBKu-JIb
zBPI2C%1+#Bj;zdgn-wqtr-Zq@rS%2c5y{m!BUl|jPl&R%bc|e$8|K;Y7WF%0q;aR6
z*0`T|W|gFL-bX{-hLlU+)85VBH41_=sIY_PG#zc8NcXUUGJp*OSE
z)}u+pPIy9ytcIeD7;>$xtI%Bq0Q7^Q7JhVeT1p%uJH6Q2KgWcheqCky^PagR<*r~z
z@`AQKpRUvGtQ&+(;uq2@NGSYeqBO=aVg8c%+~}QUO-vjAqPVUnwSR7T&}gPUludD$
z740}LIP7^i*QgNQWI%&_Sd7Uvr7lz#3x^Jf(oD)-B3F%^CFucftA(NpcP-x%NtV=j
zBAdi_Nkzul*Hd^+WZp;Cno^00B0pwF+tKyX?w;K`b{f$4Kogg!$(I?HF1G=X|G`9{
zx0~u!OJ`AL)v#;g8S?RjP1oQxqt4fCpl1mgFCbkLA0E6&3gP_m3w;S(5IkSE=}>ue
z=j)IL->MtnMtVt?BJ1U%b1<_+6`kc7d_2qN@1$C2l6Y!2N8|p!har(
zZc5#ofhRfg8=TAUn+&(b%xwY0rTvVCqlM8nu;dv5EBAPVf->Zq!U3|>a2>kME-}43
z6mJyW6)vwd3AujcD5V~gTz{MBl>%m^3{DyVGtwm<9Q)T{BGgP%2qC>VVkAIQWI=jg
zDKM1S{`{BP>l7>d#EL&
zlCOt5eZ!iRP;IkB4JTyJEUv6dh@Z(@HFHIFDHs;4Krv@+;S1(jmcv9|qrFgcB?^_4%qg)f2_*A{bbr{M&LEK7c*6ZAz(cGqN2IAGp%C6oGOS&+ypRu(
z3OFc;to%7|s%!>5Qwbu$&Q)54nMNl)TH+%V-d%V4Pw4PjMX{wna%tywUnL+80L>OK
z)l7DO`y-dVuzB3jyfUB9=dP^^fjpkQh>3xxVM?ScqP}MB0$FJw_bsUa0aeg<9oUH^
zTPikZdgD|#c`2kQ%N1STfJ?D@`xiasn^i&(CAXZ7beczq$L{Phm{|Vd-rbE%bI<>G
zQ`nh3p7k~*i@oYTBg#xa>_DAP%QkKCWsOY`1)yB0`UWt2d(!>up+7n5pHx2ok~9_e
zHp15tX7j|)X}0^PNhz7!)&B*0+Tr-kq{(e^DVH`rx<1ra*D>+>&*ZG7qRa|tcIt_r
zHf?ukwZhrgUjFr&*i@k%TARLIp83N`1DM>ni~f4)2yBM%J~qEebq$kk!EAGXXQ`N9
z3JHGBUN;{$pI}AR5Lcy)wN-x@Om%IAXR~Nuivhy3opb*+3S5uU+dcoc;PT#a^#XXr
zaee&+{+@fCZ^Iym``LXio%NRpK)3=h*7bX;+tQz$(Qsk@Q!Kjq(NDA6-Zq3110Ki4
zAJW94ZP4;!Uc-0Xob96JGs3-&n?2a5z=!)8PXcCkB@1!Wj@O0dp1d*
z_m}Fcv4CVI>o~qMWAf$X^@UL4&Ojewf%I97ni2oWPTRd?naEEv>=?y)McT*A7do!>X%<5)qX}9-DoJB)g
zEo8nh64{UBC}EV>y{qd*Sg)p+gcobak(#V
zX;{4Vn5*!V`0-!mi-mo^Y>)2Ede*F1jB#}G2i^dm*w4VtoP*NORZcJMdaT;#z%d>y
ze(oSKz4}pOgmY>_`S6FaM=im
zAP63VcML{$uBJ!_PlQh`5Zme`S{dy=z{1qp;Gb=_DLN|7E3r#{x=yF?8u_;y
z(8%3k7I;Az$7SBal+>T!5n4z})FS_HNhVj{2?@EoeNvV6ono>u9
z)R5fo#|v$uOqr^UR?N$uO1yV4@X6$PCE&fhAy7;Tr*qwtH=&$DuBjo&
zPAZ@u+54w)P{zO)O6jZ>QVX;ii4j$S@tt@^U65$0gW5?7grA;tTkD=JZnlh<{$^_J
zpseB43u8sA+RR4RzglY)R%=Jmad+S-@o6KoOMI^YVyDnCCso@@Y;#2#G;2nmN#T1A
z!A^22gwqb-A;IavijR=Sp=gPSJjXSs=vxW#(z3>c&f#OWgYb@74MYfwah8X;w7R>!
zuFuOoXt>z`ZFOWmr_*8BD^(V}7pL3q>&^;M*(^P?3OuAlJ!YQwpfM;%zE-PEpz74T
zwx~T10-!+xv5)~@OX$UZ6*mW&PnMaiD``Tp??smzB|1HITNjHeKJ)F*wrJ6D#|9?1
zouvr=h{&4KvqMDzUTbzxZR{bT&}05>6NxXuUyCC%5fxKaG{qtlyw5k+(fxDNXESEb
z)ss4dNnjb&ybvx?MW&hiA4gS=ED@gYB2>RHS1jL`zw_@gd~rwEj{X}D&M&sc!wp}r
zdd?O{!wsDFwsV?qseA=|^}l_=%fgIprOW5ARnBxeEITbB)_
zo9xX!0PE@p#4{fi@;wJ&*lZfA6Jk`#iuTQ2g!aY4tvU2pYw7KU?&26r>9{mj-e<{R
z(8{K^VJLaOEFo#32Sy3yO{|z98E7T#FL75s6vD**TEQ|>rtQnF;~t`DMdfg~6FWEZ
z;<)M~J3;xU?p=eGKvbpE@XnAZ9bxfGX*w(V2{FwTD{$6p0&|jA$yTrH)?wk3H(
zB##OwtcI#m@-Rcs>_e7fVH?o&ja7Nul8#zzsO8#eL#?1(-Ok(tWLL&6b~noe-4ki7
zb+--_Y$c=>BzTH#vUEpFNZx?2@F&9r2lupCx5t#p=8%MCfdi}1`ZE!09q$DjCMD96
zHR}3<;SKAZR}9qbSi&Fgc^6v|eq_F94@{DK
ziQuV&6a@FeQ=$UeB#E5Ll(r~O%Gyf!`uX+q1_OfhlL8<{zpuR}{XSCD%kiKpU^JwM
zSuvTRg$5+qpo7Ut8xklNasYE7Vgp9hdw~IXI$$?
z^+Ake?F6r7Glnh$R4piHz@JmsjH9#Knz)nAu!Lp411rRHMTC9xoRnC!af9DF+Ufts
zT?B1&*An;Y#8fmP9tHvSu*`9{oFD`=Iwxk2~z|sf9$!!ttb7#Cz
zxwn4LTOCD`?wj-W?V_LbMzYTKi<=-8m-qE;cHTghL;nX=9y#4X;;x2UN@>m{U=V=S
zPENxZyf(A3wT4U86xm^5s09KS6P?t#*<*XleAp7h@8up
zo|s$Jt(q(qlnYP;7Z{c%w*giEU=CFU@q9mOcFvUM14wr)z>Shq?S6Wp3Dy1r#tYaC
zxnwq?(rq)OCN+O>yX^N`Vq}BYR%M;i(UuB9-7nA#1Ay
zS6Q(-u0lvrZTuMSI#SU#^QJL1iK^(+Y_}$R_LGZeO51D|Mg4-ob7rXz^_W_%)xo)-
z;}?E@lHV}w{^Eq`cB+l5FBj0!Yn#=Htv-B`{o}&dn`1l6W=d8rsO*vzY8{9hq|bMi
zQUyG0uSU5(VXdptXwCQr5bOf(FzLq}ptasLd)^WRK^Qq=KFkv5#$h`hGbjxthayi|
zJv#u
zcX3o)5ky*yiz>zY{9UC^H$i|sPz?Amx3Yb~p>)lm-)5BLeNCA=6iu;^xZHI4bE46>
zJWWtDYvfIlc^Nu1X3ldiao`w2!XfC1A28$1
z_#|_(Ep>)Z$Af3qnK3?e`P;i@m{d${)|-wtt&{PP+P@uazYFPd!5#21&9sg`)pIU`
zHJ1kaEw9Tv*X4&?r#{|Ngdr({_(N#(l93x|O*RsAO$P|ffUk-GqT*o+2H353X`N~t
ze~m@F{TpU_C^cu=TVXfLZDk&j``$^hsQZ%}cl2x+s((vU?;*ytVBdv6IY6sutK4^-
z^q{;=-fv>7(A>%^`%#i)a-?i}IQpaT{8dcR6}h$v=w>;`?=P$>IudQ_UXeRZ8>!!R
z9HQ_o$038!mzPxw)oF<#A-ej5{59p77I}w%Sbi&e_uU&6`n|+GSL|zx=z>u4W!Kus
z=|1R*+dp4_r5a*{E;*TYy`TH#`b;U-GIsE%dk1pBa<4kN*9%d3@L2O%@LU9H-vQYL
z7Dq-?WhgzHR#>kj6Ry6sNb|bJX3HGLT=)zVw@3l5od7yYL_8d1di(zqa#Hr0|AeIm
z`Hz;sAyYGjm9V%Sfrnx|dTkczhe|anUj!zMLjs23Hc>fd`~}S2Sfz1;A>Ii4QFN=X
zo9vi8%RD7!MqJ%M+Xv2%E@z_>Q<5rmsqo-B1hZ>{n~)&_rhZ|7%6{e5pf
zEZA)=pVAor(QPgE&o8<+U`@ITxR4?(Imzyv0|P*xLYp-i{WwiNlw*^7