222222Added DeviceTunnel profile in Windows 10, version 1709.
Added the following settings in Windows 10, version 1709:
+Added the following new policies for Windows 10, version 1709:
Experience/AllowFindMyDevice - updated the description to include active digitizers.
Added the following settings in Windows 10, version 1709:
+Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall** -
Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Centennial apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed polices for those Win32 or Centennial apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: `./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Centennial app policies, see [Win32 and Centennial app policy configuration](win32-and-centennial-app-policy-configuration.md). +
Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed polices for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: `./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md). > [!NOTE] > The OPAX settings that are managed by the Microsoft Office Customization Tool are not supported by MDM. For more information about this tool, see [Office Customization Tool](https://technet.microsoft.com/en-us/library/cc179097.aspx). @@ -87,12 +87,12 @@ The following diagram shows the Policy configuration service provider in tree fo
Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall/****_AppName_** -
Added in Windows 10, version 1703. Specifies the name of the Win32 or Centennial app associated with the ADMX file. +
Added in Windows 10, version 1703. Specifies the name of the Win32 or Desktop Bridge app associated with the ADMX file.
Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall/****_AppName_/Policy** -
Added in Windows 10, version 1703. Specifies that a Win32 or Centennial app policy is to be imported. +
Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app policy is to be imported.
Supported operations are Add, Get, and Delete. @@ -102,7 +102,7 @@ The following diagram shows the Policy configuration service provider in tree fo
Supported operations are Add and Get. Does not support Delete. **Policy/ConfigOperations/ADMXInstall/****_AppName_/Preference** -
Added in Windows 10, version 1703. Specifies that a Win32 or Centennial app preference is to be imported. +
Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app preference is to be imported.
Supported operations are Add, Get, and Delete. @@ -914,6 +914,9 @@ The following diagram shows the Policy configuration service provider in tree fo
Added in Windows 10, version 1703. Specifies the authentication endpoint for acquiring OAuth tokens. +
Added in Windows 10, version 1703. Specifies the authentication endpoint for acquiring OAuth tokens. This policy must target ./User, otherwise it fails.
The datatype is a string. @@ -81,7 +81,7 @@ ms.date: 07/14/2017 -
Added in Windows 10, version 1703. Specifies the GUID of a client application authorized to retrieve OAuth tokens from the OAuthAuthority. +
Added in Windows 10, version 1703. Specifies the GUID of a client application authorized to retrieve OAuth tokens from the OAuthAuthority. This policy must target ./User, otherwise it fails.
The datatype is a string. @@ -116,7 +116,7 @@ ms.date: 07/14/2017 -
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the enterprise cloud print client during OAuth authentication. +
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the enterprise cloud print client during OAuth authentication. This policy must target ./User, otherwise it fails.
The datatype is a string. @@ -151,7 +151,7 @@ ms.date: 07/14/2017 -
Added in Windows 10, version 1703. Specifies the per-user end point for discovering cloud printers. +
Added in Windows 10, version 1703. Specifies the per-user end point for discovering cloud printers. This policy must target ./User, otherwise it fails.
The datatype is a string. @@ -186,7 +186,7 @@ ms.date: 07/14/2017 -
Added in Windows 10, version 1703. Defines the maximum number of printers that should be queried from a discovery end point. +
Added in Windows 10, version 1703. Defines the maximum number of printers that should be queried from a discovery end point. This policy must target ./User, otherwise it fails.
The datatype is an integer. @@ -221,7 +221,7 @@ ms.date: 07/14/2017 -
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the Mopria discovery client during OAuth authentication. +
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the Mopria discovery client during OAuth authentication. This policy must target ./User, otherwise it fails.
The datatype is a string. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 80029f2e95..c69b113a36 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -144,6 +144,46 @@ ms.date: 07/14/2017
Most restricted value is 0. + + + +**Experience/AllowFindMyDevice** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+ 2 |
+
Added in Windows 10, version 1703. This policy turns on Find My Device. + +
When Find My Device is on, the device and its location are registered in the cloud so that the device can be located when the user initiates a Find command from account.microsoft.com. In Windows 10, version 1709 devices that are compatible with active digitizers, enabling Find My Device will also allow the user to view the last location of use of their active digitizer on their device; this location is stored locally on the user's device after each use of their active digitizer. + +
When Find My Device is off, the device and its location are not registered and the Find My Device feature will not work. In Windows 10, version 1709 the user will not be able to view the location of the last use of their active digitizer on their device. + +
The following list shows the supported values: + +- 0 – Not allowed. +- 1 (default) – Allowed. + diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index bd043230c8..b793558289 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -18,7 +18,8 @@ This topic lists new and updated topics in the [Configure Windows 10](index.md) | New or changed topic | Description | | --- | --- | | [Add image for secondary tiles](start-secondary-tiles.md) | Added XML example for Edge secondary tiles and **ImportEdgeAssets** | -|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)|Updated several Appraiser events and added Census.Speech. +| [Customize and export Start layout](customize-and-export-start-layout.md) | Added explanation for tile behavior when the app is not installed | +|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)|Updated several Appraiser events and added Census.Speech. | ## June 2017 diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index 8a06655003..0d8275d602 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -40,7 +40,9 @@ You can deploy the resulting .xml file to devices using one of the following met - [Mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) -## Customize the Start screen on your test computer + + +## Customize the Start screen on your test computer To prepare a Start layout for export, you simply customize the Start layout on a test computer. @@ -69,6 +71,11 @@ To prepare a Start layout for export, you simply customize the Start layout on a - **Resize tiles**. To resize tiles, right-click the tile and then click **Resize.** - **Create your own app groups**. Drag the apps to an empty area. To name a group, click above the group of tiles and then type the name in the **Name group** field that appears above the group. + +>[!IMPORTANT] +>In Windows 10, version 1703, if the Start layout includes tiles for apps that are not installed on the device that the layout is later applied to, the tiles for those apps will be blank. The blank tiles will persist until the next time the user signs in, at which time the blank tiles are removed. Some system events may cause the blank tiles to be removed before the next sign-in. +> +>In earlier versions of Windows 10, no tile would be pinned. ## Export the Start layout diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index 1f4eff567b..f10201a997 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -33,7 +33,7 @@ Members of the security community\* continuously collaborate with Mic Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent Application Whitelisting policies, including Device Guard: - bash.exe -- bginfo.exe +- bginfo.exe[1] - cdb.exe - csi.exe - dnx.exe @@ -42,14 +42,16 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you - kd.exe - ntkd.exe - lxssmanager.dll -- msbuild.exe[1] +- msbuild.exe[2] - mshta.exe - ntsd.exe - rcsi.exe - system.management.automation.dll - windbg.exe -[1]If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you whitelist msbuild.exe in your code integrity policies. However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe. +[1]A vulnerability in bginfo.exe has been fixed in the latest version 4.22. If you use BGInfo, for security, make sure to download and run the latest version here [BGInfo 4.22](https://docs.microsoft.com/en-us/sysinternals/downloads/bginfo). Note that BGInfo versions earlier than 4.22 are still vulnerable and should be blocked. + +[2]If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you whitelist msbuild.exe in your code integrity policies. However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe. *Microsoft recognizes the efforts of those in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people: