From ef0cd33d1d14e167b360b7cd3fd23d570f554b58 Mon Sep 17 00:00:00 2001 From: Nagappan Veerappan Date: Tue, 17 Aug 2021 10:38:04 -0700 Subject: [PATCH 001/284] AADS query update AADS query update --- .../identity-protection/hello-for-business/hello-faq.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 405b6710ad..3a715535a6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -219,4 +219,7 @@ sections: - question: Does Windows Hello for Business work with Mac and Linux clients? answer: | - Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). \ No newline at end of file + Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). + + question: Does Windows Hello for Business work with AADS clients? + answer: No, AAD DS is seperate on-prem enviornment and device registration with cloud (Azure AD) not available for them via ADConnect. From 3340cf5e13d033e17beb0870569512218639433e Mon Sep 17 00:00:00 2001 From: Nagappan Veerappan Date: Wed, 18 Aug 2021 07:45:54 -0700 Subject: [PATCH 002/284] updated AAD DS and expand them updated AAD DS and expand them --- .../identity-protection/hello-for-business/hello-faq.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 3a715535a6..65c19ff255 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -221,5 +221,5 @@ sections: answer: | Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). - question: Does Windows Hello for Business work with AADS clients? - answer: No, AAD DS is seperate on-prem enviornment and device registration with cloud (Azure AD) not available for them via ADConnect. + question: Does Windows Hello for Business work with Azure AD Domain Services (AAD DS) clients? + answer: No, Azure AD Domain Service is a seperate managed enviornment in Azure and hybrid device registration with cloud (Azure AD) not available for them via ADConnect. Hence they can not perform WHFB with Azure AD. From 5e7f41f67f99d943ec6cd5daced76d2b5092e5c6 Mon Sep 17 00:00:00 2001 From: Nagappan Veerappan Date: Wed, 18 Aug 2021 07:48:17 -0700 Subject: [PATCH 003/284] - added - added before question --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 65c19ff255..d774f0890f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -221,5 +221,5 @@ sections: answer: | Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). - question: Does Windows Hello for Business work with Azure AD Domain Services (AAD DS) clients? + - question: Does Windows Hello for Business work with Azure AD Domain Services (AAD DS) clients? answer: No, Azure AD Domain Service is a seperate managed enviornment in Azure and hybrid device registration with cloud (Azure AD) not available for them via ADConnect. Hence they can not perform WHFB with Azure AD. From 76182769f5889e4a19ed0ad7bebdb9d148d2bd72 Mon Sep 17 00:00:00 2001 From: Nagappan Veerappan Date: Thu, 19 Aug 2021 17:58:31 -0700 Subject: [PATCH 004/284] Update windows/security/identity-protection/hello-for-business/hello-faq.yml Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index d774f0890f..7d470d3748 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -222,4 +222,4 @@ sections: Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). - question: Does Windows Hello for Business work with Azure AD Domain Services (AAD DS) clients? - answer: No, Azure AD Domain Service is a seperate managed enviornment in Azure and hybrid device registration with cloud (Azure AD) not available for them via ADConnect. Hence they can not perform WHFB with Azure AD. + answer: No, AAD DS is a separately managed environment in Azure, and hybrid device registration with cloud Azure AD is not available for it via Azure AD Connect. Hence, Windows Hello for Business does not work with Azure AD. From 22099b37d5ee6c1c2dabc123b1390fca29d94dbd Mon Sep 17 00:00:00 2001 From: Nagappan Veerappan Date: Thu, 19 Aug 2021 18:01:51 -0700 Subject: [PATCH 005/284] updated as per Matthew's suggestions updated as per Matthew's suggestions --- .../identity-protection/hello-for-business/hello-faq.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 7d470d3748..a6c2533e72 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -221,5 +221,5 @@ sections: answer: | Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). - - question: Does Windows Hello for Business work with Azure AD Domain Services (AAD DS) clients? - answer: No, AAD DS is a separately managed environment in Azure, and hybrid device registration with cloud Azure AD is not available for it via Azure AD Connect. Hence, Windows Hello for Business does not work with Azure AD. + - question: Does Windows Hello for Business work with Azure Active Directory Domain Services (Azure AD DS) clients? + answer: No, Azure AD DS is a separately managed environment in Azure, and hybrid device registration with cloud Azure AD is not available for it via Azure AD Connect. Hence, Windows Hello for Business does not work with Azure AD. From f4d31b487e0f58220b1f916837dc8dddad1479b2 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Thu, 2 Sep 2021 14:44:14 +0530 Subject: [PATCH 006/284] update-5388078 updated per task 5388078 - Windows 11 update --- .../administrative-tools-in-windows-10.md | 9 +++++---- .../advanced-troubleshooting-boot-problems.md | 3 +-- windows/client-management/connect-to-remote-aadj-pc.md | 1 + 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index 6da0fdfdb9..6f70ffdfb5 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -1,5 +1,5 @@ --- -title: Administrative Tools in Windows 10 (Windows 10) +title: Administrative Tools in Windows (Windows 10 and Windows 11) description: Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users. ms.assetid: FDC63933-C94C-43CB-8373-629795926DC8 ms.reviewer: @@ -14,12 +14,13 @@ ms.date: 07/27/2017 ms.topic: article --- -# Administrative Tools in Windows 10 +# Administrative Tools in Windows **Applies to** -- Windows 10 +- Windows 10 +- Windows 11 Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users. @@ -29,7 +30,7 @@ The tools in the folder might vary depending on which edition of Windows you are ![Screenshot of folder of admin tools.](images/admin-tools-folder.png) -These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders. +These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders. diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index d039c10c17..493bf99dba 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -31,8 +31,7 @@ There are several reasons why a Windows-based computer may have problems during **1. PreBoot** -The PC’s firmware initiates a Power-On Self Test (POST) and loads firmware settings. This pre-boot process ends when a valid system disk is detected. Firmware reads the master boot record (MBR), and then starts Windows Boot -Manager. +The PC’s firmware initiates a Power-On Self Test (POST) and loads firmware settings. This pre-boot process ends when a valid system disk is detected. Firmware reads the master boot record (MBR), and then starts Windows Boot Manager. **2. Windows Boot Manager** diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 4d8f35673e..a038b6738d 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -21,6 +21,7 @@ ms.topic: article **Applies to** - Windows 10 +- Windows 11 From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). From 84e0dd479c2a03113a665fad621cf506cb1cccdc Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Tue, 7 Sep 2021 10:17:54 +0530 Subject: [PATCH 007/284] update-windows11-5388078 updated windows 11 terms per task 5388078 --- ...nced-troubleshooting-802-authentication.md | 2 +- .../determine-appropriate-page-file-size.md | 2 +- ...s-for-enterprise-and-education-editions.md | 1 + .../manage-corporate-devices.md | 25 ++++++++++--------- ...e-device-installation-with-group-policy.md | 11 ++++---- .../manage-settings-app-with-group-policy.md | 2 +- .../mandatory-user-profile.md | 1 + .../new-policies-for-windows-10.md | 1 + .../troubleshoot-tcpip-port-exhaust.md | 2 +- .../client-management/windows-libraries.md | 2 +- 10 files changed, 26 insertions(+), 23 deletions(-) diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md index c2a8ea0c57..80304a3e5f 100644 --- a/windows/client-management/advanced-troubleshooting-802-authentication.md +++ b/windows/client-management/advanced-troubleshooting-802-authentication.md @@ -21,7 +21,7 @@ This article includes general troubleshooting for 802.1X wireless and wired clie ## Scenarios -This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 10 for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS. +This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 10 (and Windows 11) for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS. ## Known issues diff --git a/windows/client-management/determine-appropriate-page-file-size.md b/windows/client-management/determine-appropriate-page-file-size.md index 8daf0f4ce4..da6bb869ab 100644 --- a/windows/client-management/determine-appropriate-page-file-size.md +++ b/windows/client-management/determine-appropriate-page-file-size.md @@ -74,7 +74,7 @@ By default, page files are system-managed. This means that the page files increa For example, when the system commit charge is more than 90 percent of the system commit limit, the page file is increased to back it. This continues to occur until the page file reaches three times the size of physical memory or 4 GB, whichever is larger. This all assumes that the logical disk that is hosting the page file is large enough to accommodate the growth. -The following table lists the minimum and maximum page file sizes of system-managed page files in Windows 10. +The following table lists the minimum and maximum page file sizes of system-managed page files in Windows 10 and Windows 11. |Minimum page file size |Maximum page file size| |---------------|------------------| diff --git a/windows/client-management/group-policies-for-enterprise-and-education-editions.md b/windows/client-management/group-policies-for-enterprise-and-education-editions.md index 8b2eb55f2f..12d6c0051f 100644 --- a/windows/client-management/group-policies-for-enterprise-and-education-editions.md +++ b/windows/client-management/group-policies-for-enterprise-and-education-editions.md @@ -18,6 +18,7 @@ ms.topic: troubleshooting **Applies to** - Windows 10 +- Windows 11 In Windows 10, version 1607, the following Group Policy settings apply only to Windows 10 Enterprise and Windows 10 Education. diff --git a/windows/client-management/manage-corporate-devices.md b/windows/client-management/manage-corporate-devices.md index f7fdbd3994..fec82aeb5a 100644 --- a/windows/client-management/manage-corporate-devices.md +++ b/windows/client-management/manage-corporate-devices.md @@ -1,6 +1,6 @@ --- -title: Manage corporate devices (Windows 10) -description: You can use the same management tools to manage all device types running Windows 10 desktops, laptops, tablets, and phones. +title: Manage corporate devices (Windows 10 and Windows 11) +description: You can use the same management tools to manage all device types running Windows 10 and Windows 11 desktops, laptops, tablets, and phones. ms.assetid: 62D6710C-E59C-4077-9C7E-CE0A92DFC05D ms.reviewer: manager: dansimp @@ -22,20 +22,21 @@ ms.topic: article **Applies to** - Windows 10 +- Windows 11 -You can use the same management tools to manage all device types running Windows 10 : desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, System Center tools, and so on, will continue to work for Windows 10. +You can use the same management tools to manage all device types running Windows 10 and Windows 11 : desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, System Center tools, and so on, will continue to work for Windows 10 and Windows 11. ## In this section | Topic | Description | | --- | --- | -| [Manage Windows 10 in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows 10, including deploying Windows 10 in a mixed environment | +| [Manage Windows 10 (and Windows 11) in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows 10 (and Windows 11), including deploying Windows 10 (and Windows 11) in a mixed environment | | [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC | -| [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees | -| [New policies for Windows 10](new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 | +| [Manage Windows 10 (and Windows 11) and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees | +| [New policies for Windows 10 (and Windows 11)](new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 | | [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education | -| [Changes to Group Policy settings for Start in Windows 10](/windows/configuration/changes-to-start-policies-in-windows-10) | Changes to the Group Policy settings that you use to manage Start | -| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 in their organizations | +| [Changes to Group Policy settings for Start in Windows 10 (and Windows 11)](/windows/configuration/changes-to-start-policies-in-windows-10) | Changes to the Group Policy settings that you use to manage Start | +| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 (and Windows 11) in their organizations | ## Learn more @@ -46,13 +47,13 @@ You can use the same management tools to manage all device types running Windows [Microsoft Intune End User Enrollment Guide](/samples/browse/?redirectedfrom=TechNet-Gallery) -[Azure AD Join on Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616791) +[Azure AD Join on Windows 10 (and Windows 11) devices](https://go.microsoft.com/fwlink/p/?LinkId=616791) -[Azure AD support for Windows 10](https://go.microsoft.com/fwlink/p/?LinkID=615765) +[Azure AD support for Windows 10 (and Windows 11)](https://go.microsoft.com/fwlink/p/?LinkID=615765) -[Windows 10 and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768) +[Windows 10 (and Windows 11) and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768) -[How to manage Windows 10 devices using Intune](https://go.microsoft.com/fwlink/p/?LinkId=613620) +[How to manage Windows 10 (and Windows 11) devices using Intune](https://go.microsoft.com/fwlink/p/?LinkId=613620) [Using Intune alone and with Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=613207) diff --git a/windows/client-management/manage-device-installation-with-group-policy.md b/windows/client-management/manage-device-installation-with-group-policy.md index db00986ab0..50d666639a 100644 --- a/windows/client-management/manage-device-installation-with-group-policy.md +++ b/windows/client-management/manage-device-installation-with-group-policy.md @@ -1,5 +1,5 @@ --- -title: Manage Device Installation with Group Policy (Windows 10) +title: Manage Device Installation with Group Policy (Windows 10 and Windows 11) description: Find out how to manage Device Installation Restrictions with Group Policy. ms.prod: w10 ms.mktglfcycl: manage @@ -14,14 +14,13 @@ ms.topic: article # Manage Device Installation with Group Policy - **Applies to** - Windows 10, Windows Server 2022 - +- Windows 11 ## Summary -By using Windows 10 operating systems, administrators can determine what devices can be installed on computers they manage. This guide summarizes the device installation process and demonstrates several techniques for controlling device installation by using Group Policy. +By using Windows 10 (and Windows 11) operating systems, administrators can determine what devices can be installed on computers they manage. This guide summarizes the device installation process and demonstrates several techniques for controlling device installation by using Group Policy. ## Introduction @@ -44,7 +43,7 @@ It is important to understand that the Group Policies that are presented in this This guide is targeted at the following audiences: -- Information technology planners and analysts who are evaluating Windows 10 and Windows Server 2022 +- Information technology planners and analysts who are evaluating Windows 10 (and Windows 11) and Windows Server 2022 - Enterprise information technology planners and designers - Security architects who are responsible for implementing trustworthy computing in their organization - Administrators who want to become familiar with the technology @@ -223,7 +222,7 @@ Some of these policies take precedence over other policies. The flowchart shown To complete each of the scenarios, please ensure your have: -- A client computer running Windows 10. +- A client computer running Windows 10 (and Windows 11). - A USB thumb drive. The scenarios described in this guide use a USB thumb drive as the example device (also known as a “removable disk drive”, "memory drive," a "flash drive," or a "keyring drive"). Most USB thumb drives do not require any manufacturer-provided drivers, and these devices work with the inbox drivers provided with the Windows build. diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md index f64ee0de0c..03a62619ca 100644 --- a/windows/client-management/manage-settings-app-with-group-policy.md +++ b/windows/client-management/manage-settings-app-with-group-policy.md @@ -14,10 +14,10 @@ ms.topic: article # Manage the Settings app with Group Policy - **Applies to** - Windows 10, Windows Server 2016 +- Windows 11 You can now manage the pages that are shown in the Settings app by using Group Policy. When you use Group Policy to manage pages, you can hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely. To make use of the Settings App group policies on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update. diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 7b77f47742..3ba302eee0 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -17,6 +17,7 @@ ms.topic: article **Applies to** - Windows 10 +- Windows 11 A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 183335b55e..06f5b50ca7 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -21,6 +21,7 @@ ms.topic: reference **Applies to** - Windows 10 +- Windows 11 As of September 2020 This page will no longer be updated. To find the Group Polices that ship in each version of Windows, refer to the Group Policy Settings Reference Spreadsheet. You can always locate the most recent version of the Spreadsheet by searching the Internet for "Windows Version + Group Policy Settings Reference". diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index 4c1e8b1b7f..26ba85c430 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -196,4 +196,4 @@ goto loop - [Port Exhaustion and You!](/archive/blogs/askds/port-exhaustion-and-you-or-why-the-netstat-tool-is-your-friend) - this article gives a detail on netstat states and how you can use netstat output to determine the port status -- [Detecting ephemeral port exhaustion](/archive/blogs/yongrhee/windows-server-2012-r2-ephemeral-ports-a-k-a-dynamic-ports-hotfixes): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10) +- [Detecting ephemeral port exhaustion](/archive/blogs/yongrhee/windows-server-2012-r2-ephemeral-ports-a-k-a-dynamic-ports-hotfixes): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10 and Windows 11) diff --git a/windows/client-management/windows-libraries.md b/windows/client-management/windows-libraries.md index a287d48be1..66162e05f3 100644 --- a/windows/client-management/windows-libraries.md +++ b/windows/client-management/windows-libraries.md @@ -14,7 +14,7 @@ ms.date: 04/19/2017 --- # Windows libraries -> Applies to: Windows 10, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 +> Applies to: Windows 10, Windows 11, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 Libraries are virtual containers for users’ content. A library can contain files and folders stored on the local computer or in a remote storage location. In Windows Explorer, users interact with libraries in ways similar to how they would interact with other folders. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with, and these known folders are automatically included in the default libraries and set as the default save location. From e679f238d0df8c58dd65e7d02669eba1a7e05ffe Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Tue, 21 Sep 2021 17:13:15 -0700 Subject: [PATCH 008/284] Update configure-authorized-apps-deployed-with-a-managed-installer.md --- ...-apps-deployed-with-a-managed-installer.md | 28 +++++++++---------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md index 70e5a3a31d..cd3668f905 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -1,6 +1,6 @@ --- -title: Configure authorized apps deployed with a WDAC-managed installer (Windows) -description: Explains about how to configure a custom Manged Installer. +title: Allow apps deployed with a WDAC managed installer (Windows) +description: Explains how to configure a custom Managed Installer. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: m365-security @@ -11,33 +11,31 @@ ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jogeurte ms.author: dansimp manager: dansimp -ms.date: 08/10/2021 +ms.date: 09/22/2021 ms.technology: mde --- -# Configuring authorized apps deployed by a managed installer with AppLocker and Windows Defender Application Control +# Automatically allow apps deployed by a managed installer with Windows Defender Application Control **Applies to:** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2019 and above ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). - -Windows 10, version 1703 introduced a new option for Windows Defender Application Control (WDAC), called _managed installer_, that helps balance security and manageability when enforcing application control policies. This option lets you automatically allow applications installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager. +With Windows Defender Application Control (WDAC), you can automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, using a feature called _managed installer_. Managed installer can help you balance security and manageability when enforcing application control policies. ## How does a managed installer work? -A new rule collection in AppLocker specifies binaries that are trusted by the organization as an authorized source for application deployment. When one of these trusted binaries runs, Windows will monitor the binary's process (and processes it launches), and then tag all files it writes as having originated from a managed installer. The managed installer rule collection is configured using Group Policy and can be applied with the Set-AppLockerPolicy PowerShell cmdlet. You can't currently set managed installers with the AppLocker CSP through MDM. +Managed installer uses a special rule collection in AppLocker to designate binaries that are trusted by your organization as an authorized source for application deployment. When one of these trusted binaries runs, Windows monitors the binary's process (and processes it launches) and watches for files being written to disk. As files are written, they are tagged as originating from a managed installer. The managed installer rule collection must be added to your AppLocker policy XML using an XML or text editor, such as Notepad. You can import and deploy your managed installer AppLocker policy XML with Group Policy or apply it using the Set-AppLockerPolicy PowerShell cmdlet. You can't currently set managed installers with the AppLocker CSP through MDM. -Having defined your managed installers by using AppLocker, you can then configure WDAC to trust files that are installed by a managed installer. You do so by adding the "Enabled:Managed Installer" option to your WDAC policy. When that option is set, WDAC will check for managed installer origin information when determining whether or not to allow a binary to run. As long as there are no deny rules present for the file, WDAC will allow a file to run based on its managed installer origin. +After setting your managed installer rules in AppLocker, you can then configure WDAC to trust files that are installed by a managed installer. You do so by adding the "Enabled:Managed Installer" option to your WDAC policy. When that option is set, WDAC will check for managed installer origin information when determining whether or not to allow a binary to run. As long as there are no deny rules present for the file, WDAC will allow a file to run based purely on its managed installer origin. -Ensure that the WDAC policy allows the system/boot components and any other authorized applications that can't be deployed through a managed installer. +> [!NOTE] +> Your WDAC policy must include rules for all system/boot components, kernel drivers, and any other authorized applications that can't be deployed through a managed installer. ## Security considerations with managed installer From e04620bd926c53ef6ed84fb2728a00ae36bd0a14 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Wed, 22 Sep 2021 17:09:30 -0700 Subject: [PATCH 009/284] Update configure-authorized-apps-deployed-with-a-managed-installer.md --- ...-apps-deployed-with-a-managed-installer.md | 51 ++++++++++--------- 1 file changed, 28 insertions(+), 23 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md index cd3668f905..1282f52575 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -26,13 +26,13 @@ ms.technology: mde - Windows 11 - Windows Server 2019 and above -With Windows Defender Application Control (WDAC), you can automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, using a feature called _managed installer_. Managed installer can help you balance security and manageability when enforcing application control policies. +With Windows Defender Application Control (WDAC), you can automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, using a feature called _managed installer_. Managed installer can help you better balance security and manageability when enforcing application control policies. ## How does a managed installer work? -Managed installer uses a special rule collection in AppLocker to designate binaries that are trusted by your organization as an authorized source for application deployment. When one of these trusted binaries runs, Windows monitors the binary's process (and processes it launches) and watches for files being written to disk. As files are written, they are tagged as originating from a managed installer. The managed installer rule collection must be added to your AppLocker policy XML using an XML or text editor, such as Notepad. You can import and deploy your managed installer AppLocker policy XML with Group Policy or apply it using the Set-AppLockerPolicy PowerShell cmdlet. You can't currently set managed installers with the AppLocker CSP through MDM. +Managed installer uses a special rule collection in **AppLocker** to designate binaries that are trusted by your organization as an authorized source for application installation. When one of these trusted binaries runs, Windows monitors the binary's process (and processes it launches) and watches for files being written to disk. As files are written, they are tagged as originating from a managed installer. -After setting your managed installer rules in AppLocker, you can then configure WDAC to trust files that are installed by a managed installer. You do so by adding the "Enabled:Managed Installer" option to your WDAC policy. When that option is set, WDAC will check for managed installer origin information when determining whether or not to allow a binary to run. As long as there are no deny rules present for the file, WDAC will allow a file to run based purely on its managed installer origin. +You can then configure WDAC to trust files that are installed by a managed installer by adding the "Enabled:Managed Installer" option to your WDAC policy. When that option is set, WDAC will check for managed installer origin information when determining whether or not to allow a binary to run. As long as there are no deny rules for the binary, WDAC will allow it to run based purely on its managed installer origin. > [!NOTE] > Your WDAC policy must include rules for all system/boot components, kernel drivers, and any other authorized applications that can't be deployed through a managed installer. @@ -46,7 +46,7 @@ Users with administrator privileges, or malware running as an administrator user If a managed installer process runs in the context of a user with standard privileges, then it's possible that standard users or malware running as standard user may be able to circumvent the intent of Windows Defender Application Control. -Some application installers may automatically run the application at the end of the installation process. If this happens when the installer is run by a managed installer, then the managed installer's heuristic tracking and authorization will extend to all files that are created during the first run of the application. Extension of the installer's authorization could result in unintentional authorization of an executable. To avoid that outcome, ensure that the method of application deployment that is used as a managed installer limits running applications as part of installation. +Some application installers may automatically run the application at the end of the installation process. If this happens when the installer is run by a managed installer, then the managed installer's heuristic tracking and authorization will extend to all files that are created during the first run of the application. This could result in unintentional authorization of an executable. To avoid that, ensure that the method of application deployment that is used as a managed installer limits running applications as part of installation. ## Known limitations with managed installer @@ -58,40 +58,37 @@ Some application installers may automatically run the application at the end of - The managed installer heuristic doesn't authorize kernel drivers. The WDAC policy must have rules that allow the necessary drivers to run. -## Configuring the managed installer +## Configure managed installer tracking with AppLocker and WDAC -Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy, with specific rules and options enabled. -There are three primary steps to keep in mind: +To turn on managed installer tracking, you must: -- Specify managed installers, by using the Managed Installer rule collection in AppLocker policy. -- Enable service enforcement in AppLocker policy. -- Enable the managed installer option in a WDAC policy. +- Create and deploy an AppLocker policy that defines your managed installer rules and enables services enforcement for executables and DLLs. +- Enable AppLocker's Application Identity and AppLockerFltr services. +- Enable managed installer trust in your WDAC policy. -## Specify managed installers using the Managed Installer rule collection in AppLocker policy +### Create and deploy an AppLocker policy that defines your managed installer rules and enables services enforcement for executables and DLLs -The identity of the managed installer executable(s) is specified in an AppLocker policy, in a Managed Installer rule collection. +Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, you can use an XML or text editor to convert an EXE rule collection policy into a ManagedInstaller rule collection. +> [!NOTE] +> Only EXE file types can be designated as managed installers. -### Create Managed Installer rule collection - -Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, you can use a text editor to make the changes that are needed to an EXE or DLL rule collection policy, to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO. - -1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps&preserve-view=true) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback but other rule types can be used as well. You may need to reformat the output for readability. +1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps&preserve-view=true) to make an EXE rule for the file you are designating as a managed installer. This example creates a rule for Microsoft's Intune Management Extension using the Publisher rule type, but any AppLocker rule type can be used. You may need to reformat the output for readability. ```powershell - Get-ChildItem | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -Xml > AppLocker_MI_PS_ISE.xml + Get-ChildItem ${env:ProgramFiles(x86)}'\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe' | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher -User Everyone -Xml > AppLocker_MI_PS_ISE.xml ``` -2. Manually rename the rule collection to ManagedInstaller +2. Manually change the rule collection Type from "Exe" to "ManagedInstaller" and set EnforcementMode to "AuditOnly" Change - ```powershell + ```XML ``` to - ```powershell + ```XML ``` @@ -175,6 +172,7 @@ An example of a valid Managed Installer rule collection, using Microsoft Endpoin ``` + ### Enable service enforcement in AppLocker policy Since many installation processes rely on services, it is typically necessary to enable tracking of services. @@ -251,9 +249,11 @@ appidtel.exe start [-mionly] Specify "-mionly" if you will not use the Intelligent Security Graph (ISG). ## Using fsutil to query SmartLocker EA + Customers using Windows Defender Application Control (WDAC) with Managed Installer (MI) or Intelligent Security Graph enabled can use fsutil to determine whether a file was allowed to run by one of these features. This can be achieved by querying the EAs on a file using fsutil and looking for the KERNEL.SMARTLOCKER.ORIGINCLAIM EA. The presence of this EA indicates that either MI or ISG allowed the file to run. This can be used in conjunction with enabling the MI and ISG logging events. -#### Example: +**Example:** + ```powershell fsutil file queryEA C:\Users\Temp\Downloads\application.exe @@ -281,6 +281,7 @@ Refer to [Understanding Application Control Events](event-id-explanations.md#opt Once you've completed configuring your chosen Managed Installer, by specifying which option to use in the AppLocker policy, enabling the service enforcement of it, and by enabling the Managed Installer option in a WDAC policy, you'll need to deploy it. 1. Use the following command to deploy the policy. + ```powershell $policyFile= @" @@ -290,6 +291,7 @@ Once you've completed configuring your chosen Managed Installer, by specifying w ``` 2. Verify Deployment of the ruleset was successful + ```powershell Get-AppLockerPolicy -Local @@ -297,10 +299,13 @@ Once you've completed configuring your chosen Managed Installer, by specifying w ------- --------------- ------------------- 1 {0, 0, 0, 0...} {Appx, Dll, Exe, ManagedInstaller...} ``` + Verify the output shows the ManagedInstaller rule set. 3. Get the policy XML (optional) using PowerShell: + ```powershell Get-AppLockerPolicy -Effective -Xml -ErrorVariable ev -ErrorAction SilentlyContinue ``` - This command will show the raw XML to verify the individual rules that were set. \ No newline at end of file + + This command will show the raw XML to verify the individual rules that were set. From 92b73669c922e558250999ffc2502b1683f64e64 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Thu, 23 Sep 2021 16:23:06 -0700 Subject: [PATCH 010/284] Update configure-authorized-apps-deployed-with-a-managed-installer.md --- ...-apps-deployed-with-a-managed-installer.md | 92 +++++++++---------- 1 file changed, 42 insertions(+), 50 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md index 1282f52575..2fac9952d2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -34,9 +34,6 @@ Managed installer uses a special rule collection in **AppLocker** to designate b You can then configure WDAC to trust files that are installed by a managed installer by adding the "Enabled:Managed Installer" option to your WDAC policy. When that option is set, WDAC will check for managed installer origin information when determining whether or not to allow a binary to run. As long as there are no deny rules for the binary, WDAC will allow it to run based purely on its managed installer origin. -> [!NOTE] -> Your WDAC policy must include rules for all system/boot components, kernel drivers, and any other authorized applications that can't be deployed through a managed installer. - ## Security considerations with managed installer Since managed installer is a heuristic-based mechanism, it doesn't provide the same security guarantees that explicit allow or deny rules do. @@ -92,7 +89,39 @@ Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerS ``` -An example of a valid Managed Installer rule collection, using Microsoft Endpoint Config Manager (MEMCM), MEM (Intune), Powershell, and PowerShell ISE, is shown below. Remove any rules that you do not wish to designate as a Managed Installer. +3. Manually edit your AppLocker policy and add the EXE and DLL rule collections with at least one rule for each. To ensure your policy can be safely applied on systems that may already have an active AppLocker policy, we recommend using a benign DENY rule to block a fake binary and set the rule collection's EnforcementMode to AuditOnly. Additionally, since many installation processes rely on services, you need to enable services tracking for each of those rule collections. The following example shows a partial AppLocker policy with the EXE and DLL rule collection configured as recommended. + + ```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + ``` + +4. Deploy your AppLocker managed installer configuration policy. You can either import your AppLocker policy and deploy with Group Policy or use a script to deploy the policy with the Set-AppLockerPolicy cmdlet. An example of a valid Managed Installer rule collection, using Microsoft Endpoint Config Manager (MEMCM), MEM (Intune), Powershell, and PowerShell ISE, is shown below. Remove any rules that you do not wish to designate as a Managed Installer. ```xml @@ -173,46 +202,18 @@ An example of a valid Managed Installer rule collection, using Microsoft Endpoin ``` -### Enable service enforcement in AppLocker policy +## Set the AppLocker filter driver to autostart -Since many installation processes rely on services, it is typically necessary to enable tracking of services. -Correct tracking of services requires the presence of at least one rule in the rule collection. So, a simple audit-only rule will suffice. The audit rule can be added to the policy created above, which specifies the rule collection of your managed installer. +To enable the managed installer, you need to set the AppLocker filter driver to autostart, and start it. -For example: +To do so, run the following command as an Administrator: -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +```console +appidtel.exe start [-mionly] ``` +Specify "-mionly" if you will not use the Intelligent Security Graph (ISG). + ## Enable the managed installer option in WDAC policy In order to enable trust for the binaries laid down by managed installers, the "Enabled: Managed Installer" option must be specified in your WDAC policy. @@ -236,17 +237,8 @@ Below are steps to create a WDAC policy that allows Windows to boot and enables Set-RuleOption -FilePath -Option 13 ``` -## Set the AppLocker filter driver to autostart - -To enable the managed installer, you need to set the AppLocker filter driver to autostart, and start it. - -To do so, run the following command as an Administrator: - -```console -appidtel.exe start [-mionly] -``` - -Specify "-mionly" if you will not use the Intelligent Security Graph (ISG). +> [!NOTE] +> Your WDAC policy must include rules for all system/boot components, kernel drivers, and any other authorized applications that can't be deployed through a managed installer. ## Using fsutil to query SmartLocker EA From 8d5428e1955ced860617b80210a7624c9ffcc0dc Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 27 Sep 2021 22:55:37 -0700 Subject: [PATCH 011/284] update for win 11 Updates to the documentation for Windows 11. TODO: Add section for attestation flow based on MAA. TODO: Add links to MAA documentation --- .../mdm/healthattestation-csp.md | 225 ++++++++++++++++-- 1 file changed, 211 insertions(+), 14 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index e570b9890d..c18c474d71 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -23,7 +23,204 @@ The following is a list of functions performed by the Device HealthAttestation C - Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device - Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data -## Terms +## Windhows 11 Device HealthAttestation + +>Windows 11 introduces an update to the device health attestation feature bringing in support for deeper insights into windows boot security, enhancing zero trust solutions. Device health attestation on windows can be accessed via the HealthAttestation CSP which enables enterprise device managers to assess if a device is booted to a trusted and compliant state and take enterprise policy actions. Windows 11 introduces additional child nodes to the HealthAttestation node for the MDM providers to connect to the Microsoft Azure Attestation service which provides a simplified approach to attestation. +The attested report provides a health assessment of the boot time properties of the device to ensure that the devices are automatically secure from the first power on. The health attestation result can then be used to allow or deny access to networks, apps, or services, based on whether devices prove to be healthy. + +### Terms +**TPM (Trusted Platform Module)** +

TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption and signing.

+ +**DHA (Device HealthAttestation) feature** +

The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.

+ +**MAA-Session (Microsoft Azure Attestaiton service based device HealthAttestation session)** +

The Microsoft Azure Attestaiton service based device HealthAttestation session (MAA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.

+ +**MAA-CSP (Microsoft Azure Attestaiton based Configuration Service Provider)** +

The Configuration Service Provider nodes added to Windhows 11 to integrate with Microsoft Azure Attestation Service.

+

The following list of operations is performed by MAA-CSP:

+
    +
  • Receives attestation trigger requests from a HealthAttestation enabled MDM provider.
    • +
  • The device collects Attestation Evidence (device boot logs, TPM audit trails and the TPM certificate) from a managed device.
    • +
  • Forwards the Attestation Evidence to the Azure Attestation Service instance as configured by the MDM provider.
    • +
  • Receives a signed report from the Azure Attestation Service instance and stores it in a local cache on the device.
    • +
+ +### Attestation Flow with Microsoft Azure Attestation Service + + +### Configuration Service Provider Nodes +Windows 11 introduces additions to the HealthAttestation CSP node to integrate with Microsoft Azure Attestaiton service. +``` +./Vendor/MSFT +HealthAttestation +----... +----TriggerAttestation +----CurrentProtocolVersion +----PreferredMaxProtocolVersion +----MaxSupportedProtocolVersion +``` + +**./Vendor/MSFT/HealthAttestation** +

The root node for the device HealthAttestation configuration service provider.

+ +**TriggerAttestation** (Required) +

Node type: EXECUTE +This node will trigger attestation flow by launching an attestation process. If a process is already running, this node will return code 202 indicating the request is received and being processed. Otherwise, an error will be returned. +

+ +

Templated SyncML Call:

+ + + + + VERIFYHEALTHV2 + + + + ./Vendor/MSFT/HealthAttestation/TriggerAttestation + + + + { + rpID : "rpID", serviceEndpoint : “MAA endpoint”, + nonce : “nonce”, aadToken : “aadToken”, "cv" : "CorrelationVector" + } + + + + + + + +

Data fields:

+
    +
  • rpID (Relying Party Identifier): This field contains an identifier that can be used to help determine the caller.
    • +
  • serviceEndpoint : This field contains the complete URL of the Microsoft Azure Attestation provider instance to be used for evaluation.
    • +
  • nonce : This field contains an arbitrary number that can be used just once in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.
    • +
  • aadToken : The AAD token to used for authentication against the Microsoft Azure Attestation service.
    • +
  • cv : This field contains an identifier(Correlation Vector) that will passed in to the service call, that can be used for diagnostics purposes.
    • +
+ +

Sample Data:

+ + + { + "rpid" : "https://www.contoso.com/attestation", + "endpoint" : "https://contoso.eus.attest.azure.net/attest/tpm?api-version=2020-10-01", + "nonce" : "5468697320697320612054657374204e6f6e6365", + "aadToken" : "dummytokenstring", + "cv" : "testonboarded" + } + + +**AttestStatus** +

Node type: GET +This node will retrieve the status(HRESULT value) stored in registry updated by the attestation process triggered in the previous step. +The status is always cleared prior to making the attest service call. +

+ +

Templated SyncML Call:

+ + + + + + + + ./Device/Vendor/MSFT/HealthAttestation/AttestStatus + + + + + + + + +

Sample Data:

+ + If Successful: 0 + If Failed: A corresponding HRESULT error code + Example: 0x80072efd, WININET_E_CANNOT_CONNECT + +**GetAttestReport** +

Node type: GET +This node will retrieve the attestation report per the call made by the TriggerAttestation, if there is any, for the given MDM provider. The report is stored in a registry key in the respective MDM enrollment store. +

+ +

Templated SyncML Call:

+ + + + + + + + ./Device/Vendor/MSFT/HealthAttestation/GetAttestReport + + + + + + + + +

Sample data:

+ + If Success: + JWT token: aaaaaaaaaaaaa.bbbbbbbbbbbbb.cccccccccc + If failed: + Previously cached report if available (the token may have already expired per the attestation policy). + OR Sync ML 404 error if not cached report available. + +**GetServiceCorrelationIDs** +

Node type: GET +This node will retrieve the service generated correlation IDs for the given MDM provider. If there are more than one correlation id, they are separated by “;” in the string. +

+

Templated SyncML Call:

+ + + + + + + + ./Device/Vendor/MSFT/HealthAttestation/GetServiceCorrelationIDs + + + + + + + + +

Sample data:

+ + If success: + GUID returned by the attestation service: 1k9+vQOn00S8ZK33;CMc969r1JEuHwDpM + If Trigger Attestation call failed and no previous data is present. The field remains empty. + Otherwise, the last service correlation id will be returned. + +### MAA CSP Intergation Steps +
    +
  1. Setup a MAA provider instance: +MAA instance can be created following the steps here Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.
    2. +
  2. Update the provider with an appropriate policy: +The MAA instance should be updated with an appropriate policy. How to author an Azure Attestation policy | Microsoft Docs +A Sample attestation policy that only checks for secureboot is here: +TODO
    3. +
  3. Call TriggerAttestation with your rpid, AAD token and the attestURI: +Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Azure Attestation) | Microsoft Docs
    4. +
  4. Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties: +The decoded JWT token contains information per the attestation policy. +{ "typ": "JWT", "alg": "RS256", "x5c": [ "MIIDcDCCAligAwIBAgIQOLMUhXOEQ2axV6zXp/KvnzANBgkqhkiG9w0BAQsFADA1MTMwMQYDVQQDEypBdHRlc3RhdGlvblNlcnZpY2UtTG9jYWxUZXN0LVJlcG9ydFNpZ25pbmcwHhcNMjAxMTI5MTExMjUyWhcNMjIxMTI5MTEyMjUyWjA1MTMwMQYDVQQDEypBdHRlc3RhdGlvblNlcnZpY2UtTG9jYWxUZXN0LVJlcG9ydFNpZ25pbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsuOlDyU1sYAuAV53n7TrmTU180bOREgfZoTsdOyllMcsKciTUWkTO0vKDa8CFwGEHmSVTAEngDIHw1putio84HKZdcI6nPt2B74kJ/+5ut8KGMWtBm6GFWwS0TXti1rE4Os1mPpCYAsUyKxaEw4lBbEzGa5mGx0SGLdseuUIiw23S695RLVCciDaAvf+q/gBScFgZJm2ZxgkyNF7+MSvnDMU1xv5YLDQeh3j5vZlstSq+rrRbB5SVnuD4cFBjvGW5lXBLxMEjpBXI6yzFmFuw/OjZ7VClk6HSNjvvhSwJu4F1oHuJ0oAuABOtPpRK/898Ru+9qS5ZMm79775nZK75AgMBAAGjfDB6MA4GA1UdDwEB/wQEAwIFoDAJBgNVHRMEAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBR/8W25+uWj5sg8lEKKYy1gdCqWUTAdBgNVHQ4EFgQUf/Ftufrlo+bIPJRCimMtYHQqllEwDQYJKoZIhvcNAQELBQADggEBAJGfbRRvF3EpG6ZsOcSmWtu/1LDVZq+fGspjK/7+ImybEY/zC2CsWWpz7pT54KEGYe91q67nV5GZoSz7+O4A4A5QtMDFzOnrFVicDo5Cg2EDU4YQDN4j4DyrbttkQYiEiBFexJImrjIk4bfW2YqZjtzR7XFDsCsOAUHNY8cnnKaZCRbXrLwP/LUYAz/NVkttO4CW4U/8OZygrarfAsVrsCsx5o2mXBlaRYl5xECWfvT2YbCFuIt3gZR9sau65uMWthgyV0XAR7farxycfMEuBkyb+IVPwYW5QGFo5M8a78r/rFPdczGPlv0Qvg7zrBm775xs8O33V4nOmC1tfsxXUgw=" ], "kid": "e5j-rIjIITYTB9RQSgM-OzOWjXM" }.{ "nbf": 1629758941, "exp": 1630104841, "iat": 1629759241, "iss": "https://ulptestwin.eus.test.attest.azure.net", "jti": "e325dad03894f09b12c53f3b5eac5e36824c89ae", "ver": "1.0", "x-ms-ver": "1.0", "rp_data": "AQIDBA", "nonce": "AQIDBA", "cnf": { "jwk": { "kty": "RSA", "n": "vTCRaX0IZMsNHfJPOVyiYSCM2WABZmNo3PSVTOt9mh0vR4Mon080EGHM_V3afjKJ4NxmEZ01XeB-1TsuNM2-19_JMWZF-wiBTrBWEjcUQ84AxzukaWD1sMsH2kiqjaxXBHEUl8Hhq9SRjVEEdT-fKLOzBO070TffvRCKVxZIRI9Ry6E6K8gMEX3CH6Yk9b7clAua0MrUxd28hMxwx4hy1HyCsFSnXb_bIaqxLYjCxisc9mRx2vO6IuEqEVskSYDc-5f8u2G98ld6PuiMkAhvOOEBmaDlEksvUpnA8e9nWO98rg17pjyOms9GLvgKkSgOKbK8wQ-NuUyXutQfaN2MbQ", "e": "AQAB" } }, "x-ms-policy-hash": "BpV0Jxx6oZ2AjkgXx3Gj7JiJ1NpZWGppjdT2OTtBR4g", "AIKPresent": true, "BitlockerStatus": 1, "CodeIntegrityEnabled": true, "SafeMode": false, "SecureBootEnabled": true, "TpmVersion": 2, "VSMEnabled": true, "WinPE": false }.[Signature]
    5. +
+ +## Windhows 10 Device HealthAttestation + +### Terms **TPM (Trusted Platform Module)**

TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption and signing.

@@ -173,7 +370,7 @@ The following is a list of functions performed by the Device HealthAttestation C -## CSP diagram and node descriptions +### CSP diagram and node descriptions The following shows the Device HealthAttestation configuration service provider in tree format. @@ -243,7 +440,7 @@ HealthAttestation

Added in Windows 10, version 1607 March service release. Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state.

Value type is integer. The supported operation is Get.

-## **DHA-CSP integration steps** +### **DHA-CSP integration steps** The following list of validation and development tasks are required for integrating the Microsoft Device Health Attestation feature with a Windows Mobile device management solution (MDM): @@ -260,7 +457,7 @@ The following list of validation and development tasks are required for integrat Each step is described in detail in the following sections of this topic. -## **Step 1: Verify HTTPS access** +### **Step 1: Verify HTTPS access** Validate that both the MDM server and the device (MDM client) can access has.spserv.microsoft.com using the TCP protocol over port 443 (HTTPS). @@ -313,7 +510,7 @@ SSL-Session: ``` -## **Step 2: Assign an enterprise trusted DHA-Service** +### **Step 2: Assign an enterprise trusted DHA-Service** There are three types of DHA-Service: - Device Health Attestation – Cloud (owned and operated by Microsoft) @@ -339,7 +536,7 @@ The following example shows a sample call that instructs a managed device to com ``` -## **Step 3: Instruct client to prepare health data for verification** +### **Step 3: Instruct client to prepare health data for verification** Send a SyncML call to start collection of the DHA-Data. @@ -366,7 +563,7 @@ The following example shows a sample call that triggers collection and verificat ``` -## **Step 4: Take action based on the clients response** +### **Step 4: Take action based on the clients response** After the client receives the health attestation request, it sends a response. The following list describes the responses, along with a recommended action to take. @@ -394,7 +591,7 @@ Here is a sample alert that is issued by DHA_CSP: ``` - If the response to the status node is not 0, 1 or 3, then troubleshoot the issue. For the complete list of status codes see [Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes). -## **Step 5: Instruct the client to forward health attestation data for verification** +### **Step 5: Instruct the client to forward health attestation data for verification** Create a call to the **Nonce**, **Certificate** and **CorrelationId** nodes, and pick up an encrypted payload that includes a health certificate and related data from the device. @@ -431,7 +628,7 @@ Here is an example: ``` -## **Step 6: Forward device health attestation data to DHA-service** +### **Step 6: Forward device health attestation data to DHA-service** In response to the request that was sent in the previous step, the MDM client forwards an XML formatted blob (response from ./Vendor/MSFT/HealthAttestation/Certificate node) and a call identifier called CorrelationId (response to ./Vendor/MSFT/HealthAttestation/CorrelationId node). @@ -455,14 +652,14 @@ When the MDM-Server receives the above data, it must: - DHA-OnPrem or DHA-EMC: https://FullyQualifiedDomainName-FDQN/DeviceHealthAttestation/ValidateHealthCertificate/v3 -## **Step 7: Receive response from the DHA-service** +### **Step 7: Receive response from the DHA-service** When the Microsoft Device Health Attestation Service receives a request for verification, it performs the following steps: - Decrypts the encrypted data it receives. - Validates the data it has received - Creates a report, and shares the evaluation results to the MDM server via SSL in XML format -## **Step 8: Take appropriate policy action based on evaluation results** +### **Step 8: Take appropriate policy action based on evaluation results** After the MDM server receives the verified data, the information can be used to make policy decisions by evaluating the data. Some possible actions would be: @@ -816,7 +1013,7 @@ Each of these are described in further detail in the following sections, along w

In case of a detected issue a list of impacted DHA-report elements will be listed under the HealthStatusMismatchFlags attribute.

-## **Device HealthAttestation CSP status and error codes** +### **Device HealthAttestation CSP status and error codes** @@ -1027,7 +1224,7 @@ Each of these are described in further detail in the following sections, along w
-## DHA-Report V3 schema +### DHA-Report V3 schema ```xml @@ -1131,7 +1328,7 @@ Each of these are described in further detail in the following sections, along w ``` -## DHA-Report example +### DHA-Report example ```xml From 96f9551f2040fbbae5aed97ea35e89d0773c60b3 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 28 Sep 2021 09:24:45 -0700 Subject: [PATCH 012/284] Update healthattestation-csp.md edits (pass 1) --- .../mdm/healthattestation-csp.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index c18c474d71..7c0aef670f 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -8,25 +8,26 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman -ms.date: 06/26/2017 +author: dansimp +ms.date: --- # Device HealthAttestation CSP -The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT managers to assess if a device is booted to a trusted and compliant state, and take enterprise policy actions. +The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT admins to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions. The following is a list of functions performed by the Device HealthAttestation CSP: -- Collects device boot logs, TPM audit trails and the TPM certificate (DHA-BootData) from a managed device -- Forwards DHA-BootData to Device Health Attestation Service (DHA-Service) +- Collects device boot logs, Trusted Platform Module (TPM) audit trails and the TPM certificate (DHA-BootData) from a managed device +- Forwards DHA-BootData to a Device Health Attestation Service (DHA-Service) - Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device -- Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data +- Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data) -## Windhows 11 Device HealthAttestation +## Windows 11 Device health attestation ->Windows 11 introduces an update to the device health attestation feature bringing in support for deeper insights into windows boot security, enhancing zero trust solutions. Device health attestation on windows can be accessed via the HealthAttestation CSP which enables enterprise device managers to assess if a device is booted to a trusted and compliant state and take enterprise policy actions. Windows 11 introduces additional child nodes to the HealthAttestation node for the MDM providers to connect to the Microsoft Azure Attestation service which provides a simplified approach to attestation. -The attested report provides a health assessment of the boot time properties of the device to ensure that the devices are automatically secure from the first power on. The health attestation result can then be used to allow or deny access to networks, apps, or services, based on whether devices prove to be healthy. +Windows 11 introduces an update to the device health attestation feature. This helps add support for deeper insights to Windows boot security, supporting a zero trust approach to device security. Device health attestation on Windows can be accessed by using the HealthAttestation CSP. This CSP helps assess if a device is booted to a trusted and compliant state and then to take appropriate action. Windows 11 introduces additional child nodes to the HealthAttestation node for the MDM providers to connect to the Microsoft Azure Attestation service which provides a simplified approach to attestation. + +The attestation report provides a health assessment of the boot-time properties of the device to ensure that the devices are automatically secure as soon as they power on. The health attestation result can then be used to allow or deny access to networks, apps, or services, depending on the health of the device. ### Terms **TPM (Trusted Platform Module)** From 5461c8aa37e152e9f1cd491a832362bc80fbb7b3 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Tue, 28 Sep 2021 17:19:54 -0700 Subject: [PATCH 013/284] Refactored managed installer docs --- ...-apps-deployed-with-a-managed-installer.md | 219 ++++++------------ .../configure-wdac-managed-installer.md | 187 +++++---------- 2 files changed, 124 insertions(+), 282 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md index 2fac9952d2..4e8d47ed2c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -61,7 +61,6 @@ To turn on managed installer tracking, you must: - Create and deploy an AppLocker policy that defines your managed installer rules and enables services enforcement for executables and DLLs. - Enable AppLocker's Application Identity and AppLockerFltr services. -- Enable managed installer trust in your WDAC policy. ### Create and deploy an AppLocker policy that defines your managed installer rules and enables services enforcement for executables and DLLs @@ -93,7 +92,7 @@ Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerS ```xml - + @@ -105,7 +104,7 @@ Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerS - + @@ -114,105 +113,77 @@ Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerS - - - ``` -4. Deploy your AppLocker managed installer configuration policy. You can either import your AppLocker policy and deploy with Group Policy or use a script to deploy the policy with the Set-AppLockerPolicy cmdlet. An example of a valid Managed Installer rule collection, using Microsoft Endpoint Config Manager (MEMCM), MEM (Intune), Powershell, and PowerShell ISE, is shown below. Remove any rules that you do not wish to designate as a Managed Installer. +4. Verify your AppLocker policy. The following example shows a complete AppLocker policy that sets Microsoft Endpoint Config Manager (MEMCM)and Microsoft Endpoint Manager Intune as managed installers. Only those AppLocker rule collections that have actual rules defined are included in the final XML. This ensures the policy will merge successfully on devices which may already have an AppLocker policy in place. -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + ```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - -``` + + + + + + + + + + + + + + + + + + ``` -## Set the AppLocker filter driver to autostart +5. Deploy your AppLocker managed installer configuration policy. You can either import your AppLocker policy and deploy with Group Policy or use a script to deploy the policy with the Set-AppLockerPolicy cmdlet as shown in the following PowerShell command. -To enable the managed installer, you need to set the AppLocker filter driver to autostart, and start it. + ```powershell + Set-AppLockerPolicy -XmlPolicy -Merge -ErrorAction SilentlyContinue + ``` -To do so, run the following command as an Administrator: +6. If deploying your AppLocker policy via script, use appidtel.exe to configure the AppLocker Application Identity service and AppLocker filter driver. -```console -appidtel.exe start [-mionly] -``` - -Specify "-mionly" if you will not use the Intelligent Security Graph (ISG). + ```console + appidtel.exe start [-mionly] + ``` + + Specify "-mionly" if you don't plan to use the Intelligent Security Graph (ISG). ## Enable the managed installer option in WDAC policy @@ -237,67 +208,11 @@ Below are steps to create a WDAC policy that allows Windows to boot and enables Set-RuleOption -FilePath -Option 13 ``` +4. Deploy your WDAC policy. See [Deploying Windows Defender Application Control (WDAC) policies](windows-defender-application-control-deployment-guide.md). + > [!NOTE] > Your WDAC policy must include rules for all system/boot components, kernel drivers, and any other authorized applications that can't be deployed through a managed installer. -## Using fsutil to query SmartLocker EA +## Related articles -Customers using Windows Defender Application Control (WDAC) with Managed Installer (MI) or Intelligent Security Graph enabled can use fsutil to determine whether a file was allowed to run by one of these features. This can be achieved by querying the EAs on a file using fsutil and looking for the KERNEL.SMARTLOCKER.ORIGINCLAIM EA. The presence of this EA indicates that either MI or ISG allowed the file to run. This can be used in conjunction with enabling the MI and ISG logging events. - -**Example:** - -```powershell -fsutil file queryEA C:\Users\Temp\Downloads\application.exe - -Extended Attributes (EA) information for file C:\Users\Temp\Downloads\application.exe: - -Ea Buffer Offset: 410 -Ea Name: $KERNEL.SMARTLOCKER.ORIGINCLAIM -Ea Value Length: 7e -0000: 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................ -0010: b2 ff 10 66 bc a8 47 c7 00 d9 56 9d 3d d4 20 2a ...f..G...V.=. * -0020: 63 a3 80 e2 d8 33 8e 77 e9 5c 8d b0 d5 a7 a3 11 c....3.w.\...... -0030: 83 00 00 00 00 00 00 00 5c 00 00 00 43 00 3a 00 ........\...C.:. -0040: 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 6a 00 \.U.s.e.r.s.\.T. -0050: 6f 00 67 00 65 00 75 00 72 00 74 00 65 00 2e 00 e.m.p..\D.o.w.n... -0060: 52 00 45 00 44 00 4d 00 4f 00 4e 00 44 00 5c 00 l.o.a.d.\a.p.p.l. -0070: 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 i.c.a.t.i.o.n..e.x.e -``` - -## Enabling managed installer logging events - -Refer to [Understanding Application Control Events](event-id-explanations.md#optional-intelligent-security-graph-isg-or-managed-installer-mi-diagnostic-events) for information on enabling optional managed installer diagnostic events. - -## Deploying the Managed Installer rule collection - -Once you've completed configuring your chosen Managed Installer, by specifying which option to use in the AppLocker policy, enabling the service enforcement of it, and by enabling the Managed Installer option in a WDAC policy, you'll need to deploy it. - -1. Use the following command to deploy the policy. - - ```powershell - $policyFile= - @" - Raw_AppLocker_Policy_XML - "@ - Set-AppLockerPolicy -XmlPolicy $policyFile -Merge -ErrorAction SilentlyContinue - ``` - -2. Verify Deployment of the ruleset was successful - - ```powershell - Get-AppLockerPolicy -Local - - Version RuleCollections RuleCollectionTypes - ------- --------------- ------------------- - 1 {0, 0, 0, 0...} {Appx, Dll, Exe, ManagedInstaller...} - ``` - - Verify the output shows the ManagedInstaller rule set. - -3. Get the policy XML (optional) using PowerShell: - - ```powershell - Get-AppLockerPolicy -Effective -Xml -ErrorVariable ev -ErrorAction SilentlyContinue - ``` - - This command will show the raw XML to verify the individual rules that were set. +- [Managed installer and ISG technical reference and troubleshooting guide](configure-wdac-managed-installer.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md index a6fe5ce62e..de7ad4786a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md @@ -1,5 +1,5 @@ --- -title: Configure a WDAC managed installer (Windows) +title: Managed installer and ISG technical reference and troubleshooting guide (Windows) description: Explains how to configure a custom Manged Installer. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -18,148 +18,75 @@ ms.date: 08/14/2020 ms.technology: mde --- -# Configuring a managed installer with AppLocker and Windows Defender Application Control +# Managed installer and ISG technical reference and troubleshooting guide **Applies to:** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2019 and above >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). -Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy with specific rules and options enabled. -There are three primary steps to keep in mind: +## Using fsutil to query SmartLocker EA -- Specify managed installers by using the Managed Installer rule collection in AppLocker policy. -- Enable service enforcement in AppLocker policy. -- Enable the managed installer option in a WDAC policy. +Customers using Windows Defender Application Control (WDAC) with Managed Installer (MI) or Intelligent Security Graph enabled can use fsutil to determine whether a file was allowed to run by one of these features. This can be achieved by querying the EAs on a file using fsutil and looking for the KERNEL.SMARTLOCKER.ORIGINCLAIM EA. The presence of this EA indicates that either MI or ISG allowed the file to run. This can be used in conjunction with enabling the MI and ISG logging events. -## Specify managed installers using the Managed Installer rule collection in AppLocker policy +**Example:** -The identity of the managed installer executable(s) is specified in an AppLocker policy in a Managed Installer rule collection. +```powershell +fsutil file queryEA C:\Users\Temp\Downloads\application.exe -### Create Managed Installer rule collection +Extended Attributes (EA) information for file C:\Users\Temp\Downloads\application.exe: -Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, a text editor can be used to make the simple changes needed to an EXE or DLL rule collection policy to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO. - -1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps&preserve-view=true) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback, but other rule types can be used as well. You may need to reformat the output for readability. - - ```powershell - Get-ChildItem | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -Xml > AppLocker_MI_PS_ISE.xml - ``` - -2. Manually rename the rule collection to ManagedInstaller - - Change - - ```powershell - - ``` - - to - - ```powershell - - ``` - -An example of a valid Managed Installer rule collection using Microsoft Endpoint Config Manager (MEMCM) is shown below. - -```xml - - - - - - - - - - - - - - - - +Ea Buffer Offset: 410 +Ea Name: $KERNEL.SMARTLOCKER.ORIGINCLAIM +Ea Value Length: 7e +0000: 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................ +0010: b2 ff 10 66 bc a8 47 c7 00 d9 56 9d 3d d4 20 2a ...f..G...V.=. * +0020: 63 a3 80 e2 d8 33 8e 77 e9 5c 8d b0 d5 a7 a3 11 c....3.w.\...... +0030: 83 00 00 00 00 00 00 00 5c 00 00 00 43 00 3a 00 ........\...C.:. +0040: 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 6a 00 \.U.s.e.r.s.\.T. +0050: 6f 00 67 00 65 00 75 00 72 00 74 00 65 00 2e 00 e.m.p..\D.o.w.n... +0060: 52 00 45 00 44 00 4d 00 4f 00 4e 00 44 00 5c 00 l.o.a.d.\a.p.p.l. +0070: 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 i.c.a.t.i.o.n..e.x.e ``` -### Enable service enforcement in AppLocker policy - -Since many installation processes rely on services, it is typically necessary to enable tracking of services. -Correct tracking of services requires the presence of at least one rule in the rule collection, so a simple audit only rule will suffice. This can be added to the policy created above which specifies your managed installer rule collection. - -For example: - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -## Enable the managed installer option in WDAC policy - -In order to enable trust for the binaries laid down by managed installers, the Enabled: Managed Installer option must be specified in your WDAC policy. -This can be done by using the [Set-RuleOption cmdlet](/powershell/module/configci/set-ruleoption) with Option 13. - -Below are steps to create a WDAC policy that allows Windows to boot and enables the managed installer option. - -1. Copy the DefaultWindows_Audit policy into your working folder from C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml - -2. Reset the policy ID to ensure it is in multiple policy format and give it a different GUID from the example policies. Also give it a friendly name to help with identification. - - Ex. - - ```powershell - Set-CIPolicyIdInfo -FilePath -PolicyName "" -ResetPolicyID - ``` - -3. Set Option 13 (Enabled:Managed Installer) - - ```powershell - Set-RuleOption -FilePath -Option 13 - ``` - -## Set the AppLocker filter driver to autostart - -To enable the managed installer, you need to set the AppLocker filter driver to autostart and start it. - -To do so, run the following command as an Administrator: - -```console -appidtel.exe start [-mionly] -``` - -Specify `-mionly` if you will not use the Intelligent Security Graph (ISG). - ## Enabling managed installer logging events -Refer to [Understanding Application Control Events](event-id-explanations.md#optional-intelligent-security-graph-isg-or-managed-installer-mi-diagnostic-events) for information on enabling optional managed installer diagnostic events. \ No newline at end of file +Refer to [Understanding Application Control Events](event-id-explanations.md#optional-intelligent-security-graph-isg-or-managed-installer-mi-diagnostic-events) for information on enabling optional managed installer diagnostic events. + +## Deploying the Managed Installer rule collection + +Once you've completed configuring your chosen Managed Installer, by specifying which option to use in the AppLocker policy, enabling the service enforcement of it, and by enabling the Managed Installer option in a WDAC policy, you'll need to deploy it. + +1. Use the following command to deploy the policy. + + ```powershell + $policyFile= + @" + Raw_AppLocker_Policy_XML + "@ + Set-AppLockerPolicy -XmlPolicy $policyFile -Merge -ErrorAction SilentlyContinue + ``` + +2. Verify Deployment of the ruleset was successful + + ```powershell + Get-AppLockerPolicy -Local + + Version RuleCollections RuleCollectionTypes + ------- --------------- ------------------- + 1 {0, 0, 0, 0...} {Appx, Dll, Exe, ManagedInstaller...} + ``` + + Verify the output shows the ManagedInstaller rule set. + +3. Get the policy XML (optional) using PowerShell: + + ```powershell + Get-AppLockerPolicy -Effective -Xml -ErrorVariable ev -ErrorAction SilentlyContinue + ``` + + This command will show the raw XML to verify the individual rules that were set. From 33822bc890ba663ab1852b4aef16472559765138 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Thu, 30 Sep 2021 08:38:16 -0700 Subject: [PATCH 014/284] Update configure-authorized-apps-deployed-with-a-managed-installer.md --- ...figure-authorized-apps-deployed-with-a-managed-installer.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md index 4e8d47ed2c..3b9a4829da 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -26,6 +26,9 @@ ms.technology: mde - Windows 11 - Windows Server 2019 and above +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). + With Windows Defender Application Control (WDAC), you can automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, using a feature called _managed installer_. Managed installer can help you better balance security and manageability when enforcing application control policies. ## How does a managed installer work? From 9eca1f6ad789ea405828b01a3ba683b6002fe418 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 1 Oct 2021 15:20:33 +0100 Subject: [PATCH 015/284] Create essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 319 ++++++++++++++++++ 1 file changed, 319 insertions(+) create mode 100644 windows/privacy/essential-services-and-connected-experiences.md diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md new file mode 100644 index 0000000000..3e1363a9b3 --- /dev/null +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -0,0 +1,319 @@ +**Essential Services and Connected Experiences for Windows** + +**Applies to** + +- Windows 11 and Windows 10, version 1903 and later. + +Windows includes built-in apps, services, and features, that connect to the internet to provide enhanced experiences and additional capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. + +When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data can also include information needed by a connected experience to perform its task, such as configuration information about Windows. + +We give you the ability to choose which connected experiences you want to use in Windows, which then determines what required service data is sent to us. + +Required service data is also collected and sent to Microsoft for essential services. Essential services are used to keep the product **secure, up to date, performing as expected** or are **integral** to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. + +Although most essential services can be turned off by enterprise admins, we recommend that where applicable you consider hosting the services on-premises and carefully assess the impact of turning off remaining services. The following list describes the essential services and connected experiences that are available to you in Windows and provides links to further information about each one. + +Note: The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. **Windows** **Essential Services** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Essential ServiceDescription
Authentication

The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.

+

To turn it off, see Microsoft Account

Certificates

Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
+If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.

+

To turn it off, see Automatic Root Certificates Update

Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

+

To turn it off, see Services Services Configuration.

Licensing

Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows as well as store applications.

+

To turn it off, see License Manager and Software Protection Platform.

Networking

Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows devices will lose network connectivity.

+

To turn off Network Adapters, see Disable-NetAdapter

Device setup

The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.

+

To customize the initial setup experience, see Customize Setup

Diagnostic Data

Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find, and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.

+

To turn it off, see Telemetry Services.

Update

Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date.

+

Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

+

Other services like Device metadata retrieval and Font streaming also ensure that the content on your devices is kept up to date.

+

To turn it off, see Windows Update, Device Metadata Retrieval and Font Streaming.

Microsoft Store

Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.

+

To turn it off, see Microsoft Store.

+ +**Windows Connected Experiences** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Connected ExperienceDescription
Activity History

Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.

+

Synchronization across devices only works when a user signs in with the same account.

+

To turn it off, see Activity History.

Cloud Clipboard

Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.

+

To turn it off, see Cloud Clipboard

Date and Time

The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.

+

To turn it off, see Date and Time

Delivery optimization

Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.

+

If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.

+

By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.

+

To turn it off, see Delivery Optimization.

Emojis and more

The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs,  symbols, and clipboard history. This connected experience is new in Windows 11

+

Placeholder – there needs to be a GP link here

Find My Device

Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to https://account.microsoft.com/devices under the Find My Device tab.

+

To turn it off, see Find My Device.

Location services

The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.

+

To turn it off, see Location Services.

Microsoft Defender Antivirus

Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.

+

Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

+

To turn it off, see Microsoft Defender Antivirus.

Microsoft Defender SmartScreen

Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files.

+

Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.

+

To turn it off, see Microsoft Defender SmartScreen.

OneDrive

OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.

+

To turn off OneDrive, see OneDrive.

Troubleshooting Service

Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running, make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience.

+

To turn it off, see Troubleshooting service

Voice TypingVoice typing (also referred to as Windows dictation in earlier versions of Windows) allows you to write text by speaking by using Microsoft’s online speech recognition technology. To turn it off, see Speech Recognition.
Windows backup

With settings synchronization is turned on, a user's settings are synced across all Windows devices when they sign in with the same account.

+

To turn it off, see Sync Your Settings

Windows Dashboard Widgets

Windows Dashboard widget is a dynamic view that shows you personalized content like news, weather, a glimpse at your calendar and to-do list and your recent photos. It provides a glanceable view which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11

+

Placeholder – there needs to be a GP link

Windows Insider Program

The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to builds of Windows. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s website.

+

To turn it off, see Windows Insider Program.

Windows Search

Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account (including OneDrive, SharePoint, and other Microsoft services), and the internet.

+

To turn it off, see Windows Search.

Windows Spotlight

Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.

+

Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.

+

To turn it off, see Windows Spotlight.

+ +**Edge Essential Services and Connected Experiences** + +Windows ships with Microsoft Edge and Internet Explorer on Windows devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience. + +You can find details on all of Edge's connected experiences and essential services [here](https://docs.microsoft.com/en-us/microsoft-edge/privacy-whitepaper/). + +To turn off specific Edge feature, see [Microsoft Edge](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#13-microsoft-edge). + +**IE Essential Services and Connected Experiences** + +Internet Explorer shares many of the Windows essential services listed above. The following table provides more details on the essential services and connected experiences specific to Internet Explorer. + +Note: Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences. To turn off specific connected experiences, see [Internet Explorer](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#8-internet-explorer). + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Connected ExperiencesDescription
ActiveX Filtering

ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.

+

ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.

+

To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls.

Suggested SitesSuggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.
Address Bar and Search suggestionsWith search suggestions enabled, users will be offered suggested search terms as they type in the Address Bar. As users type information it will be sent to the default search provider.
Auto-complete feature for web addressesThe auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar.
Compatibility loggingThis feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed.
Compatibility ViewCompatibility View helps make websites designed for older browsers look better when viewed in Internet Explorer. The compatibility view setting allows you to choose whether an employee can fix website display problems they encounter while browsing.
Flip aheadFlip ahead enables your users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting your users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website.
Web SlicesA Web Slice enables users to subscribe to and automatically receive updates to content directly within a Web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices.
Accelerators

Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options.

+

For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word.

Pinning websites to StartWhen a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email website might send updates to the tile indicating how many new messages a user has.
+ +**Related links** + +[Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) + +[Connected Experiences in Office.](https://docs.microsoft.com/en-us/deployoffice/privacy/connected-experiences) + +[Essential Services in Office.](https://docs.microsoft.com/en-us/deployoffice/privacy/essential-services) + +To view endpoints for Windows 10 Enterprise, see: + +- + +- [Manage connection endpoints for Windows 10, version 20H2](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-20h2-endpoints)[Manage connection endpoints for Windows 10, version 1909](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1909-endpoints) + +- [Manage connection endpoints for Windows 10, version 1903](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1903-endpoints) + +- [Manage connection endpoints for Windows 10, version 1809](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1809-endpoints) + +- [Manage connection endpoints for Windows 10, version 1803](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1803-endpoints) + +- [Manage connection endpoints for Windows 10, version 1709](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1709-endpoints) + +To view endpoints for non-Enterprise Windows 10 editions, see: + +- Windows 10, version 20H2, connection endpoints for non-Enterprise editions + +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1909-non-enterprise-editions) + +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1903-non-enterprise-editions) + +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1809-non-enterprise-editions) + +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1803-non-enterprise-editions) + +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1709-non-enterprise-editions) From c249765865768d4b96d1e21ce9a15095a7d91fb3 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 4 Oct 2021 12:26:33 +0100 Subject: [PATCH 016/284] Update essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 60 ++++++++++++------- 1 file changed, 38 insertions(+), 22 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 3e1363a9b3..95a06854e5 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -1,8 +1,24 @@ -**Essential Services and Connected Experiences for Windows** +--- +title: Essential services and connected experiences for Windows +description: Explains what the essential services and connected experiences are for Windows +keywords: privacy, manage connections to Microsoft +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: siosulli +ms.author: dansimp +manager: dansimp +ms.date: 12/1/2020 +--- + +# Essential services and connected experiences for Windows **Applies to** -- Windows 11 and Windows 10, version 1903 and later. +- Windows 11 +- Windows 10, version 1903 and later Windows includes built-in apps, services, and features, that connect to the internet to provide enhanced experiences and additional capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. @@ -14,17 +30,18 @@ Required service data is also collected and sent to Microsoft for essential serv Although most essential services can be turned off by enterprise admins, we recommend that where applicable you consider hosting the services on-premises and carefully assess the impact of turning off remaining services. The following list describes the essential services and connected experiences that are available to you in Windows and provides links to further information about each one. -Note: The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. **Windows** **Essential Services** +> [!Note:] +> The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. + +## Windows essential services + +| **Essential Service** | **Description** | +| --- | --- | +|Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services#12-microsoft-account) +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services#automatic-root-certificates-update) + + +**Windows connected experiences** @@ -214,7 +232,7 @@ If automatic updates are turned off, applications and websites may stop working
-**Edge Essential Services and Connected Experiences** +**Edge essential services and connected experiences** Windows ships with Microsoft Edge and Internet Explorer on Windows devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience. @@ -222,7 +240,7 @@ You can find details on all of Edge's connected experiences and essential servic To turn off specific Edge feature, see [Microsoft Edge](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#13-microsoft-edge). -**IE Essential Services and Connected Experiences** +**IE essential services and connected experiences** Internet Explorer shares many of the Windows essential services listed above. The following table provides more details on the essential services and connected experiences specific to Internet Explorer. @@ -292,17 +310,15 @@ Note: Apart from ActiveX Filtering, which is an essential service, all other fea To view endpoints for Windows 10 Enterprise, see: -- +- [Manage connection endpoints for Windows 10, version 20H2](https://docs.microsoft.com/windows/privacy/manage-windows-20h2-endpoints)[Manage connection endpoints for Windows 10, version 1909](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1909-endpoints) -- [Manage connection endpoints for Windows 10, version 20H2](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-20h2-endpoints)[Manage connection endpoints for Windows 10, version 1909](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1909-endpoints) +- [Manage connection endpoints for Windows 10, version 1903](https://docs.microsoft.com/windows/privacy/manage-windows-1903-endpoints) -- [Manage connection endpoints for Windows 10, version 1903](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1903-endpoints) +- [Manage connection endpoints for Windows 10, version 1809](https://docs.microsoft.com/windows/privacy/manage-windows-1809-endpoints) -- [Manage connection endpoints for Windows 10, version 1809](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1809-endpoints) +- [Manage connection endpoints for Windows 10, version 1803](https://docs.microsoft.com/windows/privacy/manage-windows-1803-endpoints) -- [Manage connection endpoints for Windows 10, version 1803](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1803-endpoints) - -- [Manage connection endpoints for Windows 10, version 1709](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1709-endpoints) +- [Manage connection endpoints for Windows 10, version 1709](https://docs.microsoft.com/windows/privacy/manage-windows-1709-endpoints) To view endpoints for non-Enterprise Windows 10 editions, see: From f2721bf732ff94a0ee7aaee37fa479d1821b3cb9 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 4 Oct 2021 12:35:21 +0100 Subject: [PATCH 017/284] Update essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 272 +----------------- 1 file changed, 9 insertions(+), 263 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 95a06854e5..407cf18dc5 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -40,277 +40,23 @@ Although most essential services can be turned off by enterprise admins, we reco |Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services#12-microsoft-account) |Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services#automatic-root-certificates-update) - -**Windows connected experiences** +## IE essential services and connected experiences** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Connected ExperienceDescription
Activity History

Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.

-

Synchronization across devices only works when a user signs in with the same account.

-

To turn it off, see Activity History.

Cloud Clipboard

Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.

-

To turn it off, see Cloud Clipboard

Date and Time

The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.

-

To turn it off, see Date and Time

Delivery optimization

Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.

-

If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.

-

By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.

-

To turn it off, see Delivery Optimization.

Emojis and more

The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs,  symbols, and clipboard history. This connected experience is new in Windows 11

-

Placeholder – there needs to be a GP link here

Find My Device

Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to https://account.microsoft.com/devices under the Find My Device tab.

-

To turn it off, see Find My Device.

Location services

The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.

-

To turn it off, see Location Services.

Microsoft Defender Antivirus

Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.

-

Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Microsoft Defender Antivirus.

Microsoft Defender SmartScreen

Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files.

-

Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.

-

To turn it off, see Microsoft Defender SmartScreen.

OneDrive

OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.

-

To turn off OneDrive, see OneDrive.

Troubleshooting Service

Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running, make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience.

-

To turn it off, see Troubleshooting service

Voice TypingVoice typing (also referred to as Windows dictation in earlier versions of Windows) allows you to write text by speaking by using Microsoft’s online speech recognition technology. To turn it off, see Speech Recognition.
Windows backup

With settings synchronization is turned on, a user's settings are synced across all Windows devices when they sign in with the same account.

-

To turn it off, see Sync Your Settings

Windows Dashboard Widgets

Windows Dashboard widget is a dynamic view that shows you personalized content like news, weather, a glimpse at your calendar and to-do list and your recent photos. It provides a glanceable view which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11

-

Placeholder – there needs to be a GP link

Windows Insider Program

The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to builds of Windows. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s website.

-

To turn it off, see Windows Insider Program.

Windows Search

Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account (including OneDrive, SharePoint, and other Microsoft services), and the internet.

-

To turn it off, see Windows Search.

Windows Spotlight

Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.

-

Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.

-

To turn it off, see Windows Spotlight.

+## Related links** -**Edge essential services and connected experiences** +[Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) -Windows ships with Microsoft Edge and Internet Explorer on Windows devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience. +[Connected Experiences in Office.](https://docs.microsoft.com/deployoffice/privacy/connected-experiences) -You can find details on all of Edge's connected experiences and essential services [here](https://docs.microsoft.com/en-us/microsoft-edge/privacy-whitepaper/). - -To turn off specific Edge feature, see [Microsoft Edge](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#13-microsoft-edge). - -**IE essential services and connected experiences** - -Internet Explorer shares many of the Windows essential services listed above. The following table provides more details on the essential services and connected experiences specific to Internet Explorer. - -Note: Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences. To turn off specific connected experiences, see [Internet Explorer](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#8-internet-explorer). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Connected ExperiencesDescription
ActiveX Filtering

ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.

-

ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.

-

To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls.

Suggested SitesSuggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.
Address Bar and Search suggestionsWith search suggestions enabled, users will be offered suggested search terms as they type in the Address Bar. As users type information it will be sent to the default search provider.
Auto-complete feature for web addressesThe auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar.
Compatibility loggingThis feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed.
Compatibility ViewCompatibility View helps make websites designed for older browsers look better when viewed in Internet Explorer. The compatibility view setting allows you to choose whether an employee can fix website display problems they encounter while browsing.
Flip aheadFlip ahead enables your users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting your users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website.
Web SlicesA Web Slice enables users to subscribe to and automatically receive updates to content directly within a Web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices.
Accelerators

Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options.

-

For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word.

Pinning websites to StartWhen a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email website might send updates to the tile indicating how many new messages a user has.
- -**Related links** - -[Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) - -[Connected Experiences in Office.](https://docs.microsoft.com/en-us/deployoffice/privacy/connected-experiences) - -[Essential Services in Office.](https://docs.microsoft.com/en-us/deployoffice/privacy/essential-services) +[Essential Services in Office.](https://docs.microsoft.com/deployoffice/privacy/essential-services) To view endpoints for Windows 10 Enterprise, see: -- [Manage connection endpoints for Windows 10, version 20H2](https://docs.microsoft.com/windows/privacy/manage-windows-20h2-endpoints)[Manage connection endpoints for Windows 10, version 1909](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1909-endpoints) +- [Manage connection endpoints for Windows 10, version 20H2](https://docs.microsoft.com/windows/privacy/manage-windows-20h2-endpoints)[Manage connection endpoints for Windows 10, version 1909](https://docs.microsoft.com/windows/privacy/manage-windows-1909-endpoints) - [Manage connection endpoints for Windows 10, version 1903](https://docs.microsoft.com/windows/privacy/manage-windows-1903-endpoints) @@ -324,7 +70,7 @@ To view endpoints for non-Enterprise Windows 10 editions, see: - Windows 10, version 20H2, connection endpoints for non-Enterprise editions -- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1909-non-enterprise-editions) +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1909-non-enterprise-editions) - [Windows 10, version 1903, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1903-non-enterprise-editions) From d74cf091d0d63176011c361bb81ee67a5721b298 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 4 Oct 2021 13:49:22 +0100 Subject: [PATCH 018/284] Update essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 44 +++++++------------ 1 file changed, 17 insertions(+), 27 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 407cf18dc5..35361d5374 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -37,8 +37,8 @@ Although most essential services can be turned off by enterprise admins, we reco | **Essential Service** | **Description** | | --- | --- | -|Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services#12-microsoft-account) -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services#automatic-root-certificates-update) +|Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#12-microsoft-account) +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update) ## Windows connected experiences @@ -48,34 +48,24 @@ Although most essential services can be turned off by enterprise admins, we reco ## Related links** -[Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) - -[Connected Experiences in Office.](https://docs.microsoft.com/deployoffice/privacy/connected-experiences) - -[Essential Services in Office.](https://docs.microsoft.com/deployoffice/privacy/essential-services) +- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) +- [Connected Experiences in Office.](/deployoffice/privacy/connected-experiences.md) +- [Essential Services in Office.](/deployoffice/privacy/essential-services.md) To view endpoints for Windows 10 Enterprise, see: -- [Manage connection endpoints for Windows 10, version 20H2](https://docs.microsoft.com/windows/privacy/manage-windows-20h2-endpoints)[Manage connection endpoints for Windows 10, version 1909](https://docs.microsoft.com/windows/privacy/manage-windows-1909-endpoints) - -- [Manage connection endpoints for Windows 10, version 1903](https://docs.microsoft.com/windows/privacy/manage-windows-1903-endpoints) - -- [Manage connection endpoints for Windows 10, version 1809](https://docs.microsoft.com/windows/privacy/manage-windows-1809-endpoints) - -- [Manage connection endpoints for Windows 10, version 1803](https://docs.microsoft.com/windows/privacy/manage-windows-1803-endpoints) - -- [Manage connection endpoints for Windows 10, version 1709](https://docs.microsoft.com/windows/privacy/manage-windows-1709-endpoints) +- [Manage connection endpoints for Windows 10, version 20H2](manage-windows-20h2-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) To view endpoints for non-Enterprise Windows 10 editions, see: -- Windows 10, version 20H2, connection endpoints for non-Enterprise editions - -- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1909-non-enterprise-editions) - -- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1903-non-enterprise-editions) - -- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1809-non-enterprise-editions) - -- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1803-non-enterprise-editions) - -- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1709-non-enterprise-editions) +- [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](windows-endpoints-20H2-non-enterprise-editions) +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) From 0688525f9418d782464f191509be3a463f06d60f Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 4 Oct 2021 13:51:52 +0100 Subject: [PATCH 019/284] Update essential-services-and-connected-experiences.md --- windows/privacy/essential-services-and-connected-experiences.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 35361d5374..87d18e28f5 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -63,7 +63,7 @@ To view endpoints for Windows 10 Enterprise, see: To view endpoints for non-Enterprise Windows 10 editions, see: -- [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](windows-endpoints-20H2-non-enterprise-editions) +- [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](windows-endpoints-20H2-non-enterprise-editions.md) - [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) - [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) - [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) From b9da42087649f62ea9adf20f36f9f9f55d83e0c0 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 4 Oct 2021 13:57:35 +0100 Subject: [PATCH 020/284] Update essential-services-and-connected-experiences.md --- ...essential-services-and-connected-experiences.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 87d18e28f5..1136e003a7 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -30,8 +30,8 @@ Required service data is also collected and sent to Microsoft for essential serv Although most essential services can be turned off by enterprise admins, we recommend that where applicable you consider hosting the services on-premises and carefully assess the impact of turning off remaining services. The following list describes the essential services and connected experiences that are available to you in Windows and provides links to further information about each one. -> [!Note:] -> The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. +>[!Note:] +>The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. ## Windows essential services @@ -44,13 +44,13 @@ Although most essential services can be turned off by enterprise admins, we reco ## Edge essential services and connected experiences -## IE essential services and connected experiences** +## IE essential services and connected experiences -## Related links** +## Related links - [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) -- [Connected Experiences in Office.](/deployoffice/privacy/connected-experiences.md) -- [Essential Services in Office.](/deployoffice/privacy/essential-services.md) +- [Connected Experiences in Office](/deployoffice/privacy/connected-experiences.md) +- [Essential Services in Office](/deployoffice/privacy/essential-services.md) To view endpoints for Windows 10 Enterprise, see: @@ -68,4 +68,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see: - [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) - [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) - [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) -- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) \ No newline at end of file From b7edef14405bd7946e0d4ecc3aa26c17455f8bdd Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 4 Oct 2021 14:05:18 +0100 Subject: [PATCH 021/284] Update essential-services-and-connected-experiences.md --- .../privacy/essential-services-and-connected-experiences.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 1136e003a7..63bb96c43a 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -30,8 +30,8 @@ Required service data is also collected and sent to Microsoft for essential serv Although most essential services can be turned off by enterprise admins, we recommend that where applicable you consider hosting the services on-premises and carefully assess the impact of turning off remaining services. The following list describes the essential services and connected experiences that are available to you in Windows and provides links to further information about each one. ->[!Note:] ->The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. +> [!NOTE] +> The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. ## Windows essential services From 5af2c4a0a7667efb0228e778d209edbf5c3fe3b4 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 4 Oct 2021 14:19:40 +0100 Subject: [PATCH 022/284] Update essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 63bb96c43a..da2e065acf 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -35,17 +35,34 @@ Although most essential services can be turned off by enterprise admins, we reco ## Windows essential services -| **Essential Service** | **Description** | +| **Essential service** | **Description** | | --- | --- | |Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#12-microsoft-account) |Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update) ## Windows connected experiences +| **Connected experience* | **Description** | +| --- | --- | +|Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user. Synchronization across devices only works when a user signs in with the same account.
To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history) +|Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows 10 devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard) + ## Edge essential services and connected experiences +Windows ships with Microsoft Edge and Internet Explorer on Windows 10 devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience.
You can find details on all of Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper).
To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge). + ## IE essential services and connected experiences +Internet Explorer shares many of the Windows essential services listed above. The following table provides more details on the essential services and connected experiences specific to Internet Explorer. + +> [!NOTE] +> Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences.
To turn off specific connected experiences, see [Internet Explorer](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#8-internet-explorer). + +| **Connected experience* | **Description** | +| --- | --- | +|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.
To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. +|Suggested Sites|Suggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.| + ## Related links - [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) From 58cba274b50b79739fadb3f25a9b6522bfdac388 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 4 Oct 2021 14:25:02 +0100 Subject: [PATCH 023/284] Update essential-services-and-connected-experiences.md --- ...sential-services-and-connected-experiences.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index da2e065acf..6e5c37def6 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -37,19 +37,19 @@ Although most essential services can be turned off by enterprise admins, we reco | **Essential service** | **Description** | | --- | --- | -|Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#12-microsoft-account) -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update) +|Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#12-microsoft-account). +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update). ## Windows connected experiences -| **Connected experience* | **Description** | +| **Connected experience** | **Description** | | --- | --- | -|Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user. Synchronization across devices only works when a user signs in with the same account.
To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history) -|Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows 10 devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard) +|Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user. Synchronization across devices only works when a user signs in with the same account.
To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history). +|Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows 10 devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). ## Edge essential services and connected experiences -Windows ships with Microsoft Edge and Internet Explorer on Windows 10 devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience.
You can find details on all of Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper).
To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge). +Windows ships with Microsoft Edge and Internet Explorer on Windows 10 devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience.
You can find details on all of Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper). To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge). ## IE essential services and connected experiences @@ -58,9 +58,9 @@ Internet Explorer shares many of the Windows essential services listed above. Th > [!NOTE] > Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences.
To turn off specific connected experiences, see [Internet Explorer](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#8-internet-explorer). -| **Connected experience* | **Description** | +| **Connected experience** | **Description** | | --- | --- | -|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.
To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. +|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on. To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. |Suggested Sites|Suggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.| ## Related links From 0e14e99d1624d803c49cd49f06b1ffa32807c9cd Mon Sep 17 00:00:00 2001 From: Karl Wester-Ebbinghaus <45657752+Karl-WE@users.noreply.github.com> Date: Tue, 5 Oct 2021 00:07:25 +0200 Subject: [PATCH 024/284] Update script to ensure PowerShell 7 compatibility Windows 11 has built in PowerShell 7 and Windows Terminal. The aliases gwmi and gcim has been replaced by non alias commands to ensure this script does actually work with PowerShell 7.x --- .../credential-guard/dg-readiness-tool.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md index 8d3185afd9..5e6d9befec 100644 --- a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md +++ b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md @@ -22,6 +22,7 @@ ms.reviewer: - Windows 11 - Windows Server 2016 - Windows Server 2019 +- Windows Server 2022 ```powershell # Script to find out if a machine is Device Guard compliant. @@ -780,7 +781,7 @@ function CheckOSSKU function CheckOSArchitecture { - $OSArch = $(gwmi win32_operatingsystem).OSArchitecture.ToLower() + $OSArch = $(Get-WmiObject win32_operatingsystem).OSArchitecture.ToLower() Log $OSArch if($OSArch -match ("^64\-?\s?bit")) { @@ -818,9 +819,9 @@ function CheckSecureBootState function CheckVirtualization { - $_vmmExtension = $(gwmi -Class Win32_processor).VMMonitorModeExtensions - $_vmFirmwareExtension = $(gwmi -Class Win32_processor).VirtualizationFirmwareEnabled - $_vmHyperVPresent = (gcim -Class Win32_ComputerSystem).HypervisorPresent + $_vmmExtension = $(Get-WMIObject -Class Win32_processor).VMMonitorModeExtensions + $_vmFirmwareExtension = $(Get-WMIObject -Class Win32_processor).VirtualizationFirmwareEnabled + $_vmHyperVPresent = (Get-CimInstance -Class Win32_ComputerSystem).HypervisorPresent Log "VMMonitorModeExtensions $_vmmExtension" Log "VirtualizationFirmwareEnabled $_vmFirmwareExtension" Log "HyperVisorPresent $_vmHyperVPresent" @@ -1046,7 +1047,7 @@ if(!$TestForAdmin) exit } -$isRunningOnVM = (get-wmiobject win32_computersystem).model +$isRunningOnVM = (Get-WmiObject win32_computersystem).model if($isRunningOnVM.Contains("Virtual")) { LogAndConsoleWarning "Running on a Virtual Machine. DG/CG is supported only if both guest VM and host machine are running with Windows 10, version 1703 or later with English localization." From 6a9407b27d8a52aa206f63671e269cd68ce6ddc0 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 5 Oct 2021 15:52:30 +0100 Subject: [PATCH 025/284] Update windows-10-and-privacy-compliance.md --- .../windows-10-and-privacy-compliance.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index bf24ccb668..70ec74822e 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -29,7 +29,7 @@ Applies to: At Microsoft, we are committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows. -Microsoft collects data through multiple interactions with users of Windows devices. This information can contain personal data that may be used to provide, secure, and improve Windows services. To help users and organizations control the collection of personal data, Windows provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article. +Microsoft collects data through multiple interactions with users of Windows devices. This information can contain personal data that may be used to provide, secure and improve Windows, and to provide connected experiences. To help users and organizations control the collection of personal data, Windows provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article. This information allows administrators and compliance professionals to work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR). @@ -44,7 +44,7 @@ When setting up a device, a user can configure their privacy settings. Those pri The following table provides an overview of the Windows 10 and Windows 11 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information. > [!NOTE] -> This table is limited to the privacy settings that are most commonly avaialable when setting up a current version of Windows 10 or newer. For the full list of settings that involve data collection, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This table is limited to the privacy settings that are most commonly available when setting up a current version of Windows 10 or newer. For the full list of settings that involve data collection, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | Description | Supporting Content | Privacy Statement | | --- | --- | --- | --- | @@ -111,19 +111,19 @@ You can use the following articles to learn more about Autopilot and how to use - [Overview of Windows Autopilot](/windows/deployment/windows-Autopilot/windows-Autopilot) - [Windows Autopilot deployment process](/windows/deployment/windows-Autopilot/deployment-process) -#### _2.3.2 Managing connections from Windows components to Microsoft services_ +#### _2.3.2 Managing Windows connected experiences and essential services_ -Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows components. +Windows includes features that connect to the internet to provide enhanced experiences and additional capabilities. These are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. -For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable. +Essential services are services in the product that connect to Microsoft to keep the product secure, up to date, performing as expected or are integral to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. -#### _2.3.3 Managing Windows connections_ +[Windows essential services and connected experiences](essential-services-and-connected-experiences.md) provides a list of the most common Windows essential services and connected experiences. -Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints for their organization to meet their specific compliance objectives. +When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows connected experiences and essential services. For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services). This topic includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. -The **Manage Windows connection endpoints** section on the left-hand navigation menu provides a list of endpoints for the latest Windows releases, along with descriptions of any functionality that would be impacted by restricting data collection. +The article [Manage connection endpoints for Windows 10 Enterprise, version 21H1](manage-windows-21h1-endpoints.md) provides a list of endpoints to which data is transferred by Windows connected experiences for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. -#### _2.3.4 Limited functionality baseline_ +#### _2.3.3 Limited functionality baseline_ An organization may want to minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. @@ -131,15 +131,15 @@ An organization may want to minimize the amount of data sent back to Microsoft o > - We recommend that you fully test any modifications to these settings before deploying them in your organization. > - We also recommend that if you plan to enable the Windows diagnostic data processor configuration, adjust the limited configuration baseline before deploying it to ensure the Windows diagnostic setting is not turned off. -#### _2.3.5 Diagnostic data: Managing notifications for change of level at logon_ +#### _2.3.4 Diagnostic data: Managing notifications for change of level at logon_ Starting with Windows 10, version 1803 and Windows 11, if an administrator modifies the diagnostic data collection setting, users are notified of this change during the initial device sign in. For example, if you configure the device to send optional diagnostic data, users will be notified the next time they sign into the device. You can disable these notifications by using the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`. -#### _2.3.6 Diagnostic data: Managing end user choice for changing the setting_ +#### _2.3.5 Diagnostic data: Managing end user choice for changing the setting_ -Windows 10, version 1803 and later and Windows 11 allows users to change their diagnostic data level to a lower setting than what their administrator has set. For example, if you have configured the device to send optional diagnostic data, a user can change the setting so that only required diagnostic data is sent by opening the Settings app in Windows. Administrators can restrict a user’s ability to change the setting by enabling the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`. +Windows 10, version 1803 and later and Windows 11 allows users to change their diagnostic data level to a lower setting than what their administrator has set. For example, if you have configured the device to send optional diagnostic data, a user can change the setting so that only required diagnostic data is sent by opening the Settings app in Windows and navigating to **Diagnostic & feedback**. Administrators can restrict a user’s ability to change the setting by enabling the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`. -#### _2.3.7 Diagnostic data: Managing device-based data delete_ +#### _2.3.6 Diagnostic data: Managing device-based data delete_ Windows 10, version 1809 and later and Windows 11 allow a user to delete diagnostic data collected from their device by opening the Settings app in Windows and navigating to **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. An administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData) PowerShell cmdlet. @@ -148,7 +148,7 @@ An administrator can disable a user’s ability to delete their device’s diagn >[!Note] >If the Windows diagnostic data processor configuration is enabled, the Delete diagnostic data button will be disabled and the powershell cmdlet will not delete data collected under this configuration. IT administrators can instead delete diagnostic data collected by invoking a delete request from the admin portal. -#### _2.3.8 Diagnostic data: Enabling the Windows diagnostic data processor configuration_ +#### _2.3.7 Diagnostic data: Enabling the Windows diagnostic data processor configuration_ **Applies to:** From 6c78f75a0635761f58dcd22c44a1ec7867758664 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 5 Oct 2021 16:00:14 +0100 Subject: [PATCH 026/284] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 70ec74822e..1eaf63cbfc 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -87,7 +87,7 @@ The following table provides an overview of the privacy settings discussed earli | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later and Windows 11) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry** (or **Allow diagnostic data** in Windows 11 or Windows Server 2022)

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

**Note**: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the state to minimize data collection is not recommended. See [Enabling the Windows diagnostic data processor configuration](#238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration) below for more information. | Required diagnostic data (Windows 10, version 1903 and later and Windows 11)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry** (or **Allow diagnostic data** in Windows 11 or Windows Server 2022)

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

**Note**: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the state to minimize data collection is not recommended. See [Enabling the Windows diagnostic data processor configuration](#237-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration) below for more information. | Required diagnostic data (Windows 10, version 1903 and later and Windows 11)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later and Windows 11) | Off | | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off | | Advertising ID | Group Policy:
**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | @@ -119,7 +119,7 @@ Essential services are services in the product that connect to Microsoft to keep [Windows essential services and connected experiences](essential-services-and-connected-experiences.md) provides a list of the most common Windows essential services and connected experiences. -When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows connected experiences and essential services. For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services). This topic includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. +When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows connected experiences and essential services. For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. The article [Manage connection endpoints for Windows 10 Enterprise, version 21H1](manage-windows-21h1-endpoints.md) provides a list of endpoints to which data is transferred by Windows connected experiences for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. From ff6d89d721766550ac4e377beb91a7513ba95fc6 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 5 Oct 2021 16:44:06 +0100 Subject: [PATCH 027/284] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 1eaf63cbfc..b8ef1bb3f5 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -87,7 +87,7 @@ The following table provides an overview of the privacy settings discussed earli | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later and Windows 11) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry** (or **Allow diagnostic data** in Windows 11 or Windows Server 2022)

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

**Note**: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the state to minimize data collection is not recommended. See [Enabling the Windows diagnostic data processor configuration](#237-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration) below for more information. | Required diagnostic data (Windows 10, version 1903 and later and Windows 11)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry** (or **Allow diagnostic data** in Windows 11 or Windows Server 2022)

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

**Note**: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the state to minimize data collection is not recommended. For more information, see [Enabling the Windows diagnostic data processor configuration](#237-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration). | Required diagnostic data (Windows 10, version 1903 and later and Windows 11)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later and Windows 11) | Off | | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off | | Advertising ID | Group Policy:
**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | @@ -115,11 +115,11 @@ You can use the following articles to learn more about Autopilot and how to use Windows includes features that connect to the internet to provide enhanced experiences and additional capabilities. These are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. -Essential services are services in the product that connect to Microsoft to keep the product secure, up to date, performing as expected or are integral to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. +Essential services are services in the product that connect to Microsoft to keep the product secure, up to date and performing as expected, or are integral to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. [Windows essential services and connected experiences](essential-services-and-connected-experiences.md) provides a list of the most common Windows essential services and connected experiences. -When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows connected experiences and essential services. For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. +When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows connected experiences and essential services. For more information, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. The article [Manage connection endpoints for Windows 10 Enterprise, version 21H1](manage-windows-21h1-endpoints.md) provides a list of endpoints to which data is transferred by Windows connected experiences for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. From 40d1d6559fd7220d3a2248c655252d22effecefd Mon Sep 17 00:00:00 2001 From: afirodiya <42394035+afirodiya@users.noreply.github.com> Date: Tue, 5 Oct 2021 15:50:09 -0700 Subject: [PATCH 028/284] Update enable-virtualization-based-protection-of-code-integrity.md --- .../enable-virtualization-based-protection-of-code-integrity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index ea4b252a30..03ca52bd5e 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -311,6 +311,6 @@ Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true ### Requirements for running HVCI in Hyper-V virtual machines - The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607. - The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10. -- HVCI and [nested virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time +- HVCI and [nested virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time. To enable HyperV role on the VM, first install the HyperV role in a Windows nested virtualization environment. - Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`. - The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`. From c262c14d3bd6dad51251c0cbbb6d1f2b59b3b1a1 Mon Sep 17 00:00:00 2001 From: Benzy Dharmanayagam Date: Wed, 6 Oct 2021 11:58:34 +0530 Subject: [PATCH 029/284] Updated-5244097 Updated connected experience documentation. --- ...tial-services-and-connected-experiences.md | 42 ++++++++++++++++--- 1 file changed, 36 insertions(+), 6 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 6e5c37def6..58c2c0ab36 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -37,19 +37,41 @@ Although most essential services can be turned off by enterprise admins, we reco | **Essential service** | **Description** | | --- | --- | -|Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#12-microsoft-account). -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update). +|Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#12-microsoft-account).| +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update).| +| Services Configuration | Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.
To turn it off, see [Services Configuration](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#31-services-configuration).| +| Licensing | Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows as well as store applications.
To turn it off, see [License Manager](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#9-license-manager) and [Software Protection Platform](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#19-software-protection-platform).| +| Networking | Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows devices will lose network connectivity.
To turn off Network Adapters, see [Disable-NetAdapter](/powershell/module/netadapter/disable-netadapter).| +| Device setup | The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.
To customize the initial setup experience, see [Customize Setup](/windows-hardware/customize/desktop/customize-oobe).| +| Diagnostic Data | Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find, and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.
To turn it off, see [Telemetry Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics).| +| Update | Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date.
Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
Other services like Device metadata retrieval and Font streaming also ensure that the content on your devices is kept up to date.
To turn it off, see [Windows Update](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#29-windows-update), [Device Metadata Retrieval](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#4-device-metadata-retrieval), and [Font Streaming](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#6-font-streaming).| +| Microsoft Store | Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.
To turn it off, see [Microsoft Store](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store).| ## Windows connected experiences | **Connected experience** | **Description** | | --- | --- | -|Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user. Synchronization across devices only works when a user signs in with the same account.
To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history). -|Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows 10 devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). +|Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.
Synchronization across devices only works when a user signs in with the same account.
To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history). | +|Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). | +| Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.
To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). | +| Delivery optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.
By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | +| Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
PLACEHOLDER | +| Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | +| Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.
To turn it off, see [Location Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). | +| Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.
Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). | +| Microsoft Defender SmartScreen | Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files.
Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.
To turn it off, see [Microsoft Defender SmartScreen](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#241-microsoft-defender-smartscreen). | +| OneDrive | OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.
To turn off OneDrive, see [OneDrive](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#16-onedrive). | +| Troubleshooting Service | Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running, make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience.
To turn it off, see [Troubleshooting service](/windows/client-management/mdm/policy-csp-troubleshooting). | +| Voice Typing | Voice typing (also referred to as Windows dictation in earlier versions of Windows) allows you to write text by speaking by using Microsoft’s online speech recognition technology.
To turn it off, see [Speech Recognition](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#186-speech). | +| Windows backup | With settings synchronization is turned on, a user's settings are synced across all Windows devices when they sign in with the same account.
To turn it off, see [Sync Your Settings](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-sync-your-settings). | +| Windows Dashboard Widgets | Windows Dashboard widget is a dynamic view that shows you personalized content like news, weather, a glimpse at your calendar and to-do list and your recent photos. It provides a glanceable view, which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11.
PLACEHOLDER | +| Windows Insider Program | The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to builds of Windows. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s [website](https://insider.windows.com/).
To turn it off, see [Windows Insider Program](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#7-insider-preview-builds). | +| Windows Search | Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account (including OneDrive, SharePoint, and other Microsoft services), and the internet.
To turn it off, see [Windows Search](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#2-cortana-and-search). | +| Windows Spotlight | Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.
Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.
To turn it off, see [Windows Spotlight](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#25-windows-spotlight). | ## Edge essential services and connected experiences -Windows ships with Microsoft Edge and Internet Explorer on Windows 10 devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience.
You can find details on all of Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper). To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge). +Windows ships with Microsoft Edge and Internet Explorer on Windows devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience.
You can find details on all of Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper). To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge). ## IE essential services and connected experiences @@ -60,8 +82,16 @@ Internet Explorer shares many of the Windows essential services listed above. Th | **Connected experience** | **Description** | | --- | --- | -|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on. To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. +|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.
To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. | |Suggested Sites|Suggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.| +| Address Bar and Search suggestions | With search suggestions enabled, users will be offered suggested search terms as they type in the Address Bar. As users type information, it will be sent to the default search provider. | +| Auto-complete feature for web addresses | The auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar. | +| Compatibility logging | This feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed. | +| Compatibility View | Compatibility View helps make websites designed for older browsers look better when viewed in Internet Explorer. The compatibility view setting allows you to choose whether an employee can fix website display problems they encounter while browsing. | +| Flip ahead | Flip ahead enables your users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting your users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website. | +| Web Slices | A Web Slice enables users to subscribe to and automatically receive updates to content directly within a Web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices. | +| Accelerators | Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options.
For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word. | +| Pinning websites to Start | When a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email website might send updates to the tile indicating how many new messages a user has. | ## Related links From 3ec75ee83c3313b375ff9da855b7f716b0b90f17 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 6 Oct 2021 12:29:26 +0100 Subject: [PATCH 030/284] Update toc.yml --- windows/privacy/toc.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml index 96516c4786..af35fd6f4f 100644 --- a/windows/privacy/toc.yml +++ b/windows/privacy/toc.yml @@ -43,6 +43,8 @@ href: manage-connections-from-windows-operating-system-components-to-microsoft-services.md - name: Manage connections from Windows operating system components to Microsoft services using MDM href: manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md + - name: Essential services and connected experiences for Windows + href: essential-services-and-connected-experiences.md - name: Connection endpoints for Windows 11 href: manage-windows-11-endpoints.md - name: Connection endpoints for Windows 10, version 21H1 From 9ea750d0228292ee02e5850fbb28608d4867c486 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 6 Oct 2021 14:36:00 +0100 Subject: [PATCH 031/284] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index b8ef1bb3f5..af9c8e7a03 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -71,7 +71,7 @@ Windows provides the ability to manage privacy settings through several differen ### 2.1 Privacy setting options for users -Once a Windows device is set up, a user can manage data collection settings by opening the Settings app in Windows. Administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says **Some settings are hidden or managed by your organization** when they navigate to the Settings page. In this case, the user can only change settings in accordance with the policies that the administrator has applied to the device. +Once a Windows device is set up, a user can manage data collection settings by opening the Settings app in Windows. Administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says **Some settings are hidden or managed by your organization** when they navigate to the settings page. In this case, the user can only change settings in accordance with the policies that the administrator has applied to the device. ### 2.2 Privacy setting controls for administrators @@ -80,7 +80,7 @@ Administrators can configure and control privacy settings across their organizat The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve managing data collection or connecting to Microsoft services. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This is not a complete list of settings that involve managing data collected or connecting to connected experiences in Windows. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| From d02d62187fca204b37bcbf1581eae3e151d441ec Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 6 Oct 2021 14:59:44 +0100 Subject: [PATCH 032/284] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index af9c8e7a03..9d28f8f85e 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -80,7 +80,7 @@ Administrators can configure and control privacy settings across their organizat The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve managing data collected or connecting to connected experiences in Windows. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This is not a complete list of settings that involve managing data collection or connecting to connected experiences in Windows. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| From d6d0893942104164a8e24de29c1248097636b23e Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Wed, 6 Oct 2021 20:39:59 +0530 Subject: [PATCH 033/284] Create config-lock.md new topic created per 5475844 --- windows/client-management/mdm/config-lock.md | 95 ++++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 windows/client-management/mdm/config-lock.md diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md new file mode 100644 index 0000000000..bd05413472 --- /dev/null +++ b/windows/client-management/mdm/config-lock.md @@ -0,0 +1,95 @@ +--- +title: Mobile device management MDM for device updates +description: Windows 10 provides several APIs to help mobile device management (MDM) solutions manage updates. +Learn how to use these APIs to implement update management. +ms.assetid: C27BAEE7-2890-4FB7-9549-A6EACC790777 +ms.reviewer: +manager: dansimp +keywords: mdm,management,administrator +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/15/2017 +--- + +# Secured-core Configuration Lock + +Config Lock In an enterprise organization, IT administrators enforce policies on their corporate devices to keep the devices in a compliant state and protect the OS by preventing users from changing configurations and creating config drift. Config drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM, Windows 11 with Config Lock enables IT administrators to prevent config drift and keep the OS configuration in the desired state. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. + +Secured-core Configuration Lock (Config Lock) is a new Secured-core PC (SCPC) feature releasing with the Windows October 2021 Release which prevents configuration drift from Secured-Core PC features (shown below) caused by unintentional misconfiguration. In short, it ensures a device intended to be a Secured-core PC remains a Secured-core PC. + +In sum, Config Lock: +• Enables IT to “lock” a fixed set of configurations on Secured-Core PCs under MDM management +• Detects drift and quickly remediates +• Focuses on security features +• DOES NOT prevent malicious attacks + +After a Secured-core PC reaches the desktop, Config lock will prevent configuration drift as follows: +• Detect whether the device is a Secured-Core PC +• If so, prevent the following Secured-Core PC features from being disabled without IT Admin permission: + • Memory Access Protection (kDMA) + • Memory Integrity (HVCI) + • System Guard + • DRTM + • SMM + + + +IT Admin scenario: +1. IT Admin use MDM to enable Config Lock +2. IT Admin use MDM service to set policies +3. Policies are targeted to user/device +4. Policies come down to device and get set +5. Configurations are locked +6. A local admin user attempts to override the policy +7. System quickly remediates policy to the desired SCPC state + +Helpdesk scenario: +1. Helpdesk support engineer investigates the device +2. Helpdesk support engineer contacts the IT Admin to unlocks the device +3. IT Admin unlocks the device in order to make configuration changes +4. Device returns to locked state after a defined time (default 30 minutes) + +## System Requirements +Config Lock will be available for all Windows Professional and Enterprise Editions. + +## Enabling +Config Lock is not enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it on. +Config Lock is controlled by the presence of the Secured-core PC Device Identifier (the “BuiltAsSecuredCorePC” UEFI variable) inserted on the device by the OEM during initial device manufacturing. Config Lock can be enabled If the ByteArray value of this identifier is set to “1” and IT admin pushes the MDM policy to turn Config Lock on. If it is “0” or the variable is not present at all, Config Lock cannot be enabled. +NOTE: BuiltAsSecuredCorePC actually accepts ByteArray values of 0-9, and any value from 1-9 will indicate Secured-core PC to the Config Lock feature. While we recommend “1” for consistency, OEMs may optionally use any other value up to 9 for internal versioning reasons, or other purposes. (Technically, any value from 1-255 should trigger Config Lock, since BuiltAsSecuredCorePC is a byte.) +The UEFI variable can be set however an OEM likes, but one option is to use the Set-UEFIVariable command from [PowerShell Gallery | UEFIv2 2.3](https://www.powershellgallery.com/packages/UEFIv2/2.3), per the following syntax: +powershell.exe -ExecutionPolicy Bypass {Import-Module .\UEFIv2.psd1 ; Set-UEFIVariable -VariableName BuiltAsSecuredCorePC -Namespace '{77fa9abd-0359-4d32-bd60-28f4e78f784b}' -ByteArray @(01) } +Below are the steps to turn on Config Lock using Microsoft Endpoint Manager (MEM) +1. Ensure the device to turn on Config Lock is enrolled in MEM +2. From the MEM portal main page, select Devices > Configuration Profiles > Create a profile +3. Select the following and press Create: +• Platform: Windows 10 and later +• Profile type: Templates +• Template name: Custom + +4. Name your Profile +5. When you reach the Configuration Settings step, select “Add” and add the following information +• OMA-URI: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock +• Data type: Integer +• Value: 1 +To turn off Config Lock. Change value to 0. + +6. Select the Devices to turn on Config Lock. If you are using a test tenant, you can select “+ Add all devices” +7. You will not need to set any applicability rules for test purposes +8. Review the Configuration and select “Create” if everything is correct +9. After the Device Syncs with the MEM server, you will be able to confirm if the Config Lock was successfully enabled. + + + +## DISABLING +Config Lock is designed to ensure a Secured-core PC is not unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as MEM. + +## FAQ +QUESTION ANSWER +Can an IT Admin disable Config Lock Yes. I IT Admin can use MDM to turn off Config Lock. +Does the Secured-core PC Device Identifier UEFI variable (BuiltAsSecuredCorePC) value matter after it’s been read by the OA3 tool in the OEM factory? Yes. Config Lock will always read this UEFI variable to know whether it pertains to a device or not, so changing the variable changes Config Lock even after the device has left the OEM factory. +Could an end-user run the BuiltAsSecuredCorePC PS command to disable Config Lock? The PS script is accessible to anymore, but the BuiltAsSecuredCorePC becomes read-only after boot, so the command will fail when run from the OS. + + From 515a1236125152b31121ef200f32e845d325ba01 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 6 Oct 2021 16:54:12 +0100 Subject: [PATCH 034/284] Update essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 58c2c0ab36..35f05bf092 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -40,31 +40,31 @@ Although most essential services can be turned off by enterprise admins, we reco |Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#12-microsoft-account).| |Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update).| | Services Configuration | Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.
To turn it off, see [Services Configuration](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#31-services-configuration).| -| Licensing | Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows as well as store applications.
To turn it off, see [License Manager](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#9-license-manager) and [Software Protection Platform](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#19-software-protection-platform).| +| Licensing | Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows as well as store applications.
To turn off licensing services, see [License Manager](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#9-license-manager) and [Software Protection Platform](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#19-software-protection-platform).| | Networking | Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows devices will lose network connectivity.
To turn off Network Adapters, see [Disable-NetAdapter](/powershell/module/netadapter/disable-netadapter).| | Device setup | The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.
To customize the initial setup experience, see [Customize Setup](/windows-hardware/customize/desktop/customize-oobe).| -| Diagnostic Data | Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find, and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.
To turn it off, see [Telemetry Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics).| -| Update | Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date.
Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
Other services like Device metadata retrieval and Font streaming also ensure that the content on your devices is kept up to date.
To turn it off, see [Windows Update](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#29-windows-update), [Device Metadata Retrieval](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#4-device-metadata-retrieval), and [Font Streaming](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#6-font-streaming).| +| Diagnostic Data | Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.
To turn it off, see [Telemetry Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics).| +| Update | Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date. Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
Other services like Device metadata retrieval and Font streaming also ensure that the content on your devices is kept up to date.
To turn off updates, see [Windows Update](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#29-windows-update), [Device Metadata Retrieval](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#4-device-metadata-retrieval), and [Font Streaming](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#6-font-streaming).| | Microsoft Store | Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.
To turn it off, see [Microsoft Store](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store).| ## Windows connected experiences | **Connected experience** | **Description** | | --- | --- | -|Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.
Synchronization across devices only works when a user signs in with the same account.
To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history). | +|Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user. Synchronization across devices only works when a user signs in with the same account.
To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history). | |Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). | | Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.
To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). | -| Delivery optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.
By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | +| Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.
By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | | Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
PLACEHOLDER | | Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | -| Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.
To turn it off, see [Location Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). | +| Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.
To turn it off, see [Location services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). | | Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.
Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). | -| Microsoft Defender SmartScreen | Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files.
Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.
To turn it off, see [Microsoft Defender SmartScreen](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#241-microsoft-defender-smartscreen). | +| Microsoft Defender SmartScreen | Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files. Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.
To turn it off, see [Microsoft Defender SmartScreen](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#241-microsoft-defender-smartscreen). | | OneDrive | OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.
To turn off OneDrive, see [OneDrive](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#16-onedrive). | | Troubleshooting Service | Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running, make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience.
To turn it off, see [Troubleshooting service](/windows/client-management/mdm/policy-csp-troubleshooting). | -| Voice Typing | Voice typing (also referred to as Windows dictation in earlier versions of Windows) allows you to write text by speaking by using Microsoft’s online speech recognition technology.
To turn it off, see [Speech Recognition](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#186-speech). | -| Windows backup | With settings synchronization is turned on, a user's settings are synced across all Windows devices when they sign in with the same account.
To turn it off, see [Sync Your Settings](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-sync-your-settings). | -| Windows Dashboard Widgets | Windows Dashboard widget is a dynamic view that shows you personalized content like news, weather, a glimpse at your calendar and to-do list and your recent photos. It provides a glanceable view, which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11.
PLACEHOLDER | +| Voice Typing | Voice typing (also referred to as Windows dictation in earlier versions of Windows) allows you to write text by speaking by using Microsoft’s online speech recognition technology.
To turn it off, see [Speech recognition](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#186-speech). | +| Windows backup | When settings synchronization is turned on, a user's settings are synced across all Windows devices when they sign in with the same account.
To turn it off, see [Sync your settings](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-sync-your-settings). | +| Windows Dashboard Widgets | Windows Dashboard widget is a dynamic view that shows you personalized content like news, weather, a glimpse at your calendar and to-do list and your recent photos. It provides a quick glance view, which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11.
PLACEHOLDER | | Windows Insider Program | The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to builds of Windows. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s [website](https://insider.windows.com/).
To turn it off, see [Windows Insider Program](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#7-insider-preview-builds). | | Windows Search | Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account (including OneDrive, SharePoint, and other Microsoft services), and the internet.
To turn it off, see [Windows Search](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#2-cortana-and-search). | | Windows Spotlight | Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.
Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.
To turn it off, see [Windows Spotlight](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#25-windows-spotlight). | @@ -82,7 +82,7 @@ Internet Explorer shares many of the Windows essential services listed above. Th | **Connected experience** | **Description** | | --- | --- | -|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.
To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. | +|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.
Note: To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. | |Suggested Sites|Suggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.| | Address Bar and Search suggestions | With search suggestions enabled, users will be offered suggested search terms as they type in the Address Bar. As users type information, it will be sent to the default search provider. | | Auto-complete feature for web addresses | The auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar. | @@ -101,6 +101,7 @@ Internet Explorer shares many of the Windows essential services listed above. Th To view endpoints for Windows 10 Enterprise, see: +- [Manage connection endpoints for Windows 10, version 21H1](manage-windows-21H1-endpoints.md) - [Manage connection endpoints for Windows 10, version 20H2](manage-windows-20h2-endpoints.md) - [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) - [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) @@ -110,6 +111,7 @@ To view endpoints for Windows 10 Enterprise, see: To view endpoints for non-Enterprise Windows 10 editions, see: +- [Windows 10, version 21H1, connection endpoints for non-Enterprise editions](windows-endpoints-21H1-non-enterprise-editions.md) - [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](windows-endpoints-20H2-non-enterprise-editions.md) - [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) - [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) From 97416189c9d72c789798dbda5d1b7fddb7e40242 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 6 Oct 2021 17:30:07 +0100 Subject: [PATCH 035/284] updates --- .../essential-services-and-connected-experiences.md | 8 ++++---- windows/privacy/windows-10-and-privacy-compliance.md | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 35f05bf092..9facfe7e9c 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -20,7 +20,7 @@ ms.date: 12/1/2020 - Windows 11 - Windows 10, version 1903 and later -Windows includes built-in apps, services, and features, that connect to the internet to provide enhanced experiences and additional capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. +Windows includes built-in apps, services, and features, that connect to the internet to provide enhanced experiences and additional capabilities. These are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data can also include information needed by a connected experience to perform its task, such as configuration information about Windows. @@ -28,7 +28,7 @@ We give you the ability to choose which connected experiences you want to use in Required service data is also collected and sent to Microsoft for essential services. Essential services are used to keep the product **secure, up to date, performing as expected** or are **integral** to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. -Although most essential services can be turned off by enterprise admins, we recommend that where applicable you consider hosting the services on-premises and carefully assess the impact of turning off remaining services. The following list describes the essential services and connected experiences that are available to you in Windows and provides links to further information about each one. +Although most essential services can be turned off by enterprise admins, we recommend, where applicable, you consider hosting the services on-premises and carefully assess the impact of turning off remaining services. The following list describes the essential services and connected experiences that are available to you in Windows and provides links to further information about each one. > [!NOTE] > The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. @@ -40,7 +40,7 @@ Although most essential services can be turned off by enterprise admins, we reco |Authentication|The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.
To turn it off, see [Microsoft Account](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#12-microsoft-account).| |Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.
To turn it off, see [Automatic Root Certificates Update](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update).| | Services Configuration | Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.
To turn it off, see [Services Configuration](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#31-services-configuration).| -| Licensing | Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows as well as store applications.
To turn off licensing services, see [License Manager](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#9-license-manager) and [Software Protection Platform](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#19-software-protection-platform).| +| Licensing | Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows and store applications.
To turn off licensing services, see [License Manager](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#9-license-manager) and [Software Protection Platform](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#19-software-protection-platform).| | Networking | Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows devices will lose network connectivity.
To turn off Network Adapters, see [Disable-NetAdapter](/powershell/module/netadapter/disable-netadapter).| | Device setup | The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.
To customize the initial setup experience, see [Customize Setup](/windows-hardware/customize/desktop/customize-oobe).| | Diagnostic Data | Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.
To turn it off, see [Telemetry Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics).| @@ -56,7 +56,7 @@ Although most essential services can be turned off by enterprise admins, we reco | Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.
To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). | | Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.
By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | | Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
PLACEHOLDER | -| Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | +| Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to log on to the device, the user is an administrator on the device, and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | | Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.
To turn it off, see [Location services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). | | Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.
Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). | | Microsoft Defender SmartScreen | Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files. Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.
To turn it off, see [Microsoft Defender SmartScreen](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#241-microsoft-defender-smartscreen). | diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 9d28f8f85e..fa1a4416d7 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -35,7 +35,7 @@ This information allows administrators and compliance professionals to work toge ## 1. Windows data collection transparency -Transparency is an important part of the data collection process in Windows. Comprehensive information about the features and processes used to collect data is available to users and administrators directly within Windows, both during and after device set up. +Transparency is an important part of the data collection process in Windows. Comprehensive information about the features and processes used to collect data is available to users and administrators directly within Windows, both during and after device setup. ### 1.1 Device set up experience and support for layered transparency @@ -113,13 +113,13 @@ You can use the following articles to learn more about Autopilot and how to use #### _2.3.2 Managing Windows connected experiences and essential services_ -Windows includes features that connect to the internet to provide enhanced experiences and additional capabilities. These are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. +Windows includes features that connect to the internet to provide enhanced experiences and more capabilities. These are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. Essential services are services in the product that connect to Microsoft to keep the product secure, up to date and performing as expected, or are integral to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. [Windows essential services and connected experiences](essential-services-and-connected-experiences.md) provides a list of the most common Windows essential services and connected experiences. -When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows connected experiences and essential services. For more information, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. +When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring the settings that are associated with the functionality provided by Windows connected experiences and essential services. For more information, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This article includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. The article [Manage connection endpoints for Windows 10 Enterprise, version 21H1](manage-windows-21h1-endpoints.md) provides a list of endpoints to which data is transferred by Windows connected experiences for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. From b95df14f27d9a1840986144743282773ffb40fe3 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Thu, 7 Oct 2021 11:26:00 +0530 Subject: [PATCH 036/284] Update config-lock.md updated per 5475844 --- windows/client-management/mdm/config-lock.md | 67 +++++++++++--------- 1 file changed, 38 insertions(+), 29 deletions(-) diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index bd05413472..74aff00b7c 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -56,40 +56,49 @@ Helpdesk scenario: Config Lock will be available for all Windows Professional and Enterprise Editions. ## Enabling -Config Lock is not enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it on. -Config Lock is controlled by the presence of the Secured-core PC Device Identifier (the “BuiltAsSecuredCorePC” UEFI variable) inserted on the device by the OEM during initial device manufacturing. Config Lock can be enabled If the ByteArray value of this identifier is set to “1” and IT admin pushes the MDM policy to turn Config Lock on. If it is “0” or the variable is not present at all, Config Lock cannot be enabled. -NOTE: BuiltAsSecuredCorePC actually accepts ByteArray values of 0-9, and any value from 1-9 will indicate Secured-core PC to the Config Lock feature. While we recommend “1” for consistency, OEMs may optionally use any other value up to 9 for internal versioning reasons, or other purposes. (Technically, any value from 1-255 should trigger Config Lock, since BuiltAsSecuredCorePC is a byte.) -The UEFI variable can be set however an OEM likes, but one option is to use the Set-UEFIVariable command from [PowerShell Gallery | UEFIv2 2.3](https://www.powershellgallery.com/packages/UEFIv2/2.3), per the following syntax: -powershell.exe -ExecutionPolicy Bypass {Import-Module .\UEFIv2.psd1 ; Set-UEFIVariable -VariableName BuiltAsSecuredCorePC -Namespace '{77fa9abd-0359-4d32-bd60-28f4e78f784b}' -ByteArray @(01) } -Below are the steps to turn on Config Lock using Microsoft Endpoint Manager (MEM) -1. Ensure the device to turn on Config Lock is enrolled in MEM -2. From the MEM portal main page, select Devices > Configuration Profiles > Create a profile -3. Select the following and press Create: -• Platform: Windows 10 and later -• Profile type: Templates -• Template name: Custom +Config Lock is not enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it ON. + +Config Lock is controlled by the presence of the Secured-core PC Device Identifier (the “BuiltAsSecuredCorePC” UEFI variable) inserted on the device by the OEM during initial device manufacturing. Config Lock can be enabled if the ByteArray value of this identifier is set to “1” and IT admin pushes the MDM policy to turn Config Lock ON. If it is “0” or the variable is not present at all, Config Lock cannot be enabled. -4. Name your Profile -5. When you reach the Configuration Settings step, select “Add” and add the following information -• OMA-URI: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock -• Data type: Integer -• Value: 1 -To turn off Config Lock. Change value to 0. - -6. Select the Devices to turn on Config Lock. If you are using a test tenant, you can select “+ Add all devices” -7. You will not need to set any applicability rules for test purposes -8. Review the Configuration and select “Create” if everything is correct -9. After the Device Syncs with the MEM server, you will be able to confirm if the Config Lock was successfully enabled. - +> [!NOTE] +> BuiltAsSecuredCorePC actually accepts ByteArray values of 0-9, and any value from 1-9 will indicate Secured-core PC to the Config Lock feature. While we recommend “1” for consistency, OEMs may optionally use any other value up to 9 for internal versioning reasons, or other purposes. (Technically, any value from 1-255 should trigger Config Lock, since BuiltAsSecuredCorePC is a byte.) + +The UEFI variable can be set however an OEM likes, but one option is to use the Set-UEFIVariable command from [PowerShell Gallery | UEFIv2 2.3](https://www.powershellgallery.com/packages/UEFIv2/2.3), per the following syntax: + +```powershell +powershell.exe -ExecutionPolicy Bypass {Import-Module .\UEFIv2.psd1 ; Set-UEFIVariable -VariableName BuiltAsSecuredCorePC -Namespace '{77fa9abd-0359-4d32-bd60-28f4e78f784b}' -ByteArray @(01) }. common ..] +``` + +The steps to turn on Config Lock using Microsoft Endpoint Manager (MEM) are as follows: + +1. Ensure that the device to turn on Config Lock is enrolled in MEM. +1. From the MEM portal main page, select **Devices** > **Configuration Profiles** > Create a profile +1. Select the following and press Create: + - Platform: Windows 10 and later + - Profile type: Templates + - Template name: Custom +1. Name your Profile. +1. When you reach the Configuration Settings step, select “Add” and add the following information + - OMA-URI: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock + - Data type: Integer + - Value: 1 + To turn off Config Lock. Change value to 0. +1. Select the Devices to turn on Config Lock. If you are using a test tenant, you can select “+ Add all devices”. +1. You will not need to set any applicability rules for test purposes. +1. Review the Configuration and select “Create” if everything is correct. +1. After the Device Syncs with the MEM server, you will be able to confirm if the Config Lock was successfully enabled. ## DISABLING -Config Lock is designed to ensure a Secured-core PC is not unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as MEM. +Config Lock is designed to ensure that a Secured-core PC is not unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as MEM. ## FAQ -QUESTION ANSWER -Can an IT Admin disable Config Lock Yes. I IT Admin can use MDM to turn off Config Lock. -Does the Secured-core PC Device Identifier UEFI variable (BuiltAsSecuredCorePC) value matter after it’s been read by the OA3 tool in the OEM factory? Yes. Config Lock will always read this UEFI variable to know whether it pertains to a device or not, so changing the variable changes Config Lock even after the device has left the OEM factory. -Could an end-user run the BuiltAsSecuredCorePC PS command to disable Config Lock? The PS script is accessible to anymore, but the BuiltAsSecuredCorePC becomes read-only after boot, so the command will fail when run from the OS. +**#1. Can an IT Admin disable Config Lock ?**
+ Yes. IT Admin can use MDM to turn off Config Lock. +**#2. Does the Secured-core PC Device Identifier UEFI variable (BuiltAsSecuredCorePC) value matter after it’s been read by the OA3 tool in the OEM factory?**
+ Yes. Config Lock will always read this UEFI variable to know whether it pertains to a device or not. So, changing the variable changes the Config Lock even after the device has left the OEM factory. + +**#3. Could an end-user run the BuiltAsSecuredCorePC PS command to disable Config Lock?**
+ The PS script is accessible, but the BuiltAsSecuredCorePC becomes read-only after boot, so the command will fail when run from the OS. From 0443ae280cb36e375a8e48c4e58f981cc58a2fb3 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha <69782111+Lovina-Saldanha@users.noreply.github.com> Date: Thu, 7 Oct 2021 11:31:14 +0530 Subject: [PATCH 037/284] updated-5475844 Added new images per 5475844 --- .../mdm/images/configlock-mem-createprofile.png | Bin 0 -> 92936 bytes .../mdm/images/configlock-mem-dev.png | Bin 0 -> 54105 bytes .../mdm/images/configlock-mem-devstatus.png | Bin 0 -> 48408 bytes .../mdm/images/configlock-mem-editrow.png | Bin 0 -> 43533 bytes .../images/configlock-mem-firmwareprotect.png | Bin 0 -> 14066 bytes .../mdm/images/flow_configlock.png | Bin 0 -> 27467 bytes 6 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/client-management/mdm/images/configlock-mem-createprofile.png create mode 100644 windows/client-management/mdm/images/configlock-mem-dev.png create mode 100644 windows/client-management/mdm/images/configlock-mem-devstatus.png create mode 100644 windows/client-management/mdm/images/configlock-mem-editrow.png create mode 100644 windows/client-management/mdm/images/configlock-mem-firmwareprotect.png create mode 100644 windows/client-management/mdm/images/flow_configlock.png diff --git a/windows/client-management/mdm/images/configlock-mem-createprofile.png b/windows/client-management/mdm/images/configlock-mem-createprofile.png new file mode 100644 index 0000000000000000000000000000000000000000..f43f6b7ddbf09ccec5dfb2419cc6859794752453 GIT binary patch literal 92936 zcmYhi1ymbf&^}xoinUN2N{hC*Q{16A#oaZyySKO$D8;2X#a%)O6f5ot?ry;y@=t&7 z`=0N+=j80!Wbf|1GdnZSJTr+_Q<1}cN&fQ1ix;@^pQY7byg&|l@d9ZL6B+SMdxK&F z;(+9?E+_e-dW>=(ae`_ip)B#@MO`BHqZu0F9Lwdip8Jaz#Pt6@Nb>4*r!QW>i{+&y zG<}SZo-kY}c7b2MnO&Zq<|f72$p{`-8mDfq zG{HvuZ(LDelXJZJH)fb$@tA)2H_Fm}dA`jO(Q!5g0;U(V*4RHg>%r=3$7sXQasFqL zIWh!0z&mFEy4ZZYRA&!80U<65Cs4yHVXK6_`M=xr*DZY6w*Z=N*84+l7kMYx4 z@90D!6eXLF@@#qkFpJ+&_Z5Z|N<`Sdq5oBwujb#Tildupy+R?ceQ z&ciC&e_Ea>X{zvo-Cf^~n%W#u_&mzGD5%)kGj?J@=jS5)IGU@N>G&T0&W057hl%HG z@=JNap1m4&e`Byd)+3=ruC_Wkn!hapRV_RW;J&rjt}y_ePZXzLH$(m|M&4xOGJ2TR z1OOeE$z9@PRWS_Z0N(dO*!V*vN^Ut4FG4T-XNSGvKEFE3sa7?;>>eOgCeAB$le}pI z_q@z_D^U)P_J=1&d;14b7edEKM+3`8;lN>GzG|Z;&qGMq!NQD2Bww|k?)r26+sf#H z_SA}m+=P9n3g8*9OM@JQva#8$XC=o3wzP(&FrlZ-y6kps?P}0aN$VF?y9Y$ok~-f8E`9D)r^~YUtFrim8r%<|6yjLv2f2;; zCCvZK>&kyp5dT#vmGC}ZFun;Uqy1kr^*O#kugI{vhZDDJtumqEZ ztu}OCavR!l)2??f&J7m_G=(VfB*$`^OaeOnW=krKk^VLl`ve9u<%8M|ruYp+v|03k z=Hz7FxaNKi8m`eK;M{8irJ(ejA2X>o#}0kIE(zy#oea#dz9=02kc1rd5sue>%Cr9T)MB4QTrIzb{A%bDMGv0eE6a`?hMkeyn;;fUG8 zHGe);Q6%)H#sno(A9Oh!pVd+qcg+c|um|5-#=8d!Bi>3NppT)Jp`u&;rvTJ)Khugi z1gVA3ygCTvG#gVhajs>nkw1?jR^)!S^fep^sWikBeJ&}^bHo~x?keTwgi#r`xDA#H z;bELgKxnWQo2>fI>DN3^jo@0$U4oS+pqb@2x3%^nd^JYqRUhu-_b(*;;XR!yD zzVLC(W|U0bcI&(3W8jSixxU6p&}Ll#RvAp6#f}$%r%UyYb-M+8CsRCMsdR*he zYL&8EXfkv@YZBxp#HHAO0)ARfW7es3Yuc=C^J==-42g#s8~k&i{EF2UYuYxwXn4yA z$5<%WH_J>sW0*ghTLE5aJ{}kr9dQ2EigO#|tfUpljTt~q%JG@x=WGs$B4OpbC+*&C z)r1rYsKsf%emh9+vVrWh-7{y)H)rJ+sk3nXGs-w^C%14zPsq&n()_dMi|XQ?F6g1x z5qOGEyx@E3ndh&TngM(~Jc85XkD(8$%L$a3=?p0)4|VgA{8e-Am)f*uEUX4dAYaB?S?d6x2|AL^c?hl+%zX2*%{Q*yEbpP@ba9!UPPjtxCvItu~W=%pCy7j zE>3hzSg;1!U@#iIR|6%b51TdAx=-8pYmNHk89bs>v{Qi0ag$DO_Sgxzql34FN~$`2 zMyt1d$rk(t_l%{brGw$D-^84Z+)r&?&}tM7UMFh|jGIT%)Y^9Q ztV8xi?6s?x8jmg*`Jr)z?)yOX;rRSKmdF|D7PD?w?7pEw0Saq(#rdAlwT zQO6AXEh&3KvzI$}vMMH@Xf05}X?r6orLwduSA7fWE#5f9K0ha6nJ=F`QFIC%Pji0~ zEuo0AcpM z%YLFY7PDjP#BBpUxSFP1k#fpMl(}gPucbKTJaZq1O0m0@N$2a8J-X{A@2jLiIzyGY zB|a&`Eg^98WKS9fOE?E)c4 zc}f6&GCD_GqHTIT9sFtq$5O${9&{LoMNX3speUs6t#CM@N6mWX`(dE4_pHJianqL z!Afll9qSozYWuIJl#q*wT{QFxdR`31ZHI2rPaUfW8!rx}jnMClgMi5Jh2#wNIan=|1)I@d zr@a<3I;(CQ=cVBkn%@iQwL{wNxziK`1U4R@?wKFG9M6}|KhNO(i*5JV$1jb+KY3(c z;^G;e@5^-sk}361O0BZr9TlE_e@9?%@$)Fk?m?0QSy@ zz2S2$RTaSM*WN-OP6mcM*-&IfZngKujQqPgs%3L$L;T4)Cg)lYuIJ@xN<5QS)QDFF znFqF)@2^dxB|o`yfA~=~ZQj8jc-w+6dbdadJ-N2CoCfN!3wTua7m?)7)txT~2fU5n zeL2AFe79A5r+%+iF3bTMQ1dYNnQKj-;ml5bdLLg82sv9urz|$I_|< zJkQq88u0t%qi4r)A8tP#D_1r3LBS?DOR`^56q^ICYi`bgGnbIolOSH8*?1;gzup`} z`4>PmScKF6vy9Wj2`Kpa^6O1@@)uFfKk6f>*|&Sk@W*#(avE{OXns~7iyJx(obc5f zoA&uv9%@)wQ8G_5)2V=N@v@$e{02HK2JN2VrPCo7zA@`XGp2%x;e!K{<-J>{Oy8nT z!1mDX)9miq-Q``Nd@BZbr3$+0cxf^V#ims{$K!BSq8q^sc+9-sp%bFqN z4fWQy`m<|n1Y57OJ8l;e1p)Ri$8ecDg_6r#_SM;_bU{J>S2#3BO+W|bO>Xb!|e^Lqm9 zO1HtGZQy)+{+4W8b8saUcAMtGyrXYUz7Q9~S(_~qiTsU0ak{PIEF;{{8h*!XLU}zd z%Tsx|q1h~(N^!b8RBS-bK=*hO=g(h1TQ6YRC1vSoRSk^{US3pD^M>>XJ{TqS{T>zY zbOBvJOwy2Ic{QHX_=>J#ScnJ2gZ5GtGnhnq`xz4)d2fE)%UWJiX!7KZw!Gz=rFE?7 z=8I?E3RgywNMgz9VA|0g{cbpy0rs9BfL`b;ll$44vQSKVTdfFO_H=JX;yDQVRA$C1 zX;Pi(*5Qzz-dp7bQX86j*#1t2m1s>ix_`|w{zyk*#M z@0(aUP~vIN{^n8$=jb$xFZgUH9opPGl)TuRH$QclAil8g`7|dy1*h;=O0H z9=(P|6Bu|;<^-z`cf(8EqGUboD`Uf$#$dU#2y~1FFFkirI<5u zglY%eXJ7Ils~oz0s_YP8a*xO)a%Coy;~ddOM!~Dz&W>6p zuTmJoqj)4TsU05IH$LL5ikFM6bFIZQgO@xxzZUbk?|yd37#tx3ZTP<6ephR^t@N_z z$YsQaaYZQ0nd|cte~m!4g3F#wf}=^h5K*blI>`AXM_o{`;0Bd=(=oX-g<`dh(!`2? z0ws~fs0k3idp?^M@RCR{GQH1S#cQ>FXH{8?CO|NnOKK#pqn;hTj+6`Eakb+rcgD7+ z)8}-e$+oHIJwp>}Zks@tx~)J%%Jc;lJqi15;caw)llgEZD)v`PpJ)@Hx<)@&tyOS_sy1l38|fP^?OeUPg20>&1;GB(nN5c+My&zU;}0kC8W?y- zPiG6o(~JDRPP(9gMW}!EYTNN{;O@q+oZR8GV0e!n*ng$7rRK5Lee+-b?c zY`H@0NEd9~cOWH}+wOY3SKU-040RR=y8eB$d?*$KdR@sjQT-&g((bwpeW+d)so|Ep zrWSVFxX*xruMIol6Lnc62@WRU$3>}9aSd;_+)l5nqnliy#>;`(xb-qc9oSOm`4iM$ zM2B^;-t%VEU@y~9@O-r0Y8XK*tnX}dKky$3dtXo0!MuH|7km!3in--Fjdt61<}!v? zjG>*Y4R$>X2o9-w;eON`TAeF;dUft7_IN;^58nE?Pd=c5Q1U^`+bG>RWWMp5tXm`Juny;`?JwdoMN0_%aVn^P`kF(4q zY?Mna&JUp!I%CJHYjvAlNm*&C$4jl&i=jPGcB(rsXv75xd)`uu8602E$@o*deb2eb z0~qYPefjKY&*vA$?r|lEKTcT69u~jv{xoupTj3q#Ps)N8;GGuq=mp&YL2HbK8$F+X z#tYRLwgm)0cRUYUazP%WyO2I-VQrX*OYh<#Tbb|KM8Y!A+XU?Q9GPR!{|EaYEd~}t z@}6sRhY{uN4YflccsHZt%B^F>r7+|h$3M$piV8v#<3*22W`ddE&fO5BbHh5z<4i3B zKA(`UyNDw+T>OA}e71tW#-Psnj=-ZAXI$&;FjyaS#GI(b%U`(ykGW=ofq|I*B zZ6XSIexOC6&1w+7G7WUv1bo-U(>4V)l=JS<%H{=L-L=nf)yK>{_b|eB>o12r-|l^X zlLe{n05dR8NQgngcum?}pAMRsJM~+vubSiE<}!m3d5znl-ziy6tnneGQLn(OflMn! zejh(4bXFFVdb4Hy-3~>*f^jqflJLIjcF)-dq0_LIj!eT_DYkrx**X}mQK7gJ$ zYs0o$?tJKH+NJs?Do!GYJI%@I)aNK6!-jW_U*T<*un2e=2%qbAZWfYDxt0H>lRtV0 zaae7-xg6ZwRn7Z!_LR$NpXS^lCW!GL@0(SooLkZ2IG>)KJ1@V7@*ak~>WTHko8Uf0 zgS*9X>BWJV;Ddo(S9KDDjxeR)#?>o9HVi@Yey(vX=C^V6SpOK|s~te$!0(*JX6e3u zl)~e^ef#4hF9FV5?5X^sauBnyp!EYpIe#b2cU9$oxz~F~)NIef-Ghcw)d6~jG#v

J$M6Kd!GuTgY{rd`G9R zF3lpI@y7Z;23heH#{%wKW`yCaw*klyk5_FlPJ4a<5C`q(gVF!HkK;6T=W-L(K@&6~ z5ctcO`uI^E>mU2=euytjjDO%soYtKh)l2@@9=Sl`2WElnk{%{1vK~wD#0Orrnub>b z=3MDi-=XNhz7rLRcd!0ppJEhiVqFO;zSrL45xjw-`8Lf_;>AkUOlK*d{=h^I?f5Ve zV&W}<5)@x6SjkW!TgaKAbVBgoJ^%LyBbNv;af(dgRC?S*$op4+W07%ho4)Ip$i9hE zD4F`ei_L(TZB#34-i2=4^$K%KCKUbg0IgEz{g<^fpA20-4h{~f9N(FUUr1m!T}rQp zWm_IZ6cT^Oj%M3cqx)3@3l6bEX0zPs3 zzxC940E`sf6;YZ)m1uUiw)S}aUcD02U!TXF12l3KF{E6Okrj?fCxO3y7cW8Yr#qdXjtF}5W5UNLuqX6)V}f$5iG zgq83wn^{Y~__#RCJ6roivx#q7t%|eeGNuA~Xqi(KZV$!LQc(+LyDlCyB7$0UGu-qg zAM0M@`r+)vi0Vn^#h?*eaTKIt%mUP$I3eNZX1wD9!-r^dZev2V#8zDqD^nAmdC$k7 z8?mKYMA&-h)N3=Z@>T)+Z^Y)4==3k)L@~kV3G;L!zG{Mwz|XhwI(RxIoEf7%P4i~* zqym_sRpwxkJhs&>c2AwJ;z3|>lpt2r4O6@n6at#isDX|0?E{Pygla}5M-%NXX|?_| zH2sm9zg(_T&l-HAJ%;z5i4(PZn<2W}8k^}?4j^fl@0@?PRN`UIx;%6`|Et2U|AEb}!F5M&z})a|thw7MU`gMw z^-Ofv;^=QzH05uys8WoVcROO7@=mH^@o-~Q#_vRTTj>WzdDRmq8=Ad zaQSJVjQJoq*GxyT`+K<-f{g0SO;6{GEF>y(&O>;Rg&4osmNCyyK-KNVvQUiGjH3cnYm3vz+XCpl^1^H>x}O3`dI zL}^qj5bIbzkWgKwfcycsp)G7k%*WpbrG z-EsSS7&q^b5FLx;wo8>zHdi)xtE+Z0CdT;BuZqZ#@L-%dz5*uL2V~w#19jQda#%Nq z#a93cHJjtiBT4a>Ord?hW_z3S`)H-L=hLmtrCrdN$%sh*nx{N6roGW((sFjLQM>)h zwzuZ?mO^{f3A$Pz z%F+33Ug-6EqqmwUFX(bTO;N{L7jA@Zja<3m<2iFrWa79`=MAeKH3?`GEGi2&vk6nq z_F12Un!rSAgW(DB6=HWj7J^RwBKxBE`v>%}=R`-w>LrlZ_QW%&LhNDfNflz%tkFfc z9B{J}{4lKpOjzltg&$VQ9m>)P3iKUL+^cpPc3MDJ94R0HmuG36^T%D52K5~x+HCOK z!bBZkCt;Vr&f4Kc#|9T*QBi4GRVKPb@>$c<>iGh) z$^H*^Lh410 zY3raR>*@NOHnBD;j&9acXaswT6y-?SSUzw6j62L!X2nN9@n%k9(UjvmgFIk1rCo^? z9Zmz8BwtSz45c;}48P`GaFL#DBMWOx=cWCV=NuOW^{h&;I~83b?+t2J4Vel`b7rNfy>J@RO^F`}4u=ajoJDt+ z@y){4#Gc0S+4^|e|A-PWT=sy2b7OWtxz`&2)2akX=~@Iwk_BG&Ii?gXlz|`5z{t$~ z6LA5Td%wj_K-sYSKU*^p*1X4U>3~@7-7+lU%aybTS($3QmPvvoVj&|r_L3_RhD`eCadS46eSDqYVTY7hDT`=&TuX4bwi<3Ot?a?@c?M+YM z=Vq=Je>}@0eTjo@s^B1Kq2C*kmdz`xpwn&)y{GD7;)qMB#pm`N7NX_ECGC)&@>nObA9%UY7vvJY-N$SwGvO~v^^vwAXZ1my~ z^a17V(DmIK7*1OrWcFiUI%}h8H#o2v7`wU9k$F2Tv;sGG2gvi5R8nf_xgG+qVC>5R zAqzjgEiAs;4t|&m6+xsx0jFu+HI^Hb0=*~$+Rt|5+rrSFbi{t3ixat(X!_LckQlnv zY1k8Vb?SbJ>KXq#r|e6DKVwv4js6!A?9XS=t3@f|rFa}1pJhh)nT2$`5X_~Ko-z>T zOyNhzClqWuE(C*hYVYY=#JU_!*uYLYv`$8Tk$%)-UWJcS>>s}yJyFI$&z83oD1Dp> zLE*)VY^<@|4hDI5F}Jl7Xc%i7CvRQc0fR-e6gm$lmIsBxgfH6@?Ps+(GR+m!5`m$ zyrQ7S2Ij9?Bhd2|3nYXJy>q;~7=E6oNN_Mf?Ln)11qgkC+8nVZ1YFhgG}S#~;v@2- z_OTfpLmJ!^v##J-%K`^AcT@MqzL*z(9)LZasYh@l6BFRG!*4)3vDq4wMeToYR`28h zu$0_6FAL`wF?da|-sD#M)sT`{%MNu#GwSn92sHSxu|k2B`k-sd)813Z|1&j{USqEv95EP8%dUK2G5h@)ESN)Oxb)t;*Q_o#fp5 zg%ZCYA9;E;;)M!vP%^~nz&flV;#t!fFTf>j#cjL#zPtK-r5Zf%yA=R1cKzaZdmT^V zTyhi6z5kWM1U@k39C6}JpeSe07j&6-2nJ40tU%@Her_|A@M=(c8Qlvc!f%HUzGjY% zm7Fiic|GmsJ^M@&A<_Q0$XbO*?&9ASw@!Xc(Bt!WTx1M3Xk#p`FRZD-*GZ+yT#XYB z5(z{lyj%f4?R&VGdF$8|tj-t1;JXK`p<>5jEA>Y;c`U0(Bw91e(`n>!qS|;~ zNNYfHoASW$?#wMFE`9ePj*a_uM6=M@;DCwK%5|W}@*XmC1K_qVsZ=N6I*}*~e+Rnx zN7Z4jnf<&@1yG7q^YA!MA~pTe99DI|kwRa=hrY}6I~$tORM{`hh}zblar}p#S4t=mO-I7UmHA@yZd_c2`QhiZ|;%4@L4vAfDan32cyl)5}RwO3G2E2HROcm6_RB0RN#T z6MaG8(H&=2Uzv7AJTVk77q1_$U+5mB3zPu5w4vi7>rWg|gKa2~eHVQhP_#d%3Kr`# zd_ms-!Svlo4e0<%h_D0v(-;!IHGZ@-q&#K6iE*4z@gUZq`4A$4V!ik%nV99tTan4- zcS!a5E)u+DCh`cFC<10iDVYhl+J!%S_UH@yON#KP9*8MbK*3}EBCL%B_!5T5YM;-iEetme4$n9-z z1yGvpcnP^5Z>qK7HHu$BdI!$g$XMT>4zI|ka8|um!?oO+vWIg?DG5Knu2LAy&1S$I zW!Azhn91^B5CQZnG^rPA9LAH2(C8e#3YWm$LBp$>0>sHyy-gBnwk^Z>_rx}8oP|o_ zl9R;IaInNM#PYcnv|UEm6k3-KnI#) zdbnjeW?jkOb0}7WVeHh;o7BPZ2Qg8&$NreJYX8nGHVN5PhJAQK=L59ntU=6|_bArP zYJ=_Q(N*`+62%(N9EB}!u4&LcXJCkz8A92a)g?|XX@sLqG`ov2PPh`SOcma-p8%q0 zG51@lfrpE~`z~|gZZtvO7Q?7{JWdiwzHCX$lslTv({+n(K(WeTHm0ci z+RV0rv9~kjimPy8KrNVsowJaFB|LOs%T!^=VuO2V&{|^kinbfM;xz@8f$<~}wd*Kz z8)X)W_gx3Imf7SWwE@zHd>!+y=Pd2Vo(o-NieEKpA*{pg=RH5+_t0SYy$6fN&FzH3 zc*JbT=Qr$dkq2!rXgo|Mk(CrUiB-($d2!E*RG#XN^Yb&EDR&8lK~_0_gi?SCozyq~ z&c}qUfOn9uA3kbKtM{3YQX+?npIo@3SL&3ZNzOy{9>pRs`HHb?vMG~;v#l0jp*j1^kBbay}vY?S-US+vCD$DA!a2TcbyYlT5N)LiA)>8YOYCuMjG zdqxG!kk0PD5iMINRlPhOjnL1x;a`huj1y`(xm~$@u?L!+7i!@OTiNcKGU|@~ z-A#yCeU@h6b<&!u$e}o(8Wdb)KJxSu?H@nN12*kq$vx`v>8ExY$?fNeS9m`$=*I9j z=*{?x6mc{i|KOvTss=02P* zudJ*fnwIbH@6XTcr#1*~MiS5HP`t_rRfEp<58OQ(dYJM+oi>BXIV2R(D1oeKi{OCZ zn|Sq#o@8IICm?g8D)WTeEEC<)<0HEm>P(2z@~Bksqp2JQRebZ{6({_5nwmez8%PXY zRM#=qp2m17Kexxe`mm*LIoQ=D-nseocJ6Kxq+TSd> ze}e)U2!@9{6Zjo(mg>@{K*7r%OdM%E!vt;_$KTBCp~p28awhG=1Enk`ZI{}TcQZIS z5)`eC?#EbpZna2pO~BMIa9e9D}C3Lw1+AnZ^?2H*JCi%{`*vD+loNEc}5ReG23 zeKGguFx~;;(RvvhCf#>H)>yVze|hWWA|ig4H!)QW-BH%+mm{rLN)}9%#cLOiezleO zC0jKe_K{0E(pKxH;br+kS<76U_GLNU?b2z=cymzzL6wI8!yb_Oc;9-FQWlcoNgdP#jlI}=GDKflRt`4t zqFXVtP8Vo72+w);WH5v8BtAPnWw`8z&-yF@^31z_*M^t=i78!b8zB3DxzM}{ORDyi zTkkU}eLU~h3#;W`*<2*lQ1HG}sv1uyB$*$RiN%NoKRuET-noV%1-ICn407<8A_8Q= zV>Xgdv8mhkw9=ih+!)CRA7r%8AuJy}MEijGTr+T zJl^>j%jeJ1G(612id|w!pDOKm%8sLDujo)9++)>u5A`DJZ# zKxUJo*wX+QeADtTNzOcC@3zZa-K2o4YoGAbDY8&0q640M1bizVsBt z;|9YX5Vk&$oO&n%2}4H|&z{#*;q@Cnzh|9JhOp-wkA_u6O>VdwAuV1dJ!NJtRkJ}e5plR1lu+I5lE#P z5MMkU0><^bl=0jw?hL-W@jm$x7v^Cx((Mgz<`V?Bx7Q>@W6g@ha=T9URlJ# z11h4UaBr!l-CIo``~+BxC!4oWB@jC%KlRwIN(GLO3a|fS^w%1h7g?5cB4R_bSNfaxKBO@bi8Ui=1dS$ZvLsStp@t-q+{zT0*`NdYlb%R?62P z@PU}v1Nk(}uv&iDI+jvf`G9O3%qAxK!D}_y@ds0*EKrMfM`39cf_Czl20yj+LMyuQ z%|sI7Fi43@xiug0Bn5MEob8Jz z&f96;cWrJmC2cH6*!6PlZ1H^x0f!7U-Oqm!BBBFAra^{Lt%7&mbUXjF6~A;4ikvp3!!sCBu7N+2m%}3_>(?EFXbC`n_*5 z41QGhZ;bq{otWF28G9`VxU#mQZl+_SVG(9%?zA~rM?SgWMnCEmo;S)PrY0gI%K4%u zvn^_vH~;JBkJi2P+s6L4=i!W@S{F}RqsM=r`e!bmlNYpg@>()Qz9eZ6NU^*q4EyrK zfTRC@9~}`kzVD)tpB`4rke(hxGK!FhKWnNgR=14A@a(8P2ADzv)Sw-z580nLPtpV1 zk-%h+$w**_5p9sM^Mpa1Y~gI{Uo(M!DH+ngasn#@vQx$&sVwbU3E6z=j$UdvM3B)r zH?3)8IBVCER};(No8PH{X%`ef`<@ktlx5xfLiC^CovIZ&62nFmi;QApL)iJ%F>9COkpb zy=Cpk%aO8sst%F;dEDEq`a1m>>4JvO9@gb68w8(Y8&zMG?W_s}WAJb0QlE2+|Eo`r zk0YZrlUFh1>`M^um7_bT+fJ4A<6ZMm9XmdCmhOLcj)nV}+>dNUcQ$WjlvngDKL9DF z2QBh58#*OFYEa;MMb10%FXHa`$LI2?6-$l~e(rm@>rbNTmL%Pk_FOc^u1KF6duyIS zN=K~XH+&g~jw8Hbi|Z>lcsseU-^06Q@}_JjgP&4a+WBY1Bl3Tx_lt|J5CrYeXZuU( z%MY&NK2rqOFh+wPtXkH_x0ESCA)-*$$MJD?Wd7nw`AxB~PjYPykjvk1&Z>*))lAG? zPHJ1UtGql``O}-wFNGQkvwrcDMYFVA#ge~ge#cwq%zs!XVpws=_#rex91fA(XX;E@ zw&eK~7ljv?gc8-Eh3=A&uS2U4Em=H4-pD{(fW}tw)BX|wQmOhPuO$c?{Z%lqv+bQy zj6S=8yvHv)Zrk-Dw4aM@CLXJ4b3C6j)Jvffnt6gRjC4o#KdRgfMasI`savnR{Bhae zE-M`>92FkC5)v6iH)B1XJV#FF?Nx7?8}M_^$2UKNE{#DgLgj|vG9}Uwy;A$YvZ3cS zl)dD~3^cW5rDIQLb-1aFUTXRHm}*n~dafNrHuWu7#{#lnO|W!U7N`6 z?n3hFv^=JNYjFRAE03)>q+dHm1gwclemDPaE~qR3w;=u`6BQlY9kMxaZ(f2vP@Ie% z`015^%~b!5r>4n~Jz4V0``!+Mdyk>swLla|%m=BvL0{qBzY;SMOHsFyQ-4kM9WFu4 z&}51TT|z2E#!pwYqde;JG91t7EcO!YbEM*Rh*NhyF|XlThs4je{O9^&`$Fp3nB*z& z5q4V~?;>qcmHu^NEvp6AtXeA+`{z2ZUGK}ZP{=TD>wexEiOZg!?P~T*a*i#X|24h0 z(p~SG16(+DE2i2B#Kmm7u*1za80 zLXl$2dj!t*c`_st=U(X>7#fr3&{OnoBKjA`=`3t8$k{L$uTs9@#q)5V>JEnddA|>) z%7}Fy5~EH<^yvHKw0-$@r}etLjdu_GydN;lZ7(Ea=;Up0Aldb;vA+)T2NQfQ9~r$* zNGw2CD=@>8_xEeH9oav@YA(ZFbZLEHJS0$;*xsLNw0N_9og(ayz~*b!7HKVxmUsXHE@D2@gjYF#L;_*@Y_` z1B+;`$h{2BQdEkHXFSZ@YZzujeOs6B_OH^r02 zmAk8|?+~Ng$Ck%2kw*}~D%!^Me$7pLSXV>dL%c7&CxWLGb?Gc&ED>kf8&c{` z>?I);6!<@ei9yNJ#hE?4bw1Z2*JtJ0hs=rj4H5VS1*W75w{fnw@o|OK)=y0b|EfK! ziG8-gzkF@WEr^E9RAC8d(&U+%)YaBBG=_91?ZpX#vSsX<*n9arl}F@dxCx2+`sPYF zn-oOEc>A}QUPXWB8(pi*C@c&g-7ao5W(o`WZYU-;qyOCm!avAKq0|w*KGfl62z{5s zY&EVv=#Ct(UYdHoz|1jspBpW}kXWMzJ`N8>6kxCZ$7d%ln`4|TMjsySANXn-9UBoA z628L>`i+EQw+#rFEDVn6q8qiaur0$CjGeV@B3B}BQ+WTSj7YFy(i)P1qtK-AtAVu2 zI>&fBVB#~a4pR}JN+CSN>s9!mDX*Oe6V^RxGBM|3oOU=l66-qvM>k-KywQ!QU}paZ zK&|YDy?9{5imjTR5&kEUdOYV}h@K(8|CJ{xM`9mJ!lK-szb2}%8NmF21cwy!c6;1b z!m7+f>L1nnzYe|t9p`H3zY2gl&YU$TIWFJC3}GF>2RRxG6!{v#|I#BiyZP^e23-_w z_Y#2OxmyggY#VwcpuOlr>eF0+*Xt}6xz!y@YBq&4)pBBh(KZ4lIKCi1rC>(@tK2^F zQ%x-|bA2Z%6b7aW2kW1j*%Uoog0I*td`v%=HDnT9qQa!+t1iru=yxpDZsJf!Xv|fv z@RgWyV7fee#gu~KqbUcem=-^!Eh;F9w|nP)EZjDJB1f!D_W!ps1}HQMRrdRbiW=L4 z{Teo9Lcoj&?)JXCE7m@410iUowE2O)B}sOn1}2yR<>L{WAtQK0OqB9HYq6?DuQr;b z1Nqz!9i0n=QZUUW1p+01tC{BOf*uNT^p|c;Ql_aIEHaYQjF@aPI*Dk5h&7(g^>CX$Jxy+N7-bq@;82xO`BDZM)>7NWH5;C}h>=zuMeN$OVE-isj@LRx=XS)BT~4$BD*DYiB_0JMv<3B+tF5~Fci4eT z)J4F{d3{8q+}}eyo;7}Bgz8C-@R++Cv?^x0qL#mj4QqP#tyRwDypG!ei=t}{q%?)wdS5z5_HGo;1&|) zV@NGg!k4BVYIvjKLLgDp1h|1 zR%02Kk|k4^LA|m_QkGuL48-=`O2`otw%=~dB;M5sv0HXAm6IpgrB1a3R1QE55wL(S z%hSV$bah_h==g;8S{#IW6_$s~WUi{J>W!$jIxLT=P*yjWWRC8%wg{mjhYEk|qo`H* zovdgj$tg##vp>_$sPHtW_5=Id-`7n_XwSbbu^FEVG`X7k1%`NL5LCgWt*xDti_JUm zTfRt@3U2aA|E&M27rGrthj02%_Fv|eTs;xC?%X#o3@t1i$Z2XBXlO~%Yb41zsK5UL zcwH!8sHG4R%q$&{q)CSoY-M|GHVpo-*2(qO#woWdr2FQA)J3RzJ}0!pkl3G)7?I(L zH25HjRGujpU&C_!e`K7kcTNUL1_#3=>oShy!cF59gcet)C#5EBajjp|ii(sM`@dsg z%@Efj&1T2d9OOmM84R)gLGVq#oI5O7L9Kd<$%M>5T+FNquisShQIK zG(#x}0AEo&)ZDO(3pW1#_*N{@+%T`zeV+N+tG|y|FGGcTBYp=Tsmr83I`r#GR8ZZZ zjFqInWWho{WY8HUT#Stvk63MI4j%)1i?fEMa*KO?yDRRNy9oAe*sf5SK}6rk zdeziz*G4vwjJOqtyfnf!j+ENyYE28GxTimOg(9;3J*`x3wY@i5Hvk$;0I$RN3ovF?R z7SC>wY9shG8uw7UqY0G0j`zSCH19cwG}~>Q3$0n8obb9 zHDZzK{=Uk={_2p76mPPTLQ_eKVMG4NLbwLcsQ!xOW7VSJK^)3(h3kkn7Rog!*5b zX-vu%D$ja9GgjH=b2Nj8XX9&Lbjl>~>$i=+o+Y}dVQI96ge)o&J#f8$>1nTMt8T8Y z%pVs+u*J$<>Uj-9j3wYC{-PPl&^@!O!Ot^j4F>uBx~@_IpK z?CxeAx_79m>g2F7u<;XTHQ*x+-=w|Hn>V^ZqX$o^2(cA}$nz-as%h!Y4=(UY8vFWb zrhIk@6Cd1{_J9WO?h?%}$T*xoeKWMXK3AE+M)NOlY7HGUe6c09Gz)A4){2uTwQq+r ztLQY}j)!DuljU#dq-f5XYuu6(vm4f^(+-OJP#!K$+{a1V-uB(~>20m*gkPm#q;A1R z7t<1S^&BpioMuL*HN&5aONs#ftqjz(ttp8J-m9%e)PE)FIALxbI0M6t#YqgE7EXXNJ!V>S z=QQF^O0^eb-m0C`md&OB&flXy4i-QU#Sp`aBL2!|ggxjRsvFX7@|-PC$ag8z6jALz z8k|zfbIZUt%H5Nt7U_Bl;UU30KJP;Pq=r^+yD^*8BTW5K!ag225 zw>qlRquJkuH7C@u?vSrvg1}d3paz&9byF|vM-x#@6pz>Yfzm(~-Gn~wNKTb)Qd`H@ z)FInzfkkDZ0D2(HQyj&a8A$=M9wM;qTA*~Mt)#2S&TgDT7rR4fWUJ2GwBT9asX&L+ za!q})B{u?88Mb1gmgiE+SKqET0<-!GOSvcyQ}79pwJluSu(wK#IE|FW28xtb*!ZYU z3W}rwb#{ZGN#qcIfc1M-b2^W=xrm=2>Kc)%wIg8B_00Mhpn z2g2#53cp_8XgKkfS>1n;b5T)UQz=15F+=0|8;MSW#7511i#xgIO1Db^Dwq>GS%jL~VUW&}K?h(DE8F3KkT{d-}<(8(ZxP39M`D!k0a&^(bzVvXo=I3wK3_z^6Dx zJs3FB&;&I_zJC9_CqnCTlhX+86>BRm&QR8p5lP}imoYNJd(+XY#2pd{b(fczF|8sg zl3z_Px>V^C-r_(eOARKco$%5$^6HaB-n7*K97OGI&onMh8PWywH3p(g;BWYEP@F{x zajhJf*lF=oQF45cenFZ^8j5rCGe@`5rdd)Y5Jt_Gc^o_dwJHv@Lqsoc^lJD!+Nr;;A_OJ>zkZ`8;r_WE+ zR=@V>07=o~yw=5irj0l)5!#}J_R3lQC*o0Yb`+=x@Aoh|T4X|$lsgr{|p~RI$^igrAK+&f01QV)H z7?5^ftbu>ue^clmhgMUWK7M@14&nNR8Fn9Oz?SRi@Su@5UJs&a+asmV|%R5 zzE=hWk!W=AL0NfLMNbI7%n3);02_P;Rbtgk&mw6KZ@lW7f^5 zYOt?^_3M`GYYf_gEDqh;RnTs;7RmPj@$wWJRd`qTgxLUVK-K3-GBsRRb$lM!N)GGN zW#h)o7Vp%1#-E=Mn_(djs~FR>C{0N)#Foc7DA717h#bACY=<84;D6bC(*lrOUAus8}Ts$_?`H8Y$i!}2#&XZhAo;h z4(@M)emM{RHf-JJh%KyBv!0#+i5Xmds%Q7vxNBnTey)JqG4vKij=DqGhemg1fbFk);xHf;GTq< zr3&y0U-avJG|wA_{TYOZ@M=0Hz1QvXO&s!nE&-^5xqM%SYjg1QI~evV)`fzBeY|A3 z^B$zrAA{eHt*H>cd#Qa7O6B8{F)#jMVkNN%*bI1dJ6rLUhCX-9$U42n^RarrXy@s7 zG_lg~(a;iHGcPrE#=mya^xRtZHY6++r*| zLOV25S5`q3F%|=4ch>?u(Eq3mIAFWRV!V_se19DL3gI=A5T4e%9b7C9?%Z#InJ*CVlue7`UN-;B0_ITBO@;}ZJ0^$ z8rdko;9px_fWrOd6h-^SB;@bryfGi%v`p26vbOfC>|Rb;#nB?h5yD_l*8Jppm=hI< zR*==s5#ypE|IAJ{UW(j>C@c>TnU=X8G2@wmtJwNeY`~fGJbsw?F$ek2##%I$6&ylz z-PMU>>&d!|FZr-mQI>^C>u)anvwUPl4)#rdTEg+<%|yg!27xZt60($3$D(L@*5?CX z+-2>?d(r|BNFQS59xlF&zX2r_KR>0%%c6|h$SF9?^bsTL|8x?hr5w|{=a~)o&g>0< zm4{=2_=Jub60=Nxb^)DqV* zTu3|T=^`x!1b8{MIyiEukyuJS$x6*kjxkqLvGx7P&35Fk&N%%x?68fTpSVV`K+b7q zc5>4|&TxeAo=b8b$&fD!<*0L`>Z@yNZtjd+1~^_9;g~ELTy2c1j4Ao$3(?)p)#Qo6 z^P`fg08p^MLK#A7ikUtXk{4aW4aR+qOm0Q_uZuH9A~6YDL^Qw%wxyj@UxVi7aP^#A zO>L#MIrh>e$Ga=@#$OKxquF00f>q{~H#74;Aw548S#TJ3ZV3tVugovbF0U_cFC#vn zEv|2F2UXUTwzq@Y;Wk2QMvQIFqN3q(5jhIpyz*>&kDqyLID~jZK@lNr zrTVlO<8#kyw8@}Zea|gJ1sw}vt%`)gr@Aw!kk*bkqo-UFYbNw_Y~*mQQKJBm40LHr zt$obP>X2KN61i#N73-JLBWOGw{x9)}gGK1Gd|CKmWyff-613EW_)jw&Ac^eKcb>X-&}| z7Gfk0%>S8RcO!^Emin*2!?AFOQd*rt{Fj2@r|VD*Khv#2M_%h8AL)uDI75SAYpQV0%4 z!3;ECl8Kg6K#YJAzT;63YG0j5(^BOWf9EY>zxtlkNnrci#lt-jRJ;90Ua^Fk7WTC6 zG}HJ`zrU(hBT~B;kVgrWoMzTdpZfp?t4&AZ)_%e!B{!QOmzC+fPMih4z}S!9#y~m!Ur;;ynmZ=? zYo7Jm&->BkUAt((aaY1_ zZALR=y0$-og)h?k?~i9*NNv?!lfu2id~A5&^fgOU*FnM0jh6qRz$B0~N!9RD=(>|6|HG_SubT>crqPn)EB5Q3*(Ut@HDh@xDJdDCbGIU1hJ=F0OhfU=_13ZU z%*60yM)q&|@5Byy!T$stdHLy%NH~e~Lu3aA#fR#Y^BNTMA6SCan8l&-YRMou?=Sd1 zoE%jXMyW8wyadWZmn>}d#2>6bvzHP*pB=zi7zge{h<}%3U9g$-x?Jf!jpMRWy(w#4 z+!??LJ_pA^A^e3Wi~w;I$0J*N?wQ)M7veRa=gICMQHE9q?q9>9#50}`Q&JBy4<-}u zgkXOo&Pp5tGMsy933CJG8xn!q&urugi4U946OmlZtzD*j#sT}kuv=f zTI;vobh;rlWP_q4P;-R-uvsipY?CK^ur~Sbtpr&ppmu+<0ZKPeibPEsQ?&LQgK~u_ zJZZ8VQFe(^W;O2mAZ+AVs!i%>Q0QMGFy(9eW5dM6WCSpxyEa`b&xIcw{CR9_tfr=> z_MUtdgk;u$+u{PG%I3?!L0=I0-EdUaY#1fM$<6Gt+9H^t4D_q(`#pR6VzTwzYH!P} z7SeMHpxm z#Qp-+6AT#=uwa)uZnRLHWV$m&Ekb#(Ll2i?(K%HnPT*Qzyl@WWh6jZ=T8W8w-)Eeu zT`Z3B)MW{E6skWPpEPsdC^nS9E%fkyfh{ zm50M&08+c<8b5R%YM|gEq1^1A{d=^xRn~_S3hIb;1GbD4Ko6IQU zy`aIXYxxR|3h)_SwFFQ0D>D;UWBDvk!$aW*Js~bGoWN?Te}q33MO~Q3haxl4vCYV1 z{3B|ZHfoz-eIh}M?MAjC?!UyY~KZGN$w6lL{AjgA4L3h`|h z`5EcBglMRWOA9*6G1N~QX;>a;d{vzzR6MoAJDylJy^F6opA0^Z+bTwL@Dg2+i}kNg zF=s1Oy^l06Z`Tr=`L%$h!gvPi$!WB^%PRU<1U zrniHUuedGmQich2g1ai6swXin7d2K>xqzGaeC!DPgA)rtr%55lTskPVJZeqh%ELxW z)ZjjGtZ;#M@c~V)#~eFv(!_Gnr-4E^WY#Y}<%kO;DWxQ+d{gTpykTAyismqM)|BAt6)RY2oE=|M=E^S1_2W7oh)5E*9<) z4iWY#lExm-EljCnGopZu;B>rtdp)D~y8gLZsnxo*2GqL#Vy)9u!Sd$)HvuBVap)k_ z52DGji;;pufPt&V2H6Sc%a{nM7+O_x9UVvE?nS$pcLOvK#9U{0R;==>!ah-UR6Y;k zpg?=kXk}|kg*C~XS0Qglv~r!&Mf(ef5E_m)2isiI}9 zqGtIyVUD7KWie?J`|kFz&#OJ%U0-RGIWQ_eHcEVc6(I-A$THD5f}-~5X7u}tGMbI} zk7b&%@BLIfmywr9goc)soSK}M<$v~Av%aqV)J$y*&;(M2AN4pRvf#VD{_)FzCr$4= z1U;B{E*Z16%RYD)<6gWqX9EEm4wb-3llnGi#)yt{K+_QP`MCXDJD=tbGI-TChgI{h z)P_oo#ME;j52=b6C5`?ze8ehwy6si%bfzoxRqV^Hi-m-qR2XF}8#8rlSW5m zG*;I2R6hDNu#^%ucaR@0B+n&xOxEhLXrhw}uyeCyg%n(2(=c?h<7`p#U>>2Sl%O)* zrJC#f{clM_foZ_HBQ`^9v`AA+OUonS?H>6)Q!s&(JEYCj=Mo$)to1v-BL9 z@*omk?RSNO&xP67S2H3$?(BqQ$*6z z5z!N%oJ7I4(s4G``~@D4BS%fy%ON?LZ;@!|If*I>*$GN4^jyJRrX7NUq;%Z{IS5bK zU{~w^P3lgJR33wvXza4Y-u`+WB%sicD-#e4E+Qc-tR)& zz6SGxwg2B2Ud8{#cT5?9^;HQpjMk};N^6T1)z_dpuz!Vrlzlj6--h%5%gqb5m-`^zR{e+zkGKDe7|m^n za!ABrB!Oggc2ZWUr81QRinOvf%*fI_RF7+S9d<<-IJzeOPJhiVQ?^Wlf+Hwg{GSFO zS#*!sUg;Es=hy=d27g!{tx~)F_|gIM{_ch409It2x>AKq??iq#} zFnYckKwq^Vp*?w3Jt-F>D4&=Y5}>&Z2ui4QjhHK$tD3tvsk;Az0WQ+PcFSjEs2t|bJMe7QkTfXV zD2V)Q{amF4SzDATtvpfzi>Y;3k;C>qyL2svjgqR3__y5Ui*Ap$nPQ{GdiF+`6hk*)1n0u) z;`m4w(Y(djyP&h(C4pSALtpWke+67s0;vvIaRsnc2KSCpTOuaRr{-{)R7-dNYN8|z z-GD()<|DZ{L&?t6u&&T`pTv zJkDRJlC`1Ov%i^KtbtLlT~O>Ku_VgZvR50`j7FF@{^;DHm}@_52urElXF)W$IH>3r z9xTt>4ZiCn#B$P?agtMVw*{ajizvh*wK=T_3;l=$oJPjLN5LV`*jb*P*o(q59yMFKyy2sP*380;}%wS!ADq*^e<)OgSlx@=k!dG zN)-6GC_=f#KzI_))g?tIy_{5-jnZUi&-wAf*bE-7+>ELL8D8z{pA{sGulA0vD>19R z{pI3NfIl!$6icm#ruv=e>m%QQIX&0U88JM}JN2qzn-mmf*v;`cP$i4khQuG=-g11~ zMtw%6{V1nYW4)Q^m$`Y^{6iSi5HyG8Q2PSCfVf?ch=BscT-h}hC8ONEE0(^`O*NpJ z_6s+iQm{JmK?kQENlCBP$YJV`kOuvdUgALy5cSKHvuMyiHRE;Jvld3R(xfS zVZ6t4YeE=Q)ZARspincfe9ft^uOwG&3t8mln(Chqu1R{(a$8$`jXe$q^D4(`%#v*& zZ+{|S4aRRX_*#z&mS7*UbdPhd*<63EBl7m zbIxTz?!Rd%+>9-MxBQbJW3FixZY4s98Ev8VvQId@Ks&We!{vaI%UN@dxIYkWlP{)F-5wIVxDFwG&d0{xdkl zZUDknia#=BoXnOsUk5&WYq@bhdDRvFN66XB6t`^W@=Mu)>T-LPV3=Ed&*SY9evR(E zryO|-Rg3a4f7JZ-SAHFe#oDCCqO2}xT}toIN$X3h2?i4@>!vYqwaQ=JS%lJOGWX!T zj!#G}Fw*l4Scah+8Vg}mqCi&?27s$s+&}F~JgP~24>7kN!;`fsH2CPSBc{8TWp8GN{`*-EZJbW7|gw{T?4CI-{ z$S%fc8KIo)e|y#aig+#w$=F{PiQeK17>kUb&cqgI8G(QZd=mf%TUgBGPfbnfq5SE1 z21~rb>a|mhN*L$kMaI3x55nHpm2b;FM&}=QOnZo7SF;7+*#Rvn&q+y|Xel{)X~9Sq zEmXC5w-{GCcu@2DHQ^mfTOO>&lkZF_#4n7rUjWssDCr%OZnlVB{~2y{wOD zKw3fyeaL_yOJC21+S=RZg zOy$cf=aqBHCbzQRV*t@4U9>&#PIQIrQ#^Q#LuiB%YA zp`w+`XOmpTOCgr2XrVHNoYn#5bSciU@}-b)vFos>_)8I@mGfr|T#f-MHYlY;1Sh}( z_^waqi{Nc{$$6XFve@7?F5w*0BS}aA+m(mxkNMXlO&AXoAsK<5z=Xu3a<^{l|7d+WssE=TEFoGD?wF7RAQEW_39 z)IS&NX(F8-oN6Jh{`1g%F4w>#vy)%Ys1O*YY%?{JG)efZs4G8S4^6MXLLL9 z2?)F&Hpe#oiCik^dc3?5H4-*YdY}dL)N*u$VA0-rtvJcNyAjfwx9_I+PX33Q-FbxgQ#X=B5KAXD_-n)a$z^O^@*;wF5n{q*6v$su9|h5?dbFPhQdv?rxSoHAIBXM~#-Tzr2_V4}) zt8&8hGk(jKBbyl7f+}{}k}H!zy=utRRmk(SzgDA>*LKjbDSJ+|Te;t~u@|p!p&C#F z=SQ++&Km6Xt-m_0LDRMd+(D|swj**W)cnY}m!S%#Td= zAVK3LmCYH&Kob%a@^B)xdzXH$y zRStuRi2qSz{ugc+1@DkWb$?pOWSV5G6zOV6Y5?dY(O8vp@CfFC-Y5Tp3jSB=oevf# zYL}%%rKCcRcM+LQ)i>J6Xst%WQ&@-1_K%B{s>Z16u#hiK{EI^Q4}i|F9l+^KsZg+) zUZa~`A)sD@*iXk@S^#e?-c;ad5SPUKt%@-N_4EK9+$8-+t*<{B@G>6!GR|l; z%lse?sQND};`+~9=)Zog1>6OQNc#IL!afB3KljE$rU4&19)VSA(9PB^rX>^r-503I z0lt!@LxL8qXo+aDNXg3Lj}Mn$fYSh2zBFb!#6IsB7DC zSRqB|Ld}2G4tNFqUla*cX94C&G{ug2RGoU1$@<{VLB!X?2ouL$`qW(qwxRMU3W&g6 zqc02#I4DN*C+yUs#%pxp@>C{GP)*4Lgm$?Ms6kRCZ@gf^a$)i}Wts=?mM~s`rQKPf zi)n8#F$2bF`Tz4g_3E{zcNhl4(SLCmHdC0o6iI!Vb)Ws)u0=~7O**dQN&D+|B?x*T zR9%)NQK}s4=^9w*NvTTnMx99daXy-kE}_Jqb&=!hGV?Dxo32z9Rd+9J(ie09T6-7& zYsh>55^Nt1QERy~}gIT4dC`8hPHJxLa4!BV7#+p0r z6VQ&8|L`>k1h5D#*NIE6|Gk(+C|if2{=Q)*6tcObsJaevI?98?H7W85I+%V7yQUHR z0>6{%Md$v=63guPo#gR+mBr<^&la&{^u$yzGO*KSCd{z%yCsC5(J{M`QrzAcU5#%^ zw~D1>dUsfT`89jdQ2wvV46(hYOYF)XXMGxo!&^)r7YQQT{=L%vUaH^29E;w;Ss^1b zp+sZ-4!7bY;_i~YY%LP>b-)M^}3SM*Y4zJKZSL3+*g7v&N9=Bq7e4)_lWJn@ zF&t@H4Z$zvZs8B7uH(v=c0Ao>tv?z7u4q%~em9^6dIXa|F$<_seS(0igYKI{>sz8L zR6OP~Y!NNrQ!o&2d7AZd*s-C0%74r{g4;C-s-)&XjxJ(gudgiSeDr4f`ev>~W%F6btG*t^}>K#g~e zQQKJLx0vgs37aaRhaP|NgwSAZPE`@HCPieK`d%w~Iwa96Kg^Obzw4A>h{z2E9gg9l za^e2&sNrN}Y%T7-CH|r4>}WYe!oy+1$Dd6fr941R7RE~zo|KZFO);zUT6G6;^}+$H zFKNz`g%MzaTDBzMvQ|)XbW~h`T`+E$M$HoK?$`N~Q9BffnR`+96&9AxnskHkwRLyY z=ZUP6|Hu~k%+o~2OH1ESd>3P95}$6h%TK}8t5b7w5&;QbdNNZ@tEPXh@5GDNuL4xa zz)#0eSG03`tpm`8FD_zBvYGG+b$+n*k+e4lJiuy9N5K5A0GCaIEw zya3hvv(T(+rI||Gp^PS6RiV7g1Q=-A+fOWpsfz2yVpkI4>34{aYhi5z;ZN8ohdC_aX~&Ub`x;ey$}d3ymKE-DhN)b21Mbv-X=K zVk(8Iwv15aOJM-}W@&1V3RaAVnU_Tg2?_4ECRatRmd}(Yi9P-edV6RIxm0Q98TdTx{_pc7LS>yx@*`VqDIPRA3sCZKn2pS8QNfYD028JkFa#e!qTdA3pO2_ zCU*%v4hFh_ktZuOe`s5`1K<&c21Su8=VEGUScrOSqDZIuiLa8TCeYnn$8V~g@XS~C zdNB}=4foBQ(XU0iN2o8f#l*Zbcs;O=ju{y_eo$o*xznu(6aD-`ZIRcUEBY2vM$;J= zWa8UZwg0@0RERs(%^2dv#1qMi=F?fBOy9vKzdsNPDqX6*E9~3tXH84tT#ND#em|b* zKM{N&)i31yb$qccc79%1mJrYzqnm^53u76Gm44J@{-<#Lw-7R?~D+i=m zl;pf*^ms1H<@RZ$>ZW&bN4m0-2hJa{nuM*1T;r-f-p1a__O6cF(&0nDXYZ)c$b*e# zHe$K(Z7_5+^pa3ewz)=~Yuc2!R5pa5T5J6MEe(Up43qQQgcWWMrcY<4c9As86&pRH zgu@&EW@GO~^DM_xc70q9yj}H74p4T@>}h_aWAEiEVr7@l(&eP0E*RRK=Y}L{t)B~I zrl4MAYp-Xb`R_R!`dZiLJLodnq#s4x9+uZ^_1AL;x$qMp6?$=q4;<`^BxlV#{5#9=mueR95`%z z)bo+Bl-X)Brh4;W<8UykYhfD876@um2%pja%shttLa8nk~2Yo zBsHFEeA_%6zPwwHw|=|VcqWMhwDuCkk}a);=gm~+1brf=?s2q@6SJSVQK%M290#ps zu0?K79+UA!?>_}|8>KC!VJU{?lX3$vewCwwOzlh7xOtq@rUp#SJ>=MjPm?Oc$I#`L zYVA_J1tY$>KhYqnOXw@mLFyC>2=%nUq!Z|rHf8wW%~y`(NV;cdt|jNI%KcI*n+V45 z>$v6Htw(Q`j``^Uq_r_8Az=%oQd!(D<8)VG&Deig%j~+&{u1e2RNvMSIC<}+h0o^iWY zmNKuOr8UMhR++TTmn^B-A&)iTSyRNlJSwPbfScy?#4iB&%};m-r9xn8D;9AKr6+9sOVPgUz`u z8vZ(Zy?#xn)oIiuL4f~IaKKBZhWQs-MqnftKiMz{J!m+4O6lTqCnkmpLX8YvTCFrs z8zjj)jqFCzUyrDYx_ViQ~yR*Q(;-yg^y|r zp;%85?&`cBL%nwOlkj)9zxd>hyse{_mXH#aolJiOvm0b$eRdk%wD+nRwS6D0&l=ix zi*Z%rOiMO-$B2VZ8fGArBUxg#MlRjZfTU^buKhWY>U<`;^CY+5bWSh!r&?FQ=XedZ zCC+IC0ILUcetc9+*D3lMkida1KCgvGH5eC4&!m@w9)Zj}2mX*r1MGOQyJ|n8H=`Dr0DWhtHdxj%~N&`u;n1u#iCT1|{8vJtl)o$i@EkD9@{d0 z?JqaP-OP-9^=04lgtx8NQ-c-X%S;)s1b-ySeK*E*wDPDDN5<#xQ9-d5O5O$dDn~2 zU@d7yYb~u3trO>lb6A9b{wkQnrK(}*Li6S2b9TcG1lUJ0pF#d<_bX^HO0a9Dx9a=D z6gDId^|C2#O>B!?)Aq9_OA-KO8H@~5NGZJ0!U^3-7k)@}7WGQgyqy8e8 zOZ$q#r0W87C<$KeG}X0ZKHC^9BPrV(AT`gG3^6v2r(e5dtxs_7+L9)q203(r81$=T8>6zaxs$GBBO{b>f# zBkgc|heu89j-2zi97nsaH4Qn#{yM7gTfH`4o<>Z*W5(bZ_of^aMmvAz%U<^o?gRPO zb6MqKUerkU?i1-H@L4@KVTwuM%BBPFjX+;GO|uySL)QuEaspn zi%AzcZQQJV@BOfc5c&!N_X-bub}PNdht1Op3$H@5lpXg@&R0JU_7pgN{jNNna}w1D zRB3W(C~t}2RoW39$-81;#1{#hLp5=C+dJ3OwfW;Q=w;@q4E&nLhDwd*h-&SpLFVyH zRpsO?bhpW)Y<5%SK3Hkp?d#jM+lNB*EUB)p4hmw41iu!@g&uOBt>mbm-!}xmuZ;i+KDt_^<;^kgcv}!v}k1 zsGRf<*58E1X3;X|_=_7rRv^+sNQO*b|K_4kV#P7(Whvu}x4Wwdnw6eKq>L>21xg4L z$wjch(6NZwa6BUEuMkH1g1xvXMY$yXaVUhye0j$0pb z6cdloJU1zb`DXg8k>8f9bK#OHf9tuR)yORP8Z<+rs^PXZkjdXh1e$=&@SP z@6w-4Cms=~Ks=(*K7&&|9~lv0Td7%d7)Kp?6u>~=oeRNS}UJD3n-9qWz?WAiAeY{gd4MwGv?U1D4qq; zK_3!b(v8gp6AXQmU@42%+|3poIWi{8C;xy~nDJ?9*9@dqz zRyvVd(|}wsA9N=rW$pgF6?h|OCpa~jbPgm7r9_dQ!ou&Ft@4Jb&gcmoPi`2crsf_$k!rP+*+w-DS8C7+zc(~57N3s zcsn%%@+C7X7MQ4wt2!4Za1Nx6sj_VQ>4V=F&@7|2u-ZxqI*E??OL^kQs#OU5`}<)l?P@@L3A2n(gC@gjF7i&m0?6ngZ< z5~u)jn5J3^`kye1`(J+;-sBQOElsukV10uEAM7*eu+K~=RXBfaRDAuqcJJuTBBEBc z``P$Z_rsPGal<7-9R{w4f?}FSD~>Bjey;k5^%a`zuH$>^`db-ico^HN%iw!M+0^r~ zwdoqEdKjbmbzhmKx!c5yXC1TryvEtBp7rBtsPLgTx%B+A?=g+r+#i+V!|mJ8(v4WG z7SC*NMthFD)!iXbd8Ui=@puZ(SVmT zwgnd(d-pVEMUq`To>WakyyLkW!pB=*v|pFTzww3NlZ}T+%93~D@?iet)K6E zW0qu#Hzb@6&aVT^EPZ-*ehwEqp}BTodq*7^Ieq-MeA2}@r_{xpR&TV7Xns{zTIEWb ztwev+P-$8bGdnWYP9Dy|8E(52M)DTdN%+Ou#})`{@8*w-&W2~w#4RISTlx%)z=y^r z=msIuL|&`NwFfyiRBC#rO=iA^wxU?(UDp)Xz)|@TyyG%h&4GtOD;X8ZgD`ppKKGC(8m0fC9`!OXeY9&YxC1~`i;}YFNto>KpM*zKbx@&M*Z=5y`ZlbZ7P=mUVsXar z!M;Q4W=pRnVY_bdvy^)&+q5F7wI*fag-ZyDR-=xlu2$pJwN>nUR*Uyv&|F~Ah3JLy zq%N^7DWjn4eeL05>JgxWMp!m7Z?1v8>OlNjKNsot;1$sFW;Ng@4N3n86IrdhdXtARC2Rt0~U zL}#4P)5dss1Us1sKfJVek`R9g$)CI*(n1U9>+w>~>p%^TUegpVk>*v{WMJT%#RMH2 zey{Vv4V4gW@h@TO2!%i18m}^>m$RVJ zmzslv!G?4WYL_p(FO?; zxA-{!a?H;D$^XvU5piy-uK%zac1~GxXd5taHEB&kFBErIxhKyZpGyY5k-3B8+gNbq z(hPWMBz{^BY^<9+yn>BEvDp7~ThVy+g$c1d-w<}Cf^0QNsqhQ_EBq26^k3zlA@VRm}e zZu&Q)SKz7^AecL3q9Xa`MdBh=~Bba ztHq3ix>zlQ71ThYK&9{K)}Kj(<#RL4@kq#j%{_{_!hM>Wb4*`>5fi3te{Z*EKb-Ri zsWWK;fpX3?;L;>;4bwJla@V(F%&2*-D418BgqGbz9fZ2sEk$j9k;s0l&a!1=3N2b{ z^l&WG-7jq>_rd72M9+25loeqXVzmvAtjZ~Sdg*iuEpqKL>NJUn_T)P^M1eJuJgEbi zr(?>9g=&a99*TN+^5p(;8q%d8Vah-(vjhpAx5lv*0--lASWo>l3*4o^Z{jd~mR#;k zJ6gES`{C;>FI9NZ*umrvO)$n|HE#!hZ+falpD9De)U@rKRl_L^S%aq& zQn=sLF-O&EIjHnlmS@CPzVS?h5#@@Fq3CJr!?*Z?z+A0+ zVgm1s3c)Gvyhc&n^e)$kZe2txOm;s@hVZBX)S#Iq8R>iEY&xD7j~>mT6quy(U%mv5 z-l7Ijuoc#3j6;EV2}38fDFwh(I!Dj)sj%APGX*D2b}QBb5zQ9^-i2$6_#WVQcl+8g&eMc_oiP}!X;pzw%?uNlskA_+pv!c+|BkIg*8Z9(djJ)Nm) zx{F$NE9tU1)Bz&kmV!93V;C1wVNsCxL4_eK1L*`=C#B9DSCNN8qvDfwcC9$j# zv@w)xsL_yRLJxUq7qML5zhX*=!iT(if5xI$yu9iafV_YW$GEGU3Ul49uy6z`xHP~^ zOrWSLP7dqSYx^<7ZJLY7xG6aQuo4yL@?UXlY(xcIZsdiFtM~DC7Y$Fi-8Va?#Cd$iy2y+a1;HLj*7nRMrNAj(u%1ffVzrUi@yx}R~jY-Bshp!9(@-% z`KRaS88nfAn2?!~Y<-3fN>K|3`7%pu8J2e(rJ9JBo1KDFGnes6se`vh)ncF(PG2Rd zAkfy%bHj7QgoLR8^G+VnRS?oDO)s~g($0@Ts#LmyqJ|0sZ5=mcZSqk>6~uN$qSjm< z@Z}nmtdJq8{VeA5Vmt3i8DtTSdVV;;WLGh;s4R_!xx#{^$I_39BO%SNd2>Wbp&jZv zB(x;hZ6wJ>(rtmigf*)*Z7QK)J6}KcBWu%b-=!Ns-o;@56WA*-fC-%a+B6Qw#9dN- zIm^?3E$s>llZ%RI^+ZR^07xZ|p^= z&CN{8!^(=w3*`R5z=M1BfVY3xrf|3&Y{P8y zTp37$1qO-qjp%M`1CDpUEC~mV8u20}iA5&rCmif4AZ!u*t1t0iRkQygMlYLUWZ(S*HeP=YhB>$yvM0WaR5S$}ba(cck5n$D zg09WLyP2G{1)w!M-cOFc+yOILY)GmVMgVBaFjEMUqCjRp#{qkaVy~+(MNmZCQE6%A zlFM0a9-)=9D&`GLcrSD>TFe7#7v!AUP0L2YAtre>j%7|CoD1)MTsk= zHGZ|pTiabX_GckXkQi~HSZwHzf2+B;r+DkdLory=WPNc2^qhRfsA{ArlTxRIiQ91EmZ_Ga%SN11UaVZQbA-d024 zlD=EFILCT&c0hV&%$%;0#tCPaob>WhlKvdUw88nnV5&>r%=$FjNmJagWdO1TxG@|o z2M+_FP{m*&SzSMO(8L7ktY`)l)yEv{s(f}7t_kc)a8%$_H5PpJnd%u-baU1dJp3+PBu!zCO~6ZxeH z>pxYNr3Abk)@9X{YcHrwCWYh;{tK#B)y3!-jUu#&-fYFB%bosNhxPOeY&AIGr41?z zJqM^ngd81upz}|#&Nx8ef@I0x*N5Y_51_u0$M`hzM@Y#JIE^^Ga~~PMKByI@_Fz`% zgU4vG1*&_Kq)n(@hKK$4`|c&+tgLJ;EzZjN^B^kV{kU|09CfR3`jk{u^A38r>Y|;R zjg69=<;`*3Q9+k*x$Ek|b#tSxjsyJs!3{Yy;zPK7 z6V~{ts?4l};9tnFy4#zlQGq1M&I9OAk*XYFi(dEMuC=Hks}$$uBr|i3l9T5A07sOf zotB1IoC=u4z#k|njbs`cE!04L-lmTz$`jU0JgD~TrYFXZ-wGr0#+IG*dL09u?V}62 z-t4RGWBS6yWW@RL-K**Ebj&1t_-zQQGYnk+c~mSgK}ob#XKUc{(Ds;t+1rIu<=exA zM&ql>NfKmTnSyL?MUA|`0&P(Jb`M^{&vPY1 zIkUhv)pghn;-s5gn3E4#q~^EcpAovLn_+Rw7kbH6O`n}yQ;m@Dy4CD#qT=F}Rymlq z)EDD)*Z&@rii&Dz(Tp@t%j`-rdHPFg*vB_X;mxZeuD*|cl($QMb_|)wi&Bx5 zg8%`BFaZ)GaG1UWJ9PW;~WmoA-^zkK;I0`uM9kT zByT2F8ZVch#-?Lq4*diA)$hG=Y*5f0rVpvSwJ9=aNU%h^YqB6EPq|Z5Fi&CF;APlm zJ=E&%=nxXeE-=h4Oj_pG@(Op<;*71DP&}DY_k8NXW85 z&&I`9M^j2Ft>t$tFCn{~X3U#~N;U{z=_~ zFTw7~3?|cV|MRDv>C7QxtoxqCRtQ^>-c$3l%mX{qqHxSW9w96Xrz3{dPI@j9ZC@RA zorWd&WM5(sLG?zJ*UK-i&3Rf;LwE-*F6(JZuG=nwU5&5H5cw}~QJaW7y@wB5YEacI zxogonXw<~cwPf({1GvFcKd`c)E@Wyiq137DzA(9Ov~N>$#UfR>GyDD7Ses%`r^*IX zN5@E~eWAN-?j@e0-R_?}PaaD~v8RXFCF!)sR?$_(O9*F%a6PVuZI#dk`Xp>-=1rix z>*|2nWu`V#%;GY=dxHJ=EsE@L0V^{t<|j7McvXLO zRchv?C+gZ1GOl76Jh~DeJLy;h%#BCx0cDB^ER)OaS1@0rzt{FQ57?R_97yJ(%E7M` z?c^Bdm`6|}>pN#Cy*`3JS>pQ*v*X}kqA98?%wRKj-4fz2i*gIAn?SMait5tA1T&L% zGx=u5p0TBY2zBMQU$6c3@WYHc>vB!Q*t?Ic&k850Aewj&wC-L?o%Q*Pnv8FaGTmhV zh@++HW!D7+r=FgosVox3r>)FRk7ymp%7D2>P%k1N0_QjQsFdlsuBR_sZwIPx(sWVE zol{Vk?Ih`pY6f{rRuf zYC~8{uIm~hsVgt7%&C1HEkMu~8^&!a@SDJRGVj9Mik6-N3qpsUa=1*<=|lQk+U8Pe z&ve_Xz0X3PZ;jw1KCJ0lfhOJ)0Q!y6_T1qyAW`|S@S?;_lhS75welgv=VR2|rA~p^Xu<U$ zz_(=|E|p51^38c#h!X!<9p)&5{$cMtKrfizV(r#6l3|9(T%)T6-FEkIASAeq!C&jl#qCa4V!k4+BwBVxJWLu5acP@XKD6dvW5(hjv0q{8 zKrVes3>TYb21#s#kfj`B-oKKCe_l6+Inj=;;*IWM@M-m9kxod_b-NKIQ58f`?h4qGhXZ88Bx%HQJRWHN zhFa?Raps~zZB8DBF)~>P2)+ovqU1)h$+fi}ky&YT{J3+KbFfCM0_MB9a*{mliOY{fChNGjyu! zN#{VktfnB+C5-0pKyV^{l?=(!qzTQ`XY7cwr^)8cP{IX;u%hu%vt@}Hyr|9uaJCTa zQ<^NtCw21ap(wO)J7skp^#JyrMSZ;q4C@Oo#z&^lE)=S;95|^j)|RJ&3PexgJ3_&RO$mt?O>Llp!kB ztGvfXKWBLcz!KhrNDl*jNhzvFRR)ph$GwG*kY9>ff41_ ziJic@pVH9<2tFW;9I$!*J4aU&=>Hp`{`SKEL7n%> zsM(Y_OU+i8?j∾VUI~?hXULVg$^g(|Y&`Agk=rFp^)r@wk6U&0+e@T=4wgjp}?i zFTbN%Uu<36e42*ddR8!gUa%H^6pTMLPGT0WW&2JGf)ObY7jI%*Vb2E2oVYU@t#n#n z7sf-{C2w?!Mz6vwD{lIx-pi*e&}*LWlp_OMbUW;88m={jmuiV|c1+-PyX~8vU5ts1 zhm6&1yZGnvs&?MCHJ_|$Zn~Y*S~_LTyI*sD_Dwfw1aV|akm{Dg{mVOGi4TZuN2kuN ztZQtmtg&`ph9CFG$|GGVEh#xH>+`n%crsh3&`QzWlOhB2c^=J!B(88Ra?oyPbUxp+ z>2`21%quXBPoK=T)ouUEc~HiCInnAi0|5Da0{{X8_$@fP0G1G#O+b9PnBM-F-+ou1 z?eLX5b~$a`PQ0-B&NFK+EKlVwxVX5)QvjuY01q?ijaHX?et`3Nei%@NpKvL3`u0d5 z4^vAn@JvY^@BanQaD)B(_vS)lRUc-{_5ka4F1Wh`S!-_gX}U`fl4{V5XR6cK=R`U| zgSf(@piirJGIHu_L16>#WV)3kb&8OX9W^vakfmxXQKofwJJbE>q$Rk%=)9#mR+{=b z;a&C7zEUk}-L;*wwDs4&FmfSM>-+XEv^*{`AEz8&H>MNa3*1cPKB4GMpibADS$=`} zOsYF~#!o#c!tKL}B!S-ORiwb6V_ykjELdmX>`4+&D||ES3p@-KvDdxQW5XX07&6<} zOZE?6tbnvdn6d%LEK_gtP|el|JyDt74nScTxe z7i}y8yvIQrNGAi=ycQFYL9A}8N2pYWvD97T2Gx@FR0dqW2+`&GnOT02L+iKc@Ck=x z0kR?Ty#N?4t`*52uaKc(Ue21N89KTcSoqkN7;)sW#niVd%KzfY3Bj(PVwVNGImfBE z+8Nf~Sax%Vv03W8tS&dEdvk7c%(Bhha?0~9ghxGPu};@E>Sr*%;aqKd^*jagkyiC@ zKf2U1we*vens=-Xwg=|d`i~`NhbIU~)+rPafIHalPE07z4#CHh_EGgl zUALUR+ez@l2HV@fi~SV-%Ie1H#p!?#Sq?}SX~wT00{;NoxHm9Ne0|AhsW+EnrrId%9)LFBvU?&?Q?hitNeR=n(WuuC7wkG zPrlrU2ECm|e3CNb)TD|lDZhnI2kkojK#tOX5DrA^-p4$Wh?w|mfNF@Eb5)b6@fg-7ey77lvl2FhMRSEt zXFuZ;^E9yjkxm}~kk5CTa<_KKrLlp7X>65d1#T)h_P9)tC>eV~pkOLhw{5-AAr~I$ zi&Ma}BLqj~9uy~rJ>>!GSVWX;=mQf*QqX4Tczt*rttGX-9bdr8Go#~J01t7Y6gs~v zw$QVB%lZ5?iUCBFdRvS-5H-=JBcyaB-LAoOv;nEf*4HPBwRtezL{bS~j0C=lW>Vqo zf!4tB%o{O!94Ym}DkoRhPk_%n=!r5}OOt=h-5Aexr%93qE zS)^v?n*1}v?(U3u^T~Qco;^Ekbz-TLFqIgjUg+++H(7W3ygmTkqbzI{Yx3p?5?Y*#aoty1`vy+!sfSXB^tv5aI2*1Q=dtxn6$aG z2I^OK1QlQf*5|I1Ar?Y@ z<|Rb8U-xM{_y1;Xw@LxOSPl4xO4A%Wsz*YSU5T_cM^Pc%$p3x5SB2bBs-b2qB<2k! zNncwWGKrlP!sD79YDcYon)6iha~x8H#E3=7b_Cn2sO;74u>MTd=1q`eV%-!iQVK?nX$G^f9sB>HO-#PNwpF7PCYx2?KHwb6P zS*VgI5n~P>PL?+58veqBa`uq7c*=KYuJ6;IHx-Kc%WbAIJ&$>ziIqBVwU`m@!G;wm zEvivKoDcz;8r+Y|l*wSd*aDvsc=nq5aisTO_ zI~|aSG}Q0>cEGll>^}~BUeM9Lx`M(@+SJ0)V)aVaN7&%@3z za}=38T~!9&Vhb4*aQ@NK_6zb1MaeeQH}_{@;bh8P-q10_EwJ5E-?Tb|RT^pNV&JCf zJ+ys@`m9Oq+=7G-;1J)j5o{a>Ti!6ebzZ-ted`Yr;@jp8D6%Xxa+w~uYzPNi!hRS?z&Sqjd*SaSP;vD6X`3XcWeOay_ zptnmjTkCiV;)hOUVce*`>ANgkEa6gT9TgTOc*A*zlnmJtnMH3Mi#aGyA0gj>>wn76 z=WVrbHZ=BU5Yk;lhWSrny~_1;txe+WSW@yqg@Mi96%oinzubRnkTf|Xpjqa2IBpNv zRT~e#a5QOa9=@K}%GEkO$O(rp&-#hsbL&(w!8c<|Ki=mo|zF zD&vp=$$OX`CheIruu zeEZy68fuzFg2bMU87mrF%wlHQ&W3ER~cMeB1BwHq+pi2Qw8jzo~g_6X?}e&TeW~<^fEklY6Oq>=6Z%O?hUkhU>6J0rbZHU_uon?boRztEh`?C7#@{E8 z7c!EruITD+7_wk!89`-QNlcuSx?6G7(LS@?O=%?qq#!mOrtmHff)J{wz6zBLPL&dv35)#^N*K3I6|_cy<{+NaDBLi#Clm>r_y9=^$wvFZfPCg1zTXxpDZsm zZDA+6yX>}V4-|b|YguGvo-`OBZ@vPzuerP5W$Hnq7Rptfgb+^+9%W!DlVtG*5vu#4m# zBmnVhB}1gmX>91>WS!EtwS_j(wB&eoqcp(9!u_|wx9#LqTN7GCx-9ddyi{cf*WbH+ zW?yYCt09QGOH>!366`qarNpnfE-?(8xP($LMX$ppptjL8=jc0rDJLC`EbUzt^CaF# z*i~z-5R>EPlNa1xu{^~p@9a;6#(Nk!+){L3r=Oq9&lJnL`ausoJmpRQ^Br6Pl*I%a zDq^eE$;BbMG&WYY7!QJMEi2JgH|6S^-cl!RMnF;JlWIqq8 z$%@E#y;Z3+Y1*(xf^!!VcFt!H{4#vx83U9OE}8{L9-+GyS@u>vu|(Vt0V4T9*Qq{- zFOG<5H+k}y@{utB)n>(r2p7ETRvstGFaNoF3+mvbyDQxN_cwfD8~$TH)bD^~4t(e{j>g_Wqu$So{MO)w?|Bm;SpT`Akaz@Pd`4PEm* z!$vs=0>M$O7obk?EF%P+P;=!g#g0a-4UeRWR1^&r61rI2j#0Okwkg(B>dO z66@UD;uqCc)D{*NrLa_R@Bw7jyWgKHT5gl@@H1N8~ImR+d$Kd&PMYh#(oLEZz7`vE_L{3I{sjm53fMNw6Y*EXCuIMtH zY(JQW7RkimquY5I^jTBsf$}Z3xX**@5TW53gWtlt8ZPy*88?Klva=z`6qj&Rvtf2~ z1=J$awnptuqwWiR;ytnsc&Fm(VdR{CfW6k=wLxGEqGQU^>b=_C8C+5Ls9JmSDeo#eP~aKHZ|2~Ut;2Pc|I{(FQqt9?{sM2OrSMQJU*XytelHbqgg*) z{5)OMY#~v0O&VJw=^K09W@G>}xI1ry#g8{M1tK=@escxMz!0(J>pfd z?+1(}kJ|62h$P0hQ|GBOLfp}cxs@Z#p~GKg2+o~3gBp%lGhhYfxQaOq{qT?$27*gH zX{9MH9oc(KZIJTvRX0!+_ELP6k$AJ>)ul|XFLO|BS7SJAu2@bpOvHZmXj57|yF=c> zPK^lGBJ=bjOS8(88~x>4c~u7OtR=%HOS)yMASTumxU0d){Cz~z+V=gE`Uhd+06K+> zmKMnyHYZbzHfs!7`#3vJcJPw*!(OzlP3k>xfku%MHR0@_urX=kq&`-Kyz!;ci%-I3yg&ea8)-4y^Z=flkb za0E7=&F3~%)%Mrsux9~tqTFNyyR5>8w4*uIzSD=c*7wTu#s=g;eQSSX$8|4x+r#ag^mU9vPS29j0W4s z-Y#;-^D2cZzKHMjZ0WnnO7G%5gUy*-eE}NWzKc83kIyz??=Ph)>tt$#f(Gx(udJza zi~H{EOCI=A55V9wMy0!)vL+ihKJRrrJ^=g7f3s&72CLN9ZQa3}I!q10Q-Y~VL9lie z)l_wb_dFm;8+~`V>CqJDc6+SpbZru>P_ORTF}wYD5-MV9Lbmg@=lUw*=KgAeE*eW$ zFIr>qPb<{jb{DQ?)NQ;sXyD6 zJgQ#mpr6J?Nz&wUDAL}gvoDYos0xD~ckqmI0K444AYRu8C^LRbk$mrCmXDx1l0!>? ztaG-IE$`zm+Z~pCKJP)2B$eIISvhbsG|wu!mW9;?XmeNCEFa)hH(#f?edFVSE!|ut z{*4V!eBLE0_)^!>Dw}vH`fszhffZH6iH6oJJdPKA#B)t8=iV48tPa&$t=Pl#CR-cc zUchKvoloaezeE=R001`#gxj`Qa&$XD*h+g-iX`#7;_uc^8_RtaVZOWkAqMpypQ~Ul zN3U-j*JLpZEa;VKS7yA$$?q8@RG%GPeIZIS$uwefB?N`?v#K7h!9_suZ!8<{M;SC zJI?pt=idBl^acy~HvBsCxJS!%r;fgtJj>e~AP5WqfXs{{Bs*SkexBN)B2bPnbJks5 z(_iil_69#1aH!}D!QlQOY73@yB;9TeE?t-Z8HA(5uYrEP=iEE-taIE^`=qVrZd0|* ztu^KVZ05_c7+DuU_mY?@z^&O{<@Xr}?%!SjfZfMT?Osrj@3F>2O9?e%b#L|)q5EdF zYl=)3;oDJMkq2tS{Uvi##5V=D!cQQOU%U_;0s{abGrIwr9em(sszcze6K>#I^MTJW zGz#HP1#nJGv#u3e5;Lw}xR?qaADSIZI8LfPNVh~HO^X{Ut2vL#>kTAbdN@w)w4kAT z9}wj86A%at0HEaL7k@Y3Zo(XA8Ds!eXdi^@9)Esg9OAHbn8e6he=!3-i~B*ynS*Oj-1-G39_Yk*(dhw+Ae7; zhAjFS{yo3E2<9cmT>Wm|-37OGA~Uwk1Cu%^lnx8=Qvt{_GCNltN8@`vH4}O8`BXF+ zMm-P-kf)A=tiWRs6HPqpVmff?k1AYi*yyJ&N6BjMy=YgRYFqOj=e^~Bv%3qD=i5CF zJ@w_qMO&BA(ylw-V@K_4`twsO-y0RGp~{{K{_7pl&cyZJ*ia+*e1$b8zbRYfkOAPW zdmJ4KW3UxvMlU~d-(Q5EpF=@#002MPy-T3ssdvtSB3L6w(8+9C;c*%+qkD`@+QEc3 zx8l0ig@u1h9bV?~rx;k&7Hj^Ex*xHrSIR5o-&AtV>M)lXbTm7>`wr>J2aL$=K|u-g zfn{VblVU~!6`uWFHS~KFAd%g5(wU5h-}GSDoBtMV<-;)jtR%5GgL|i|XjWVQl%}{w z{k{|;ebi5!=is^2w6Q&+;Q$SOvqNKP`d@b1!Hv1<*;5rwA5aL+m>BTYRp3>UGnF4+R`71kI{NqNm2|Rbd%<=?j@j*t-Rri!XZ?QX}@OP|J@q)0MnvOrY4INqSi`@ zFq$Cv>*t1Opx#cB946>be(v~n2^2CQ$Bx0oN#x;4f+2w3d`agW`ab_s(%J#%g_09C z6A@zYYVg`03010I%|yG?r`ySm@?b` z*Z%ZfRegQ^e9hXl#K$YQLB(j;Hp%!j-PB=-)s(=-w6-ocH-P{Ec<|pL;7IfX2JBIy z4i_PoqlOwXzz0E*B-tM`B8tg>y$v<-2LRlkz^zkTym^RBO>sEN=Hbg|fX0Al1|rS3 zg9-rdzC}&gFXF>;Ka(Ac`6n3WCs%U=1pA2fGH5CC|}>E=jhpmSH$}GZ(&7})zrylTXSP{1kA9ZJi4oN{L3C8FSc*6?Q`Bl> zOOo7cE z!o+ouV|%*I;@vBRL%{e1l8diGUdy3qF$9q8fT4zU^qB$+;TQ=~C%-8XVWc}7Cakvg zH%N#vBSiOK2$^5x#fky6pbjC)FEJbgXCU!RjWKnaBv*(`nWC7n^;`CX@eUgEZ|_VF z6XfcZi;q_Ct9FAFnITQ>s?{@)BY%~A&gAdOJpm6FyA_7OfY*xN(?batun&Xq0>B?4 z_c5xIjfOyaa=%g$C5ggGRSjfU&Xnj4wqnf@N3T!wVpSY9is0}fP^LtcH36O;Za}{M z{{BudD^u!k2_xMP=NQghIOEO^PLu_CIkMEG6#R6;H8DDj?Dr=3VEm1zyr$jkfCv7& z?skuXy`p^ey`~~C5xMphaF?FVzqe1~7;+U4aUjYufID0);kefZz>|;Vk7sJN1WA5k zFrLDAQN!8+og70V9S#-Nk3-| zqWtNJMOIycOwbn%fZmfCbV@yh8HQ}7-lF*<$(x>~zup;6x9`2f8G;e2A1FU<67Nqc zZ#`cJH_y*bnbgm5UV5f>4rKpEYAYKKzH!q)e;A9}GS5(nqlV{j;`6+L&W|9E^&gE6 zD+YdNTcgQtBn%>>yAZIn#S~g9PB#9T?Su*(-dDHhMYreYebnw}>=%T|W3omb76Y?SyZ*ifN6Eq# z++->kVC`|Wb{;!nt}po*@mRO85Xa-LkSGY~iy0sG_xGnQqe+FL^u)H^>|P+7>kCt+ zWNNFGGV`$*PaN3X$k4co|Ht{cD-*kZmyZ&`+wlv5Y6uq05kOF)K*^LO_UZkt6V(<$ z;}N|$DA<~G2JWWndz_s-&vVx0q-VzMjqoWMXlx@Q8TyritPTeo}u{rakuR;S3fJfM24j^Gw8|LGAn5j&m2y%T$k~!8mp4~W5A*+x=&UKHQG;_M#!BPkAX%+D zRV++6c(oZLT5maL(wPb|A2$=npb`a;MzCmS|958Cej^N}{W{F+%*QQ^+MOkvQIC`T z+f7%?=M6S5De!P@skV3ynj}U;jGmlKj`0+n9kV`lah^;Jrqcb`S{Zc+N0Yuh; z45{Lzd-1VcApAi_AM(yYxmxUK!ShjclXP1ElXNP68hlHz({zMH5p3_;m-0A>r((l2 z&Te%Y9O;1=xd zH_lbqW!p6Vz1zLZ$AhrX_tWWowex-F%KHuTj{rJa=dIzzL*UFOFSC6H!zgL_Rbz0&x?Yj##{aWz~}Uv$!cRDo3XYLo{rAJ;(6 z;VEQ;Jy#_=uNp>&a;{`m{ib~!O~b*9WsmuC*T@dvK*m|YMc!%<&Jc2xODwVSRSs7_ zE@`9*c(qRCi~XCR(8CA5RlbuuumAu$82?4<_NU-nD9`G*)Jt-iUHXLk+d^damfKEMX$Tr;|KmGhej^)e0zQT#` zCl*9L>d7{B`L9B=wZrJh|8p_1qeaq07Kw6J@z*e6#QgOGxFZVEDN&$YQC)@#*45hB zHwTR}ZSNy^{1QCHw+{YEBYK=+3;40)c?=AcqeuA=LxK@KI1?)0Tx3ECO&oLJnu(!O3u(d9 z8DkaOoATIB#0(80H3e*LF%Giy*{3%-)8G~}1g%;%w=wW6lA=}F$4c*Wb? zM(W0@m5ipTvZ7;$oPLy`kO|B_^8Yo~e}$iazy4_ectCtH4O;kr@mdUkHPkXQcg;qM#LCi6rWEMwIUXlluE*|F(J$L&`7|?) z+W)o!YisXitbw)5#dFU@aX$iI-TrH-|Nmv<9(__|KeOed>S3Sm2E=zcH~pS$%tzvD zZ_R!IcAu~)itetPK8QqcjLP|q(s@|+@;tS~OI&XhDzc{4dDk$*GxyVTG8J*6qvAs5 zmp5$F3zX@O>Ldz5hDmNkb#`~a2liswcjNyn2sDZxv2{Zk;PPx&{ z;Qh^xzDTpLOgC)2>JAQ3V{+5f+*}IZO_UXVO|6HvShMJ=lcC8&J}f9bR#3SNy`QoI z4IQcdXAX#)I;Ym5Pd-hSCyji)zXI*`QN#mCUKf5t-~aa)*FZC)`c-rf+0bBmm^~li zPo944WPadJ?)(ex{l0Hz@V<`ow~r%tBXQ~AM-=RHq$e{A=Z}+$!{PNvk?p%-4gSV@{nf0n=DLhha)pmAV(cwq8Kbdh8^3#8@)FZrU`(x816=tJaMv5kv^U6)cq5LLYSdekMlJ&b@N-RHRLXt^?aM^n%1e2AIMHA zD)$Er#BHOlH-N%j;=_97&*6p)5IBBq9w-6%%r4%2rHrwWr|e)L_lRqJ>yJ!wwOpUf z=Z3D99IQdAF>pDZjC=BVKbfl9GD9B4I)i!YGw_+Z}86HlOpr}q@Ab7WPza#FA81}_e}A|98Ft+T0Q)7@Uc*rn^JB3Tc6 z3KXdDTIdGFAUk+K|$sO+!0S-91dEK(Bd&JJ7FNo9;Ff zbpWk?T!{D87nCL1fCD07TSuO;*nw=x<_D7zmUU-~uSn^-jzw98CU1lR z4d$ZI{Xf?u7vUyk@jofWmUv1F#_2+rr&%}NSC%!~shYDN~nwmZi2^b$dHO^YNMLx{4!O zEB>^wfVwPbYS1DD@dJCSmCeaVsGqi9Zu`^I(|16oyXK%U`)wmw)@-w5+oYh!`)>VzIhujKhiv^|b zgk(8Owb2Z^=xowWY0JKXvh>x~u}{{`K-($jPQ;t$G38zH^4%gfdc zHAX|zW(U=(!W7%4NoG72*6PT`=j2JE$m8LCW?SEqD7u;N;=T{aei_$h2!0l3iL{UiKULqpQfkUfjhbK94 z2{^>-<_IRpC*#T!)W|bmapMk#ZqF9O`yZfbYo?S*9XH=@!+;W6**~=p)0y z76!3JNFcGA+@uxHU7+J6_g1PUf^2u2-B`m0aLp zqTy$O#lo26$mdgpGhky@oUhKA1*Hp~?*(VP-Y=g$c)1k;3q<<5Hl*zcH{6d#_}Wx< zw&m;_T=cBNb#~Z8W{P-Q=}Te^r;|Tcz^{s@#>RKaa6{5x>GkiU+ z;IqWrVXTH(e%WtO$XcPR4rVaQn41;S%y;U%&vNbHT&L~y&2mJbwgm=wg^Hg!u?GbA z`jxLzBN+d&1Ef-x@FGb4Nn-4o0r_t!%|SnpH~U&Rrhi0~zcvVmOrh8tH}O!B4}_u~rt$Btb$ZD*+ok zwxYAS&f^w}C3NJBUiZZxGeD^%=o=Kkz#B_c;RO8tW`ESK?Ha-;-P93qr=tvabUznxHYve^Q&-vYEpYT`CPqZsa4T&IeVxalM09X zAD3losl36{rKEU>-w2@wF~pL|Rf)=6TB421cWYD&!v}BLjlf{%Ru}91;2g%Qp$b?Y z@t z5J5n^C$`8to<90JIyw@rXaAv2R6qgdgij0{UYkVWp6W3hWYQl;7hCC#rH-iyiATMA zs&A^10>Mcz)ECy$CP0cfy+_Enf?!`syf-k}wT3KX33-hE3|XFNR3&c3noC6%Q( zq}M{nx5;{Z6kjlV#hq?piLQ1SK93s`mwXZ#gS~*;536sULgKzj$CxdiZzD@uAA%olby=p9ROq z2y%-FobGQIHCSFfeYAITBMp0QRmyEib@uG20F10`+5dIO9+qFka|q8NeLa@nC)N2r z8|U87@qvSjwtmYWpJSi#rw~N>U;zzI9C->u+*;*!8~jX?S;#^K2wBo;6&%SfWX^EY znqirYqkE{B-OnB-?`LKT9#tnhx(;@@a_+kI``XJIdzYu*|@n;1EDv+mW;9C0J?>~xj)yQs~CDAmN z($HwHV%oTlFGWLpq11*$N?Hf_WVdeMzLO3y{c2_jwwS_-D~{(2wzSUvRZeBJ~>X_a35p# z#Jk}{cp>Dz9fL6)JN1VgLrTp^nNR3S z`GS|pgh|=;Nzy&a!V|k0W36+2oWmB_rsf8(A$F(|j})J-cb`Wf{6=Cp0m1FQP&aKu> zgPIto#_41bB2z4OjZo7amZsHRlrLzv78$>kcsfc7bqGiN_$|9MFEF`SKB0S}+okSM z8Ph0FUzkwrYq`BNu~ ziiE_74BShE|G5E$x)_zH8b4m&fgTM+eq$(lIf{~L31M=`qUD{5{bHeWDa*AyX}T+&}o!PPWmur`KyA0Q$vj_ZHKh2t5|O zH#nghF)o^G-gGe344n@mfx~;mh%#RW!i6y)d+bmc#Azt*K7G@@r}|a3FAU2ze$IpO zlM(3|t``Pk$0kVy^;2pkLo!N0aNNSlNlV(uNQb2DnTl+{tE+fOS_R>WSBvo)X3O`@ z5C2MPeb+C6Pr=tgpmN5M^P|XaD7U0cZ-;qMW=sL+*if9uOi`}&3v((Q>vmaal(qd) zT2i*QrGPR!eU5%P3{ORmLQpZVft5%4`bhLa*U^xuC<_?3xW+yV$X?_?!$5u>r#<*1 zR}q#r6CE?MzFlZBCG#f*FG>@oWcKkVEx|}!Im53*J->6q9-<*pMi4*m4%>u{rY<&< zpw;KZpW3I_o+#~YlSswFHGa8exmz4YXCh0 zz5JL(jg_r|=gd;r_((nLvh_H>%)85Bq3$hy_7(^0g@=spUzajnm@;OOXkr?EC4pGLLzM7L5Z=KGgh7WArQ zfq}*1!xt(DESdsqv>T{EiXSn~2vY?RT%RYa6}%gJ{Z@@)OSw5AI4>;}C3%Pwuw7iqdQy_t=KaCjPL2;&1QEzVWV z+BJkrf7aWy0@k!Xsx;3YKT>Nmew6u(e4rCNx zcUk&$PTm$e!dHAM9e(ny0~^Q|`Jr^%BRrQ-u=AwLI=O0(yPOXu1KRwexL0qey4vO% z+HLr{*}IqCi&lZ-OaYNR9GFZZUCja}%G1}D=7kB-lAg0~+}RKydO!UACw+Kx{8^r7 z;Q3{EhGvtVEldKOR5BLPiV~l>TsnNY*g76H9QL7`k0VZ?!~3h{ylzhvzMbKBEY=&z z8+S70U4eQlQkt}1a!u#$d|;bR6&k$1GaMcm7S7il=RP-+ zcI@K4@Uge^k|xF3vozcC&=mEMrRi1YPgXuBM!>JmFLc0w`Y0(G8z73~b>*6Aj2lqL z+M*MfWXQ5RexTqS-f7IM8UUV<^*^|+KhcHnF13ASY;h5Fs8aboqyiZ&fP zDOt9a8X1#&g7@wV8?(pG%lhk`>@9nqopb#0B*7&-h`YfTQ2s~YjX&_bqH&dSy7pPO zd>f0qRyh{@IV!Q0&Fbk}v3%>N+WdlkG%Q5;Ynv^W(37Ruz^+g_EH+YGtZ{7mk7?}O zjQ4H@b$6Y!+=vPRrY^;uE*RWqFU6+T}jqP zSL2@yjLQlt53o8HRk&W51~3CTQ2SQTXWm2yPICnbvHN4bSxY~1h#h2nq0UK$}N zl9M!;xcPMQqzyh~<=liT-Io<*@EX|e%S&Qp$gNmEy7N{7mzPsDg^#P7kaKu~8Ga&o>lYVyVzj;|b5cY3%qf zu5h`!8#8LIQRVLOl^M&&z|(oZNds$z#D6qxqi5k?`Fc2VP+N04Z&)VmIH;3tpkuyd z3jCCfi!H*nFg2Mhq$5zSL|m-CDkE<7wBJ?Wap|-hHQkMk8J}v*KMUwMRxP_9f+kxG z@$wAS06s0M$Sf~O%ibJrvj%qWOG%BAX00gFy%jywK>*jv72Zp)QLL2BSOn`Hlt-I)RnYI?z6aNC)dYGfHW`eOHuT zeR@ipIK58FK1ha1h5P95LXnudxaptmW9+E-MWMn^*0*2f0lIBXMCj0((ShWy4}H~h zI|lB(c8ZJ=P{SDY(>J1{3pkrSwl_zfO_9kRWd6X)WD3huX8BKn$4e1Ol1AjCV6TllU5DCe z6-cE=9I}hTbvJNDlPX_ZV{9UB+X26Kyg9dY#x%wA>+N4FKjMFufM&}Yt;HAXY24(o zQ`_ZpAiiGnba2NUIr#Gj@F-Gx3tQTjNQa&j%EYQOI~Ga0O5gK(*O?5lOUAQuXm!;% z4e|pQuJQrdaFvRCifNHK107W81vfgVM5rcwwfF6jnU>L%u;s+0O22jkPd+@cs|@t; zf%X@^xbNk2ulDbxKeKdG&3$Bfy?th|!ocB8`%fZPwh(xtluFhJ!+SseEMiBzyg!jA z-Jtgua>exd(8n@h$p^RbjDkLA4Yv<|Y)oztM&GMzj-MQM|cxT7A%I) z=ykfw8ia}YWc@&r93(!0ulDaezRv^B>sAhUHg;0`C-$t@Ul#?z{!YJ=UClZZ`>x1a z0)jv$H#cZ@{|+*%m}nlzo%}TGQVcur|2Qq(bpwB?tmN9Wg%aNW{_Vwzu5i! zu85UreXlm&%&vfFMsUva_Z!>}CE@&hxxI^^NIOValGmKiB_r=+U6RLO?G5NT#jP(w0&dx>UO6dd zeM$onD+^#|<_=qhPn25Ur!}C24CYFeA~ac45drda5uP+5nO|vbR?k}40cxYA8y16h z0vObnu8gdbt7`A{g3mCWMIjaoSC;}!r*c19+XBer{l(7n>8v;tbP+?iF6;>cV+ow$ zEJ!@Syy|ZF@jHK#gDn7|oTiqB4n^z5al|NP6fSFrE$UPftd@;tOj?6rtco(lHX1vR zJV&0NqI*X5e7oHm7s@TdA3FbVq!EAqDwTmE;sj)g-Ox{+$d3!67iDEfGQBqd(>0+B z5S9<}>zsVpgp_gPoKS)DO@z&YdNQ2MnV<8!tvDgLIh%|6Zo6U3?kaa%Wu3voHoRXx z$p`^C%p!|^33r>+bDf@G#ZGIBeN0pqrKUA1I;{wY$p~5y$nEiJ&yd8b<#0*vBRJ({ z1U$9^`&8_7UU7fhaE}`ncn#%XJN&wkX2=!ui#{Qiqvd}_HP_-H!a?JpH9H3t2>%Y|p7=%F&gLo8P)Y(aQ`*uJ$%~M9uL6#UH)cyTTG0BK`1a!l~y-amCreYFaz0p-hsVGV9$zO9*!ZfLd zGC@esm;s(u@A4%5641fgw|R)5i<6SZG&i@%?rDB~3rXL(DdqOGWt_XET0?ESmLDUh zw$Vwn#3ui^QCfV8ZQ1ehq1|pdt~DC0r%u%mC@-pU>CUTfzzr-@k~<9K+9fIiRBXT- zP*WKh3UNwVVq+Y`P``h4Wseu7e-&I^jegBha<}UU=7j`*O9J~Zs?h{ag0B70 z$&>dn?*UKnX`hVsMB$XCpQ@TrPXH&#uZ2nVvrBMu8n8hqm*2DDasijb+g<=n9the#O3ye)k^q%iHPv5BNPn=2cOQQ*a4wv_GuhErpqnPHMn5h51H`4exrk40tS zrC|kCE|&n+ErM2KnZ1NhF!t4a5-R|CFlWLLUd)H!Jz#j(9t+`|s8YCSUX<9Ov)7b~ zdt9u29(l@^R`!?aBjS3h$bd%`eSEp*I6~kGLho?#t$6^`I9jx8LKnL3JAd+m%O8b_HXg38z- z=xxUYzKO{nF)&4n5_+v^kAg7xOXFFWBuwL5fNA7YLG7ERBi{H{YmD%dB8nXcu#?E9 z-%CgZXTqEyb;Kqm2vvGoMrMF7is*M{C+Lqo-1ZRNeQNeTD;L=O2Vmv+654B!Dl>5C z#KFEt3G;#n3X+8gjMTF2Hb$fGITFtW$+;dfV^8_AlRA(9yR>^PQ9vV|Yf`Q8Kp7-G z10M{EIXEoj&vF&@Rc8tyfq^Ls;dN%*GdN5UC}?+Kyyt8_heHr+#+-_W(5mFY$ijE- z;w5(ggmf8x0VTzKDWpI*so!(T=EwZz)9U9j;^#5p+oHY~TIZ+!$MEJSq@PthyGzZK z_%KC6wnwHsHww;6F8F!j@ zU#iXF8tvE<=rAIP{GhUT?%jjE4cK8@Iw3(i%>RQGNQ<5|e%yBgPM_@{JJgLs>?&|N z>P`E0aiu1$^j{C`_=`*VG%tEZ9v3e4JM7+~BAwQHeoV^-LGcGzbH_>eY}wu4fS*>a zv8=-mu%Ox>D~z2Grl73fBBMncHYb*JhpN0yw1Ze9DW}t{9*B5Re{>;s-j076uq8Ie zG6yudRdyuQ;f-P>x3C-7u zIdN?sy#*F}OdwqR*AH`b`F3&1j__V2dwCgt_bFt5$Dnz#Nqqjkka)4`_fYGny*cGx zvlc25u{;aU_gNaWZhQZN1UNa6s6t!A*~KR&0%jg>|IG>>W`y$u=p|#f9MKsC3^gZj3VWq%7tA z!!O5R^g_Qtb3CVOtI-2*6j_hR% zat|aybw>kW_W0^c<)pOPR4mUCIvq3}hLZ81Yms{XZev*G?GyYu4`2S-4#i>flFe@i6qVwuSkwAXs(!%e$nTH{BZhr4=SI!+-K zesz`N3cCcNdlXQe*qW8EUOUImeJGCfzB1PnZ)#*=D00CWKc@Uw(8@f!Sy%k=3sDa# zE7d=;)q4QS=hGONlg}G&t{01FJ-ImI!$pgaroclLIa4JsU2wNcSn$X8Y)X`L3;|iR za23;4j%uCi$UJm|tPjz$#6-mbjmqvA{5_7qjgcQIT%?bf$#>5kWz2vfq^Elq*wu7l z0?7#AYN7#U&M%FfuRQ2reuB*HEBQ~Z?Qaa%+2iSclI%Kf2a|r44S);d=0Qe!`1d!{ zPLaMA{p%l-=}u=8jj$C@&d)A%r6kKpR0Z&?Z=-=vOmN}TM9XN|KADhxK@`4uDHhOm)UWf6V(6;B{tygxK?qBTr%EAoJN;lZfL&1Tb z33t3KEy+Zo-Ox3zl-$Fm1PEe&MPe=is=Bgea+4#00eU9|{PWL=OmtY#!{ykZ_8 z`1|{PDF{j!{u5_@8#=++vEE+a51o8AR4iPJotMEPW^~r7{ABn5)<1)C?Y=~rO;|8y z!P`f$j$=fcH7P_CIT1~mC~gGPEkbm=`;D=M7P%S|W68Qffs%7+on}u!OC6|h_5Sh? zlB4v+XbIG6TU_8{8@RNX0v`8+nDlL*5383STS=Ebr>lOx?<;JraKQEOa#MAI>ASn`?8dGO5}di#>{+_C^%RWE~3JUuv%}_?YeZ)Tx(Q zZ_rsH_K6lm%v=t^)oHn4eCHq;KqpnY^x>w>S@94CQJZ#wW#e|+;wv7_V|Ze0pAw<% zBQ-(rEYi&r8dA10&>s{#ybts2&7VGg;MnXatC(|{lld0 zEdV0mXipu|)P@|eLVz&vYlwn9{Oe9?KTyQv{_t-A*KHl>ga{O*8yAY7W8&H^GQt3= zehSB(%ZTS<8Un|4s<=H|-6VqYIy)Lknr)1(;pG|zo=7j#oxzLO+L$AixK2@(4wbU4`}1@m zKM}D#EfSo2V3W?Z;##7C{I{b>q3q%@1=gc$QK2b@L?2pkvMHdyEa!WdVGTHFU$Q{W z7$*KcM$xP}41(VQjT&gY6!I1+p#{od**qJya5+g>Kl3tNBqHyN7hew@H1_VX5 zHE*VLa5KJ7!tIC%b!L84CE$Q##FUKPh5abGyRhEADpheiy@A^h?= zNYSJ;9vV~glhr#PJP-TE1{%5x746PTh$wAWlCGPqTqzQRh!G-rP(nxuDj9yWN`>G+ zdZN)pRPb3r3v1q2?9RSED@}aUPmyp7RG@|x452G=cbT-}#ye{piNCN0Ts(tHfXW8r z7n&f*=hXeNhjGi-B|CITmR&HXHoSDdOm~A=*3-w5Ps{uGv%bCXpKw2B^ud%hjBxgG z*OW;@pQk$%Sb z^H2tKV&9RzF%skx8WcPXlPrV2NMK9gndeg`>jB$7ca0%OAZl&N?H#}Rl~B?r;Q$JP z$X)39$@_8r|*6`-_USCgGpfj0Qd8vLo#^)aNs=8S~piW&Y1KHW7^-o8ko;jtGMZN`r3HH zZP$Kpc|PVzY)sJNRk33`9yr2-Qoop&xYprOeV{l0{&2hw*1vxFmO`ioSJKe8-VTp5 z-(5dismea5>-k8nY5;G^u~NBNVP(_lvEQ>-$`-rR5_~N!`1uTr%|pTo`95G_pOw}1@`ov!5luOnwQuF>9|&8P#6Db{UHzV zX_absX2{~WrT1N z1!_~}d-jc|4Sny=dG*bcoJf*tG#pV>B8K)ysmVIVcv=mzw{0z!&X?Iy=5P!eL-bAyxunLxeX>q+Ta{B zPdK>09^QZamUp~K{?n8hLBDv$GE+A4I`437M9M9cTR#V)UI?pWhP3Q1dOfbf{Ta4E zL)gVaAtBgjJlr;U>K$pO%VU2ur8bWp+hrr{GmfJ8n0snAiUCgX$G0xxCuJFj?&z7# z)aK?qU&VTl*5=T}+YknC2kL`YW$|^EAxaJpLdYVQ_P_#lu7%{;Y|uANMQF$D z`c{c>#Ml1RPn)Di`f&XA`e?JstIvC|w>wok{Kb_~Khk#xF)(Djx+jM8DYGQ(HZ=Nz z7x!gXJjQgEXaUQ|XEaL$mEsVzKxx|l*USt*Z&MGtY~9t>x%8kN;~w`#7uyKTbaC*H zd;cilUs9k^aj0Bch@d=31KEhM1UM3z^QjO@2;EsPjfV~Tp3!eJ^23!el_c95#4!3=Odt2t6@K5>QnVu9=Ej7D%;O*-1 zgLCe4IwmgmY1K3`t(zTR<@EL4?!V1q+)bAe@|vGpG&z)H)tN5mf4or$U?1VNcvP55 zTJ6-kPHVij{=6PIp=Wln-JP;guaJw0QB$vH5*h71Pf?G;UTT|J=&!@whhJpiXt;N& zUpu5Z$Jy?i$5nrM@hWX8)?%pR^0;jGtTC0IThOdnQPr`yU79TlB=itCkRt*I^NoO#_rl9CDkW=`7FZ36e`s^;d3U)-R5scVk)O~3i- z-6B|Y>h{7*9Y-wv#CA>@4_W*%{Zg-t&>YabEOFpPS2}>Z2plg~FI=Ja*-uaGWiNk_ z27E=-SOn;0=vDg@AKk+I7pP&x3y5cGigUVJ^p)}Pu!oO8I=3Uu3v$@hpJ|(;bT@Gj zAPDBC42$_@Kjl_eh8RK=yJ0@nY`_^8V$>=f6;1`{#vbjP<=_3F&8+Sya9!~cjFrt( zxw42NOQlbh;zo#-IrxDCPtyde0wWBlYj);QPNW)+;71ULw=7tV{qFl1HxM!~`;q4} z@D${(j4RH9%?i-f&G<7$Bin6F{Iz-98n8EH&T<_4W_y`4fCNWG)Y@x*G-kp=zF+81 zabndxuI9;Xui4nNEu;V{`A3BBd>1ufTEbnwMj|z1lTEBfQl*xvfH4R%G&JY?Zx+{r zguX2qddu-@>oxudU%K#W3A2a_J=V-I2w6zyo4uJD_N<8@8;J8bDxB~l!#LSgjTV#d zBS~HI4>x`P>rWstt5z@cFc@|be0hygQZ4oGVSzF_9Z|)wc8dr1o{~^DcV$IVw5U1& z9-Re#_>uU=xTwAAma+n8T;DxL#I~9o1#G_zf|~~|n((#?k?v5R@--Hy_%0P|!swn; zIH^e6w?vum60}jqO3#Lczd{tjrO=s!X*u~WjjVhJ8b#J zp!#IlKf_XDfj2_-NMDXSs2s5(sj9CkbWDG3NurDR%;wCprm{z8_(c@y)TE~<)}|@I z8w(0>Xw0iEW2Ss9gCThMN-sNX^F)y@7H__^^y#}B!WOd+8-8OY(FdIzi!I>xCJ}EB zO01VC#2l^z(H)D2CYUYXq45RtO1uB8m;Y6OaK!6rPm8o!hWwGLmOznukL8&5qa-83 zo|86V_{sZXAOue|9MAw%qv5{gBEySSh?T8d`|*~Omo4s(lQMVyLBYTaxHZpkAHLs4 z^9GspWMa+g4t`vU*T4C07`ByN3txnYxvRMW^^@e+qN#&d&%XNaADnm&*k=LX z&zx*7{+fbr&%kwL1`!tec?tAuI_|G!Irqzi03!v;LvAt@33Af(H6*)L9@3%v8wvbE zOxOq_Mo-V?4eAYaPhEqm|qt3|FSc(>rYC5GhYanNpZ_sIV@2!rZE0hG}G*5OWx zDY`v=8w8X0yVmUd-o>Bc|>HW z_G^~iyHG`T`kW0h(zxX`r6mP?>hkQOc;#}~8eAyvM3Q=~J3yZCvlycowvb%Z-QXd& zRXTo+9!5S1knY@yg%KqDB*2U(V~-!*i)gkc-D==k%dzK77<4S&v~;7md1?UdZNxe3 zTTvm8We}sylx!(iV~{CNWx%MVnmcta7;z$?z=+;{=&!vn%)z<|y`s{KRUg7Mt=-oJ z1!16U@>e#8!8|YOSC{BIWc}N`0)+(Ke9bB?ZoF;0Q}xAFqBarRg~<=e*TPnP&E$p? z)QQqFs@Dg+KEA6Nl;l1;R4sHz-w+??>Rq7b08JJp&l~q~f&)_$kFHp~N+H9Fw)r{) z<;d`Ej){Y~;%u<^32R~6%8MFYOPeaH^TksyePEcK_cvZ;+8EWwYUQr5h1{oFt5#*W z=6fXp3nPWda%~#%aO3!Ar(dJGLq>2n{T?@R2z84PIp!Ddr<2?n zO-e%|&w&;5j~DaKh%0{*<+vS+N-U~AY*{peyqCKFe<)FOkP5X+>)QS^NLM5@5LZC_ zn`K#xYHzMjzg0nSO6AKcK(ljK$HBaiv??>w1*J@)oF!r#8I5l zYoet(_?GM&>QLeKVDHjU8~d}egF$c4=Jn@@$wWl_6hp``MN2~_B5X3t0z%=KXOm}< z593dRuX*m~p2K;%X?x*UsjyLs6IszrD-*TJ@u5-D=jABL1cT88LS(wAR@C0`W32;e z+hw;{7*(y#tvdh!f>lEuyM(&dEY&M}v#fjZz8f?96&X>xyQ`~w_hp4q=`|0i(s`Dc=>!V~5a9NY3*6rb z5kp9sER2ekyFw|s!!b%^C(&8wh3boZAY=Ejw6V$>{!JzoudeOq>*8LZK#Q%G+MD21 zR(2Z0h_jk~mYG4OBtc8@4beH;es=JgA;hHjrSMgDw^oPVFQ=@`s~-vzOq;`2-7zI7 zkM6vjPJEwxmaglP$oBkFj$22{I*O&}& z@|Nf-PzoR1E=dxhV*M~MojEqCb~eJ_qykcf|7h@szh*$=MY95>yd`$W1j`NHmZEAu zf0`xpS^$R=UTqkb`pakuo6_eM9v_iggQ7gB%W?*R*FaCttW1AchfZsUG?|?0=T{0l z9Fv}z=3|GIwuQ*TUf&`TG>6vA{dnU}Ri_`sS{}WqD?ZRZ-WhEMSEfjn%iG)?ZZov( z@-|u{ffQ)DY8P;+GI=zaeO~+?ho1XW;C8l_in-L6^tBXdmn9il{_CiM_z1NE;pjge zbNHedtQyjUORT&0V4Cr9rCDYZlxJxJa3u-Do9~AEWh=;H%m75u3U$VhLDu4W-cE|| zA9qK^PyX&q3};NZpihHJHUI=azd9%>#t85c@59+ z6W@$NW7u5m;2PfoAfqowq{5@(tmDcNh&CAR+I~pZ88C}%xVnRVFke_CV;*+R4bp7r zGlmh~C!XWlbT%>U&(X66;A0NzB(GQCBc~M9LFlBhK}e%e3Sh&Xa1>g=Wnv1HMESaz z*$FcbqKMasHX6RX`n?U(&D}c|tT3PgH}Ygmh7>c4#Lgf}c0qNNs1g&s`)?uvzuaka zPP`b3FgtRPtDb+Ot3cIi8C333V)_}Mm(C-gn?)xq&$5ulV(SqU-4kQ9>EPg`5!ajL z4xMl-H#vo7a<@xy@A+<>m?I6ms@hYBw_O+3cgw;tMeVt0p7R%MneBYrs;#=MbbWWV z1@fww+%{jX$MlZE99|jp+iNTvOAcd+My z@ndYqXM2E!Ywv!e7WV6xQ86nYj_lT{r$5?+Rq8&EkQIr~AFY?F@&J#dH}%h*)j%25 zH>1mHUbBuU(1~<6bn;6E^NHNwA!i>F+oMK5K(@+&nNH2Iv(Qh1DV^2~`!Zg1E(RwX z{T!7p3L&TZA0GWVu8n}|%O7qfg$}$}Q|#*=RV7L)x*bMTn6lh`y#h}IxTMt2H>V7Z z)nOM|RVXul&t7(Fckz%`8}6qk2U+DWrgT9D5g#L7B-)m0v+YFKfPjb56f7wru-W@Y zND--zE?q~>uJMG?*Ql)0Zdth74X^hZIdCVsgbP>Z6!ZH{k9T?(!@Y5Jy~DFoFNV#H zpsGHC`}5a4=)N`YL%{W@seT4S-rta|6#Ty~A7IAck^Oe&>pBx$Bsa&UelzV1kGt$5 z!=my$&V9~CGQ&Q&&m-_N&Y>@elBd-5TidOs)Y_i`bE$ndUn7HV2IK(|uJfE(Lk`IH zKXslb=98C&>($I^An$)hoT?hYXrn_g9S#wU4exLcmEstThj>xm|hM zMlq}+YDUAW3=_1s7W#qp(mrmM@(MBT&e)4S?wklcTBT?|BGhX|^TVX3Z#GwB4-n(- z+UZ_Ki`6}DwAX!-c|*bdV>w6s_YSk~q4oN#PqEvuD+aX5r<7b%6&saRwB!PEQtJz; zcMLa9K5tVP2*9N@gjO9ZM-r*AMU5`?Jv$3rM(}U0hw0o1=Ma?4_`(y2M}PTNT-%Du zN>`dMrn>?bR2xJYt$muFH-;LLH`ir!2U5a+@4>rWtW_2t{ej-~kXdrG)4G_s_G&R( zM8p(ZmE^%Pwd>fh{?1qyb@M|ZBZx1*@Ku$qLb-fgW@6T@)|26yK6;%#{G>~ToKK2-tlhsihUsbrXAm6N6i z1e6=k!0H-Dr!S4Ogn|TqJXE-`oVo<8x?PL11!0(azyt;A1ctqt31lgkiO|9+P7qU_YB;;sT#`wWGwx1vc z@PxF2eL)`aZ|h5p86WOa+xCpf)MV{AA1w!xFVYc%Z`-jA1bRPz%H7RA+Wbx``!NOzX2#}X9^1+TLi&UdGKy?ZVul2 z<9)pJZvIF7%qbCsJUPFI4r<&%WjIL*5w*|go7T9o_G(*%2%Wor-Qc^lYf9!SnUZ?h z!*p^{CIa&TT(dXK)(Ryc`_Li#F7&2AzO#vGR zZa~u{XCH~GbcyXE1%6-FgR16h-2F!oB!aOfrLQR3U`a5?e+ExrvYf|N#)Q-&SuiNngajO4Os=BzDA8WL z`Mo*!5Vu3K$Bmny?1VOCD`Et7`QxT+VEB6aGRCgTkB-zC4hK_bj&rVM*1KoL# z_?T?H2z;$p6}(|w>LTS_@H>gDsyg^Z&}tY5X{B1)IHx?J;w8I2Ze^Z`V=*oSJW74+ zCFjQBYy?x2GK4{6Wneb4s%-Gu1WWX3onFlmq)U#=b;3Tn@c8S@>ym@L9l{RUJg?ha zhsxJbm7VoBAMFbl{L-u!>qhG(mADoj3LH&G@E#!mpWAiQ8EW~yG_`}Bjo^)tgVKP) zkQhzXE{AU^w(eJm&Q{45cdI3hRs?s`uC$)~E^XC?j^?J2*Jo{yD~R;0a>cGGEzOYq zaD9aCO?et?)E56Z5^@*jiqFQTN7 z!%fQ3bQSMTKP7la&N_4!na4A-+8!UWfqq*pHtk(}_@w%Z(?SXE1ETx-&F1+oOsjR@ z_3!eByG4Fcz1v81;a34dIe)kna-bY2oQwI_HkRopAwl?I{;$~#^Y=jPfthGV)`QqU zi(|SZHeSZMuKq4;EHV4=UCT<1SS}sS0~TCdn){T7kaeJ&rCCEvV);WF^u;ws4Uy4p zEW<{JHq(eE4_X9v!bq4wPDNIt6Rwl2_Bu3pujN17%oCH-n(*qjz!h(dQmFHOSdyCNZ(LO=GL0Z|Io( z)J1Zq87~2+nOZ%DT#c*VO;qO<1R_%h=)%U<8TU{6! z*D|Ka{rIrwA<9f^0_4-Nc!zgpr6U;JZ1|HhrNg3=p&)j{(p*YI@>`J~+o1K}l`WCcr>upi#u+gF)cNX{=U$SKJd z%EZ!MnJ&zG!6vt{jLCz?5K7NeE>rTIty|IkfIn#Gt6V=JiYrlJwwl%101aumiwfyS ziXflWtPK-jDT%;Z22PjW$q~b8*(_TFMQY=H_JjdG{lOOLUydK zLz;#%GOT)K`e?Xy-UzX7LHewPRsc3cS%u=cXA{|GG%Tmf>lMhb4vrWuEuzO!>!M%nMapB1u+UyMa8-!)RVD>i{TGk6Bfs;MK3-^TLMdlA^o@Qs>Y4_tltb<2l_d@f zw>kilLpF7~Ov&6VgIMPlHTW_pO-&0a`q*jBkXdUUXd_a^c}`N5OP}zaco5zO0y$_D zwB;gp!r_(zu$s?;x#0Or_gHOL+fcNknS;9{mP;eNp2XSt#}{#9Fp9M5_HXXzpUHJu zb2hePWMuEz*6{S_FK1rWD+Wy_j-2o3V>3ROo-Q*dcXyBNN>orH`=%w(vYUt#j_dk- zfs6A`LofMNr>Dj9m0qvY=c{~J>FJ=w9Zln<-{U+-$Mr~TsF;|1@|TQgUV5=tzo_DatM& zrHNEAj7W@lir4LWE<<M&MZDnUh37ElszeStco8A!&P6K(mjtyKQ_*YaE055PhjH>6!`$IgeZzMN5n92 zXuJl@Fq=WQCje@#^QxO&Kj>(uTJpJ5B>7eOt2=;qD7>-G^QuX!Ja>aVfNyoh*?2;$P%3cu%pmxhQ(Dd&L;g*{*o1^7g`*}4u&Y~~>EC;g0DEVTRl{$CU)<*&~mJlF5vKrN%DnhiODc~W31?K(Z&dx#d}YRooeLUL~;_7cj~%39Eym zob$7__Fj8!b?*y;O_zm}-Y#+NL$ikXOMLg*&-b~^Q;X#8>Au_zkdGSw4BfIkT zDoO3v=F>Q4#@Nb$#%TW1YI2(ws=|Y2M?h4Jn){_T9$CB`OXO1|l}Jq6iM2O3CResB z{kipNMzwurYb)drtI>{1g;N{*Me^Q&p%CRVg_J2bU2Kt9Nm9;{{1}{6iTEX>K_P$d zzC!vh_X1`!C#NZqj6-tumtPDe`E_@$rNJ6f4N37f2Y){*^_qmW04RudrGE;x^el)U z&{InfJ(K3&Hhkg0o(ZtNZJ7;d;F-&*^QYI$Y>3S( zEWkE$4jb)vHfl&98td5y|MC9F$ni(i2<~hh{hB}*5QDjJm7*@(=L9LlLnlghynuWEkZF$-PmtE=2ly@GPw_&+# zi*eM#)Ut?SNS@x}p~2r7%zqS0*foN-`;QlW9OG+`EzQJUYb&#~51)Mtwjw+QwGdw> z_WQ}R+`Ko*tdunw^xCzj1dNa=-c4EOX?+BDUMnq37g`!Tfy55#YH>8I-N8Juyh0m4 z{E*dnO#)fQY0}~*dV+s6E}ZnGg~g>PhITbJdeu57HHxDUrX~8$ufEE?iFvNp$!Nti zLgHlSW)nSwT^8K{_*2(CqnU<~xCpe6LuG!m&;7Tt_TR)BlPTyXGU}Vp7O%AL)7$dX zlpwq6vetv%>t2p++rwq-U6dGR7WKN$<1YaZ?f2UHW533UHa&&hkqCl8Jjxl3?&pJhN!Uq6g0$;xGY7~-ikDVPsYf3PDv)LyBPJfa+MTA7X~@+yMh^rg{h6&+ zGR{zm%nR}_ki5#c29LiuZw>NgjjT~OHkhrUMk2cqJ$961*8hi;UTi}#U?H4h_H7E@ z4_Lk(Hr{qTU`zXM`C2wDUR>fm)`#lgy#*w35m!rE*d88}$d8uR-M-r$oEG>&)rL4j z7YveV<2@WT?2EQ(YH!bCV_uc}W}aRO)vdMHdqgsr#qjPQd_Qa6;o`|H04horXShPG04x&o@CKjPRDJYR)XrIt7I$hV3 zo_2Czz2fMt@i`vquMUd;L{7ba#dLps8*)wTcwKpXI}i4Ko&~J6EZ?Uw>Jb!yGDm$r z%v)-sUbt(Q3}JzV^a`zho|K!v@@q@{RLWlc~g&A!3qKic{;9$BZoZjCMauRxd z*q(-;9}x>45LW@xYTgwPAj=z5=;jZB=gL^%$me&k1RK2<-OulGy3hxbrjILX+=UYm zgLIlHh)kdIaep#Wn4;M+Bsl_gVD9DrSX@wVIB~y#y_n$;|F$dorA)W6V5e9(k3)oy zOLT~jx6g|Af$9pvbiEwc4ifCX7=jTle?9(};*u2(=ls_{;)g#=;Xj@Of8M}|Wi6$p!{=GGLrjNas?OlOaH~&j0Ja!RO-uvhfMZsbVqPqMf)m z_JG=|%;=T_Y{*=;W66DWQ&^}KLpW8ZD6jE@+q{8m*A9ajN!ASJV>U2WsXAGjG9U*+ zpcVsVG5yquyG>Ter)(sOavfNBdm;IiRJpSz#f%)TPkCUe*Hyofn@rKo)_+#zYjA9e zFozm-CBE|#AoKh}xX+3x;z7sX%w3M=&~?!}M%#Tm8BJA*8Y4J3_}-2VO`0;KVU*k; z6nDD|0^;L2;>Z7DtQ3zC0~&u(*8h#B2GIpQ98Aj=xLMiAVxlbcKc=3kG)TG-GCYaN zi;I}bzqPNp(g{sBOnL42fR5|Nj!cwzw6xN&)$Yn|dKBcPUziN_JkQt1)Yh6O3a&h; z&Zbq6#>y+sTQrVR-0U)^UH5dS_#$T36fXkKbTwJsjbEmuOqbhwN;|$?W#?o9t!WIH zm5dFQea}{SXUc+!rY5Ac97UGm$;GadoP{YfH1z4$@%n>rc-jVJ+2+v@0)GmB2aA`_ z6W)VobQaO1~GD98USpEm(@zaXRi$HPIG$RikYYnoA zL`=^QK@zfcK;{3P;Tee6?0UwzHIx=2P2V_P2bU4*Ak`8K>7z_-QAH{+Gq<#&_C~Ba z19hT`hT7{(4={U%KSVT2mS=&uIgGEFH-r3^Bo>z!_X+Zv;W{1*gHv>~>Yv1(NPZMd zFPEg4ck!88Nkt~|{`M86O)+5B80g`HwABMfq4XLsV>!OMkwTn*`}YH-m~^5I$+b>u@5SMrUiXS0Hq^Ip)n{2K%KP}AT6vQcUy%WLIzBD9-Fu_yoSZ}Xe zsQ(N8j&27@AB!f6M_66?x0G@@d>M`OPVVWkF!7uLe`;wOd}7s)Z=)EaSXJdl{*#lS zny&&9{#OrtSp!i*%wFo%IZW~R+PplIfMJ206MJy%{LdEfujJ^qKCm$-re~*?W-AZ9 zRg|`^AE#gpPK^`A>m$P=U2O%hCM~^_DJtJkrVfxa&erJ4%#9W?PMStsKo>H*4I6VW z*;ZQRQQzp06T;X!c7|V24j7~#H-mDi98@jl@5zSEn;{Gy>JE-f>zT~v3ZqsHSWa^_C2Wv#6?+jhf%xTpQs-t|X&5b|UkK4pXuF}5an z3XeAO4`%LhpfDQrvC}7yo%y+@e~X64S`Lbkp(h9oR~MlBu0%N~(*{eT+N&1$gEHc& zX*E%?D-EY;uwiT>+B{4cbr3leIT5u*y~zx@lOZC3Yg6=#F^ym$yVb9_A`Ybc+bPeH zTHf1eJ=+L!X>|_TLd8O^Ne9jZ_}a-Z`Oi78Uph^uZ6cy38|rnv`o(`AMK*;aA|i%E z<$R$<^W@K}`T%i``KK`ZpOtg}_1&AkaE={09{olZCIkfazaH;zZ`c2yt@%IjhAYr7 z+?@^0j!Q>k*AQjXfkeQ198XSj+B4GbK^DC;?mw6L(_ZASc)gm9DqoZ8LgBU7Z+#M> zMeUo~ySei7iuf|8UU^EW%#Z&gCZ5w1==%BT{MyBOdv%ORl7J(v7a&f%x-;pfMC27r$lG=i!JS|iMqc>O6z}2_l<^Ob|LFRfl>;2R8gsFU^ z)wOXYyx;vL0g3Diy`J;EJ6?zJ$t=j0dbEGlGNFZ1{4Kz>SG+wi)3bg{SdYs zb1tY*BjZl;sQ0MIPyXM>AK!Ohy+0=yxLC(NVE^XK7wjW3d^j$dc9p%GQ5G!v-O*)x zG2x*;z(4I9FD1CY6#dYy$<)}9C}Ni}R`B5f7Ld#un&{l@ehT7m+2EfOi0dnAox^F- z+~G3S2xW0XlBU_n;aFcwqt>;6^pw^dhKD%Vhda?}H88T}j%N?K-a?!jTZOUX1z^jL z7(Y-3DFFFDUaGRq&h`%&Z*{iV0ITcQ!o}THYy3<&k#5OC`j0wWG9}P~28;Zxztz{6 zE21_>7Hr~yL+z?nH}AgSEe`<617lH2xa-)Or$+n?!!ul@y^(awkqdXzbH_!kmi zf-Fbs-O`a2=8T}&B{P*HwhM;~c(j|AJaey4aUq(m%qv*7E7wCAXo+4e;g+zbWmkKR zhbJ4N?o7UQ^d^-h$|$zfqzxj~Up{GRX`nG2v=v1gcYb$#FSyZ|qiE^ImpNqQz;!IO z(=~csHz#{d@eYEI)-5vd0eOlC0x@JgX*wT@@To+0>c*g@UB{*CN9&J zrqAl0NP)rK(m`~rFCse7E63isB0iEwPn@0$_kNb9HG0`J+bj>ls33pV(B!2Z?+kLqa5q^3`p861OGZY8RWW*jxS$a@Eo3HJ}e zBVL98N&FwxMyj!zN4mR6@JRPJEAmA)w0(w-mZffk9J6y?MK!WDM|KOG9z1wFo{x7Y z?S@o24H>(i?>tS4taUl#CKnbLTbr6qo$-S_G!KJupB4jPZQCDbBN#H~c-@N%EzC@u z1J}khLA?Q2`R%-Ssk`RouaRNIUU!qJL!XbbRC%^e!R7LRR9K{&QEO?`@EBVBv`5dg z)e>F)>*Pq)#Z>&oLh|Zhs73T&ldf$sF9{mWttwJ6Wk)v)BzQDtRGs`g|Lhw)LuV_{_T@Ob2g4Jr-mowb7bJ0G{2KCwfU-w zRjCTC7lhEq8UIp+Pjrk4QY#Fuf52GyzjApH9o^WW{Q!prf)8EbdOD*=8u*iucdavq zdAvB}+8u|1rbulF;Y z{G->8n~V-?X`W>uBSQu%;WkyLuFHAnb85=&6c9c~7w3&HO&n z_D63}%!P~pyx-Qm{juemHN!EGbt{vXmEX0nsHg=ip_Dw~)_d)1Xg+z^Q@gZweN22) z*k=3LlN?cOFduik`pmbPnH44H8Hqy=;^%CEy>os<8fX6JtR3%y{Zwv#$G|e?Gql;1 z0dQlA=>CMu&?B#at}oQcmb@#TxD8j!HWqEikOVdNtggiSfWu!cMy1&`lS~-pJ&v7U4F_bM9 zD9fi4UEJje^u`L<5-(f2Rh0|1J&Chn#^Tc|j&POCIXuYEE1H&{8~`tuj*b5%-BbH{n1-i| zc!f^|&cm)dTzTbNKf%BO&)O+je=6KD+SI)fPRS{Y9odzW>tzj0(2my1Qy0RIFAfOr z8tcI28fap;Hs%(=ed1B~(bJ!~5knT#OW|K?VzGaP)rDo4>y{P%%=iIV@y5g)Y2o_S zoY6)mcwJh6&lM(_6CWzMbfk{btVGd2AYY+8A39Qrk8K9uo9Guq>TN$9>VxY?xD}uk zvp46@2tzPlFyx(u%xJxS?pC@@XT)QGHk(K_P_#FsnwQ8$FRB$TK6m5qaH}0iY?!mA zuf2)dzA(2s_%6{A@lf9h>P08~tHCusjwVd4#;Dt-1~vyo=Nu%A*Pf#@WRg??loaYV z{SNnoFp1V+VGVq|diT)vn6Tk-T-6fedSAa*M z)Diw^YCje#c@u9nrIN;NNY9os+ik_ralDe6{f8I>y)?SIhV`@Sc_L^F|YQ zy2%|qvBvUoU&+I_M8EoW`sh9BoE=ZgR~}l4y2rju&v6R0uH(+s@r8D^BR_62_IidI z9_oy@+owB*_>#BUw{!1FMQKGP?cm?*dokGOc-OUHFOvh^EO%qK*iKCJBHkza$@mxj z>jUbHu9cK-iw}zV*^e8HybQYL9BCu5eG4FhR>)qZ>Md zh=7RZc@Ds=NFOF~oKbLpcK&Gg6H0vu&@Rg)Zz3&=oxoOG2PiN2F1E&@FZGjp0f zRK(;+vsqh*`q!W^#kN{!V%ud8zb+eMjfoRAIdY?VDx&J9*aAu=*-%dVrQHOghM(qe3{-6cn&OtO5xEBvj_xA%qlO_yQr|mz z;)FXGrk}-#n}^EvS|X`v*u`vfo!3-HU8>rH)GQdrU%J1R?ZVu+v+r`b)+0~m>I1A} z<)9h8r)e4o_N40zEzI9Ri(r&$a_S1gGH4UADoN9Dryb490yqQN9EGv$(`ag%pdVz0 zjgfOJVP$WPa&*UfGj{c9jMO#q12eM*e8d>il8(dFKfDj`Lxa259D~>Ptw#bAA_&N} z2k;NyzTkW|StR2m-LQt2Q zZQtE_3W47dC!BvdWNH(GCqb4ae6o#nme|PC#->mcH6qp}dv69H!c5pqW7+27)@+;1 zL#;_u>L^M^ugU)!0P)ls`Gw_-?Pw)5d_bAe|EgcaJNFr%?$G~_2J8kBs{IO>=vVOC zEmSO8RT$cET}ZJrG*e&ALc4W4QVC&-qOJu^h~kmSaM(K6K7{TNa#mS&nV{53=*G!W z9?fCe$aW#h6+PH756OsO_i*{qqHhhumV8|ku#0l9l`Sari%cRoWmxcR4+=Oe`cY-@t7RBQaevS-yW-#Q)Ni?g6u9tQGauSZNK*aBJlsUid`)-CxyQ*hT%l|A?h%_Q2N`*Wz|}o8)B^$% zTJ2d{A@7GfE!R+<*Jly`;ZL266-t??ka98AQT~%#j+=}LN_Td*sAe1aO2~n@e}m&M3U(evwKm$FXNUQ-A#Cx zPRaDH=aMv5&@xMUMMTYMt$MDN5bb1ZrEw3ue{;)+ytB&VLa^vAR~*YkheIwVwY4P7 zM1r45SsWqE6@TO;73s@_)aH*VYFgG#d(^s-iqrqohU7FK}v#NN^{NSYj^Le zvsNx1*T?d))4ZkC!~P83QR$4WX3;z}uJq2(fY}$KRxaF{@;jEOe0;2wuP!#KFAa(szJ2g^H2xI;YNo zWrX8?p6k?mH0pC#k@y{qA{=)rw22_o{GPz?G<18s0%n(0o#1Hrk@sPYT$N zJ*@qfcH?z=6UEM+?XaP7;3ZU>4BC@U5UbSyU^qTBz7>B<(;{Ct!Te!yek8a%H(5OQ zn|+a0PmUUAacO1if{Qi*!8_@s09DQA|rS?1d z78#b3gECuWwX$iboX#Bw_qI&K8D?`+stga###%^-GjLBVSAn@^c*Ju#H%}-z{QNC> z9{c;Tv7OLY8kc(mR-j$y4x(QC?HG>=h_WXK<`IhE5>^_!{_}?&J{x)3rALN$U^`5) zT19J>aC6&F&zo~O<#RHJd%7x>3cY8S!J1q697pwd&F`1ZR6fV}y@eAdXV+IMe6r&B zz1W=ktC0a|-r8j-6GmsJ2AoB5WA*bp^YZhv&1|GvpC5W%T^-t~Gx{FpzAZOzM26B# ze0O8uDo>IxhEGJ8p6s!>P%B3=e(M~e{}rg&(=3fojCYK$enAzhLMwz$Po$649Bi89 z;#@v)4I)gx(kM1GfGH`~kk;9!^fWO(b-GrOBg=R%TazO%zFQc4b^{PcV4Ue`+0;pz z3Y6>JvXAR>0!9yP6-;Hry@zNAJ9oQ+*Agda3El45DGQXKryEP3t}F@FPw>7dD$kK( zmuF%F#fm?J3%*-%N6u9cR%kdmv!GVJ4GmEPBv-U6u3#2bb8CGqu)27^ek&}Gdy#!t{^cKH7ELYGx7W zCAlAdJ?odCO6<;74#g6rDJYEF~6n^ed?hHT-j832B7GZ_9Qslh4Oot2xx+`#HH~6!gDNzQw8s zw<|>kE?0;OpxQ6x?MtT=fA*`mX9;x^?%k_Rmf=XF$2bRN>cGE;fLMe11N%R%r|q4< z-*d#tP@;#50-wi;irz!4{(C{(iFAU;`UI?|+XLgstN$R%D-$RNu*cYYuB7|Kzsx@W z-upD6W&NxfO~8GZ#s;Szgw zKd$dxuRZcF`j*7 zN_iys9CF)*zVSB5^M-l5jq-;68sJ-f>CZgr0ddXVxd1&o`(+>?vk2THFrn0_EmeRX zQAH_6pFF8r;udLdzdL#jcgXw2jW=nY%W3ral<>&-J_1I&Y~~r#7x9`34sNiKLZE{Y zEu!vC@J;H^c2Pm0AGSdySmf=;{cs26$vH6j#=5xnko1{2nKbrxgb~s*)N%{|T7n@< z{@rm76jUF#^i|IlPCfC8&Pqci>IHS2w7ORA%pz&wSk(7wUbka&wzIp12vvi*VBh;G zSPM(?<4Muaa7xHAoF-I-7qjYw{w$Ae-VE@Z((_~N(I%_Xy6G7`R_`rBY@<5rDSau| zcNbQ72k*-jw!}?KnMe9Jx6veZzedjktsD$uDI3Wowvy}FszYjv@WxEUBy{ms*82~~ zid8vyx$>C!8GF|#Y&9W!z=ORck!N2(3br8x!)eT_jR9gs!Dyg(E3Ry-5wY@fk#EB} z1ys;786s~x2o~yRFRvp`?)JT3V~wO_JiXPnZK9`DgL8%vCS; z2@o>IQnmI{(*3>8VOXcAxcQ?BD<6lv$U15M)C73{HFO$~Z}+CtDA!#XBMT2b#9pqi z&?5J_rt50OTtTWO{(GEKA`M0AV%x&MCXu=pQc_rIjOEEBPJhW~s(*Ks2%6=#sLc$X z30mO;$BZJ=28}KRniZ6O19g+kw1|3%~yc4ZUnGIbjp(MGJ~^Ay$i7ObAL zGIlniQh-=%$%biBWkQc1$y+o~XxxCN6dpUB@J$BiRY1(b(&a)rRvJ=#nzu*GtMbLj-B`{&TjNmcLqd#4wN<{sUZR@kte+LI}@LOMuM_+reMz8Ij0&lzJUvis&!T$}D2&1MuMm2$ZQ$*tDEg*^y%G(;j zXI?bUWnj>H zQmWE!IHeanxW9pLsZ2)+wQIZMA+ikt0OO6#%bzZ`geGEEEMr{w4|UZygM@|py+A#$ z_U+@!(0^=^8`1uz+V^Nc&n?sIjw|(Ra67WO3@@M1zky-fRSy^#ssqz~5=`i`I*t$D z91mw`Ri3<@?s!y2v31}0luFd8)%5USUt`7Um8jzxy?-gu?1uf`(b$>w|8|JYTmH=f z$fpA6xv>yPs?@0yi(=FBaaQnm?Xwl_jPR&e0vnE9;=#-uf&_6o_ohoR_ag*Sv>A$2 zXx;fDwHc%-^zhISAl$J3gc@4?{S*-tT9G}vJ+xZ?L4Liv=kYwCt1~jx`b+gQ$>wi- z2?dHYqR_Z?Ig;Rx$Wtd+XPHvdWSYvlH|D2F?pw|;uoe`JH{?t8OvH|Nge6uyL?aze zuwQ2Fr8HwYF2Q7*AsF1yK4olAw{maPONS)Hp90A=$3KCj}~Q>2VE6t*6VgCI57~|J#;4|s{a--+urn7 zpqum9K&!K>sON*3v)o6p13)G@>Si%c-F|1qy?u`kq+IsHk1zpZL=8xN%U2C);`8s` z!Tl*laqI{j^;nFC(<#xQ@yJ;1Mzjbh15X4@P~)ltG=Hhm_!%N5qx5eRPo2lAV(;C2 zcoAo6+*>LsSr~@*P!pzKy;*l1pK?Km<5I&%SLroI-GJH7o&=TUBczVvDW1onrsouG zTyHJFf&;v_=RS<~PYXLtT2uJs>aL8u%|0IZEUJ&PVlu(WkS5fJC_Wpj_XatGI}VNu zvwK)zO?B3SOk&S2MtGJWcviJK|4$H`neWVtkDwifHfQ=oMM;&3?C{M$BylueBIT&3 z^;W%iT39;2K^F^2b6p3W32Sq2I$d4-F;_RT3eg@seM6Sd$Z z?1yqdMNyoHA+-0%v`oP%tK{S3)9$Y6?w-VImE*?NfHzJJd!pho9n#I6thF8D&g9Uk znC;qD%EaqKb(;r!-n=f(3E{vd=E7v)GG5hF2si)q96yt_WPIJyQNRi-8GlC4Q7r9; zlD-q?Juw(-ZxaAnPg`6ZSyT(v0gTsM9CGWID4!Un8YcdzOym#95;Ctm@r9fHV*Rk< z#5YqKkrw^ZnS{iI$=?wHNev8rBENtOIqiJ`WNj*gvh2}h&s;8Z-$FDbmn;(86!W9+ zd~X8;AKW@)0lY3HB6q}5h8#{jW9L+Dai0x|y?H87T8&iWhUz-jnhl9x-W|$0D-_(^ zY@eT>KR++ta6;Jq_uD=OJ|8d&c%3(eyKg#5HC7owH~*FxsE*?E@A-CoDmmmDlx5*e zI84-+W#%-}su1cXRa?)*Oxkh{fddX$BD>9AjR73b90}0`m+_YlYJP+=0ys7i=#B_r8l8ZW+2B<)=)!#pb1&6 zq0x*PGvmrx>|z|C5Dv=t$E_n-p{H2>?Qtc&H4~lLn4~(MBGI9}W73h--23Dc#7oJQ zxQzz|LhgAY9DQI+Y>98+u`51RlBR1Pneh=q0R6&uTUJe5ZF%w#94gZBWw=b=!lbBG zVi!FtiZca3q|81v>h%k=i%Y&Z$2)6_ApI+I^Yp8b)McuA3O1JE2FhR+Ys1g^Mr8!S zd1CHoB38IUbn%k8W*LSsGC?KeDj6isvsbm`4lTU?!NEypYxlWS}?zsd*e$pGwv9R@l5 z=+j74?qbZi_w<&!_TQCMIz918k$ApG!|&kTU2sU2n>ok2man7lvmpE2*>eq~Jv?Su%-!XjD0F2n;uUNb3>w&KbcMS$DwDDLau7iO z-rO6omnQ^Vb^S#q_3gV#3>t1=&uY=QPKD(%!EQasoyrMX-J&qa?DqWgfO)^&pH5nH0H*V1vx*{U9gDK)W2J6i#jEYYa6?rkq4`$AGDuqZeC=d9b zwO~CdBg_bcF-7AF42S(j@f6`28tRP6a|kFKJT+xA3Cp7pCPMdLNu^(6HC_Zd)Tf(C zs#O@mf96U7o!hlL_a68FAh4H$I0U3GeypsC;{m}S5=D$Og~Np?DPB~t;YRk__gWLy zh1<99bL1rnqew`#_rg0l>?Se4BIPf8Hy0w2pEDWVnwo|M8DOlHvycv#h5FZn4(UFT zG04lsHKkkgX<^*qw63_0anMb>l_>4F#Fqg8K8)7{J>|#ML$&>jW7@9wM zVaJ0d7uXY{&$Ws2(8dtH5HG2B{pjqyE-X4su5X`4m)TH&KyMo-%FR4KwV=d&Y8Rww z>OBVQv;(9vyP>QprXPm=i#3W$+i)3Hc@E3MNKw2r%MAE2(43%T=onlWi09(qY<<8X&-{-f=E4N(bmu}4Hu~BU{UEFF^ zMh=aSLb=yOhf(i)EsEQ_W=KJ8w*9$Cj&**Wl)lwz2b)mtmm;FoUr%!9-t}>k|c5Ep= zug|VMwu+A2=_`gK-^9aVz#Jaslm5qO+t?NgeK3~*D~5cce!LdukiuXxDE<7s#?ZWd zIj1*>F=;HJqv&=xHG@{F-!34b-3(l{zRx_2hPTjsGrY?NGHB|(+YYN7`` z*2RBrYZ|`FKGLmt#grUiEl>jJR(uOf5T;Fg6%HsPCj?<#B`8rQg?2nnrop@j#L!OD z+5yx{z;-)MsKc1L)>l|ie@fL?KYm)jBL$LM)L+l<-vI4s+JaLLjRC{uwb_!A|}i^D;;+d)BBVH!mw1R)fGnERANZ@j48d~ z#*;>q#1g1os7*gpR^TA8VlgG!7{e$|PbKp#1YgmFB-Zjdb|ik0cX)eph)>0@)VK+9 z24QIQtMv-4br~QqLaZQB-sBRfRIgNtIlLg+pk2yoIcCuglknLD(%A|wk0m3ES9nk9 zxe{9)XjPz8&RGU%^qXBMFaRh9i~v%fBIG+dfPR+sseL=fxrsbw;JpU+-rP|OB2^PZ=7 zWw7$(Ci^1u`{6L|LV8JuAFrqRhET^a<235(WZg%#A+zfEc&h78WJLt(!+_P*!_oPy z=I_k&I*PJr*@f-3&f210pEt_oDkm}*08&a+VhZ%}x41_-B91KHRZ7DpxVa2wHt`0>lg7oGp`|@+|=ZvIAS_9RVE09*a4D`l`f$i z7XGfN`9bGZtl!j*h58zAgT*yw8F!r(pfeE0+S&}OhYJI|80Pp;&$bzTCR+M;tbU<@ zCh2HR=GOPSN_=)|tMeQgO}$-WNV#{v6Fu80c-nNY^gKv~sI~fSh05oYUH{+$C>9W_pT7NEKf}1jpqnH&kVddXHfLXUdy5)e>OWv zFQcd%CHA^TPu-5@5o{Gkmu7MleCq2hnQ|TNLqet-NeHVCB&i;k>XDHvKf(JdZK(dk zJ?p_q*-BM`vZ@>%*At=9{gbg=1k!QNP6y*HlALUS@^5h51ql+$htYv%eE|{DP%hw5 zKgK7MG8qjq_1qnbCp;;sgL-}49CY2Uk*z+oU9+Ic>NLsSVIJNEr=$;xLq?9|$Yd~2 zF9?$cwhQdlWLPur=NQ4fxv7HPTKVSBu~G9eDDOTxQxa~#bE}JWOA$!YaqlpUDZjhH zi?zd>#Wu-&ex%wO-3rlVo&!~o;%=^o{TlELTL3Pjnub#5DQ8uzx8e2{eFPvmDt%NL zRL#>=9iZh`7CV%C7t}11v9?NC65|o`GcEf-(;MFs^A~2JSmn0;c2}~8rAeB>s_D%M z9MCcAWpg!dA*X_v4@ZzAy>>1ulEIcc0BC^sCpGq5_~-d2EBvCKFIf2OakN#$kB2O3 zCeQaQG>XmTzv%+}(18vleMI=F{bz-UGct7h4HiM3u-v8kWX5_~dea$c%uyz{V+TKE zfk1XsUS17~k9;xf{Q*PXZRR(U9n*@`ixl#{0;P>97xJbA2Zt9fcQ9Xb_r_%7n(9UE zj4Oik>qa=9D9s%zHTf1LX-S7pG9UPdUbpuLcOp3wRcDkY;(*_@J~#~Bp7$)P)c-)> zsxW>l^&Czq&b+cKb1H2Xnk)HrVZDf5@xb&5`xdwr6_11OTdkf&DSXEAu`ar@flG+zAQC$o?zRWAlI@;VtV=r zT$;9dL9!a!9`ReVYjGp~=Lu|))13-=yB3FWG1l<*k#O<(etpmZM z>>8!o3`UlcdFOHBC}No|t7pmFNJiHx2niJoDu?EGL&9fU@`4Xm?!hU;32bPYUk<{} zaJeYg3bACTkSBFVCeH(4?|3=XFSDnbSbkqOq*@+a=h367b2#z?mur{6P) zpUT$5BB|cEW1(n2%}Q{;9M+0FSd~Oey<2(B7EF}g4Ff9C;@m!w7N;rZbxhu0k=Le} zjqcf%^rmegZrkOmNSFq!Dv)M=&d+Qd+KF2Tq56naq$$E(aG9dch9*@vD{G{;toVw^ zJ8Wz@f!<$f+PIwQ#+OQCa+L%^D%t`-kN2TNx_(NbYrR!0=3C^$x@mcdQQ#w#4{CeW zXG)RpxFA$Fvr*}kZG!rSug9V<57ZXm;n}=u^7L$p8B91G0^^4cN$}~IH(djqdq2Lb z@YLRL_iGlt^T6wLfnRDLCRJLeo@d`owyx!%>3P9ppE_fKO4e1t?c5yHG>SuQinuTB z?$oFHL{~aLlDIEwNhj!Ji5)hk%VB1F)ko;P`szTMMl%3Pke*&quhDL5b$Rki!(I|X zX-*@Xd2OE zM#(x!a$%S-Yk0J+9^K4aao`1(^UgHrL4(6r(4X|9U851naubYE0o;1-2LSRE#R#>jIB%|p=UFH3Onx%yc(7uKQaxrNJw`kVeU2ZgRfp4_rgCk zwBs~O>M=dV$-6qo+tj_Rd+2tpVlJ(6q_I0}q-T3ZEAnla$7GNcv>^0G`SumkvrRWf z;ip_DQ~BKC6>#=<$NM~?0#%(>WC#eGcYi}Z@TC_VAExxY?$_EK)dGj+yl;(}t26t-0 z=fDaE09aH5hNIi`h+IC+puJ&6@jY3bg*KHsJO%^Ts>_d13lH8H&dY|qF|LVw?>(?w z4TP4s{Er@g_{D{iM~#S#teMo(V1+6VVKggHCZvL7l90fy1*{>!oS2GG8vCm6{W1hF zv=gamwRrA(u`a!ube{pUUdY$Hecz?GV4b*pRTfUR(M`m=D8g6e#XJBs%n)P6c&L}e zkjxoriOv&#z?I4vgS8bd@pby0?e7y0_dUF_^B;bSk;qZxn{Bi(^(LvZ0jeOA8vQ1p z3sP`G|1Z^2HWUM<)X5svdZAy87yvRSo}_M*E@AbY6Y5_XEkvXgr@?LMPZBE|HR4im z=}0)U2GhppbPrt2;Xl=1!%^6n^Pc8^%mh`vHD; zC;wvpLOW{W>$KWJG~Z%FxA770PhvqkoA%e0+en~b@a%8}n{ND-?sL@oV{C83`cJC# zufo2+1qk58>3@Av!?q(wv3yRL`gCm|2Nf;wA;FSytp~aZ>#xn`FJYCoPG`q1xzABt z?V5+(tC9fg+g+43i)+EkKHitT_W)k|i|i54zmV>~6%KI$qig97F93JY8{65#66mtg zWaaIu##Zq9YgD&nnnh0I-s;rFO0Apc!iXr;svD#YsE!7~2tlo7YV$6L6U`2wdIkGT z|2yjwn0zGOKetOLR6O6lYCeIZlKfnkIAWrA2h z*Tkr-Dzk&7`e!56TEIB*>VL#VJDK+Ff0BY(Wr%KUi}$D8*K7(8a}C35yk*bh8auw= zUyP=|T|s4wb5_|tqf{~s0Ag+}`IvrLmeI|}_DA)j5I8ZhQ0x}l!wlP8OP?NL6b5v*fvG+rB`_Uwc*^*k3Ki+A_z{i{Ug23JjyY*&Gor@eT32jbDo2*|az4s`Mn zL*C!0bG3AIKtjO41oprdXR#JtnMpXraD%Qx6>M38N3^;p$^ds|)#|N6NEP?R}|50h#rcoVi0?WmdQK1Xl!v?u3 z{#S~PVciu9Bj@t#>D>u1PYo>cuu+-REC?CfpmEM*e7IEF82$>oYTVx-sWSLr5`@ui3NSP^HCWV|ka( z3eg(;Cr7bd^_Gkm1O~jvBp;%$} zI?85Xma^%iaH+V=Hm@b_^EvqRx0^%LOeyTOgpk!+J<8HSR8{CSO%jS6jvDBGL| zUhA=AOWwikh3C&H`JzNJZ0Rfej?d3lDiqXPxA)2m&qUUz8#PRNC9@>gb_%J?SxeZ~ zD?ENgqV>pmusE`9v?eVp3<**bp-R>9?H^lJ%lN?^Pux%;+@k(1r^xg(qg z|2jP}*T(Wt=cqrX^<|i3M#=VU`F!+cV+LJZ-?GHl$iu7ZiA2auD52PZ(b-w>^e80( zI5nZn9pQw>HWVa4n36{1!_-Q6qtz_<`g$jDDj2SJ-8AV3^BEoR!A@)ww`wkIxE}R|FjZ%~D1zhvV_S8O!87Z>EfS9-w7AtLM9;!37Qv z>IWFWo~jcRAaucs1ID|W69=4a{x4ZXI)9SjOJ6Vwk?X`vdtKMHTlEt&d0u@MdfxsUtqKpNy3O4e<%`!7w>I$Er$63|P!HV)=)%}&mfC{nwW;;746 z*7jz~2PJaY-OKL!E3&mYXUoq*ChtU&Vb@SRCE9Z6HW+hXBFd zApwE}2u^Tm+yX&@yM)Gr1`VNuH^JTAg1fsn?!nz}k^S%e-Fwf&eK_~~&O<#`t*X_t z=NfCQG3KOIa4qBeT}xAyB8%)syN$dCQ%9|-BI=)KB#;dwD4N45==5-(5oiMmbeeH} ze7W!q(Y^V9`>-E6y$d6pVH^u0u2)JHWbXX+M+p7=(fo=MGrb9HC~+63O2Lsfu&UAS zFbVQcUPjPgx%kg(zbmo^iss-l$%cUqeGM0DC|T*f|3`BJx}um?^ZHYu16j5XwS}Z)8lI7*F}G%W7W6qMt_*?|+C0sa4$Ufdse8 z^V>^Mkdx3>1XyNFXKx9Sbk(l54l-y}jQtRx6^GqdonZ}iC*DHd&sk!D?f#2QoDh&y zrRvbW6Yq3c5(9MV_^N7w=Pq(iQzEfbTzG>O|1|Z>N$xC~=wJF(*X}p|q~OsSXy5P_8Z{sVpfWQj*6>a#1tCpr0(6zFaf5nU60MP?;pa5CTrj#9Qi`C9-cazW8v zGK)>Bo__(B0r@9Q-BRO|8hkN_ZP}PEb%>~lz4WV@IXGCJcGQ9!DMECP zYL1mi$rT><^5tKFZIm2bMzQ4M`3!8~;lQo=wjjy}62dUD@eBSpXU- zJM6O6>c+{fCiH1RL%7B(H!IBV;I2VDckkC|J zErBQzQk)X&y-t<=-bUTt&ShGRT1HCti14E1+7lVJ#@Psrb+lq9mu$b54}f3^|0lID z9}k~#E;s3rS}23lv9D!?L-D#I2Bw3e_4d+!-CamO4B8d_Rq`y$KRi4&K3*7Q!_oEp z=Eby`y4EUzGu@?MPy^4I&tuLZ9vyR7|Bif{Ohs|Ft&*a=g?LsWfTnobd@eRJv{6^f z&=O@j-O_)cXsc8Ie ztUUIZ32foq)SRO5@b0A zzu9B*ouhOj$03u@WFI~F_0DLw4{yI}en&?_-r#nYzg#s}eWvfjw6_F9#idp)f8+Zs z*i!PWqoh#g?|o(J_c}XVwe5w2blLJnLP7*3!)lV|oUe3=7cmWm+0=$~FuJ9hj0?ew z1kUL9XRySp_!@yaDdA#Bo5%f5XzXj=uH!kL0E?Bhm|8I>YK&=IsC(n^?Zyv>ux=%4 zR+S+~LSj>+guF4v;UN&sshlx{E8bc}F{zruZlKabEc?vab-;cif3a+qz^X+Mc0P+L zN9s)a;_4jlYeJQTAjGMAifM<$7-yf;^ji_b9(|1k*yTdGfI;5IX%?R`vvGm`8Nd`1 z+Y@-WGN*7)Usxh&{79) zV;a;Vqh8P1Af=|SH!$Fc^hG$;;=b1mQ?xN1l7NAe&m9-tA~g2O7S}XKlrft)l`LdK z)#+2aBhWo#TO%&6J#MXE{f}4tzE=hVRNTuTThaMc*@(t;Wv;Q$c6O%=8BerpGurdf zB+rfuB$YqQx=@&K6%d$5R!}2^WTQ-{OZ@Bl-DVz`g?@|p0)<^!`eRNA3(X%}v>sh# z+Y0ADD6S8Gx<_IN!klDSS>Q5)BH+#6MOPwuhmGgZ6Xd|AtVi|<||7l56YZyo#QWFD-v^S$8)T_4TG5Q@bD*DW!?&Z!_gaWDnmbxUt>fX zbVI-tKW3gZHGl%_bCBgH7-EA5LLfsVz zV~A>?=P^Te1MfO?Gk#if;FtBH+nv$QB1-Imoyprhe%5r`itIsui|bC({>|GcmjLsH zoKO@6R#7<~_Ly(u+Wn7u&Kow$fp}Ai{_FO^9qCK*vmw0U=O1b#e*+Zavn#28QYE9j zoaa1tcCzG1v^>sgh4p9gT*!QcL6-Kw)@dLI?AJoi)=8E5B{7I4i`v+ib*L=nm_P6&tN)|`{wKrig#S>$bJq)*RSV25i?{YAjJ{SA0*qs>!X0T=m` zy7LGVfY$p@^7_AuNI`)3tA2uMf6>w*P=0Ej98hlmZGhbP{J(o6^evt}UY@v1?hDZ@ z-5=Bl(;W5qfMUJoX&5MAR>FKMzSE~ond558xM;LCofxH9mCL`-c1X84R~HVwX!kl(&06^mkz*%lGZw)5JpL zvbjn;p+v!)?tac4JHrbD@84G$Pb|w-n-`-eqml0wLiXH9?s4r{m&Jequz(}(1?sj{o%I=W8nHcwKhKS%$2C!@Y8fT_6C{j~ z5vj%~(On(VzsK&``=##F}tHDc0ay5?Xi@sfQ_mx(1G&s}jhR*i{QnGH{ zbbGq=s;(Frwi5nmh9sFTTa?c98~vO07gHqGQGPFo(or#u*5lr65m$x?>o2xl<5{ds zb<{TsK|ju{AJvb27BAVLgtG9V$LM2zF)~|xWidx+qD6w2doK6~R zqQl)HgycI@K*t-!d*R80UFuT_w{p%ikUOC|_D@Y>aK88`yum8xan6fw<=(5E;b5EM znctpK6(8CLjL+%KtIv!bP)9v93K40uV5XyV+n&m7?d;6#hH7@4ZeK9ZbV7-393nhiyvq6{Sa%_?Nb(KTtECo0D$G9(M zUp>5kZYoyyEt<{F-x_*1rIiNC-$|3U>7Cs@U>&Go@vP_J1T8pIFSe=$bkX!OU`b=y z{8sq$PBQ&mYQ*lDVOs;feU<94bh4O$Hl+%A{zcUJg$XOMGgu!}iPumOx#_}5npHhN zjv1$9+O|4~dRCU6_S5pqwjb{Gda?|Qn@)zDD3E-^!;e4`TIL1(`}2T*pT%aU`6g}I z?oQ%L5Nll=e){lT?EPTsw}-hX#O8VMjP3F36({1K*(z@wq*67*jbvP>Ya(f6rUI69 zDo8Nx5nkoLPIZWq(L6*cgSWFHxW)PIZQr+@r9V}zb25-NNo9~>RfW5Yq%xRh54rnD z+mcA8GrMWB%K5NulhD$&qM?C0jIN+NryDG9ZgE51|{ z^`00+o>%PF=qaeo9@Q7BM)PxOs5h>t9;m4eyyfk0(yRF3)jC)M1?@!4E)4%#A6nNL2bD1_Kpzo`1*^cie7iddaz{GOvv=kEOaQeTto% zHtm1{5_oCDi7~6;Ryx?2YI<97y7?lL8xYLc1Elot{knQzf~g6^8!8HyBe#QIq^qIB z1uOmM5B)%LTRXT1!r3n@w1`1uH$JY7(;Az@`%I;oMpH7T-sR6&ouXfB(I!rZmGX%@ z5*<+(UWR`mHUq^-)DV+bhIA|HScqMTvH0~j54Q_gKqcX5WK=}CmVk5rxu;aQfWk+L z=8wx0uH9|gNPh6QPNeg*%$@`B^U+muPI!)mr7ccoy93{{qodYmemNzcvkFFs@+}bf317-?uBbLp zhuVgiuwf68wGN8iG$?pi2PXj#+Uk+l2(AO!UT-K*w446>@V#(KGCdFNi6Ta*#I&{^ zd4bT&q4%9rS*s;a-5>uG(MwDUwJ{u(LuiKZ;(?yW=Z~>(S3I~H<-3&uE9Zpp>5$^zYKb^IFJe#NdG6$Nt2-RT>Uff^ndCo7_7sM4 zMR*d47>>lOVFmHHUmeYua≫n7=_%e`HLU58117#K2&lo9bNKiWnsr4dk#p0$eix zUJIZ6p$$Ywc8tJ5W{V9#>HWouUp~QYHUDZ!QrP3>dHP{={|zZ&GA-LWlW(`#PEzO% z^E8|5_Y?udnFN$b{nveO;0%4IT5Fj1+kr}_e^KBQ*xVw0qPw2`M*r`C&;J*k{96|o z2KUbb-KVAL$Q3%%w<@3aUJO7i zG{Ovce9S!C7fHICS0;`c$VFbYp~wvfKg#J!F%U(u7Mq`z#8fBZQ%i$4i&U0OaO$== zBEGKIkU5EmU6 zIyV4)7clXLD|k|uDS!u+#7GUFeX0rYyR}L}*c{5l5rQ1IP+0<)-&mL5+;=)FXUB5! zc5ziUO~rT1i257q8p0CisF?g+dP;2fLp(qOL0hR0XOFiIIqZ5;vPNTf+-7qAiPf*( zwPQy7u?JmyG-(9Iglgr*Hq2lF)7Z%WKaLJdg0YLtJ9XZx?&=fj`wt;czW$TGx=P1a z+I;NnI=|yMUab*%Zr%n-$-rxvwtbUKvK`L_g=J;iIlHZj=W!ZE>*!e*EGXif{z23UQYCpEk}~Mhf>?6elXkK3h<0-^071rYWA~<~y1Pkpq}rjXQB|{EWv*M&uVJ z^me4w#ZL8F6*N z%o|&h>t=qaAY+BIe>KAxmL*=JH*8K@Fph9>jE1CWv)YctdhoRlT zT~dEhD(1rLJtf2kw!B1cTQR=#v~Y1{G z>)VJ>KP&JR_fKkjAtda>4XJA^L?;r@Oq=8jkJlDQyK7&+K4@opedDzn9&Fn0_I6tH zItX7C?c!Xi&&6E#s;-~xyZXba_z7cw(8OHwRUq&?~k|UwTduN zHk6ImX#f~YU%P)2VKUov-fmAlHDAphL`#(dZ>YH@^ERg`*r&b_m^}!y%Wf-oceo-V zR!%m=&e$f@ix2-oI0xmIvIR)$f1`{7}S`+qzHD)0u( zCMU9f53S@KqofIGDm47`5MCo0r$W3R%@~@kldONQ8M2$ps#6>aa$4CBER#-AGE3;* z*R4$A;j!B!(#QMphGs#{X^!f#u))sgSAn?+1ISnI_gZgv6a&(x)HGw4mWG_}Zqv;7 z87NDqe8wV~qY`^2j;ou<4oTAVRk_aQLI#5p=PT3fgyI2~!zNDZJj+zQjtkw&lpEinkx!12+sO8BE2fg+qeH?{DIPl`p(&hpAh|ff zqF>V5j2bIaKv59WFpQUeR_gXd+(07H{Y!JR literal 0 HcmV?d00001 diff --git a/windows/client-management/mdm/images/configlock-mem-dev.png b/windows/client-management/mdm/images/configlock-mem-dev.png new file mode 100644 index 0000000000000000000000000000000000000000..3ce6cd456d9abab23178607948545ed182fe4838 GIT binary patch literal 54105 zcmaI71yEaE)HYg5fwowoxKj!gr?^Xt6?b>n;Gwt`C`DU}ySuvu_u@`~;1=8^2^Ze) z|Ngl%cjoSyOy->I+2@>f)_&Hrp0yILtSF87mgMb=7cVfs$w;Wac=0me#S5gh*Ds&W zwA9MgK7Ap%s!D%(Q87lg|8(%mN?bww#f$0~beIXs)A1W886DRbF9>L#KS1o@YoG6V|=v^sxiM@%g(@5hG~Q(6>B1a0EDF7|I+tSqg7T2q!C52@)Zp61|w zcjf;XqSaYQU&Wut3bHtIXwdU$Azgac=nhXQhiW?NG?Ktj_8mw!cjlYLCjzpwp2x9# zr&r(!;HURpexjlG)zv)YJ30)-M)~D%*VNsWSr94)%JZmqb6BYYLPMK)SABMSDzE*4 zYs-n!xWKfgw}_z2FhQ(i7t4WLlYD(HjJ%1|L6JTl$Yl)ohj`_t2WK25~bgZi2CfW zg@Xq-={F!%s>uB93NKwtgkh}5}`CYzNV zZniQnM6$b`rel;I=pba5ryOnjB9&P;bgh_qA*&W->9wfxkC?WJvHE{#%gn8E}(wY$SpWF<{kJVigd1>&v75MYF|UI0>X&~ zMe@Faah4{qf!~qb)n$%8-n@Q|fu) z2?V+2)euu?J>=zo2D2V%nRRTt8@o0OuU_EwdzkEnoeQW!UVvIFYthfvqAL(1#1@&9 zEth?huavDGsz)5#&c^1hN-HbZ!!U{XU^|#l7e*5A7TqzQ76!mk3Z|W=Z;fbsVZ>jT zjapt0TFe^{GN0XiOuH_Al4i0bVYTu6%JOxuyEe&Mt#@Kn?Vh8*ctuvg0Vl+r^C$k> zeOgAV_Xj(Rn$D#26|ht5x5cG)Rh1q^9lRIaV|>P{5)+yIkpDYZJEK7A?*lO){`OS@jza$P^M3S%SZOPyK>qQAy?ag&Z;+}Kf8 zunpbR5)l<5eMRqE<@=a$Wrvd+UcSYHLG(%tIv*u-G->VD1lww{%G9a#l4H<8uE{Hz zX7l$g4hvX(ypC{YGSY5zS-hWR;wjT<_grC&U47B5yp~>?SgD8dR;x^}*=PF6`!+R$ z4*R*8c&U(%Q?5!A%8?af1=z~IdnwrR(~wkcOtI;U#FeREsCDSnyU@N~*z6qkNQjik z9b=Vu|4MrR3sjn8^`}@Q(>^M(fCk<;>Z5DcTQ0h$HiAB0NG1_tm3v<{?nV+xFMG`?I zSSUHlF*^q+K@&6JPCX@r8D3Yla<;LUBo!c#!}c%2&h6JVkEL2cz6(v3i_0aQVFrYa z?kgo%rCI=e^f?TX2Z7l16{{_^VDz6?&Z(WOfp6_%PhPxl%iM;|7YdKQO`= z)0L;=jeb+#^{cyTO@LveWe;N&BED8{u?EpkY0;Omn<4aD)%K5?lF#XKNqni*Jg1iH zO3K0jk`ZEg^~)2&3Tvkbqk)JbnmUU~pWt$gzP%e z#tY4sUQ?a613IY;3?MB~bzBZAsCD=ClYcCF?DRQ+8w{X7LBhzZRoO9uo7WO7@6$6K zeeB`8yCEfFGf-<5(YxW1#Fp@d8>7|J18=leYci2U-U+Ym-rvju=^{cCag>j%^Yp4j z%oK?|xxl}^4Hny}Mr0>s1u@Z_4-wOl@2spK45lr`^V_(325Aw#3>NP1FR|dtUys<0 z-U=y>9tq!Emv*iPv>q~(ohS7h#yo&C{T{=1Gkw=xbdc*azvQxe3fa#6zL^(l{9OHx ze$9ohKh%wt-ef$m)=Dl+`V%}@UL+=LNT}v+kq{)5B5QH+U5GVZ8@?Z5Ckp#eO=#5U zalsqE7f5XjS@;;X5{&SAsF3=FWv|;qDgwF~tuNJd&_Vo@I}0(D{zOvs?iZFYd;$F| z-xpK_&Q1nZIjk(U+0OC#Mh^9wAA_q7Hka8>^J=$xokG|T>e5Q*Mk+NZfn~w}f zRUTO%lcPaU;syG1>Hz+Z(_q1I%*la){{B|waIm32OL2O4KK9jmNermT(|6hSozZTN zpbiG3YmmzC)7d3L!v*&bF@3uV(U>yKJH>yNgHO^)vtll>BF`7i_F#X2xWNPI612yD zHsDfgACIx@L@dK0V&WWCH1RtL$?maHrY?={mU3sN1_yXkLHvg`=exS-^pg%RW_+Jt zDs*uv9@i0#5P>CW;{AQfbr=4XZ7os%-L<4;3|8KcTm1%LLxI%!K@ux@`ABn0*dDy{ z`estwY%6=Gt@mcG>{az`8x7hM<{ya6?^62T&e^dc5BOR@ci2SXxAEnvV)sY$h6vau z_ReftAq!Ni<9f-?h(bJ6V4Q@VeQ9Y2XnGQbb1Ft%Vlq(O%Vydb*htw5yIYs5Y&$== zTAygN>kOX8bsqR3Nw0u7KZ?`Q4*bF|Y}T6_-G1|#?r_?-#n%d1!3;lUC*O+BVA+?! znVkfaI|Ft;dV_W5;P<(jhox5g_zYvqh{fiw1bN#(ro^}yasj`Fx&21tk!f_Oln|1^ zS;&tD@oKf6agjQ!$)V{m zgwKkV3Idtu4{qXY&(TZJmVY~e=h0kblP8N%QoWlitc0xb^#z=MW?w2`Hh!eXXJA2+ zwSZ*@*PB$HPtC=ttIRMQj{hs4yUWdM$(t^2&yKC^_;|I+%i|cS7eVCoQnp}|Q__v0 z{HjOG5U@@3mxikrNQdZie;7|2Zy_^+bj9fMxAKzbkL&AcurCD*fVShlq7ZAnm({aZ z!M=wTeCJ{@$5%J+ZT!qVS#-Wt{ncQa=gph=WVQEi1ur(nc^JPM>fA(oG&rD4UWD?! zi!^LYNdq!u@a0_pych95c|HFwjifuza*k0S$HcjRzmlo5{$)9JWd>4()(79B?u>6y zMsv>AyI>!yI#Kv2dVHSsOfZAu35nXP_&Q{8LSMN-z2)f6OhR~oPWaf^KgDp-6!p^D z)X%ivXxni+GJtmy8Nwv#9}>2-)N-lq?h)-4M>AFP%9%~jy~Ve=J)v?POY*qhcv~Zh zoW7Hv>i4^$dUKAg)V5*I^zkvo4aHG^AbCswTcrPb@j&2%Y~CL>k-NQ+LQ18Uw9fUa z%6T1Sy}5EfcoeU=GI|>RYwg2AG&WlEziX{tE%&Hmhu~S!g{4K`57ZY=sAz>rbhfss zW#|o8m;eH4pPbG-+*XLDHs2~m!RBLi-_ey$o{g(V-kh?EjFtPI z-5G(ZY{7p=7avBuE@3$6tqJHT`tE0c`k)x6JT}h`Y%_09Ewf-vSR*~Dy4&nOE$U#OM z<17n;^?dS}$93MAZ4Y$jP42Tox$^$~3$WtE9jpH2q$mPN`g@10x1i%*V0gFIsvW*D zygg#LTqk1L8P7Ok4G_=K&bKZ*Bv4X0|HDp@e!Bs!q?BPSoKAkfX_^`CZvu5*y3$Zd z?>TCA^!IEdeUx6rd8l`I9!22y64;?+ zWnPl{2^G-Ex_1dbRd< z=e(jv6JbrGtr>`s%#2&8nIOp?PK<3N&)y(QD;%J&p3im7bOA zNDuIuH#LJVy%)2&ZY4cExJMqTzI07CV={YesnzA~+;IR;>^a_w-5=&+S4eiI20V;O zb!NT#J6_7K#4FXANg4gP;RMTw)4I-71f}R0LY7w}Y1C)U#_6{y_|oeh<);XxamCV) zWJYNvJ84{2ZntaEVs=|{s5_z?TpuzF!*l5^JAuL0H^mo1ss1nAtvcVCkn;F*Paa;jCya37*D|_(9U0?qua8kY__Er+ z@=zm7%(L1l9U}@{a{+MKGYGw8#S^m*AvzuFrp^qhg_k$gk7)IlYpd{3)hXscbgv#F z_QWH8Catb+*Rpp3S79Fwq1YQ9l*5eK-gz^^cA4-))8rlorV^G|L5Cta$}-)C@^lMj zY=TT-T}$5Z03^<)3d@=Oj>o(53=?lk){As(+aPMKyLn1LBqlta+qm8Jd;_5nVs5}r zl&@jP-_+4tkRdCY$bgL!dN4*$sMgNY)m%Q%VK5t8jRp?PtV-Iym3za$(MTMJpiMBD zyVd~J!@_CsKX$13(29ILKD|s#gKceMH~OC=60ke$RRpw?#y2%t(NNo*@1`kfHScm1 zTj4dUss2XCSO92bfNQR&(?lvm;CD=HZ3)4Rd##G( zo^iz&)TsKiN19lN3zrYR`&WkGnUL{>avhLqU&KlM&vp`*)l}$agS~cR<1dn{;kanu zt9^P(|Ld_*qocuEf$}@b_BMC$xA@VB)w|XF<)tFM?;Gi}R%-hum3*F%-Ao_EzO(9_n#Mw#1B}!Ibu0_{Wl&$-wQ|hP$38vyCCx`~Yl^o9n;!b|)jS3SGTB167jF z8v22wb&yxv4w~n03=$TRWpShd=V*AFX!9Kqndu(}mJCL?Kc%dOUB-?}F1@1&8!O;t z#(W1jes{w)yl-2C8v;28R#WPvyr)+qE6HDzN`aPO56C)6Kefmn?`mdC=PQh=Egze0 zBLqtlhw=`)HpAGk6m`gLKZmj9{mmou;a$PGOz=4$o+BJ5@%^3POX=srH%bw8z~6i8 z7(HoDkZ77Rnz}D}0`@+u5wvC!r~}}089yh63e_qTl!ptCS3_Gq>S|h#?}|NM6a~*{ zt;}c|MmSh^z4y8gZ-@7S0*_a_mQ63C-w&NQLK>S?CbACZqM#j%tyYi+M|;EOb!g@F z;rE+*OwtCw+LO+C%J%E?2ugC{rrjtOyLks6o0C8@!m%`g`>ThOj;sB3xS-Kujo)+% zK3h9%=XV@EYZ`y^N!c9LdyJgvp)`jR)Z<7RzVFxuy0 zas;Z?b~BVXaP5Z}?#DmzIp@}%9r6{#rd+z3yyrbHr9b>LIRg(<%;39ynmbo%2s-NH zjV71AHh3x8u>f~_k;mKkLSM<4SnGgi1ZVH{@oIkl2WkgVa1(P1hxg`EL2Qi=zyNC zRzl#%B|yLHow@l{Vb6`*a2hnMBk;v`E3^TG=<55y#GqBNQ6$?DT?36O+~5KE?d`oe z4IevvJfGES@B>*rW{fu&v_juCdX9#&ftEb3FNe$?Jjj=>W>cTib1!JH8og4QaNF)g zSG%{U&&`U~s;HOKjd$vXq3`2`85+pX;bJLq_3>~JF%I$cozCz@19^E&dsF)R*`E+r zI_jS7cvF%KHeIwQ&H)Uu{U*3cH|92Jsc$x@`?eW9bEbr>~&B1J8%8mvA zXB*O!fOmEJrm4rSvfceuU)Pl>d`6J>mKd@k9eKyjzy*A<+8w~F2vTvXE7(1^T?0V78Q6zDNXj`^8Lf8)OW7VDC^xKU0Q4>4 zk2C;&wu{jKwwJcY%XJWBpCAo3D+To=#CTm^*7 zDkHiJn&TesS?sg|;{RzF)_P4JY}@_*+)m0UhnKB z;&<-I#_SFFN_H;$iv_A_0FH|vloOo`6gFz`+)Qz2%7jz_N99sC=PJGY;0GFPfLEEH z8}{9+8zXuRd#izWH44yqM-)5lv+e>+sHua|LZlEO9(eB;A%XU6iiX~ksxnF~mnhod zvUpxOEHLZxIg{6+mNDfI7C^7sXL^}6aK*6N9lnIglxY;!CcJq+j|KWcxHE?hN{E8) zfPUZ)ZmL4(Dwf*(fV^`KDBFXCAV09~>1gFb8!LeP)_o%&B$(N{3F!{MlcK^%^k(PX z7F2TXXT_- ztJOqG5M1`q0T)v0gk9&}v!rF{Z?~%jzByd3-pu7~EZ3{PTLSYxubM?6;h@v8lkbpv z@k{nTR9b9MaNNTRW%wbq*b{}8&0+P`0b~JYWz$*fn4*7oR7!u0O?|R0wwhG!13!qL zht#}z){U>$Y+aWR<_(t;QhuXEHh5V7nBnDv_O7wX1mpTB`K#*QGqC}XxOeN}o+Rve z&tpc3X07Z=*ITT2wX#$+{K{DoH8IQ0j)9ot-4q+DsPuT2YYcZU%Kop|{o69r^d;-V zajK)w{aKhG2=?+>z~*>xn{K-mfy$rhyK$4(Ug_Z4{+k;-EU|$inndUde(o4QN4Tps^(n`U-?)o zTg0@5t0eW)iI;)PKcvf~peu=8ww#L}eh)57J0ftmD zh>}W2?V*Q$tUD+x)kKm)o{e){ju%Tt4!08bYQi!#{J)SKWjN0&=jq6$gWF7 zmx;$K^%nb|An` zHrp5c${OdokQM@@np(}jtujoN~pyI>r-BH0{(aPv9T>LGgUcv8mO) z-kr7~E!D*;AMw`T+^XCc&9B21)BA{=ELuwpxUD+FoK=6}6B(L+?@kdm{xIyDwP1UN zp#-*Lu&m+9QU})#5n!p(lel}TsGDJ}03_dJqqx%G-64vu1YgT@(^v0e)ct;#l zd&uXnEUhbs7yGjv2rL;;?Rml6vY4?eripS}oiV!_+UkUEI&p4#@m^Y`K&{-3aMj`o z!UARY)~Xh%0t^3Op9wqy`J%b_kyM)mkGGbJzga&0F{ST1#71TOIXv~v>MDTIZn?qu zuYj;HX7@z%KeFEq01f)ED9eP_DmYH5C5B{Go;^Gf-q?y`pPO*mWi|hO2*EH|PYN5IJ0#}`wnx=mt%#8D zO?a6ml~;c}6xWZPTG=qtVKc$^`v8JupDtAx6%#YQy?Yyt6f@2B1_QZ8yoKCKmU7Nt z`D4L;`<29K(U8G(MM6ukg)bup#4r1+h;b^MIWWieEU|i+GEw$k;`pE9Y&=eBSH~&6 zMYYaf9NAB9gaWhAd+MC?$?ssux{*k^y75N`Ns^xJXw_41BIpTotyMpyw*&{LlrT_6 zl&^BW!r;@N&Ly7?3&wI4(WK$z8=oDn#>JM~j1&BF@nKDjz0OE11Ia^4QLp69`1b1lHbB$XPuG3|cr{%^vj&E(PWJsG z%%wiy$n9`I@*TC|0RPC+-35N*RtxjBekc?bvMU0KEfC5z8_1xTm6dun)b!#+{-Cif z_3v-%WG~e_eDNQg1b93C4UOIRQy8QnPUuz@Z(utVudJR?2QP5%3@WHq(mQcM=418++`zC-6?8uF8|XdJ~Hh za#7+d{r{dqU8t7LQPDC17xkdg^{tjJ<_IB!qzC$E{4YAo`E>>aKAiWp?2i9I*ofX8 zxq$Vy8y?&Jzb`hkCQrQ}7%hdB|KG^~i%yfoI9m0`Gv$$vLrTBW83a(C3aQ3lBxw8f z?0Tvv`~L-R1zKnk*}lcvafw^@6nZnt{2Sw;Uh+w_iN_GzN7Td5IhAWEt99XG!PL@f z>5Oo4fhW(`iyL)`Cj*^m9n37HiW2xJVelPV%dXt*`6EoXBPb0<%a6%(>SlN7cg+;! zq66Ef95e2wQ-m#Qn`JulIg=eZE>60Ww41m){4b}!3_m}&eYazVr%%r+?thWi1^aVK zq;0(yt1G6mDM#`SN5qyU>S6T)x9;>v{(+IfoIS%71wg#6Sq8nP@^4AKZXCEq`H^!% z6?1|7r}AufLiGN!>ATSwFf| zG6JY?-4*cqij=7!a^I&G5QHxzR@R3H zIdZdmZ9xbTXfN2I6oF_g6yZyn&`xMZ+%?^fB`@SSHYX#Y$#c#!&>KbRUH5LrRQld+ zF5h=8h7%&;#8lLOJc}B&%YcC)TJ}D1T$_rI>lMlpbB6wRR%VOv4Qn!e{JA zz=#-KYIo#~8ArBZjcN5h0q}$gw_3k}1t5*67j#&Cqu>{4uT?pywG9N>#s(d3>flzr zR!^EYSB&5?Hu{t@f`_NAg z7Fw%Ir-vPnh~nvm{e?M@g*Y;npt)AZ!YQ<)tVuN}JNBVg(f4%32yv%>_s&K9UA20e z*8^{dpS}N=p|y7?TInln>{2VLy#d(jK?S#4Y>3;1I8TE%+U5BM@R4RI{>OiowbT2r z-UN58U93z}aX&MGg%=?2jhS!)`;jxX0ju=yL$FR^Y4L3)+glIrAqkh2I{h1k zI1FAn58{ zfkun&T8Pt9`stQD8M?e>_`glP_kw0}IW)8nln=AI%SFWc>|4Gq2jg}Pt`4o1b7_->r_T|I%&U8WM9N3W?)s?#oKjAQczt{!fF z!Uxo40W5tjkkxG5_{md%aQkhVbzTe+c7E%jhvVe2dJI9pJ%bLx6Yu>k2OJUisIz32 z@o9HGmGfK*`kdE9IN(cA{744m{Jf+CzMlVe)-^u@O`?;4X-eE*_~jhwCHu>#P!cPN zv_bF=$xN@B>Lu#rss8?-TXE!u78ah$*`1n&Lpr7jdjeRx){$U~12R@fuHaepuF6gm z$w--|hR*81;%Bv0+yXnZD0j@$9qqd%+mV{La?nc!RLT(hzOY6Z*fE3YAfdja=x@?yN*>s4Qi&3okZkbZU& zH1a;s>hSim^U^?5s<_}Uw|B7;XBfi?AB+7%@z}@ak#8(N7`uI{ZFhj)f!GA;a}2)L zGeuqI-%S^_?rc(d|GKyotL<_GGN5t!VV3OI&~#?mZKJ4&D^{x*;bn`c@bx!f%>0o% zzrJGFG-+fKp9AURWhx8ATy}J@?}urd%>`$N_nmSE4at?1YSmcrlp&*{P)Lozvv?`FCnR@jAERFGi{02}}=X!mEE z6wxX1ZLwGMXPqHCXh7>x31qlcPu>YXVfDhcYw1JgQ?>0$WMg~marA#^v`Tc)ZA275 zK`4A)XYj>ARxQ8t$wkbgFkqzA@rlpW6lUI?YF7vlbe$j7&nDil6?;f0G@trc7xAY!om^nMmPSEVYTv zSsi?0EhA34u%wMkO4RwBp8^%QCVn+)p`)dG{z=VpQTa~I-!CUX=<&l~F5w*h&hD1E zMV^(pc^Gz!__H$~E7U6B*c{H6NeNpE>jJ6|CXk=j*eNBbRT#F)pJxNLc=Rx~y z9CeX^>ciGa>vsv3)>=n_M4t!!N7d(+&5(D9UMdmT`e)|fxsIjzC0B?{g)DFW)d{A0 z7&vq!gnv+gQ}^SwM9m@=tY6hBzSMB2S&U>f)q&M^+$OTL*03~sDHA`-53wgsF_;VM zF`%G1gjLCH%;J;|T)O1;^&8J58B5H7!;_kw;m24O_>H~2`x;*wy>`RnHeu}NN_{tvcV={fX9|VmSW3Zk_wk~>P|(HcsQr4VP$GL? z7~9aFM^6oy5!)}s_-(TPx8E?=nyn7{Uymmv8@=Mw?HxDhPj~ok&|sqg^{|l-oj#co zYrTUiPK2b}Uy;r*jfera#v{^g`wcyI6c&hgL8sRu$o7KdgKi!YGRD}cN!z+s@gINr zq&rczQJ5L*pMON=U06iUBdoYO zRFG)t8UQ?uog4kr;Xhb2hVilPS29p`9dyY6i`E95nkMz$Z6cUxF~??OECJ6Z^c^q9 zOgh_Vudq*{@eoj+w!g&iAk4pb5!LybwDvACedd~jb@Q0y)E&gz2*+NFtvw_6{j7wp zBI8hJllpDAms`VKIY~`^__Z`eRH)7t($cG_@~ZoPIR)q4C36&UI@~>%_dH&v?kZ+|0b)%`MOg$7z^}BnRLo!8wIzb0z45~s&D zGyej*eKXO)l(fbG=YRK+^VRS)5WHHt3Uv&cnxE3w3T3pCNmpD^_eE(*?N(>db~moH zg??uo$1A>+_`+!MM^uCk&$Y#wM$NA>eQsKHdZGIdYz=StIczj1E)NIPCeiH2UB1aR zIg#Oo*fQeCw}HVmjz0$3ZKW<5>yi@3a~@?-+q46aJQ}Wg4S(Pe=VJT`lbQ%&u-H2& zyZi?@rwSFTB`H|?$wiQxYv$(i8Z4hkB0gh{gISQbJu`<#pBMi+O2(=tV;VBUzvt8n z2cTfhcTe+|$jR_j=@UjpkRYnqANg8Pp%4$DiaYm)Ow zQg}!-*`3;Ha0&A3TKW#Ky&^ZR?>BB|UPjAvPfUtXdo18>jynA98Y5VW>~csnOF4yw zBQ}P0LndXcOUUN`_3u?+xe-Uxxmw?9>klkwJAPXU7%6qIO9z+kL?eh1+UVKimh%mD z7-u@dx6VkZ+Hoq%nkumgTEStJD9@<&kgP}S#2VLNm*f^Ia;oF_AntOrYBE*WPTm^! z+AY{trm!q!eTUuVCL9TD@jm?sPPKDU;<;y;rp&IRraz3!#O)P4a6)_nsF2`w!2{A3 zmin3#X+^{h1X*xmXR54z&@6WI8ab2*Q}cCbLM%iy_)hI$1tIMvvbS4zrY7IyG6Zru-IE|e0g@8;#& zmdFl67jVCFZDhO6Xlc!x3WhmQi6pq?$Jf1-o|6CL<@vVH+|fi)McAa%eDcPWNyWWB zorcWO-pW^#yCJ8jtt5qRQm)7W#bUe27EiKB!^x)IoSMBa!!oD4fZk)n9Z2f=Le$J9 z@}2F7%HBcEVW>&9q!hzHrc&0?;(aT-S7sj>>G6O!+zIMDbNKjLt{R$%cNI0sTr3;z z*r#|ozkhXaoDUCUEk(+W+LBVB2zC;6M=@AAVtadiE?WMe?rwpST&Xe|i5uF9FXrUc zL`%6?dQJ^mEluvdQ4=a_|##&l_6D;g# zTpE4TNWO1}A}|NJ=FZ;lEBNKR;_%Q~ebP8fhjktBe@w9P`%kUAs@TchtptQleB&jRux+eJ`jn25BAeFm#j2+gUZCv)odXtCf5}4@N zP}666hVr$Gs>Zo-HfvJP)En;{Emq{zc!CmR{PD zjrgfBji5()(74H50Ni6GMBMN{o_f|)jMO?BO&yq(CZal&WuSHSiCnn9$Xr>xC6b4O z`CSW3^s~r?j0}?gp`YuU#G!6Oo`HLD*!t5h&r#XD=^`xt*?cadPv%2)Nj@@+n09?1 zD5-ey#c}T^hq&3umfRA3hF%JW9ApBVpBxye68Ms1V$zcS_j zpQ`!4S|r;4cT#6NuW<+qU-6aVfsgWyly2sl5;N7G2elfqFi{Z3V8kQR68ej@Z_LbwzkP$C@!;iSw)Ngw8jAJV|BmY|`)31=1(hv=)PpUyyx$@kEBk zp2?6UueW8B?H;oc-)8|1Me+jGp$po?VM44RM{vMRBNUOr{Wx=SF1=KcX5FA*k5FXa za^hp9H%uN8JElNKycNX+8ku`XAmZO{XYj1_8E$SPO@n|dVeSVkpW+99{2PD$^bSR} z0M6J8mK=NPEyNLB_H%mwyiPqpp!uzo(z*v4 zg(`i!F59RB`uj&XH4HN8=*znp4`irv_JEZv*HB)5TGiVxldy|0x$+*S~kSH=w7FOFa>)jRhbmeb~czK-L$G6}9 z8#AVSpVtP6BC5&oR&049PWU%m$faca#a*auujG57Rp@8LRq*{La zxA8gC`vL-j`mFQ%`zu*q-Lsv}^VJ4nX9=4Ub^?p5^w)Hltj3+1$Hv3OG&+m?p8Mg+ z_{aqd8cLnpZl1rQAn7 zL>DH{aA;-rmoZtYLSsn%BJVFFCJ8e8((~>QMB;TZ;0m$g!3>(bMcT9{dH4EG)bC# z`;h&&#*0qA`eTrZB_6n^R_|54!>b2mu-Sbu>c4GQJ+NNLba#J&RJ<&=mRDjDw=vg< zd)2hdUtuIcA!Y1ssSRTL?mWklF@5knB4P|8&I;L+Vj=DFd-UjLlE-QzSuP+{I zM#-)~G^d6&r>hn*@jSWg0k(jxeV_HLk+Pj_OZDM2q%-5M4&w`l8Oc^edzwJ5vXTL_ z*;Q>741m7^lNt#o*zVV#Vq2pb>Jmm8-5hbC|5rmzSydNBHLFHy0t2;gB-|!T z-uMk@^|cphm`x=GvLA7;u5NI?^)~0U4jf5$hB|X(yE-*IfV=Dfd)!g-b94t-X;FZZ%N*n;&SH_nAK1Cb?`faXfatU31TSnRI?jw-`X*l zND$*KbTPWvghyWA9~3aEYq(2Zxd+;7NaBZ$I_sWT64ucZDUxvv+~}R}U+b6Tn|9;0 zn2-Zoh55OWdqE_|X;%)apIKO#8uN>*n=Af&h?Tzxts-)>F|noB5}nhUWV?}0UzYuH zW6wqY8NFnrHEpuU{nroj>@nSZ6^Y`b4e6eQo%{Q5@J55_!;Ax9GzUoocVkY0c%41I zW&*DK)iOD7|yHlWC( zrrr7b_qhNERZWAQckG4?#73&B!egmvDdwm0JR;56bq<5}b2Hpqu3g94x020#zGdN> zEatB}8OTk3O?@?&iT$gjIWImVROLbBKM{aL5*0d@_22^v>_Q4NbEa7XDBw@e^6k?p zdaH&VCF7wvZBQ4V9DG5wCxbGLvSxjj8aleVYgW)~O;4|TTVVD<-7lBJ(L0;S<2xSoL#q*kwFXAd(%grvR*CfG@MWm=?xcJ4_qOq5T; zCE9Iqv*kX`D?}^|%1~B@_u-AM@Pec!%I)kNQmc`fVm>7!U#0he&}RJ|M*k7LGNsh0!{1o5fK@oF02-JeHad+8il$K*y>DB~9OWrse> zkw@Kzrj|}k*E*Zy6m{kTvz7+L`aXYgm$D^j@O~)*e)W{zzXzCfdSuZOS9M<_?@G0f z0@q=E&HoI(Fc48sqR5@TFEr$ke@|6h6|pS0Wk)fCusiR(6 zDS@}CC?tVWk;|V0qR18n>1l@MQCuUOu54k&XjLEA<%UmjLNwtsXW~bSqEzGmF zDbXWJFTWe94UleDx7+{WVYqJa?#i1sVm7^Uo#L0Np~go&L%th4g8$eO$#FH(2y@ry zr)^OKJeXS0yMxueKWl6{e~`{FV@#f_{96ON6r}%kgivAA|G)VhEbrAzB+=)9RQ4tW z0PXuJnu9d%fb_B%DQ+ll*2dk7{JFhpTvfLm2<%UB`b75j2OyhrAi&IJDNPwWoJ=!p zd^5FP`-y7>zId4t06xCv6XKozfU!U@-PWx)Xj&yE{E-9tj}^_w9rbCBk6b6|3s$JR zmt%n>QB{vQa*Eb#6cqDGz2z}aHt18MQfyd?C+eZ=T}7dld+QT*SZZ19_p8A9xWn@F z&yN3EhAx^W1K@zitB(1ro~Pax9b_K888h!f*=xTjjE`ajcw?o&uo`L{o*d6@W$YjS zRlNs=DoC9sNZl6o4Sui|%aFX00L(w}HfYkIvc#M|EhFNFwo9}R{m)OAr|P@$WZSS@ z!ifEqZaH0UpMBk{G8v#DO3{P9=pQ6-J;zw@!rrI(L+wj_!u5cGeR0d)KQ*C)WTW=$ z%qgGkoxjdI2-7}MLn=9oxd8DQbj3gAEajeyp7{CroI%L}^iF!H7;R2cCSDy<_k*8T zX$J0oMxTk4#Rqn`TEvM&Xq469#|S80^DEx)Pcnz;n_cPdXtk2oER?gxjNY}o6ba7$ zd1{Ob&&w;w%gdL@fq2^rZ48Q@4QUOqZd+!f$eM49RAD;W510Lf?7M}Tv3&500rT1w zP*I+F37dQ*-@$zwcMeTo4KUB~|Ct{t)eR`@Ar(s)eW!Xun?ODL0jY5Msy)2$*;85B z?K-Jo8ZvlX91f;#LE;wjHFS==FB^!&?QJi#%PO;aV-9y;w*UI`otfvUq%>OE_R3T2 z2TQfztcih^-Q&AmpTfT8in)d`WBlQA1axRmqQs{sU?{7d{6&h^ntVUMfrfm@TY!qdm#5Wwq)jU zdA`h8z7Mr}Tbn3}Z2E0~#R*CA>k8y{RbAA^G88Mgyvu3PM73+zdk8)xN`2~A=~W!n z2Fk*In^~cK#F{mpEG|P${HB}Xb~n@aSERrNNcs$Vgvs2-RPWBEUjEhz@yP~19fU2G z%(-UnM-Z|&BlR(oX3CJUeszNkXlIlm{sqMimLFu7L?Xhv^XW=O&F6%SnURvg99P#m}V4+}S=?Z}R ziN5xUp%6WYLK5QRX5oJKGo+|if((UT-VA~T+z36#cWGil`XIC zH@(#>A9-<8ug%z>+}(swAs}bskcQ1DOvFcpz*arWm54ic(FY*D+#DX+btM8J7|V0U|qAIzLgq%ZVv)SYL<^})GsX)FujurILuic zbmo*KZ}>;O>FCO(L;ywnEzJM))w<$geldk!&dq;t+Em+eZ2~gKyZ92zPTIlQ1f2=@ ztydaSSWtSVx~f)U{9<<`$&cB1iyy~hB~vb{(%v?j5dnfu=Mn81A5AT!Y%u{d7Pz^p z$}FQOZ!l?W$7Gx>-Ld~4w!SJXjwR~$;7$nc?iOrtg1f`u?t{Ap2oT)e-QC@S!{F|o zAi>>3xRZ1K|K6AT!V6zbcUN`SUVE>#b``MnVh2^wTOSjsCvKqUbb^y2vnCe6rgZIx zPaa(=Z3Q&=^%B(VM3b%=__RgVx@Cay?fo56%B%NpY>0;sB565!)W^`~~8p|o_P5(L9 z(Pm`zd%r&G&-ng3NQ+5h0ZV~a=yB*G*mV4V-Zo4mseMy#o(7+M&t0ke_%G>23cLLf z5tWF?Lfd5@bVS!Zsv6j#s*uP(spQEl_9l(s1}ftNVDBjnd##8sa>t@7eDfKexRD_1 zBuf5uNVRUl(u1$%N9evBe3q_JMA1U{eT`oZ8bKbJQZ?fgU+X1(!e*Lhs~A=|zjh7Z zRPnU~ab%yRhgPX6K2;1u9?5rog9O*B38tagm*0n9C|jxOs*5Xn+FEcOUA)g$c#z$F zbZ^M3^)R!^3tbysU2c)f1wS^Gu`|`Bv$AIvS4VD65}w5i5y!kNk}QSjJZlKH3{n!1 z6km%reH2WfaF-T8TpmxH{yI0gzq{IOI7%j_Q5YdXnN!jTrh}J)8_An@b_x4NYQyiTj3>B0awB%{ zKTqx;Y*IInY6Wy86ld<*wW;qb{-Z>#g9;PvMfy4g?>3w@s59^HyMe z3|9BzSRHU@{fU^i$Lo#v-!T4xWA7K2e`jqe`a*bz>V3;SIr{fec+~y2waVj8qvDA7 zy+khyh?Gd|z`uw0c2t4gL=6EFWb6QZJ+v$h9DeT=w`tS*3f~;!XoCDi?C}2eRAG%>3GowMuzvCHAsJ)z)Bej$1+H#jzc?M zaaDmoNy@rD%iglau!^0}p0x)WXm%Zf95v^_jqj#gHE24=h(`O?%_6py`X6xdy>Nwr zhn7MSgs7-)ilx3!?sHL@TzB*DB#d1&b_5U~cGz$yZ8@LM8FmdL;qoO^PkpVKwal#w zSd4DTtbwTRxdco@xWk5_SP?C=L|Ekhg?{FrAA6x@#vQ~)w0u}R-&qz^gaiNQa-`TW zpYAl zi5rP5TcUzQ#+FFYA`1aT%qVdgkpx$pq!2(1$=@&<&0*k8F2X=MjDt(G4`!ur+6iQz z(3<6cd+7ueBQ7Gnk#SezoMcTR6Lap$z)m+I|1EolrO-f7pXJ6{^)FReoZRwNf*faw zk_&nbk}>=%Ts1)&;LNLrCG+5qu50(HmH(cZ`~#n-X`c}fLw(^tE0{TKls`5K6}x94 zW``9Nmdj*q!|ApXtQx4--=X1<8M{F3%H&~_IC9~&i5jdRDF^Hztcn=-3htIF(fM=ls( z(}*VplBIIzEyYil&`M2mX8PR;p$I3oykB^ymc?fvfDxN>_lu#i0$xewNA~+U-PHFb z(+PRWWv$2>=Z;ovP+z=c;Ss9o#>*DzhmIb2;YyV$w(#Oyq`+ybBoAZ4EF>6O$3V&Tj|6A64G-{?@;EWt2uRv?ulek3p85@OnndJ`DZ5kME47k;9wPJAWd#2^s|2`1t(rOr(moB%iKA34Q$TmVmSHB_8KWlKqc zr`Sa+{j(a0HlsO4*45BQLUpVAObvA|#*Eobg`ZTT>GFUGd+T4O;qd_YYAOSKJ5Nt} z#ldEpfMgL;%Zs6aUON@88*w{7H((HG9;3z#t_?e#`ydPQSIa!J4wD)3_C^h`$zBi| z2f}vMC9pA`vv%pvE3H(}u(Xsrj9^<8_aw;hWR)y+lqh5n?*vn#v?NjMf07m)`*QFZm@7U;mGSH9YA+<_F7sE4j1hsXFNpA5#)dndeNoQ7ef_1= z2o*-s3ZwlTWl{Nf+H$!}@sh9fs+;1VQR`q4>!DHmaLqLpq6G6-vP%hB^ep2HQU)3M zs&dh#0PST0azF~Z;#_&C?%Zc=JqJ4n+VY&xZOcMFY~s!ak-YNo?tT_lL2fj7V1Uy23vG*WLA=}mrqA3n0}jjTNM!c!5fd+7 zF$e1MJn&Ri{IT0mC!abtzRsVYkkm)0s3;W2$(zryhrt%*OHvlDDsshm*$*qsQ1 zV*b$s&yNw2GorKMpItKN&&LG#`tq`0SxY}i^rE>G*U>2Sb6=y?uN)LujY0SZ9f0n{ zesrLpB4tK{rNp~k>R|=y`2xYZFpceWvp7sBGdhfCc?Ut=?6DaY(AT~t1gJr6V}X~d z#k4h-pJ1@DX>qN41<`51~V%7#u=F$Sw&{6ik6s?_yyamP+A-TK~E;J&a5E0r$EiBkZ zb3v=9iD9oxLKRq4xOhWiF z2e^k$nFh5!cOO2Sm_}|A-OG(PHmylL*<^<0(h#x5FW9;3*{$HXZ$w~~`u9-3#(Axg z)s4UJCGTfRxi2E2;Wr{q7CLj-yRc$Cpnc3-BgCM83PJT1HIcP25R$fzk{}5p@uTha zZ0^mW;Xw-PDyQtxm=@7UPFdobEsJrT5;wH5b=P=}=OLsqL#g~yoNw0*lcS@pucHoJ z0bHO2?RwQWcDEO{=9UEiET`bvZA)BdFYH)>Ta!K4K3Vm$wb!xs3j-G9Kbpu*s2W5Q z#H4TYgRl9}>;aNEEK@ik!;1t9s5!F`S(Zlh-3R%**fA(Of=cX|!K!Z6DzENJ-Zta~ zV37(wEmN>+g)aV6m*tR0;{q!S*R*GJu8C?D7FzI(@7%EzWZaZq6- zXL{>2kRHDtO=5pkeX5+Y@|Glq@;R z3?WMRg68T{#^&+CoVB5`ng4+uDF1Mg17-kM)hrz;;{=#+E;M7 zd=h=S+9egkJ62s#HZ9$kA`3Nc7)@=Ij+diNeS+}kQ=uwL-taEbHzjv1rdI#pX+pej z{w%cYO;uHG+;3-lsDhx{OybI#%43oo5-gOC9Yl5h6IFY4*A5Uc;PSlM%EoY8#IY08vsz!+)UY%ud#R4Y7i-$rKXep)zrvEM_h3`BPs+F z#din8oFN!>GBW$ip^WVjo9&n8rrOqqita#;$&whZGTdZO)adoSL5X;Q{jWT`0#u;P zk;2;(o2r@IP7!mePvpUyJFo&*EiG8Cb;AEBB*DwL+r=BV(JiD{YDz0vV~Os?O692E zyVL9rR11`3Q;0HaN>q}jo4OaLsvh*mr>A~JfoLJoVfG?&Bx|JZA#{_09UVV+25 z@Hxp~Wj#GFJHtTH;-M_nls6JC_c25ScQgmTekxqyk;p|GhP!IT1}(6eL^gm~4J6Gt zY0FWTHy%)AQWq{1O?QX5zpIbd@g9Nrs@LSoZzUcjGCOlhj>!h*LK=!(fMMKkeY$BD7^$fkhm+dM$=;X||ElkycaR?-uTV#r)Kw#>>;8p~w;NG*_%FsQ`GGO7LbK|$ zn3?R`QRp78M6|~g-x0UCu)j}ukP$MOzW^X7iA)EmvPRi>mCFZ@JQ5@Zz4UMW;n$*~oq*RKnWgsUgwZhA{h1TKC z_v~In*z=wJ)z_O-eDqXNSX|l_^d)W19dTK3kuI0|LJrC9+Ko zwNU2BVh}q|nig(Qn6ka%q#_oq>dz_ty;HMaxHsKRG+$38!c;N z@mK5Je57%s)KPhI=+LMUt(>y`7f5S*J!d+7b3hbX$Y5vzjH2}F?lUAFS zW%I&&u`EE{%DRa7x7{anYN*D1wiwWob;4g^%YT*a_^@n&({HVIb?n{hg~E%~%9r#0 zDz)$R`gz+m!mHK(T@vr^F``8cnHaTDJaq)9k4AOC%ii@;_5><3Es8iLmB? zT`Kqn zn@{|6lm5)y&d<0tNS(*8+ravm{LZ)Rn=-o$bBp z4cslOtx+L(#S!m1GNlAE)Bg_RgsvDz{hw8bOv8U!CVG-$Srauz3Y}BrzJvQg_@P7< zbh)WS(q;{GNCb6>p%v89AwZ%T9|o83Ee#=hPsUv22LqY-Hm3e)>q_HyKLfV?0-D`N zcrhnkH1JHA4DYX71Y^)meLW->ZOo`vO%pn4mCkvH-wLJPYzTI(#rV&&!*0wxa}B1b z6~^Y1Ia?N39W#{n1jf6wdb?>X9;M_968Da!Y$8- zOBzh*ew@`_0zwNrOz$0v{jz>8fPSK$%-IPeQ{CQ#qCw0s6|xcUE&#NssmwC4MHZa%Vi*c+ZnggvgMjyWuhA_2-rBU*FO6r0{+QG#0;kH*DTsTexJTJ27u5k zeb|W6pAwKr2m1dBFCN^B-#KEpX;Bh(F%SI)l{Z?uL|6+zOLxm$!}&J#6hs;|R&DHl zgaZt(26vyMCv6)$lgkHw@*&A*^(n@Y57CPJ!1%E)c2UiFb@mb>*%Z}Si2`>fBh zBXtsits_JI=yU~}VD<_BDr_LZnEuRD;EunB&cgurT7U~8|B4~DZ1N)3jM2P|Apuf+ zkU7-{U*mEgH`7*e!cGf*-LH6&>8n}zwfWhI4HG?N04i>xe8uOe_MTF+XW3jjmOo(B zVV=MZ#^4^frjN8Axc7%=7pdcRVx7RLwtErMl#LvFj9|9-u@X01Wrwx6m{{0}VQ)O7 z8aZT`N2}B8H~d!(%xQQ`(zK1+b74|&T+COO_OwYDB)*;&i+G+zO`!s3Ft1R{5}*V$ zx!>H*dOH~stxM}!&BpKAxe8={N{%7qykbEYipqQU}H;>!pU3b zoJ7DG@yX;R<8>ML4^-^vLt8LZE z$qBo-K z-`tw|CnBOhGZBitw~dXeB3(i~y}d_EIVVDS?C^v{b%U$2lQ_laSWK<9k2n&Z`Dx$| z#cG~jFlvWOJxev*hLx37-p}k!U64Y``*v!|#9MrV{DZf=->z=RwLLhK0~#xvCn)FF`bBQ+izW0td-)N-^Nyandp=Q) z37ollKSk{iUeZrgOi$lKYX&a2sE<8qM&dIQpI45?_8~q&4U6_Ib7GU@yZ`fvnQ_>r zdwry^(Aj`Gzf^0fbrc=`b80}@f|Se~I6A{k@X8DUE^9+Vytea2moY*-C}!zizXncc zhnb>Ri3$&;+#&>Rlfgw2P0HpU+Z*?#G>`eAZO|fs6Qau=Jn~rin4bSKiP-u*ZRWIw z{t}w>(uPr5S(c6|3YlJvp{NIb>)U0Y89wIh^g?V!@t6tTUC;<5BXDzcE22cLG>jy0 z;=-40mj1NuB(oEqAnRaHv38#NP&wd{ikbJltWoQb6A1z@cnQNK7ma4;YjD)ivwQkD z`OINrQrztgazMb-c)QRLxrzhjhf%W0#I-G@1MQ0p!Z2Yr6_u@x(aRAWz@1|FD1vQc zRwn{cU16AlhgbDGeSmg8HB;AjIB`6JzT?PMpc0ntDvXzymb8Tfy2S|pn%>T|ghO>~ zb87=Ozm(5?JmN7DS3Uo_lojo3mfk4#94H?p#w-7kDe5-vVGMF5bvFb3&67xc`mX39I-ok5XvNx>0s zuMLVA{Hg?!YXZu&CA3CLpP2KEW0y-k18Gd&%&mQyWa1}?DtekX6DMA0N=gmCC#$cS z-?uw0@r~iYvV;#%coLCRk?nADry=>Q&ke&=N8kb(G6X_crjBzsWC>QgZN6c<)b(k;yK!!HmFK_(1R}Ce7r?xi)TT@yY z3ZObJXP{6UIYq(D9CaTsbdzGp6g{pJS(-S1xXApS_yx107j0>^YDuP{ynESXTtuKX zio&g&R?e329BgkwT3H_cxrX%E!RENIsY5J?Du3@0FBPCt5nWilKVpIpB@6+#*`1Mv zu~7UmpH+-DD(WlPXiA7(dF|4;QVvJZ;q_PWck)d&fs3f>p*I|Lv6X(&%bT0JzgLav zD&foAw7vDYLuOUBQZFJYV_Xf@?t&?(REYOUrP7%^i2>OS-j1*ZcO?`_? zzw4EmrKJHssE!b-uDJ{ODv|MfkOyKBhSnuLw(z*2E7f~*ayy1|t^$`=Wy|hMic4a_ zXsZg&$6kyA9uNzK1t|Ry!#!+#PW0b0G&&4@V6fkIT0K%>7{a0HKm%@_d60X4tkbBQ$3F@ck`!aCK+LvaM&@ql zisK&V?tqyK2;r7drOV9oEr7Q=H5{#0WY!`x0n``C zh1u{~lb{$!A3kt(IDuj`UX){QO+I%YDH{EgXFgQO@FP~IH*!7wtX7x}#oew?D7IyB z!4C8JB`xawGx!{%UblkMLk>;W+l>&9IF)k0kQ&Z1a<>ntO zx5_Y|E?H_yJxgeW6frKdn3&ufy+icSRrXyhCDf0hBc+m@9(9i4Dh6Sv$Cnogx_u2c zh3M|?AJ~~!9H&D!e>Z#`m}T>nJ8ou_h7b2MkL4l6Xad2iJvR4aIcG_NKN7kBlGr!V zb@ZWe(6?L~!UOek8>wLP~rQ2_-P4 z8HeM|v#gjWkXbg2e-*#0BUyk4U3ilxFF8Mjr%ogJj{ho+GfkS-IS-Hn{^XUV+R?^{iA-~?}Z`Ger`QgMU~O$ z;>h41h!|P&uca4mUJ$%TMwJxC5L~$)${^Go`uglb2X7apQ?~<;y2P5iCh0Gy zh`SpfhP26Nhjay2Y>(2OcfZJbAd%5e3< zy3iF{Aai8+aCuAn#a%~4{)!;qNd7#?)bFf;2RxG^z;0~ZY#C%9Z{=5}cALg^j|U=( zG|f>ZKj_Ok()bgLYu4wP6R*MDhuNPt^_Kcv5Z4(18!cd(p_5bNUvfX436U%Q$ComaDoc?8>{xQL9(_a>&*T}*L z#lo*+@r7`lF`mM2?l#kx2~r^lL3-_(UekLjP+@y;r~>g~yLtci<c0YzmB6{D}Cxw;3Rk7R}vf{IzU`(7P((1A4T#F%mu(hmM^S z8SG6FBxQ=_wX?cDl#WFt<(r0q|1JC}(uk?G7ihkrYwXj4%5MCD%NT5m2fJbL7ig&m=OKDk|{^zfI z9DyO-7kAtQMP{6@hbLLbID7!bm9Q?#Uu(bC#h#oFgJg%uEpduzjCh?1_TYulgA+~5V{YtqIF~RyLN@bjCq#Qi{CyIUmeIIe zdPaB2A_X@oJS|S4c`gcoOXmcm%5Yko(TORg<77N~^KhOrZy!MorOM+vmV0IC+ZmqXqLH zCOl2@yE12@BlL(XO47w<*IAprz;uR&j^F&Q!oxx-J1YRq0)Qz=PK-=cbZyaLV`hZ5S#vJVa)1tC#6S!wPRg z|5A*q)W#bZT~ze4e3X%V3v7XI{VzIBiQuG>;p`Q-Zl#$wxK4s&lW~AF| z9KN$3%j&g?k>a4ioWDbk?-G43nD?_M!UW;CzfPQ8Ob?huX4JW6K-sndx_emY?H zcH>B9U~6nt8Ph!}*^LJe_$}7Ixuzg{D6AJ}U)p30qC?cR7CT+Yc-b*heHW6vt&$j~ zl7@Ttj(xFKQ}@;NF!MtTVz=Sh2%MY#uk=)^t;;SUMiR=+fcfFUohwfR8AO1u9mph%?x~xPT zY5PI@=}iX@>k7CQ;~ACVjus9jP12q%2FFWEH9p|g%)yC5rti`!p1w`E;dIqnXw znKl`)Y6KqL#PkqhJHGUQnybk9jNAun%%vnX{HQny(L8vLmQfXM!fb9Egql4*bPYOl@3&(rC_;a`(8)Z3*I=gGWvozs~8@tfk zS40fu%WJ3RuoX1K0FqPM(B+DevnD=KHm4rl_o=`5DTm8eGf6yxfs8TR7+Lw4&>b6) z5>=qSWtFPqYw6mR(R3skAB*okzNe?IpQLw#p{?;O!5ZJ%Zr#L5<_a>Tt_7ZIQ23Ct z z(@XIytEveZIk{>|>1@A}smIfWFx?r8v4RpoU}0@7w|g}cS7|&Q{>OEyv}h$uXM5zY z&dW+}I0D(o$)8i%y`4rb`XA;x&W7&p?y|D7>aGjbkT2vLMCI^bneJjX zAkcK?b)60MGKfiOvUH@Ncl*gF73yA<5t6q`a97RX1%1-@K4cV#Ldvpc3 zhCpN~5WA-qQxUQUxuJ}%KQe4uRE*X0N$N*TF3&}9)3@)X# zP(hQ(5LvDML?t9$QOJUh@-^ExEYM$Y^L|ZLMo)UK1aa{$ZvnSvDOxBTWiXvWUuCG* zgJB;6#A|=DG0?aS4una7t5W66u(*8V0_1CxyHdIF*#Gv)>%fBX$gHsp8g_&D0P_dB zXsb9giN_bnUt#CSkC>)a&}xP-3IDw6tJdqF8=cgom7hZu?NH=u^AwT(&eDaH-5p z=s{A6tf8u@FFh-Od)LzymmXVXM?GV4XhyfZ9GNhN_gz{g#@aq{swWx~GP}5gkZQPN z)6s{@UYi863n1}1kn|Wxdhw6i1b4@wpll6Yry>Y6h6D zcLH+DcS>_H$rmsPsP#L>?19J?*c=rt4gpjMA+*=puC7=aRgpEA{RKbTcvd{vOANbG z*~gKjiqy@39e~{hWlyf9AIHS3Jt)$}RXA!HBgp6i6#@2l(nX~9j?!j&o?7xGns~9g zIA^$SZy0*f)pHfpttJsU=k6r-jJ$fxu+Tct^4z=eTMyPb-Dc}F+|OmvP#r?_4X{sA z@6AZ`ecT8QVk=heH}!AR+i)b@rP%`O{Ywui23|kk9N{JS6-N4{GMnr62Zj?V>f0%f zfgi0SBb8(-Na5+WsmRDc1bb<8XH>ES>h=`~t}@1G5eS~9Wt*xylf&Yp_zQ`J@;)21 z=dPz=n?}LX5$@+j;2fWWJ8D~(5fbO0kqeQTW5_YpMWxlQ$x|inZ5Uya3uY`+yZ?kM zC04$`(Xuv>7a&q)9xiHV%#B#P<1BF{039<>bl)_QS{o8ru+iKW(G-;)+qm8DKX7ri zPM~q<+Y7}^nIeT$i<(*q`?=+Jg+cuWEQVC<9@{TYcg7~j{=si(ZrB|QjMvy9gwx}W37bW7~g;V6slx+hL)6yqm z(iSh+huQDAlCvIR@OIP6{5uR0tG||BV~-&8rNVMVD0|Ti{UoGS^w}||7BW#xE|~ts z#(|235MZ?K6U)Y0Il;Tdgv3YF^ZNY>QyNE38mUZ~RKVxLSCWnnyA|7rPicQpY49}( zBL}E#Odx8S$(Nm{-?zy4k~#NtT}47*ZdCzVl!15Xi!7QSRgnQKKUm=dK)n?0EU+{- z-G1U1OUFKHt6Z$v4vrvhDwK0^`y2(`qoq52W^}#8v;|qp{0*~P0GvAsY&J3R z9c065)P|4*AB?eq;=7TY{HAflpauWs(z&OBDI3p>*=SNNXZLMCmT>{VE@T^%7h}|?_nWR-Sl}Y?YwJON$ zXdX0l>O2GSvxVV5!O)a|Qm~#4qy+>rT%5K1XfzIy)`C+cEhx3<%`^Ictkaf_=&||r z=hu~e?$R?pcm!%-uI;vwfLO_r*ZWNhbIEZu+^0RlggDcIhA>$Ode}XoeSAKU=J3n0wuV)^ZsR%9PT$^g z23)^L=dX(DW>}#h zr1sIS%&3Wpx%RKFY}G&AaFSDb@@;Leg`{@QEFoE=Is2vwUh_QeuPbR~fx<8=eZinA zPc=_?PVe$molW7vIqwg<7lP2Cg3+*kq-`4{zqg?e{;CZzMl)%Pz+ii zow1{jyvuCwaXs`Qsh5je!9#^N%c0HJq$k$vojHFnVuA_oZ}r>Xvw6Q%{M9($ywC5hm8NtO_fY5Rn1mZUo3ehC>L@DG=ad2_P9V zyi0mDYtxij%Q4r8czJ>}cbZ^h%^8SBql*2TSUvdbXkFpm>l=F5AW}y!QrKRN%HJzd zLtYt?K4}tKdC3p2Q_Z=aoL>S(3LC>|qC zU`P@LlDnH%fAl+kei0M#Faz{zym-)JjaSj%6E83pKx@nScyD zLV-Y3zYysOQHvouI&<8%m@m65kZ#U5oQHvI#(`@*)J?JUb}N#pdNtd&b=1MXyXz~4 zi%@eB{&fExJq4-6>vLOKG5ndE{4?qjN;*Lb`(k@BOU8*nA1Uxffo8Wg^UR6T{a^e< zbpf$I#AwzbeUzEhYYu=EJ>YX5M5qp~yZ2%=e(F_ah*V7w_|K4(GA1-M-XijG`SH40 zXt=}FE;vnKK#m&mj6*r%XbUuCO3OH^VJ}n}Z&q4O_*d>U?5c&jigRm_I}HzuNiI+~ z;0x(@mr+z?glEcAfN$5cv5O9Ev4HJAO-QWDY}`j{X>_qvtRx7vqy2^bBTEZKR(wN7 zH3OVX2Xp7zb5IX_+35Mz3k>=BVuTbv7U6!vLVUJ-PWtj@yB;@OSpN?q#h1pj+p?%| zP5)KO49jQ^#Xq1`8pUom#+n2hXWkrA^9z!;g=48dml>v`;6iyq*l>@P>NTXyQA=&o&pBn(yg1eNGT9%J>AH-B&5F;#>F6>&lv z8i_iKddq&ckmC?|86_{ZG%rbAX}Jm6tSa+x5YD0FmcLfK4_T{t#)09U8rs{+BO9|z zCmiKLzZHE8RKiRuGQBgIcfG0Xq&=JoL+C&o*mL^ZoQf2hvH(m%P>*)(-AX+{+?#$U zI3jwN$Ltun3Wbc98)~8%#csTZ{cf!BsP4VLWO2ufU6@j`NOu!zjp8m!G%^-EElOP< zBSrE%HT7aSxfmAPq`r$$xGO(Uu?RB)tFqz(_a!-6KjNZn)+Q5NxY}bL$Nbp07U^(e ztoS1%@nH>6?%jg~cTdcq1{qk9YXSvdkn9vH(;gl591ALLswvRIjgdhFzz7zjfA{%D zM+Op0TSnX1Y|s$FjhF*1f*|ZL?%y-YteBk&Z`%bSM!gauws5!mFQ-0sr*)ta;W&KK zqF?@ec3yebvqa2o$lvhH`s@yezTZrj-Gt_{6bkBv|LUL|pF+i#=jC9c9Vm_|M&xT6r$|OY4@i0C# zS2Oz}S~Z3)Q1EvXbiul)M_G4hKo-*dJa)#~?*ZWrJfEC3HlODJtqTbHm5dEf>VKn33$u z(6)>hQ~9Myb*o5CO8RE$sc^h>PL?4@TSr@G<=d%7ridbJTWXxGHS0L*FY~dG#nhp0 z7e=V81l{0aGfu3in!SHITK45kilhWmaueqRYJ1#RBPJJaGv3hdm*6U5G&#?L|CJFc zw%_{nnMB1rXzJFg-{3G0Q*4uUkFPRyCkXjc6`8JdrSB-GpfAhCIDzAzAPm{ua z;qtlCs_+}Ufg=@1_F=(F&Q%f&R1gjx{)VqW!E{JMDWIrXG}r05{-@3? zmqq4y1%zlR(tjhz1ygLhb|cTgo1 zQvBPa(iol_O}V8}Jr&{q=ID?sI5a6%v%ewHJw4L?`NXc?YnS^%15f?bFtpeUxPG7K zrvuYpUma_R%;f(aOaRGu#bFE!|M!^? zAf}1$1LhnA{r->$^hc_0MIZ-!3P&OT_aA>Kh|!5q;ji!@>H1OomP6Dq$D=Y{BNr(m z3~sugILB%DfQNy3$I^+U;Rxz8AJiX>Ag0s5hX{1UU4QA(Jca(WAIALcbtj<1ZhBhn zcTvV$+ySaksu1Gc%4UJECAtdsRoi<96r{4?tr7t5iw7aHR`VA~LB)c(Jlzd8zP11? zkUQVc%Z|atkWwnQ@{}Le_I5o`AwX;A$?57|L|@tnF~{r){lN;HN|q~!(YU`yC+v$t z5ndVW*5cPMfbJpS1nb89s#_ApmK}bQnB=V!qYG)+_;d^26N5gh^vQL3H{28o2G_%M z;?`$CW`0{O#v;ORE1cc^pWZk@U7D^LY#szvrp_~%$F85HHfFCGt)@fRlcDzY z574Gy{Sd{QnVC_sm|aS2J2troPhJ<&vV6rJNun?ze`8;QkdYT_a*ROP&L>^~GN-UN z`Tw9ju{s^WpRwy|z%xlZrkpr#1VQ%1#EcA~rMJ`ZUodJL$zv>R-ie_!aTcHK`Zx`8 zS}cOt#oZv5PYF|Zyjp(F-tq{+^Cp?oQ$`f|$nlNWJ9yRpH4?3+`Xpp?IpZ=p{k&X* zc%vC}6!r)o;WbYWeM>E643*($t)!+gV(Wtj<+i-31Ldd}T~3<*aw9;t+&=i%YIgEw z=7_^>;h-IO;BU7gQtW)F9XLptX^WOgX-+FtYMA9TA%9 za{P0Kz68}{c4wjj^@7c9Qt?Xk0*#qwX$ksmndrJqRsWr;$bgk9hji$TQmN;hA~GYg zFhxWtYVZiQaUT>KUkDiIE)B0Jt7KWljwHV8Z&B)h7G4Q*=x*2NB=HtjRbH@O;ifr}Bh;Qwz3(w4VnVRVe5VX@G-Cl*TlH4Mb#iitANL1%?7#eQjj zHI+|C+*uxT8Aya)ux>0Hg6{r5afkOLc?sKaOgbgykQOKZ)&Aorzwp`MT6+3lxXOz8 zayOamQ|8OSJ~kc0Y-Z;f0P<>!pQ7Rt&Dv@pQcL}*sT_QefB~dV8n~M4%-R!GxYA^+ zT#^#55L-L)jVZ%jgCT;>7WBeE*xJEB$K%et9EaB7`gJuxND8?CT|;#%(rUZ&r*L`J zkjE|qDxtCk`nm#Tt?8H$4mVBMNZOReSJGgi!ZCL7v(7ntAc~jVex50~CfpVMz8>{NtlONG3s=VAT(x#j6*KbSOb?B zX_S-LN!|oYfB`#zogK}m^APIqmlS3&D;ibvt?UKP^5$K%>AfR2iH~B-@RN`E%sv$Y z-RZCOF4Mjw=7%&%l3u0rH}!|vye5P|(kas48a6xizI!{LLAl3Ntx5354c|@3()bpa z+4Ey^I44b|tbB+hW6M81uLm^6B{E(*$){&v;QK)tP z3Sj6wDe4B-oBdXjSjI9Dn>?Lt&bb@AAnYX}q_J;cMs4sdLY4p$fPtXp+|0EEWp@CO zs(~R@CP7)VR6<6^tTd$GwW-VHkfdMu{PD+4eTkW|cGFeFj&ju{r|(RLLQ-|Y*E#(| zCB!b9n@=mT6ppIt<)0tMFWmOYTM-#KS(`MZTE@K=OhP=AWcyPH%<+E~BDFKalvn2% zT@nB(tIBu|OA83~ z)W_?&hWq1+43;1;;y?HMPG8m3Zu@w7x%swMqm!HWtb=xHOHlyE6%o=b3gaVtuLM+_ ztZ5+&(jz=8mR5^Q=X>QV11B_XD_Vs}z!>vRMw+IYFfzT~qTWtHsiVor_c_P~Rb5X_5g{UX@wO`t2l0-A zDlT4~??>Co6IP@QSjs|0cB&*JBt;#5=*wB-b>VMfppL4NPAx6=J&_j;+}{*~xn_eF z(}~WVJdv2{W63l~MtEuuX-ku@l$oz9667@V#`*ZmiXK+X-5Q!;XydESvIekPT`VI< zpWQy&Rld%-w1bNZ&?8lRFX`7Q%2CqOK;6-;LErPq1ar%TkDZttIUywiWS$II~O=rlZ3`aSJ1;*qo!Tt|Po+j2WwOO7!tX$-I7 z>GiiAt2R`+BsCHt2$=}`hg-XSdqatkqJtxjRr#j>=*6Y3p+n%k#G>oZm2W|nLiD1) zd)uMGGVJ|auKPTAS53*a+tmj_LZk~w1qc2yI-k?8znzXQFuwQ3=)E^+x|eP=w*vp{ z%-oFm_RJt3L5NgVVPYuxS9MmhQMX;DC=>w@#}eB^9}feSSjD%MJU0r@bfwEm7KU;& z-sZa`JXR03;Ut(P*oI!>hqU!fi@ET9Tkb!)v`+#d6k#(<8^8^y4eE6s@h@H%?WjJ!0`A{3;gNb`^>h zfiN2-ll0vk{qh4}QjPpm@f@a0{Evv4a8sAKEkwr_P*zNhuq&uktgx*w97JM~?E@sqxvQSCP^SyM8WHWh=@#e|BLUb^R1X zmb|T%yV1o%fOpdv01upXN=g7HfiaxTX3>Zgx zLt15sR=b$oKHY)L)C~Prk^_qT(|;pEprbK_v*z6RVm=~_M*nr;laH@V3axWZfz4MQ z`d7c+AO03of{l5v;FavUOmo#0v7T8-ISl1G2%b0@O`org?t?}UnJBcTvld;aDJ(T8 z_$C_)M{STn+zMBB>k!jzE1Isdc*W{LL7+@3E9$BzC&kF$y_Nja<5NWvoRI6I8x;jv zS>0!W`C;8+QT(cXzkofdmL12<{RfSa5fD53a%8-Q8U` z?(XhzcXAHDbN_W8Zq%BE} zZU_eK^0)(@wY`$oXG9=}6%CfrC;M3ib@T+~-K zcyh4KZ8i(GZi1p@^m=_1UUwf2CQyVNXj}mgqYh{i?l6p;7SKUaN zm`(@hKNY0ni+;m3hR2EH9=iJCre|8r)XgYNQ5SNj*(AXID>*qH&Ev@yV}>55s0MBuhq4Qgos# z5t0qx!^igSU5}+w``s-BCm}b4raL{rif@%4q^b#>-iHp81TE%P!95O*DZJZ8?;c{% zmk_;7WUq$7#;REdR#?Z1dh%%N1DePWd9_#cmClF8lp!RiQMPNtDzfAp#6{plOgb}J z>CUD6G=6h%3(HuUh~pr*3Op((>K67E4>8i|YdJusFB;4l*JMt9o3A#8+tCYZ$KhZ( zGw|bJO|0MQ1n>p!J)FmiKxCX)YU*K#;9VPA-=-g6B}s`!Nb{y9+Z9-WbCdW(Xr&4> z#?$SP#Lyz{Se&lHCvC3ITSbu|fBv-7xx9*BXa=4>+Ko>yO9i#$?YqHa$BY|^q^y+X zTl~AY*wqDee3^@=@mJQbN*mTGKjKp*1uO;eVq|CW&I0yowH(tTNlEe2s(>!WCM64n zSuKgaZ(BBt5We{426>ML>py@BP8>d&=Xc$1@s|f-RWEquwee{b7h6xI(a#M8&@|Vs zEQEK(cEyd=H7rgdQiGaMM2F&p*@9BK4PxF&oKwX>&lhQEGE zt7Rfvjm>AXmP-BpdU%vZ+;AYg=&M(%$zG_tK5EEGEVu{zu-1W=6CRVQ#>`UkmAVEw zp6Q^@cAAPpb0qENvnIWn)3+im_FpNACTC(#0%iVULsCsz^Eq73_-c026FHq;>2o?Q z>fj*oTn@TfVV)_nCn7UZmaEb$?S~HkGHmw?S(20P=l6DtSwCScwLvFxKYjk!#T~_e zOIlDfo71C(GAJitgGbH^Tok4q=J$BI>$$psD`CT(RM53#3(xltE6W^QVl&ggpxCQ< z7tG3(%A2kf7_EsHWq>|D$(Y*Y$}Px2XR49gVW=%YkgmZ+{#BCu9&1cXYTy)A#cX3; z7>#P9s^)hoA&*@HtKg%AUdRfyFar-g|qg4(`)OLk2LI%HjL#e;k4yOdNlwdB2r ze0A=m_(;oj4Pk;b93&i5HA~^ONf~1ovO(-ClsQZd8M?XQn~8^#N@5Id_iP1!xt4(B#ynJ4Xfl9|kzMD$B-}v36%cH!qBQsy zJK7guu5*Q>9{EO|y%Hh66Dga^4WZVL>X{ zngcJs&8_Yy_qt^k(^1s)zI96vBWebfe5FFsB+2MP|1wR8rD&j%uzNXaKwncNhiIo( z-Qz={FrcmLXB*~f!1B*6GeTsi4tI^yc|<6;G?hETn+A=vhUE}nR~>Y(#f3Zy=39e? zl<;{JmgHNnvXSQ&ugJMppd~e!z)*=tSmfOPh34sKLf5vXbE~prSb5ia^FUvyqb9Ls z%MHcqS&#R!?T6)#v(BcCO5W0Ie`3d!jLIp&Mf29L2z68IH^U7_W(L`df@oj^$tTxi zpu?npTs?DS*Z0eW<4c1IUTH3;*Iqji{YT$TfO{4p(Vf-zJv&vz6IlMjK<6ja6 zbU=;qPm^hV`kywOC0GzV22mdU&k+CPJ;46(b%6g7OrQ_!S-<}I%HBWBnj`GzoW z+T)k_6QtIrL5MM1lD@+*Vmg-h}Ni!(NziIXvr3K#)0h% zsxY$1NH7>kVK{OU064h=z*_YWMGe_$e(rqCpk;BsaA!qyF;~k!N9?Y9e1cLfax(xbh5dux0bNwvh}jHairtL%fO5U>zi`#1lh#?p?r;2 zkTj|eS0M*aF>7W+!S5)Xk(ph3Ac3bRKqn6joD#4BKKmsWx5 zK5Svlih$gqRIGg{B;*vc_L;A#%}s=ZY-(%}(Woiz^vfB&&bf}P5f|t3laz;|Fq=hl zBP$mL8%011t%`IAk25W+MM7QBh-CJRYUtq3aHwy$hD=|xXuVc)Tyko3tomFV4;%i) zphbis3*Mzn+rvU~@#y_ZZFFYZOj@vwR}@QP6ji1q529h$cu#eH{;wq)RKPxx=v+0o zVNN+E3pY(eBrp47it|$}*NS-(8k23g_0%`APIM~r!G)O9=0>h+8?!hZKWW{3LYksY z`*SBv<6XVW3)B14F~+uJ005$01^_7q4hdBpM=K(4P|_XA$l*YPh@;s#<|idqbH?i! z9d2A9D%$DXZo}5>1|@wO4g-q~W)DxSgGNlML#{l1BaM-q2DB9*u@-3BZ?00gWAgfz4wu+K6Ipk<(WqE* z!AEm-4eRLo{i+3jhkqdTHs^LJ-hcb$Dvb_Kg?k>y=8sDA6dIFq|ImqVpg>F*aa9E~8AC!(REDyQsl z?)cqtBwBhR)uuIPY=2zAUsrOl2<9>bw|r*A7oDJi#>geUR`DknI5@OtDmZKcBrH6T z`de#Lwu@u$*`aFJ^OQeVuL2!iWx2ndX!|tWO`~*)5-R3du4mh+>s&+(57F>iExj$*_HNA>hxRZ%p%QOuAp#W>Y^-;ZZ=i4SMsT-{ z3;N-5UPh{+f$WH1bn~x`B*u=1{sxd@aszQ>G@|cg$c%??1MafBf2R*l@8{zXwx-ck5v0nqKvu zy9RW7+7a$dSAitaDld*omF^sxCW@oA*%Q1VW-@;MW2Q(pVuH^xzuKyeV4E*m}l~vq%m|S95W>ERRcBl_{9VKP2@(xs-vc zNA>h3W8-Qon#@uq;i+`7;jx-Yb58Y-w|C}_=BpWS)=D!LA4v0D?^x3nj*N&R@((n~B?c z^o&!`bC8P-P%P?WIGUq4%Xg+QjBS@Owi9voD|YoUQk1=MLHv@nbt! z`8O~?Ogj>S3ez{4pM`13lTY6@E*F|xHBCLNWN!PbZ~DykKMf4ENu>&E)ER!w54;6H zG{L;Bpk)_$ZNFjxo66~_N6op%B+1=ouhE>v2w5o{Ma1vZ;(5eeRJtv zc$np%as(#pE@m!*PL-rHpW5J$dL3w~+EiJh1bZ9`XOxps5Fim9!66aBc%j}g!!4D2 z+F8%+1%Gg`<+iZp_CS<90a|we2ao&}=-MvWRj7$|+R@)Mz2*;997%g^9jlo$kC`l= z6ILh4%R$h%BpJu9Z4^-r;OQ_Y9-j|pTh9fC*Erb&);wVci zd2Uc-IpnP^% zMw@-OAKyt1=U_$VV)e!a-IYtfcT+*xd%lz0xgbC^bzO4w@)**WR*36Sk#;M(IJs^t zm#86VTHRk_f8>3oIa+-ud=4z4*epXnuR4=%zlH!sz<10aiR>FZa~gwa1Ad7%z>*kJb<=-GC)K=B8sq4yg?mRDe9 zW-N-~;^>y7hx~YzmsnjMv4NrVy?0fN7-^MMZZI4paIH!@pF;?pJjXhdmdUfXsV)2v z!QJS++J;<>emV4jlJ;}FxUAp~$ZG122+|42bliY`;7WLNao>+{SMXFJP|{4>a0V_i zBoq6asDJj5x}m{MR;dsF2mrpQCJf2exl^{BrdQhn}`=F`M4G-lpZBOjX@Y9jj-^TA488~B_4B0LozdS0%55B8Nw zd0&pHVN4fDX-I`gRew(9ad}G!3D{!=LlVtC6jWBM+L!nuC_*?sKjET)*V5t9T~q}p z|8ll6)E$WYJRd(lt~xdx96p+Fp%Uo+n-QPzxgQmNp{8u_K^u&Z3Lk}(VbYwQ{b+})6TFX zb9ZuMyZyVZps!`}NM3)C)}9SnU%wK}JG54ANwu#>-pVM%8Ks0F4l$|Q@o@yO+kSn1dA{)|wKWE5`~)7Y zttE}bPa23tEk%{gBs2_l9vP>u)(Y0n=hMKiGPd8Xtvd&f;5n=4DJfs{PPcv-Z8z-o z*Rxq6@V`7!Km-0=yr-}2$cx^^t!7X6Qw-@md$=MZBjSdnR>{~kqo0z04idQ9N+noS zKFpx>_;?avHYBuFwg$N^TVi)_NQYsnPfJl@{S1sn&Qt8xj>kK)_eo-UcTj>HqBVdO z7|IzS$AlG}?M(NuTqEI!Cyy~}LyrYFjudeGY}fhx9^`!9y)W;qp^R3{Wp=e(p)1ia zP$*qEqLeqygb=XUXTC(Rj^e$;L@!X$aYXsIlNmcrj~5%{Cn#c&s!EHb4;>Lgp!t(~u!2&Cpr|}Q`^|{BXcWppoF>H4X8_X>F53fs+3bP=(ASN%Q zEcomkx!=or5KP;14Ur$Y-R7ca(H}SB?bgmS*XWxpZ?|^#(8giDG)YRY70DfIGA*!j zGmHWW3RrqZaKIhrT84CZ<0oGifdX^)1qwJFHsmUt*ccD_dEdxk4Wu zz7tx3Lmh`JlPoh#j4J7ExQH>oyY1cx#-r!4jfdk#Jn@<-B*?vdhAfUMx{|nFKLGSL z8HBdIH{g^Ol{Is%b=`>3G`+B%o?k#o~=Q+jFU z%MO6i#VhhC6p~z-izl&+tqgU}@{tX-BU)y7nDFW~;z#mss$_IE7LU-;z z-AzC~!Gc^C2Dpa0Q?* z&E7>Uc7$ERoRcBkL4ia914RNa0q~umF`{i(#8JMOSmG@m%q+KkYIj$!RFr?ie@2ie z*7xGb9a$f@0VHcn=H!VgYiPm2cI5vFDb$Wfdoo{}+|jzyPlCMpVV7*voBl}!f*0ps z8P;q7rc#GNErPH*=3Fqo#gLrLGIef0rJ<^%j~zkQ1_HTzJ{C|%mMS5l={#Un=8oJj z^P%~r>ao29Rjwp!sBhzZ0`R8T?+hUxn$R7MQ+AH4<*6m~`k^n_A=nEKf@Nf2rQ zC?)#uaTN1x!k?asnAGqOaW;_y`KeCmf)DSf+<-WP?VSrg7FJ1(gEpTcQu~c}*6}=1 zKo0Vsa4peJI`UQJP+6xFiPop}FeB7rXH5`-cAe0{pQYTg7E?cR8$Vdz#)xa1b>&FM z!AO7Tqle2Yv4viKX1$}1P%f&Jy%kT6Fw~1J*k7LuLI9uJDT`=}PFult>_3e&=dU{g zw;6tAK+ioil~OoPwC!k<2d>MR}7!0}yq<68g3vyc(43lAx& z45o7Ik)SneOExo4iDysY$e6SYydXBJcEK;>vpfi59r-`2+Cc^WGYRD*WkyLwq*atQ zN;x)wez-C}tq&LHw=@y&)XjYrfp*yOizvPs5~NbOBq)_Eou&G z``wS}U|=JCYVbsOv%VJ3_^lNEuda|WoIE*z=BjS)UYhSg*as`-0ZE|9Zpb|LGud^cvAj8;<x`9@YZ?T_02U&?;CVrFIA17C#?c!fMphc$aM4_4zf=enZ>K z#RS);fCUp9^mXhqsTdT93uT@L7=15UKzU@+3p0GiEeKZ1}HO$Ul8k< zA00BaRMbsBN0A>DINyw>D~)z^$0&oG96m@wvStRI7)8`YH-zgD#*Eo50m`f&TdD{J z@i)$~aeicgR&0VW2}I-8pt6&$!*wJ+SQYfg`1sWYhZQ%m{u1Yt(R77TZ_hGl*n|(D z3`f*ay&VE?KnMw_n71f!)q*>{AkeP&E9`Ye&nA6siKUt;)$&%w!bNOlRERUn-(mlZ zy7HV@=iAPrhwC=zgtqu@P56@b$~B+E)KMdhBlMe$v^rJN@dB2DJwE9^+zB#;lrKN3 zPWxpqPh!~uG$k3#U9`23Xc>!-5zv;|wcsYt* z7w}%D#xZi_!=h72Z*@3U+ojb9bEi+T#4r{vc`FE<*5*g5&5oY#AX|k1hyLLk4{26w zJoRvzbM$2ME&#RLP%3EXeB&7^=;wyiA=ZRLi23Q9B=>aths76+AbW5o!VDbHmIa{- z+;s{-84Yg)*Xrkaijw^O*^L&!X8{9I4UFkCR1+Q_6q|BmUYOa9vr0e`D8EC7#m+$0 zLSr_)S^lI@vk0yd`uPMUObJ7)c2$o19?gI%Gs@EjhVbU3SfxD-1Q-84zw)kpMt5MZ zEh1^iWBF46rU8=U{7YajIjqGi4@XrHh!ROLerz5r4~$0|hXZYJ(3TE6^9S85q)C+| zATnYr1CtPXP!NwV!>d)B&RQR38ySsi-T`z-inuE4+kk?w1%I4xN1EX{AXRIpem`Rs8fP@U~kr68`l~%W?E(H6V5q-fbU)CKWa*9qmAN%qprJ=>K z<7M>9kcDF^7>biwuj!{;jEhjb^bY&z2Wd8$BG^@M4Z(j^C)DVPWGL?Vs7#&U0fB+K z@?wyq3t$4ST75868Ed?4o5$Z_2IUe(!G_H`^6vt8#c)Ph{9|5`TYLPv^u89=P!{bH zLM9Ji^hhofgd$ke?7@jXifR9> zFWNnm7Z-BvGABLoRZdMYMn|`v`MSHHWmoNys;Eka!Z5E-!QM`xn}SMIAucC- z$8a>rAmsQuC{ObGMsoog`rpY}Lzyv$#56cKyFkwB#(Va0BAm%PpvyBbW$$OL5C(&` z@rS90dn5xaEm|u^ta3%IsH8~s(S0KPbTg(=>K5kdDfwUM=y)k@v~o2V>0kOsWp+ZX zhsgBwI%#Pqs}R_l`i$bBdE`Guzjqc?wb*oiQ>rx-{ny(7_LVJj{tQYTv)dA$Dr_b@ zE?pay;6C@=V;jUhI^+jTj(*t=Ns913A(cjHB~?Q+`IWoEUvqXWEG^$fskOJlhid$5 z_S4pb&esi4J#sBF+DujHw=Wx~nE^;E^tVBkWkZ7&VpJhh_$rSxT85;^o1MAIhOFdy`(YDIdNk0AH6$NP5E zrM-iEV>${rvhLjAQBC}1YF>)!sBjT<*i3S@dqT)T-U-A${}a440Ls#B2gfAB9r(RL zI}t^QLyl3?o8u9zY}#%YUS%s!r(*#Mn|K8j1-CL5M7yBHtvO|kiOr61dB=?NX5tOt zqqt86bv>Rp=?k~ohT6q$-<2eL)oCMI&pTTjmYfgG>pV_td9@?*`-rmQ4rt0eCOUd` zYdqu()Ve~*VgGO9d{ zOKUo5oN)k8!&G*1$#-H7KwapLJTy8Zg|nsrBzGhAi0iIb47c9qEr6AR2-ClzFp^rw zM-_MO+1#Qm$-#4AtyFYfM84nge!}8uG5&S+*8S>2Fg%6-Ap)lD_4)Kprv0#x(X8`} zML4GzxWLL)6p|f^7P$}~Jdixp-D2$9SnJ&aoeQDkTF|dvaaZ2|#T@U?fFawdU7og` z8PyC;tPgIXR5wCnbY&#l$DU-0(k(oBHibMptrl*50pLp5J7e~)Gm8NaD(F5`jC~>G zfm8t5cp{fIET)^LQpzH}mfe+Af<^WQLa|IK4fQRFgcN7mWSmeE8@%4`SMR1eD}d3We6gBJBZuT=xXM27=XI<%gtn3-R825NwLG$ z^M%-0jfJPz|KLI-^_sC2_rsb!hkQ${kC~|6*s-HiYu7Hgs78vjTRK-6wEbAm1iJ?| zQv@*~WO2~*kfg_QKwUXkgW}kdlgE6q%TI}Rwl~wv^bEM)2h!tfVOpZyA~*A`3LyYw zU*{L6tTM7R`&`if8Kgy_UHIpWje~#&o9xQb)Cnp>$O7}ejf=S4KCO@Z@Hrfn*PraVZR4S>YCHj?z3pN&sHGN6 z)V1vylPFI~(X@`g<5(W*!Sdj0@h|Met@83gFiHylM2gdL6?h)&pnB4t_K25Xu2+oM(gbSKbX3VHA zbS>p;FU4-P`9tzxdpS5kI}xbf_-2nMCge~IYavr*o7?xuJg|9|MRl3t+1&_JJ@!I@;pa@3Uwf%P1wd^pTGNV~e^nY`70z(4(*Lku&dMbB9BxqRx;$@!*|2!)Mf+VQ#Q@j}ouH7Pd z%R$-Ko4V6#Z2tb;1^J)n2qg2$S$5+INYQ-UlMFV;K%d8E2c zV@9n1A1|NzN4qp$+h}Qqu78CfD?X+}V?be=6dSJo_41q}*z&Z?H5z-fo}AyK_ss~A z@7>x=5B3M(Kq!ejtrq!5i2p>ULqeEHeLXqmxQN82^c8W8YQhNm$ya=Avm!7}A|1*d zG?sMNzWwI?g1|XdW6$|lv%U+x{Ali99!v@jf!v>|dj7H7mn=Z~)#{uy==a3_y)aF% zd`TAT{HYvhE0?aW_x%L8VAz%3JvOH%Fd`B z)Dn&WsRPx_^O{pYy154P4U8jXQ`cLE76zT_*QMWm#hlhVKW@l%jE#X#ek0sp-=k?O zYDULew>B0OXA(1#FjCgI8WjA(@~*g;l3V`MP?ZS|JN=D7kiuP zdg`oN^Y8k`tu@WoDZ9=&b3fGi8p_-sSxERF4{=f@sX) zoUfrahk}KvPB!~Qf{t;FULt&`ka~a*lYl5D(T$!Y%Sw@3PE9UFJ}z0Sy;%kOoia81 z2JZs@e>%rBrRq{^U7L~gl0)WTCSCX$_k-$OexQ$&Zv(UZcS%caRM+QM*<$Le%nF2U zgP9UClalJ9tXNg$y8Rayv~aC_{#B0JA7W(+aO&13oMLgBD3KBKxiY6sbBnv_6_-!= zz1@Z+TC}<#s-IL1BT>VxK`G3!JkQ12DwYY&bXW;WJ9F-EhsveFXLAS~)x*Zdk4XW$ zL@i2zEZ%_(L#)czgB z!~Ot?0Sdvc^NU5`Ss*YfvFe6grWyKOPBPE`A;5@p+&n;zg`0<6pvKJp!?jwDLF0AYTQeT=9r3a>QuhXVR6m_U`ERt%V@2{PmXYV}!`BBAb6mDxb^NV6Z)l^A}rQ3Y4my^}G9ZZB+5p1%okMeSN?aCenNBUcR_{WSj z+bNTIavynD(jw8IIJ_e`+^s*&_+TBKVwVIblv>D-KZ(F_X76v}9k@5^u+~R=+7&?< zp)}tJjUz54m0kZp4)4)`h<50jc0Hhofa-LaOCq{qdTCNA$(phcsxyh13J z6j~ajnUs_MSkb9rBh|0>w()#+yJfga_M1H-bN^!(KD7rf{T6F!)OgAffUNLBTXmj;bi9OSl{Q+Jc@usXk`BzT$SGGwT5(&Q=jHd9IP z6IE{Xqi1fKWw`HbGIj29h6!CmH%!I$`f9Jw?-AWag#^n!VrE%CK}{;VT#@T&K7n|w zhPr7tv2mN12BMdg7D$G*qW^e>aw#sm%58LDsDHfMpbHs{O6bOf5k9gYe)m)bw(xud zq*S|EuWw*A4t3obxsJ<7g>u^cl$ArWL*c`;ETM~$Ox0sS2-vo5VZ^jZ)) zvXv5Ex!CSLqQFn#ix_q4bQ18}m$a0(-5IF0J z8SI2_3-1z1Oi}IN(p3>Dsjm01{^8C z{*(g$;es$g^a&k~3o?$?Vqc50&$R(74o!;#U0A$5*9l^z8;H-$HYBW&^f|(ta|@Xu z?KuRDqrGuFg`TKY(FkI=g2MCHU(~tV^}27D7^lY8u7PmGk8$Czgl^iuD~}KV@Qmi? z*jgx_rT+#6-#RF>x@1=9lRPu((;Ok>@S~^ETtmb%_?C$TU+zzBouho(H=@m{pO8Y& zZkTAU5F8c38s9`-!DQC6uA)zPo>&_axTS%$J}a1ILb+f&FC34hP}K*`ya4~w)fgOz zIQpd3ObZtFmKMN+zT<*Z1x@tZOg>!FW_qS6XkisASBpb+#?kKww8QmMRIe=lRnNJQ z(8y}lv9=s;{P_YH`x^mD{f@blKMVbuzvCps8ig4LZi#42-1HoN0wT!1SZ9lCj}DxJ zPE3=~tQ|LGqV~PFGHeFd8&nGOJVurTp>zRbNDB(jkq@2s{XP3!)46udYOP&*Q+D*J z0?QX7!Ax8Wm|HIiqZX#pc#bvAy--2NGvaI#aqn`Q8bN;ZpX?nMKn7X3GQJ}#&skE@ zmyyeirUjy~c;jUcMv@&z@_TleBj7I4oZTHgdorw(%7=WC+P<{=Jh3+$u57J&$I6w7 zIq43zyfAgL@&iZE55~h1@1de*s}e9IvzE>&o<{A9i_qx~>CmT&TwS{!1F`xbaf^uq zWY}5zZj)vC|6TeFsdiXU^>12x-PsA5LkA1K&whEK!d7DQxpx&)v`9}OGG^AHtVw-g zw~xfLryt*ST#swx`jWCQz63EGuw9eL04PFVeYnKyla%I^mUlKh^%ti|!NX0S*;5#4 z5E*g1R663W?M-OslFbedL(Y;QQ%OrtTP+7N$QM|;Tgw+mDfk-JS~nTpk+zuW+qx=| z#*dCjl}KJMZH%MI%uNqhelIxw;+!>7oU}PY8_L^y4vId14PF5rd!DiJQvHkIqSRUp zF;u1n#4bLZ_!%6HJ`H5x#FyY44any-U2*39{cdWEu{fyQbM;2U3 zBd}jqT++b4dP{kZz4|ImRw7h7bR?f1$>sXAf_nsdx)bAOJ5EtCcl(yUq`I3bCl8Cf zH)jiDD@|ggus>90L}nt=$8uSFOZYql-FbUN^t{Z*ATJ%_P4PV2Rrym{B%B$}b&X*Rf^(QO1gg2*R zLJpF1fspboff#^x&gffrIQ!yAy z!@`&>*)(ot!3uVTD6Dj~B8~!D_;3Ecdv|n)*65@tepEf=pL4#?&BPOigvx{k(bV@B zN|qHdNS5f&C>V)~<;JFt!3koe$HWq)q7fxxr(Z;SL~SBg43v8ul9 z@CMIRwB@V)Ste2j^D1zHjaD5vsAYkv2S4Dbx zu4g{|u_?B1L;7%$(MTfsJA(=SOU~nA1@dMVqf5^9D$V#6mF4NjG42Ilei;77h#-y( z2u&uTMdO*37WRC-03hPclFOZ}H!UCB-9uy<9LJZ2JqQIl&Df*K>o-!llM3Aa!!gJU z3n57_1Rq>v6p~g!m*Wh$-3C@?MG>ri?CsHz+$=+l-vtYan!VM}@;gZXU2b3u_7{jBZs)sGF@opd%##BR#q!)*;!z8C83gHvlG)+^3e5Xl5;g8u77 zJC(sj&8T@ttKCQIV&pU|B5m1VJZNXbPCo#e@D981XznKR;)-B_hSU99vi+LUWQNKDG}xValJ8|~NWQ}Q+rq>#A?v&tG+&8go z0A#j?;FEE#V`84E>5X7hPZ1WYnHvqXGWnCoG7y_{{%+fIV~eeaI+&JM2#GhTtD~ zy8RcPqFNWFKTou5vjL}Z+GF38odkAA(#0U=>k^WrMC%~&%)>px_Ag~|+WW7$`?w}dSEr#vWc ztdZT|DYqQX=^hH=U?YmlK#97T%awY>>#g9D>Ak%{tHY~Jhbx)uM@^)+kQeKTigxVy zy|3!O7@ zhw-F)1BCYoULE!zUdkXDl`%g6Rlp5?_)&GArlfvGm$+X<{$jH zjTzkWjl1$^qo~S%+ZNg1MK=q)MUXuj9pAzFXs){ttnei}dmkqm@LnxSjQLx4Io05R z{EMPyyLHMK=69%&PsneRFY!dBEGo3$k=}~^RBgq~sKX|h=ECa+=?Vhl0SRnR^-_WX zM7-@pZ#Kz;0F>U9aJ2Ms(TO_UL_0%Jt71-bfsuy9pZ2T)p~_qAV%n!jfIFzs>n|?` z>RSsmmfLR_Ez{NPjNcE~Al{FYZO-Sg=(X|q2m>IyCbW2oFO6lpivoWFbz=VA`#@B1 z(Jxou?mxA`e!q9z&j#bnGP&>w!!#zn4QR!%WQM`B#+Y+D%xuOH6!mNa^@jWf0K6jY zu*qH1jkfIB=akb&mx|x8;p(leBL+yNFA6*%@UR1bp}_;Mig6wUS-gfmOpgMh9AGkZV6}Sn@?Vd zf;L{re6HkCO9(Ci#;RO+ta^E=+3~X}+Qun9F!o;q>JG;&$4eENu5cyId^QCzBDvIX zgleepUdAo|l-h5>!>Bu!v)=sqNBas$r$~wR@E&#TjBk+m>0|p(5MFwicNndC#f!$2 zS3WZkAfx!wKAh{9qbyT^Dy1o^|6%vki2pIb^bFCeOnpbB)MeTnm)Fkj?L; zKDYNb0rzO<94qvtLzg66U?Bn`b%<#O&SvQ9DbLd2&B^Epw*PCjOtO45Lz4f()M@eY0 zVQ^LTMN!f=kF=C8k-S$wOjehz`0G-QUnQnCNUo|c&R6|w+-Yhb;~-B63Z8G{!uf}i zoQm|f?*fU<^{RBlSIFnaxKqkiz&}#{8}$I-t(Zs12qtvN<~%Wq#`f0>YUPXYws_0s z3t@XSCr03&w{H>Y-(xs`F~r+xnZK?G)av*50O4PR4qD4Ur+oe?)BitTshURwr-c2} zh_Rb-MLied-C$T0D zP6G4BZ7IqKrHAg032z=WNV#|Xe?-&>@gxw%pgUsnh%o2SzMtzWjw@wApucN5{50M( z8fe~m`XLpeWm{j5&OJaFv{-Ame|m7N7{KEgZnrUNr;RA=N)E;~j~{**TAOKEQB5BA zQd9A;rp;9R;E*)R>zlw_Ua(Y?(9<=aY6m7v6cgbRu1&{_P#WBp9ZZ-a>1l~tyNUw7 zZLrdpRdCX9a`Fl=2v%V=MQDwt^IgxDt@1=Shzv}XiBTxO&L7@#@2LSDrvhvH(>D@m`mWqOpT~!eGpP4~ zwJ0z0(~xl1n9aj3)!f!b!B#sk9ChU)TA_6zF*cDBjcMmQIR^@&gVvY3#q%FEGPu^Z z+R!fLEv)C?U4zuPyqj zJzgiq_ZHx8B}+j)$N#R5YrUuR5bEg*=pM2vBk!B%d!hpPWSg8kk{2m*mmeL)%J%UX zy*(6R=D5DR({S6peJ{ z$1>3k`5Y&rxV^RbWakFfn$|9HlQPr1BRP2~OA8YzQD=K*R?xnbI$c{;N?gStDxxhl zEF|WieZcKS$7*>7hqON`Dtb=saO&3!Q}cKNgZt6Vq4w;v7m-f+W3^|?dIl~=r`1oQ z?ekp~C3Tas>E0aoqoXw^3w!Jqy>M-Hg}Oz^_Hq%^j^3;jY@TATer9rw<7=1eQSXBDCA!iXW*c?b_|HSTa+RY}dM&mxEYcc3GI&5^+ z7FMHH$mb7S$V<+u_~+26OEButt953p>$l%w(P-Z9-Ms{}UhjU~q}OQlA3B)IqE@S~ zp^5t;fPewO?{N#*YPJsd52q%l78ev}Wn@)XRGV}r6c8{#Dc3Lv>v}LtFXqP`4LK1R zUbL*Z&QZv|1_TTMevezg=wIQ6@ZERbz5A}apZxWc?QQKgvkh9n0M(Ez;GGNz7y$ep zyboAobXXl4h344NW4+zjHIQ!mf`9=^0Re9T0tNuT2N$r`i2k*iY$hH0A8-4DfB~xc zFag^YQlZAxziPJ_bqba17s#&CY87&sa9w!Csjuu7xk_dFK=<+WVmIjVp;z(^9(QO) zf4zHiSX5G#yxG(WLvWPW^L0>3uM1A_RRyipN;=lXEi+4} z*XLkS?(u>(-L)DR1PlOv&o%*H9xn^}Kc3s)~_yqJ0TbXZmgda{ibA9@iJ zy&?DHncn61e}`?liT>8wI_8WJDbp&LS)3Z_W7TyCTqD0s3PDF*U1xV~Y(W0H{yGG# zP%7{{008(SJ`%7L6R_D}M#V!QTQM8WT9tO&#!I8$T$5X-jO0+yY zC$%W}lVcNly>@JLqN}MkJ@@?RiUvJjw>ejupI=qh*gZKX(^@QAX=_PwdTLSM*rr~x zG&#vL8!d~YT_ejXi&oS(zMvEfIFXcxg-qo5O53Y77>W!)bF^ z4JH$6sv@cBEOu51uunFXt9dkr8Eh_~Ywa6h-dr?UrX7y^NKJIKL;HGx~e7K24B5DPbi*qOXb z{xGQ!u*2$@pPB!|3xDYD=yp2(c?~iI0-+`#UFpUV7w_M@9xmE}e%O0)bEy5HJKnakdF~ZFwy-E%SWodE`gbAa?&@dR@TS zpc|c`w5as)#~vTx4uF6m5b6U0hCnFJHUY0Ju4HFqj}48XKSmVyA0`#2pv|s1hDr)c z273n`R)>2d1OlNfAYcfD;#?|V^zZ7@>gdp@-E7~oFA7D2uuzfPI-emB2xV~#*!`i< z)!qexK)ju{=C(^mL8Dj50*a$+1ZY1mf+C z4Ub8LlCADukD*S$5D3J#G3(9f;{XDIP?Ha7b83zMA8MJSc;192$N&HU07*qoM6N<$ Ef=eb-$p8QV literal 0 HcmV?d00001 diff --git a/windows/client-management/mdm/images/configlock-mem-devstatus.png b/windows/client-management/mdm/images/configlock-mem-devstatus.png new file mode 100644 index 0000000000000000000000000000000000000000..2e78bf58e54431c4c01f00b3b8eb55d6abe6185b GIT binary patch literal 48408 zcmaI6bx<5nv<4a=fdmb~ouI+pEqHKucUjzFfhCXt!3pjJ4eqW9?yd_gzQE$LI6U&Z z_uYS9)$6LQsp*>O?Q`bn_w^4|WmybVV$@f!USY_6ky3y43Nh%_D+J=Vh%Ymkt*)al z7X){8S&3Jb|bMSI9|; zYx)=;KE6pLmFwL7F@KzKZEXV|6%rDv<2qRrYI635SeG71B=PsDs=t$0FXE`e)>0l^ZjDM6ykGUY_WTcQG)$3iCb%!GqcO0e~m$i`fnTzywhbnU1h-p zcHUY;n(nVDZZIF-*r_58|Cubjst86#|DUz*mRqd0##t~?Fv&%|&gSi8Pu#B&S(`;) zfyD0?-^i*uRaCnU>3*IJ`jz`{7;EU}T*Mp=j0cOym9@}}R&1yd9_ zF=5~HOU$sd$$g-a)|LJLUX1H`*_>FWcl$cN+c?Aes8JWVGk!@LPl<(W?8vAA!;ypG zjgBEjW(yQ6)Yt{BZ*zTtYh9_V%kX-RAcKtec&*X*x={(tSFV3O2hHFuhwN8dua>ek zIeNYNt{~%Ue&-T&tD=;UIDyBK}38Z(yy4zW{@2$M7S=K8r&~JD@Ybj z{F_<+Q+AM-gFa||edA*M>-^%vbGwGAxwV>tjkkq?jU?0VpQ{QZaWx{Fb}@%_jtSt+18q)F%fJayP4@h%{?ooKdQD` zy{k*f_X7j6u3zy1xuKYgFS>3dTW<1(z{hm)qiUaEMmk2N%lagokJnCmSadaG8ySn4 z=`nYC1`r2utzAgKN--EkpRY z>lK%&f&--4>*VW6*|Ok_Kc@3q^}Oh;{)QTLDtWR&ok~$orX2I**f?3(HK@*;B-yC4 zhz0G%8Lr%?@KN3uleO7mfm9$@?w6=c6%GzgC&pnZO;|lyxp|M{$=yEU5F* zVmme$F@T!QtecW>wcRd`QC6*{z_$D6OqS?S z^t;bsGnw$5KL=7dgfUeK9$m~3>FNgLAW5HdR+JH07#=UTJhQJO;h*cGie zJP2_zF#uD%PAv0_mHU$Gz_n1h0UADNU?JxSRj~)(Smj!@(Q37{3k2+sMXHtA2zhLq zuheU>+G?#ZUAY4M5f;w;=4r+!aJW*BS>NeMol2z(SE2;u*f{tu9IhNzW6YXh%@Z~% zcWW<&CRM$0ea`RpV`>y#2$5cFHzRB0loHMlk1=4Hf_0#5nnb1{mbvU4o z#{ubIj7*s|%*)E)JAB;D(1=-s8U;Hb`-ACg^BUj1?uvSJ$@G3F z>O13pU1`)t?j_ZgiQv36EztCPK6kn#l*{0`ekTg+hvVml^K`|94&cMGK`Cgl&I&Rm z^ zevY6lm`foHh%Ad-{Px?1ZZQR~e+$p2!sKrQN-CFUTEqRY7-M51B*~D~4h<>9U!47R z_XK6*LbB)+AKv;r*eX2juVN02BYX1VK^6mPn|?PrHv`O_oEr0Q&c6e!Li`=3zlo-d zpzu{1G+A6hAvg3IxOB6WcFG+Ww>jFkHXi$`Nx^OFZGZ%CiKoln!QNR-tI-M;m@K?wB4!YPhm<>TJV9RYPce(z1_ae2n0FjSOccU~JWHy^+NPI6pQe^;cilo&r2 z^+7}rX1D}rm$;NOvzX=OtDMQG*P*o`l}Afgj%pgfhgIj}*8^DB7+BZA=V>e5OyGs! zx^GHCWb=p1o_V=maZ=qlvc#;<)f2RNrq*r_Zub0B_bVGGnQdXAf~{evK8CW|gK5-F z14JKOTE$5|wY9=XPI_z8hNkxSe>DpY#2UBG@d$EFK@76rUyATg1i8NC^V$2NI{H|O ztS_lrWI|Vu55C3n$>FlNFIeZJP`P6Hkz;s`0|gndR%1 ztV}JpKLV%aSDdH5&|EI>NBHq0eClYD4bUxurYXN#kf?$t;=L$RWS>1m#S%eWml>P+ zi4S&DJZ{2Dv@wh?yG2bE5>R#b<}ygq>j!Kp1OoX;b=TM5UOkB0sy~x}`%_z98t>+J zZuk3QaOK)}`Hp%{5#bV-&lc|s?(P;m*ce;BrGoiBjHF}8C;^KW&Wym_2d|L*IXaE1 z@EYb)Qt+(S1R6z4vcl89>2YjORs#9U&=KJYw#gjkon(=_849>oZ4%QJVs^{X%Z)GJcHYB}v$ z6iNo^3MlK584W_J-ShwZ+Ba2H-QD3NJ6-RiyQ%J9gG)%qesY+KM=r=!1R-h67`)5f zepAgry&Qj3`?!77`y1uSE{Ri9W3P=R*LIPH)>?X{D(%%r?vb%uWhSCuyf)GUJ87fC zQlKjJA~{Kb2*?(y{9eS__0^x>&MseW0=jm^W0F@qclSiv2c`BHup)sd=n3pD3`vXwr ztla6}-LX0WaMv%Y-G_&x`GOO3F9qZ^1^?S%{q^$C-R3H*aI|nmfPy)F zr=9prq~J7rtshW$*W;}U=y`^~dleG--EheJ`)zF%g%k=Iydo)un%b)Q)S{8py_K zftv<+-0*(B+<&7|8>P>wFO~B1f%W02sq0R|oJ379o?<7etq&A!KZs$|%WiT!gp* z9v*J?!Ff11{@$(VVovf?Is~Abb^s7^Iyw7Vg^4+~b%mGq<8D~xW8d@QMnc$^p($|z z;X-`K!qm#LvLTJ7&#iWxbb=MZeEA(JjA^YsaAX|mPYK=@bwaa1qj@Emg+HY@|JLN@ zknj2FdRPvXmVRl=EmUIseC6Tx&mdiXu)p;PcGPD zNa4DFR`9m>E)2t@$~fRuvtyE5$7`of?D;97>tSDFC|tVd*s02qER}Mi5oK*+L!tMb zEMEm=dsJ-?jWqyDlx>$hVYmeUAv>5U*9QRD?j2`PVm8ts(}&|`rjh`3s*LYkNdEOK zz+V~zF@e`de7djO-N9)%1KlQZ$h5isa$~f9oQR_C3(to}&oHMyO~Mi(`CJjh2g9W# z?h&Q_5}RZq5~L!M6KiNM)vX1O`0MuTBWDwQh$P}&e_w>t$Un9^eZ&kb_ZKPzh zp@o%z-S+|B@Kwi*ZU;x#i{q5Y)BDDX#|_2w{&Hov2eYll4lOj)HB3=pmgj0+K0-i|(D>5huciKQ%`FQhK+8;Vh{1HlxU4&}? zF!?W*7k*pgcR#-@*@8HB9gxuKT;Mo4>c<)tgY0v@2ERl(w##iE)40GwKsT^+DcT6h z3$=X*4?n?J)zHX9*BDBY9XPE}G|HMTnq&S08ToQ$94q-!$CMe2 z?~TZXb;CFLowA#{K>CSZI*bXWE9L2($kh@k>ndqM8LpwAL0-O!Ci!wZb!Yf*BSQZB zB@?*GwVAyd`*27;3SZTLQ$}m*?Dsr6I90q1RZ&csEB+>e3xYeL*Sr8^V8LV;aoN6TboV)t~-uQ=H5Om6O_yYzAA28_WV zxOIu#xR1-6V^9h1%!N;dsV#jl?( zmW|WpnQgvTsy<`&#v=ntTllghDl6@p!}A~PC&1`F_pMcM$lJUj42N@O$#O1sIw$9+ zPRno$ZMl7^QUqy&8HQo-~U`zgJr4kWE>BM zM1;J75gy6I83W2|7_zFG{NPPcpItbe76*a#yTtLo8GOemr5Lr_LK*YoNTI>OcP&GH z1eaI@PR4F%N~4Sb*n#8z9&)Mk{wPz~7~^lo5_<>x6Z_*=2TriPA1W;E>%@MS4`VuQ zXvA-C{v^Q`oJd8g1CEj-2`aP19*&Y(gxDa>o@X~rKrga3sE^}wOms%$ac3YbyD1FT z5h)uR=zTsurU3MISZg#JJ9frg@$@`9bLnv11djpcNreLY26|S(eP=hFMbhj~0+u2ldqbDH<|j}QE|rnA60F^-~fiDE3pG2d6)k2W`b z943m!U^*u&4UnNFqS2wT8Hl4^$6fbV9OWifiY55b924IJ8Mw*!u`%*RTcQCzBfHTy zY!DCcHus0_7{?6Wr~I! z*zIl-c!7=8?qIqEN$8r)%hT1X#T^EZF0+YsSoS?lH8FM3Jq<}WYs}_z@q8}EG`L>v zgl=x_@48+bz9=@k#cON1#0aZOkpFP8dgt&vEc=*MnXii9xW&bEX4x6@X?^!#(-)ea zzjXx@BNc7G-s>>XiFE*99$njHIvK4r1#Iy_a$12Gmm81Z%GGAijnhWz0Tm%5u{sbe zJw!G}V71j_J0lv*7xHM`gC8~qWm`Qxce!c>`kpjmK*$AmHg+Q_(h|bpM-Rs_ThTae zO~=cP6H{mNEdfGJ4yyq>yJRZGBoF}y{+mZTEbnr<#q@hD(q@>?QE#V`ZidPUyXwoJ zX!ml`?{bFx0k2{2G_bIc!83A5z=9bSooFjfHAiQwy0mlAd?J58Kk5K67mLOKI*!ZD zfeXB0V=!&UwdTNU?e|{-8hp1xvkc~)4C_#V7X7N}>eD_EmI`BL*PEX$yr zZPG=z$+e-wf8hlcTw2w& zVjch*j8Tf+wPb-$$10hQcdd1L_7pYb{=tAaG_fw4&>mQMb3&HW{E7xi~6C7!S>;%dYGAvf%W2S-Hjwttk zWWcD9b~J_ZrOqKUoJB!Q%yrTM!OdhcQ|xY1r!@yq_dA0Q-H{isTl*m*=m7cj4>+u` z60vn>YFy?E!f1Vy8SJnW)N$R@+79Mj1URi#n+?#F?=~t;v=6=hhrZf;40FUJVHIkf zYxEM~T!*3(vj29!O`hQmE6xV{>mdbJZC6`d>`J0wYP7`a(G_D zD{`L_@SU3A1@==vl3k+@%%5?oFmn(*W|qHva?zEJGFVUwsg5D zIk{5wwCQ&}YNBDMk84KH9c|VG?|)JBWvh2;f3wZ?yR2dTS7BI(V!nraw{^uY76n=iIcV>nS|?kh6-e``gw#~>iNOVfPOu+RV~z}DAI zt+Wc`nEV+rL;vpyYXa_5osfA|U0r@oVZ`9|^N91};Pn(f)5z~Elc@Fc>2zFQtKx~* zf*h$idmT8zTq@M@w!?Js?eFwxA3guA<(FxD+Y)GY3 zhqP7SY;U6aoj$SyZ?O(XnVz=Ilxqw1n=Z=S%cm(aymklQ3hFv0i1) z7Y}K?#A2aZk@;ub_-5@77K7vUrz4;%MtPyW z0$)o4a4+D|?k86xM?|yS(Frp3k#5jKD5giLaGqpptPalLUqBWodvp;8!&!qe^NVG^ zJ}>ea19S`H#}4cc6}r)7y?gMH`>t~kJpL*FXxPf6WY>tnDlk)-+D@qhsU61ikWRFe z^+6_OP*`keIdSMWQ39DVP21H7>at!6ai3tw$NcytB~`rZ+Wa8*0jwZiYrUDhHL0tL+L)YQImA$SGer2=Z)W9!#B=n9()_lQx>>LrKpZS? z`o^4tXU@sP1*Q267aaK!y)yk3yd_dat(o%C-6i2@hrNObSru<9)|0okXg1scFb$u^^v0UENIk&Mf`~IlUM5=$%=S-1?EFQKwt}fB9t-Ek7^UKmO z{LxAi=yco(d}?9uxFO_npIIL58B~5~fly6>A(9~p8VT_BtYUN@|8Np+I%eiyS!Ex> zJT5?A3S-`SSh2KY{}QZ<>Cw#K6kNjdY4H}xC#YeG{79SPHm`r{BUq7<7Xz@ozmjWd z1T0Rl3y27C3tMuExcZrLTWZ!+C|HEWK>M45e&d?DR9JYtw`zhB8O9|r=GjXT&n9Y( z(Cw+whUI{n2T!2VismObiFLQG4Z*SskBdPp{XzQrA5kKsX(NLlc-8z#=s{C~f!+BL zPsEDtOSHZ}Fp&NQHxP4`T{qig8KH|cMp?3B!>5Y*nh0KoIXZ3j$m((9`uvOpzN(Du zT|-!WQ0eVayX)7b-|y))-H0R#RX*m2R%UI%mKbM#GVEjAl?;^#JY$QB#c(y-xIr32V5*Pozk zK^1cDemE@t9}GUP(1-!0v=>IMNV;WeY@?-WT~z2+^F!zUf|PRv{-uOK`L#}jltwp$ z7G9+JTV9UhS$uL?*R~+vy2PznM$3JcZvveI>|Q&yY-A7Y(!!g{F+)*p^ zY>~5**7_K%ND2^3R77Fc0(=<7+i#Pc=7+y(pdu5Um9DRpZCbw9Qn>40QshmOYP8Aj zFXzDJ;Z)Id6%SF%cgyOZo$a~%73|*eQ%_|&Bas+NhYt=vkd7GTEg5zgby`<0V}2`} zI>V|~%KfXbJVWcD8?{s?>ogu=V(g61lHFPR!m!m!xQ4m*n`d1jurOIgGhIo3HH34w zLEY(#m_+W6M;TnIme)IAAl>wAAvL&u4tznwC|ooI*!_ z*PzSP$Wt;$h~42h{jVtS6>1Ma3T+qmOQXw+0oFwTJB>e^5PM4gs|NxQiBExV-kM=p zNB<$u{cq~=4Ke$FWrH(=Vlilpkv8e$ z!*JQvbIa5jq{_Se+`f=g%6ezUWZi`7fB(FE5DlG>@QC}z#Sep-=acct4Q7GK=XQ~s z5+K))ev_e)UkLxU{koQliKtq-khrfd(6?^WGCQk?5X?w zoi=~*|3uK64{8X{bIgQ8Dm9-XM;6yS`uOb5jTqj(|8j^xekcrwRB3xDPkwHor8f6# zLoQF4`Es+QM;e&TsJ1BPf9Xf4`LLW}<` z)n`*7;-A`Yv6%tg$SqW*_}=VJ4xrH4kH&}Z*;a7bYUSV7=AN29=sF-_Y8r4-6*XCR z50C%+=8obO2wxC;*pCI>&g4A7S34}X8^i=nwReF2&-W02&n4(fEc;;985RH%G%WL=-}W8TqxhToHl5*8$z=e!P#S&Kj*vARXD3A|wITJ%4a zP?Wh{-;*-1(sq#PupCN3G$AKD8ZHJc?xk8xqM!2+W zitJ~ayms?0JX-;994YR6JzVp^Orb}{OO7&MC?l!vk5WdhPY|BNRq4p=Zz=Vy!M~@R zzDQ+3yWJ9dtU3{KD;Vilrz`o=z4Z?FrFT*1wbzp9RJC{vjguNgLUUwWD0z*BR4n%B z(+2GP@=5hTkuFQ0RbwwYc3_TyR+!u*IvRj`_QvgK`dy@rJ!#-`F&D!GpJ}0H@77sC z1T>TKH}<=n0i2OUQ*#CM#d0lILgut{J8Hu}L1JR+qIa|79I1!(u2nchzU}1LAH(|B ze>*Bza}3h>UnNAEPk!k$uTDg+kO%nK6YWs3X8n=SRLLf>6;KpZpsa&thkcvK;}Qr* zz1L5W|7#Z`Tz5U&hfSQsCVt4Y@Oy)k2tB4-lp{ZRBHc~2<48sVEo(@9Z}hhw7M$a; zXX3L#lpyo{UcSCH3&ALoPHup?#XmjAejC|Yb8Y1k<#3wF-&?#{G=jFRe{q`V`sdT~ z!R!L&VVeCQ_^-7}>oQv5q;KA35g4@@>O{=^Bmkb$71$U6Nh|M{1OLg=OlZGT z!Q7xFdxISV5WT&CEF4FdWxm46^|p3=c%*nbKcmliI7$$Ex|(Tby>s}nVABOL7P5u~ z&tK~FlP=aCOn~mTPd%$vzQtXEOkf&Kmq^_sMAb1WU#{9Z+*b)e_ai0?4q~Lqb5y{a z{m*s5TBKVwz?t-}$9*;vfkQ{bxP1NAxgd=iqIuWgSb>Lt$NgjJL!75ry`dm10<7vI zUy}2*jJA0zEZ3U)WD|1e+2ck}7$&)}-%=S!9I^k0$HO>-d&W zYsP~nJmP}LC4}o3(iM;;ly8Dm(Bo$P>Eu{C2{pTg#xZ%u{cjeC z|NPM#c%9iw%)*gJeVYyBt?)i!o_E=}%ZNIL#&}Jff^*EIPIa&=EXURroWRMg0 zR`!3~fs!=FXT5=zNaJGU!ez8t{nrz*4cn=KlmON=Qf7*g<#qFzLxu_E##F-aUhS&C(CNAZ%EPD#xlPh8=fs}DtfK3UOwpP9MIjd%vkJQC%ut2U6Hfj|_|sXyS7zUyW|Bn7ecg{()V zigmc(%mLk}+00D`u0n~c-~Cz?gsEfOzUNR{JN2~Ci12}Wn_ zb>=g75)+OqAm8b*WqpL_SKVzOWu5g}hvKBD&*gHJ;=n z4o!Oaz~SL>pZgW^pWX^dppiy;3l&ig=Z2ekvBLb%NJuhVH>E>1fPi1(y}(42Qltld zi2hoF$8C2@Ssmq*7Q#T|`{e@?!TxWk(dwh481fHXl=&@okz|jOLjXC$E(?;skqpD^f^;Uf~BoTA%g4hhYBHpmp7t zHKF253Xgho9-L8Z5GdZ65k}(cYPWJFUvAk=*}daNdtX=bO#G!)PuwK;LeAqU8dY$R ze6Z-;=R@HQ24VFdQ&k4MRhs$!g5#>6D4oiE=!*xvu~%BC+D~#4kRRtuFP|b}+IwB6 zOU#AiqJ(@p%tJco_KJd6drUNnIH{Kj6SU$Xj7VC|&@hzqd~LECZr6a3#`NxSmFjBrlq?vt5OO!u2d*B|blSix+eV2#!L1vUCRcnjNohfn$82xAR>+31{Sm!bR3)5WpcJRKSMOg78_3v1z(@9dQl2<-avYhKjy zHeL=sk^9TCS0dOE{|$iv>ZAuK3Tev>)IF8fdsvb}AG~0Y7r2cI1%-u#MM>GI+Z;vlyoLeQLo7>$83lcs6 zuLzBUE%Y#zPvwl;ck2>(I9JZ_krSy5BqyIYlTcJa0yakV02;-ySinBk3aH4*G zx17j;1l}KER4o#PJ_?>W9FO(rkS;Y=*iT(1iSh?-2DjBINNLu?`a%XC&N+}8--cA4 zxH6?TYX2p@UL2rrrSKAGV#uOr7wZ@P8CK@q=3+VVbb>TPd{gB$kx3>M6Vy#WV;PSA zt&0+#G+e;e!X-%=hn0Qy!=j=f79vKZ~^zpgOt{w){3e?BJm zxH+@fYSXr*)aQNu1dp_sF$a?K=bucmbuL5cWYz3F|I$C-+3Du53PG8+Y8*lubT(R$ zg)vv+18lbFO)_KsEW0nR%(`x`RfJPG*6a53;q6IJ%nK$@@Vd>kfmrmUmD}TmvKS=* zb7Ws9=w=7H-=ShO(M0(##QQ_X;%Fds6wkg2P6R`u>vG!M>p#U~M4YYayD@r`45>@$ zwH%h*8(*-cV)ajvxTxR9cf%X}M(cGu?80JvUEf5qLY1{P92Vvrk)x!$slOW=u$t<8 z&ne)%>pupZq2nU~?BgX0>%LRnx?{wBrI0@rZrWM@Zic^GF|)J~W7y%?K^0w!4_0wr zG7xnGdN9k)Oh+JLAoII^D zD8W})vHvx3ETOWYRjchXzsxzno10W$VxwXfkvovtc-I%E$_T4Fqj|#$quCFAvAJ_{9}Ie&OD_l&P-Ufy6?iBAb0GT_5A>V~jLE8-`LicNqlP3w)(tc!ojXvtuFwDEOwdNP(NI zwj$FSgthMAuMgtyAM){O`}Vuny48WY?@A+Iqr;R|Kb02wLHKu$VZPVKxbryCW<2W; z#&Ht(%Uvc-EHz_+XOe|+Lz>psI=fA64?eFOl_O}n}t50uK#Z=P0y*#aJ zbm0$7=WvWgSHo(|(t~x^U3<;)uRV7$op21M=i~5hG$VzKU_?_O!`nayM_` z?J4rZrPO@&`3`FGbUT9q<1II+dr5lbaK*z{*tb%i+c9%FfeqGM<77hf6?YCN-(Teo zT9fRir5CK4JYQ|G={Q3=-3N}Hhg~H!6-3TXx^5m6Np%@yj<BtyCIslM4 zq3kE}$`lncw!J?h4JFL!!b#~QAo$e$HYXrmhmhm$#P9GvrTfn9> z)T4!0)JIRJQy*g*&@5AsPg&KDV*|sFdwhr?oKIZJsm3%y`jaIXM#08r?NtQH) zyDBX5uj^|<#oIgb^aONsQsUGUahF+hNNj}45;k#0fJIhsyYj2Q)1tVW8IvB3%F8J! zO&pVh{P6zuoI?FVrro&qc4~6+UVqLe%e6{EObXGT1S+p%YeZBIw!U@F*)gqtyYgbV z5IKj5IoRs?0QrVlZT^GAe06+vT61l%M+k^CO!O%v^_5Rz5bB_J!%Twsdj6sbhD1>K zkl6D?N0UaJ4RvP@y1*LrX2|+KNbCIR6po=w^C4O#Dyiu@fW*iOxaKX;A%r}dRxVOw zwOX9xe?Bxo0fP4>lZgJf*yMZuxvleA6zX}Yi-YhVz}C*!-W?Q=*HCb7@sf!r#>V=j zWW!{ojL^ePk_4L>J#BxSh)%c7zHv-ECvsoZd9oh7T=2)Z&gd=JQMEg#UvtIy2a`5*qN;$@U$b3fnlYO#)L#kn+C z`U||%=?Fpzks;((bsP#$HSP;)(65kUKIm2BqxX{dk7yj6_-2K%NU24)K^F_>&D?i> z`c=H4X`<16sftYG9hgh&i2$-Ghq|Z)oUhRQZnTtAeCg<#1q=;6JZyb>-#j;0saLn< zrp!P#?_*L#AVJY?+LGcj+R9$Wa?~2FhbivT^=W6f#l~n?`l)s}V|_^#Ar|?WvN;@n z49tQR^R|t)QuR}=o3UNC4je;3lG1cRzX5CL{%i?072FTwA5q#)@FJdH31@)Qp^r)7 zj4ohpb9AXQos;-iq97>XcRXdn>+wsneb$lg*st~qGQF3K$mQB)w}#3WG_Dp7BQMUG zLyy5+EH(fqWeIp%h{L@cI{zzQsVI|k{BnW@UpEJrhbUQ_hv-reOyD>slRp)>P`k13 zyn+~o95Uo5FlWw**j1lwM(9|mZ)OoVj;m8Sb>Lu9z(bVMV3siCz#BqTqa-n-bPg%@5KesBD_*h3U}1IFmoAcIB}8&Z)n`v-*5eiKm0qc(hA%tNG1S$7>A4>{VyS z@ULf2@6t6{C~*tvcV_E?qYlIHuc&?$} zGR+x3y83M^5uL`qCUlW>Y`bD09a;SB4LbQ8Xl`q*ChnlAIG_sBnu$w|ECZ1BMDxtX zj(O-Ls<`4&rYFV=Qhe*f!!JUSwq_2mp-d85Rhtt2jf7nks-~r(l)TS_XsD%ear)Un zCa{>;EOC3T+VWvMg0WF^Wl39rlgB_$lXZ$nuA}hH7*_(z8*2aAQR1?F(t>exOZ>SK zMe7FBnogQkF=p4~@qI`8zpmVF^HRQ!AaA3&*JvE}zFIHU-O%{u!-r18HT^WM{+hm- z($Ku}P`OHF#P$|zk8-Xu|Ig0b3$x46()P}Pcz!MLa+&5kMke69nWJc&-jdMF!GfsF z#NWNabT^70{<+r3i`AVa^rQeYRzlmxy?OZI4QqP<0q~MbMU$Q8;QmgX+n~EEPR~g= z!pOdcC(n^zT&@y+;vDnOvs*hNenB0|_=Bj{eRyqsrn#`eP`X_u*1>HyP z0ZXkJAK@A)GuXTAlgcvNCa-P#eLT-A(#bsYn%0`irsAr)oNsvt{q6RpiD>Alk%NAM zrFWqN2ln7Uzej6Yr@dA*4a_JctBSAjc+jU@Lavaw@axLy*u3rIk)LAXKdp|jTu9_c zi0B!E7qkqN;$AJt+AF~529}xb`~O&?2t}aSHZ~bC8Za>xwIFNulvFUEkdW9N=jT~F z6$Vre;(4;5eJfdRG;Wa5)S8n`b*Lc8AgLH)vm@I$zvWDV7aQFFgZF(slle^382#!Y zcDaQf*g6vZc&wv|Y~#`@SlNKG;~n<4#YB(4QnM~>|HVhK76h0S+V>x7L`!;hONAHA zM4t#9879VuSu6IFgLQvS;pNQyZp;<-2VM(@$sQ>EP-6alf=m5#t#ze-?|*@GBP+uUKkjSMFWyd&v3BdlQES~oha|{7^BhgFrIqS8TBRH+ zYeNUsMX(^#LZwsk%gg-)X8}hun%`6y$K)r*8OT3&?k))Yqj}C}s>=~busuzk?>i$h z!ADw6%j{o!Z$qb@hij`EHBB5V`3REk3gO;dsI49NY``E9ibiry&?^}lL!%U@Msq@c=M5hEy z9JYNDPAW#?U{VUp2FC9VJk^(2^e>S4j$6ea!8eg=73xHz_;sE;gtKmGD{y2xpw*!m z>i^3C{{KAmwaK|#m^G!Hy{ozT)s?msUBVtWqrGok)!Bb1 zanN*!g0O208Puq$Eah$^ucna|^VJ2x%d(*;{W4*>YY{TC$iOziV)_~t@&8WA&|Bys zA$Kx;Kur^_Rb*F#7#;!HMTbL{RAAv44TXMb&{9i`K7*XR&I^2J8Y@{Mt3 z|HF#(Vjo+&^Fed!0Z_wV3P)M@7iYp!(({2a+nQY&1DGSzgwSs5`=#3u`dz<2i^7TBrPuwp6J)rf|a`GDt zG>+i)4>W=d%Q4a{pZxihVrV#hnufUlo#GgbwfN3zE08mxZ>jR*H6nuSr}dyN1zPMc z$x&7dvFxTXe+j3<>VG!$Fe{D5)hF2B3qD%(mVckx*zis6%?1f5a_T!;b**Frqts~4 z&iW|LrowGx!upHl7^&@5qCjcKY;Jkd-%$zl8zCUl_@Z?=z z;4a0`2w`s6{T1C(?Hn&>0SdaOpvGSM{}w zwT#sMDev3BMw0r@Pi&6Iw@9p68uRZRA-`pP88tp%YsieGQH)HmRaBLh9uY5?LvorZ zCBCWyMD)|@Icq*w_D@^KO?|?XA8qI1tkGp$cpENIa)n-~S?V)AWADk%hQaVZxDQ<{%p1bQ1M@6h}h5A$@%eB{l~%P35Lpd2vNOBSU9RaVjWaJ3g7oH%eSx=RFQ~T5@Kl+BE;K$$b2Zh!Jyz ziVTnTf&z9B={;|O=KwoVv?*47E^?tRjrP}$zf{|(6?kLTv*pR}zJI_-mQ<^V8o&;} zVtbSux+Ng4#x7C3zK$Lr9I7ZfwPNhJvK-Hy-%~W*lurwy*4Br8&C(vTuEEA=oY9Z6 z4$)^#e9QQE>q1_}>>I{c|I?S!)vYFT>{s;rWgp>~aC&5vDjQn-@Ra`yX5FpbKF&;x zvosq2*(sjIF@$?DRZGZBA%n$lTG!pl&)QWEjX-Vk45?6nfq_UGO?}KkM_W@}dx7$M z3wvflYNnAUw-Vh>FCCuduCz>HlsaxBzK4XmxEfDz`mzF=5cH-|;`_H`y!CDDG?9sQ zUL7fV%eiRGYl7{@#odrb{xw1Cs(0%Np=E+{#C;Otj@0LC$SiE!>pzBmyx_r`!Zr2f znlyg)kq?C3Px0*Kr;aIaygrgw)T$-N6m$DFnCU$$zka|g%ZUnNaVML5XE)YZ`7W}r zAjw6ZIwU}(J!Bg7mYBM;wYAgU!^6kaUl|$kYVBPAmxN)$HZeBg(Jqcwsy6oi7P%gG zo)(u|zTp>$M942cqt*H#4Q+J zw*F5bbmdmTyXS52wHN3m>ah)=B9|9b+XzA3iOQwvzDt`FuwgsK_uE{2onn0nKe6oV z95Lf1a*FsQshpDi&3TB^V%zrVdB5|Wwa(vOtE;Ljd7i4h_kCZxyfEKq!BrPCNdorFp*%xvU3Jih zn34PuV{w{MDXNf&&q>%sTrH{{ds2CUaZw)&_l1a)v$DKJD;%Ey;X`h5&pSR*b2O+R;cQnfmdMz{M^)T5d2?SzGLb8umJOsG#`KYCi~op*xJ?ZK4glXyY`-_qjMqwtItrFzH7>R|^`vF} zRg0aHp>B#e;KsB#`(7N`YPJHsQH8I0gEU0i7LZR)RZv`@5JFc{U0WJO?ekM475L^* zC8w*R1VeTZG48(}xgNJ!O*08BBFwiAOYh*%Of6%qxW@phafCt<-+el8mw4wC6O}@_ zYSE4LZ1p#>4u{`Y6JBp`Rv$};PIophV;zY(Gv=BOF&f3HGrMLy@Tsw-N3U{45fUQ< z%THEU0fpeX*lP9UaMBbFW^0i_iBV=;(@~~*1xbbc>C-RV8IJAZ-{f)5OJru?vaIfe z1nn7(?(9W}@awj)$*PpdsQUk);0{a5(O;d>OIl_W2WDF~6d0A)u(cOjV|kI*k(A_j zhryu$l}P<&FIn{iP6Tnyf?4P{A)v8H;GHt0+t9_tCy5Q`o^)WTR&w;Vg|}g)aCn#4 z(Ymjq!`CYd?mv};9(dEVHPqKxVoB%$%}(OJLQY$x1tr84R*`HA$qSOn1!f+`mfAvk zPtOC#@1XQF72>c)YPvp_KmSbnAKb4N?%FvBn#45&b5&0<@N&_QQ?LmkJGc9{?DfHe zB~rh(p&7`Ehcw`-i>}-EM>`Wr7Fe_yXx+U-Zc`JV+!j>p(1)HM9GlPDp&}eIO z|Lt_RKe;?)+gs|@27dB_6gGmd;8Q6^?&83)9aYrI%}Cvc;&9mb zMXSM)3=hJ41`G712Pl~e*f$E%u1twKa2ma9K9>RLkNfvS6`MX|;;lY7Z3gdWwr@ICaPKO($x-B{vstmi}G3WNHA_$~HgtUzN;Y z<=~zImb!xmxeU_>BbO3SI8p8jI?xWatA(ys<(gz2~k$r z5nIb#gu!CkR@3D1{LyXl#0>c!YmlfCdDo~6h@_xg(VJ=Nor*3_zT`rbjG{t=Rg29e zn>^4mo$Q7q4OOozoKldEDGv?HGlx-XOcl;VmLZKQ)~esQ@9{cOhVkKLVe764GO+!G zAkt=$v)ZPP-WCmr!8&FRTEf}m56a-(Oif70(9z^&=i_3LfE06nhc>ih9;T@2YRS)U zS$1{FVp+~fOkU*@g|ghlOBfw=6>Cgh*Hq~s^8Hz70nEXrnE=ZhKHaGxGOP?P_?MG? zWzlZ(v|ZxW1t?77rS>7cXISvBEiD}0Zs_}36WnA`6JCB^(!lIz z)&U*v^~`n;Z@@SB?TgW&#J;qI7>N^!gR4AIVI>_nRs&$D@FL|g4$OL0dUbGTW}U8S zX8|wk+B!IYGqWIg-Ph=VvBY~ZaH=kQ`)!4UAKS zgnU*!`yr#lO}N1;a*^0%BbuN=0W#FI=&S}K%s?ju(6mwiK#qX5QUfBShz{ULYGKHN zL?L^!D}nOH0aOzTZWUl zu5Yi@{#mP?&R+bLaxGI%Nc$gjh~K80=|5E^l~Lk2qKOKB2OE?#W0+MU$^U+P(4XRY z2(>v9!2^~FPied;=>ZX#sQ|W$h)GqLTsT^Tkz6;t2 z=7)9qc?w18-dXu9d19xHC9JT-xAunGwvR^o#36_;D+8Dn8iX1 zSu6ec#4tiTNiM0UB?xVnN?%%#U*oi!M;TpjKCoqo`&TFH42^9+O|KmSkGwh6qzPgW z#bW`Gd{98d0S&P4{YCUGm?Zl{+M$XPViVNWsdzgcDW~cEQyQb@C&-7M8lj5CF zMP>^|+S*Y6oJ$)ES*!-4q^K~(p5P!#4DpCU!JsEu9dO*H!Y|{RQ^Qp6Tf=vutA~YL z4-7_adBwMW_`?vJHg)${DqglizTby)=YPov2aYtyeI`~Dt0R@<^Z1KAbMn3?m}KMQAc!p@40$_AU9I4NiI^SgzS zqqP*V5MrI+7nnx@NEUqhMk>6upCr=98{gsbQ~Pgpr^p`gAw6Z(e~ZWew|Js+e9gGI zrSl@8>17#Qhlj3LjoIj}0cKxhsjJd6Kq=Z6N%Z5I=FpW zIu5O`8~Bf+k9`477AQ$>Bn$y9?6q-1Te>@ypwtw|MX(^K#sUwscsU$2O}^(Fe{hSR z_M*M|@N+U%S`gI!No)>7-%w;A`KWC8Cs(RYa;>0P?Sv-{JbHib!D#~>Ql4?aANyPR zAb$Y*fBgro=0j-@{osClsXQBf1acdSKKk)#KG%I88Kwq5J-QbxT5ot9@s~|SA&uFa z^w<$IE*D!<%fZJ%5mGuf|NARY`K-d3TY*-|!7QmevUo-EZ*1EP)Xjm-fGjq3v;{Ha zTT~%SW(7Q?0x4Tz2hJ4~wqDLa!waiI++Q(lcF29gA>hRytV{-jwORG(HYdh5xU_XCrRb4`#4BPt`30L9OS8-Sze8^;4!us|cu|f}W{7S`g4n8bil2 z2}@}(_V%*S)B3IGQG>kzOG_QHt+T#4Vl6>z+QMUoC5rwK29xTVq8m72qdq zpwO{UU9h`Vi*z;Pv33qFvJ_cB%^VA0!Ixvsha!N(eX3LhicMf4+JlI#w8Un{_noCkxz@r_sL;<{ z33Ol*=gc|AfU24zyxN0Zq8tpQ7NLkO8$ulJn~W8Ef#-I!r|QV|EVk1dzike2c;k)S z>Cn zhMch*A=8{XY}rVV@IyL=AnOrz-j9!#lkVHvy%L-m++Ph%=BYk*V*6T_1|#JOiX$^K^yH@~ zbbu;h+TBy3l#To^7b$6N^nfBT0T^0PGuR_XP=XwRg@uIl#1-a#cB}?^qa}-j6c(>N zo>HDU948joy*U;$2yyJ6g85V>v{rT|MvnbWec?E&l@SF59k7dV*n6VPu{}FdO3mR3 zX*qhE%_F1=lMTRYcxDE|yj@|c31#IiYK;z}q<9Fjx8Kuhr)NH*}9 z#lOVQG7nfK*(s|)VKJ@bpf9no00AM3Q%C$q{V9B!@V5otoeI7B)P4{W)8IOcM;{gy zMX^79Y{@H5VvOg2j!L|Zu!C)4jOkeQK!o_*5i=HQ3(Jh-r&JXmP!(X>x0yVu@I(Sc zRJ2WSJ_Pkr?_#Q^+DRZ;T&2ZNaOq{SvrlZhj?(8=)qV*85-aNcSvXJn9NcGe)T!&( z_*Vs5Y72O2IxM{Htn%xvO1sJb(sg9^B^Vae2tFV!m#XPXOK4M_FMav!{05@U7f#VQyVIy?(}swWJCPa1i`pKz%a$6>Vi!3v_FjHufMace_UPbUovKSen%4+qyS zk7;ZaSb;Mw@u;w4k_&&J5W>Y_m?p?Q#jd3#^0&#bhY+$Dc#Q;xa$}@0jN`$TpOzu= zBh-l2_=7QM%P0^N?L(D;fDZYB2igE0e#P`06-5;VR7>2-j!>xA_rUkYaUERkw^Hc) z*TO=;-`>BOE$e-iLyip>5{&6<>+8a1i8l{wVuLw*uzar625j3eqoo7lcr|6^Ex5x;r;ApNt}kqmK-wH4&=|6hZwdjnq+=h{kx18z_e2SSRj+M6 zbQuo0Dw6!=8Nx5Z!T%!2xYFG*M*>EY1Yns5Eo3<=shmn)nHdOd+HXq^g}4>faMyJ; zwscf9P?nMk)$p#G^sfLb8ax3*)eACRoflVC+19dRF(?vF&O1(B;+e5`#l*+8Fw#+N2kX?!bc!E*qD_MZ%2-%x4i5fvvCOPSxo}FpGc}S~{rOsem z6$y#tODE$@@YHY^N{M+x7@8G#0m8;+u@P1-444VB=#-<{X=4}iH7GGh;0HVjF_Jj7 zl+;-mMRu+aRz6lt79vt!iNAxIJaP(<|!Oz`K;sEH0x#1=1UQJ+ja}bB3HYFgwd=D_CDJ{`>oX zVTHa$k03^M7Un_tWRfahf~hJPix>AJ5IYs&L^;mXyX$ z3Vk&+mp@Pxfw?$}4hOVl{6_zuk>(_XR3ldzSAweJhUl?j|IrwyPJuFJtynw;lj2DW zPtGCN(uN?@^Mmw`)l&UhOMm;yGF*jJM@!n9JAv`<2v`7k#(3b=z#s+^ekGhJZ9Ibx zo#!^+lLPgBE9MN1V5~_sTGEgrZ_qO#B?Arx{ z;r-XKe7p7-WQfdAA2`CZInZK5f#h&^7mN-h=9!uQPfWUF26H!1685`HbO1F1JZSSe z5c*k)iVOe|%G&u;k)7Hm2f5_ow!?wA+1Zj!cE;b&w|@0}swMX3CZS@q!JO4@G4a2E zIIoDDLVQ?Uq6g#-9bVJw!2szt6Fpoh)<2j)sJO3Wk+C}vBrDwK!8QraOMcwi@`UJa z@sW1_!_darJwUX{{C^yAC1enF20eB88jJ>V_w5W{9S<1ur|r>0=?eTC@v{t~lQ`6d zMxd?bU?q^vsw3u#;iNc(RVGWbhvq}(lGJBvc2Vlg9DL*Z(80>*BvsjDw0Ho3XE^i*_I^i%}Lgfk~Qq5lez(PNRjK=-5>Db>QwLdN_c7%iHb ziNp&bzelN!vPrU%6&!PruDuv~Ol8|gtAf6qtW3MhjWUank&@!r7%V{>52Q(xwOV3! zey6?=400<&`vCiB$bR-neelZ4$ck{wX-Qp>$R_wS+jhZD!E2}|xKNX}t=~_-Un-3^ zWLJo~*zS%%4`uM01l(EuKa)a(i-bi%~HI@unFGw*{yjuf>C(;Ppx6RA(!lOluR>!U2IH1R2 zWNkNxaa&TLwL{9v2k@1$R_jupCp6|RqHklTCKWx*Hf)1fbN1Uh9vlMl+>fTi zwxfiIzq^Th_9)cc$lkW4(;m{otd@C*qPC;?xObMu_W>aWLCzK)oS?u@IhW0#LiO*) zqV2RMh>lr6mw`-_B}>RlNezOF%Y{fd$eN}yy+p9VGO}WlJgor?spem!*{VgS22q$f zoQn8yREw18!hPv3!5;Kc15#ivX;Wnr0t_RhjYpjhi;Ip4Dz-z4E;Vr5dN3%84_jZO zo4InnAOEVjkrMy1)hC4VFTsurOKGzJ%WOs69)Kil62BTXm$;CZ#Qba4=4 z?)5bamb$KHTV1eDDnD)DiW^tg=l%lf4cv6MhYw5-oZ7q10~O9?sBBvGDC+agaB3Tg zcv{=?GY8Ucv02n0GAu2*_GE*ZmGO|%)|VoTl_>6%=YHJ+hN+Sh2lmeag>B_4sW7q4 zApcYr)9z64SZwtcQNlo^EU9b&*8YnuK+qC&wc+!3h6i;H)tsd%D{Q}iAv1f-L~4<^ ziBq|KWPMM*69PGEpH?~^Aw%S?L!>Q85s8hr&aZLO2y0us+xZ(HVkNqC>~?G-dSYj1 zC!-<*002msMH{M4KcN3%$6V-nUH`=2!6Cs0_3oFE%# z@bi7~2XhR(%(npWkw9=PaB5oY!P>kr|6WJ^p7gx*?1S-b^sUy3B*^OdQ=C&=@h}P7 z)g$7Asiu2Gc!bB){j|N+iQ3n>(AXmV&(t|8IO{~y`!TDbhPp4%08#Pp z>gjWIsJ9LOsq*Hr8Ta*eq=4zpD?$RCmXfso>Li7y))v;5#5U-WOx5>*$HS#Z-`KwL z6o4nL4&=}fwo{I-q_Or@kFe6@y`Z_oa=m1QiSmjSoRxZ1hPOKhEAXF&0ccrCLBYizvXW#w6h~y4f>xZ=ilp_*Rn@}-xK^_>eJk#0VHoM=|V0= zk0F82A{Bq42OMQNs-bV*gBcNc%7~B;NsPi>t0n)Fu_&u1W77RA<3-L1`~|M=_8*+49{jyBE-+AFYrpE!bLbAmbh?uW2%tFWWTaPUDM z{IrI&`M|u{f<{33&Kx?uFZrJ`B~WkXKWPcjt4+ME^777i(v@Y}RjUXp(nf?v{M(g~-11@B%eyaNsCnB$|ewj0&XjpCiNZ-;#7MR$*gDjVcDJ zF5L{ajKhzUf*%ZF{+pLy6*vfyD6L3}lPXy&B@#)XKRA-4CYmOw+Q`;OXMWXnWZdP{ zi5x~8#wcOoalVNRq_Hth>NCtY78o#>e?z?A19zvcPJ?OND)6?b(>-StWrpg5IRQqx z#f%w$4!fm5rXDNVWc|5kdj?26XYk~k@XSyIIgI07;oye*L-qE^l!d_E4U!AjO-mjm z-#T~7eBuIGG@9!{;2DxkA-H*iZpUN=ju+rsa`1fJkRIciv-x;%?ni_%$xASdRxv@| zh^=$sJvr^w%pmmRFmfNq>u~bs5h1-t$%A!97GwScal-#WT;`Kgz&ibDeb)3BpW)?H z!%f5|a)dkmVK3x)Gx3Tw@j|$2DZr-=5m%`!o|@Iu8iUPxk$JVh?l654r&(7NJHmC; z#M(t1?AzLGv{i|$9fwO2WCF4Do`84S*EKTon@W*LQK6AjWye5EOd~w?tAUUs%cEB4 zchn0>kv%-zHxL@l#^xGhhBtss5}=cnicNL|>?1Wy{Swb2Sx^`APBn z_d7fsf+ama*`sl_ysAp#rdVI?o2Ke{Y^eBDmcRlpxK3emc=*V3aWp^ZmVO(&=T!L< zy8Sxt$4q(RAI=U+fcZCWB?(h?3rX3HZwMws=GWA3{t{S66vLu4m)!!8jp3T293j4*uIl##Z!Y5F#`aJqh;i`hi_UOuNl$ez^j1pjzJXLME7tEK z4dritan0LlzGzdY?noBiUsglRjo8`DZEj<_@mkql?A%v_`HcGuv$JrTeJBr`J>DQ? z7j)KM71?Vu7x>nSzoJ&aqgyr*hvr-8T4ggYZS8+X9xB zgu1ZVX2V4TU^V?S#CsV~N+BW18+LG%ep>4-V?mH256Sw7@W8!%`|VB|)8X7~f%S{? zQSdT@2WDGWVRVpVX>lh*S#c!$tj3-&IUuDVN%^o8Ds%|rd1+nd~&s}m(mV#P&vsQf(%`x%0av_P>;et z#_>IUp^@bm2+e$Za0cATL#!HGVUX2C`hQq|?D=rQZ$f0PHZY$uI-uPcJ^$;qQzYPJ!ZwUqt;DC*+RynSn{Ik2Zi(HwzNa>S&#iR`SyQ24A+SuH7Fl3*lZ%Kg zpIP{<;_43^)g>TDlTx$a?a$U#!g^mx(%Y*U@}@~oO}^G?*IGM?TjAL1wq*H%8^?m2 zay@>!!VlTF82H_Ed%)WOExdC_CXX4Oc+$KvweMfva_w3we+UvHu>;m#7gp>%%zACxfRcrFb9U|HI8lM7*n2p=*m|u1S~e~z=LuD zS4B_6-HPA4>vIsd-b&KmPzlReUS&=wLZ;8*>F_NC&64D((mGnf{AJscEy!vUtcPgH z>ZxX=$u9I$apW&$veW+Gxb;FmLa(twQntS~lLIg1bzPL4<drv5!ip>fA}!;XJU^uNtjG}$H(0eY5B?yB8|~J8jfyThl^;!!fi6muj=#z>j}?o`oFb$bd`d1H-| zz^GC!~KxdRTBxZ(#1Vrpp|}aU+m1yh(j%nd zp(-iHTU$HoYNi-SdCy?nQuge#~3H zsOO1WY_!IDd+`9ATFUz7`E)4z_}V@UB3bv`cYB)iji{s4Q3w-s6!9(yxjF>pe*JbB zWUDX^ycI{##5*}t1)X~P28r(5R#Qs!a7foG#r}tXZkd9*sG-rNu;$C3Njwjf~OHNKi z(otM4ZPbLsaSBoyKg>J74eG)`JwTS1nrv}4EccQY(Rt25^{qI7Fyv71Fxh>J>fSpG z@86v>4mkn2gvW>3vZ`9D2J(fK* z990s!m%0>Cj-O35&?AmrP2R#+9@9K;1#SQ0sPHioMXG5JzivMQGYa z2FIL+?DV{*2_jLy-B4G!I>}xuy~xWGcf9KWZs)xx#*Z5lEMBE_i(I7N;l~{RB+X9$ zJeR(kxCC1bE9Z{dwb$*|T95%f>z(9C4)thA4aBVqcMtz^>GGtZzD zSGb||X}Gv&JZRX;OA>aNz9gex7vbD-I(K8ukO%|^H(VggdddKU{(nGl)N?Mk#-t90jIhqqv*w&|5H}KeAi&i%STQ43|n_W?q ziB1CXyVrxS1cpL^Q$W8VfWvCk;QiIQ)yS0l6HH)hXPECM^!?2@#Q?AmiMdQ$V6pUN zhNMw8jqp%MhRxar01Kl>S5x)O;lWVb%)Pi$wYV7fNLoQy@l_HVEqiEI(-Uwlhn=>J zdir%MlUp3F2*%U%bi+$S>EmXpf^+yIPed2NyTmh5sOXJ&@MbGpsZa zkeiLPb^e1f1|G9@h{{!_uuMhql~v4Q%|YC%Gb@Z?D;ntZ>khG&hHLpTU8rM z_m2qflC^H>L$CF>!=@Tl?mhk@@umpr0_%$_;WdcxNrlvdB|&CF5BK}^{=22W1BSAJ zbW`kK>ys?`))wWY{4E`RR-X0rd{wSiR;g4=(l_0X{Avc;oWtzc9QYeE>#NP1oWdlLsa)96Gc0`k z%=9Desmv!`J5KZe!vun(ukytN9XG z*2&|#S&fMq#v`GDux*tzrFVTvfQOBfg8{91bBQT!##)|x>@rwl?L@lHW#Z}DclX$B z>F`LLJi1mZ_K z+a?Ro7=?;~8VED<7jsIc890w|8Rx$Y->P%G{i=0|K888cwF}WCD)g zk4L=(^KGkhc~S&jMJzUUmU|(4&#k}6ps#RQQG$9Z@6Tq}^@Q49+Ta4(5qiAh!s22M z?&*HgQYi=SppDT=&3M7;2P8hTI)+C-m$!E{%K$}tE7jI2AL2W__+8+YSnDZ7|K%mW zE(>=G;W3U5&tl>!A=Fe;JY_vQX?cDfBT;erAL5I?LEt&85ckkM+hxIoQdzt1-IL1b zlYRNf%Rj4P($&%`Aw!o{;^w!w`3u~>bHPvQLUSavqkz3BUAS+ zT719xVev-Fi6i}#2jNJkg841FYPbBgm-U@Fs^405q|W=goxAK}ByXLYUaZsPMIgvC z%075tjb4YDC|xAIOC0Fn?gxtqM^L)Xa+b)*IG66CAgHI)H*T?K;xWQsQAgtxKqM{b zR-)@J;4JtXPh~n*PHd}gxwtdy_>rqgqY&%qse77z-yfAreWd5kD$CCgrV_UL8%-utO%wJ7810>iA$ilz z#A$m0LI^~Izy#2|eCHB%eVhZ=`BffcHPSWG3dH$KqW zOI}dC+OAJ847H09&pq{>pkm$$ILjI70|~*xJjRk#!zHgoz4CB>dwD%vPza#X0>=;g z{;9}@$eV$C;Do!v)yy;{fPoiChfQBA$H`T~vDK0l)95mBsTy}|s;y8r~IybK4WNgm^foT@T)lNP}7y4R`o94re zeg6`krEw)e-nP|=qRYdru7*MQ3Ot%UQ@^abW8)a5N_{S$Wmf|c%6`^8A!*^LA4T0Hll51Bx9j&?`18E zB`S8*<^0y3jirfk{PkUa60Y+sYpFVI-g_E9t`>Jc$&s*QYE4H|XzWh0u z-_;C!$NH%vx1-%Q!th%Hu!qb#YNu?X)H2O50Vzd?-X9%yVG(y=f=eGELdvDx<3}^L zfEK><245j3-vSenTv1x7m%b~kt)S?_1TvN7gSty zqKR^XEKR>YYWF#6&p+7EG?h#2FVLbUOf8S|yqcsWXnaWLhv0EDCxJy*6F8l!&7%-eTm^`#6$OLv~sZ_c< zc3V#{Ing3LsNha#TmYqhqDf?o-XCZpKk_HHp@~C4*epv>uw4~`5gLW4Q?%{xS`UD| zI@&6=GuuzHEPl7#*9z%DGBr9}&vWHBV(_$dqH!+F7Z7>`r>Lc}T+ zX;mr^#A}qPy|6km9+(?s%>nX@`6#e2`EvMuIz;oNC>h%33suM&%2C?z%oU>c;&M18 zqLDGy$}mSj72mtYUqQ3r>7G3^OpCbhyTC3ij65O-(sYpe$xjc31n;~Vu{GpT`qTiz zc}_Im0JHC1Xu+jk@`kiFz*iGT&EfpzBvkSzUD@*&P(GpcLG`l1f`gl#5 z6X+0Vko}d({D{~{Llq+?z zxgwNblHlv-=UuY4s!}T^)GFjDC-CH4dHg&w$(HpOV35G*GD=_UN1ztU3VU|ESivte zj3g(=09qs|G+5eaWmqf|$d>65_a-rn@6{yLLIk#EuKISJ5aW?zG;sDFX&O_g z5=Ji`C%gi3^H6p-<@Kpb(de8zH-FXS^=x8a-}RE}(8}K5Jbk}Lkjlf{y2T|2nN>5GEQprt)~4V zP_-Y9&^VjV(d8Td$X<_i&t2qEA`+%lh4f=7N=ATz)~Y?Y|3KgrG2mUKKK9g_=qc%F9Bd->QLdO&NumMBV`*&F)cfh zk%?Vh<7ZZCs`vov|M*>nz&>9L7jS#0@`Y9ZH9}EjC^ALBlKhcMMHcSY_$=_IDBwiq zyC3}rT_+(ap|6s3_ zD4qF`6uyD;=;Vc_h5h9H%)dC>fOJ?Ym<^{%HPJCk0v& ztljUGeNZc*$fSWNP;=F2tD46h36n{jZhd2b#RE>r68so^>M$V}hmNy!&8YfpAkKmU zoAoSqQ%eLjEB8#`X0?iyjistN_^@4+t&^E*9jMCiA*}TncU6Z(p2#e2?*d^-vjKq( z7aV(%L8|i#g=O`zTwLm93OIQTU7CwsuQcPyL}=LE-CYua4PrC}`&i^$IT}tgJTeS& zy-*%di}gV8PpLKuly%@XK{7!sYwBz3DlW|NMEH=&6=f1yF)+|lSDYF^-e1Iuce!BEmaLNI+mgNnKI%FDs>Rw0O`U(SfsC8U{vk zED~oq49^dDC#Ijm+(FuMnRsN1q-F+>PQcR&Bb?2XZ6uuzvJoWe!WlAVwwxvFfn4X! zv*u(cpCZfiPl?LO1MI4-o3WIyq1sWhvMF=<1NnJWz_yJP9DBBsHM4-ORnFgUh(F9W zO>}J;k~r12m}-~OqqRvmeHs>_XeNt?m(rDNXDV_tk$_$CegG9*9Q`bi)s31Hdm&6h zy-FoyB~-|tJ12TpCHag!T=b3g)g4(h+lvP!Vx_>R>+pN5%CKi7isuTBla7Uf`xCTX zebHs_MpA1R0jsluf=lXvK@8eKSx6YEhLq~Ds7srdyQih6k%K6|2z;M%&}=w03>}D) zr7RV6-Nc?6SI9+?$RxxMC8m-=GO32|iEuiydpH;|4{2XecqI=W2;*IMWz2V7b#=Ze~IZbQGh|>f+0bCGwBINtQN@y-v_T0>OYSR z#;Ni{F6mgs)|V^>GyzD2t}vxe5fuKhi-}DfG-WY&n!)+b8$gvnlM)W;$++NE_B88{ zpo<|==($1z?ZM%`|z;kpZj4DMfgG|nThGtMo0R8WPPySUlJ!rQdC!Z-J$L@f>I2o$GU2e1 zlJuu2H1LG7c<_Cm!Q47&KLc!erK=PiSsJ>zn1BsxSbe+$*7UD?xQ>OI(yT>&)3l3l zYGkkPVrAj4UF7Yx@M_?yj#E%V-|am@$bvoFLZ+Davu`RD>+<)vXLx$0SZwGj-yEh? z^L@!Z&mgPopt~ICigm3g(=#@f>$a@ZF@VCM0*gBO9D@@wI54sgxJTxZH6Z_P$_}3t z3jt%nU!F~D8D3rke51p0n2fnOxJ>XMx;-1Jwl|`kHpBBbhxu?UNro-yOtO3d#M_jn zl!MT4lZ7E~f0;6fd?y-C5{TZpJmp1JmbHAuMD1BE1GF5inUd6M!X|-X2;P7&Hnntl z=KiE>N$K*$_ocLyB}>|JeTXitW!=1#<+vPJ+NLFwfu?U@`7Wh;zg;&bc?z?7ikugQ z-^}ivIZ7l-73k)yih{=fc2p_%-~D~FB2mubJ}F8dI)Zyy@&p-Pn^BVn5HDB<0;zf`Uq5kAQAB zZ6FukC__51nn=-bl+v}k3q(h?;mNh;ud{b_%!bB%7QyvFW(}9fwuWi06&2j~i1OpX zAg4o72|X8Ed1)K9E8b@*#HPhvs%YJ~BHYJ3YrL|2NK2q>PgC|U7XCZ?gNSX22N#6x z$3WVR-$<6xDzrOJBVSas5*7weL;Xr-h8Tnn3@1R@n9+b_s`+q8d@(L|SpsvxWH8iq z8(h<;3goC&;pBP$zK7_XGpfKg9Pu)DZwJTt$^(MTEM?L$nLJ1ShY(VPa21pFO7MF4 z%=!C32iHK`3ISSH^ab)at}0Hl@;uPkqtur}D}$aE=r)@kUr-4v`lt4Ng1kf?akMP9 zzCM31--6k}#T*>89O}qX%CiQwq#bTl5*4n><#2zp8q3i}&>$mUB6?2Z2F|$f;WAV5 z3B$6?(8@@_(CgvuJ0*8uCQG4 zpA(_QZAlRM+|w+l_rxeFr}|G#r4vh_nQ>DBD3uDAB*&1ZqP^K=1`QH~_#gD#rvGGO zFr$KoeOhs(V`D%H4!+ayi|b^QK>^8Gt;sqIGW3JXoS6nwLlCFDG0HgEQ~ocTrk5gl8cOSq~3e zc@s^kjV2*7T4)C;AmWYMzD(uVc+zx`>;U3Ms=a-K4~#5Aj~2h=$=6?DjT4uZGy5t_ zUm!4(PDQTbiI0RvX50ytaDak?YGJ4$v=|a^Ny?@{pK#FbLg}oD8jNu$vZ-?m9|5Vn z2fpHz*~kZUZ)|*Qem78sx}!GkwGk{`s#`zV+>s= z@*-^cVuU5_*=T^0^(>585@V1P^)Jw#mH;f@9t(|N*ei2BgAO-dN zpSPW{F3IJec<5+}`ugdqO4?#%^2Nhj6f#P^x(areL{R^ytapsAELzrv<8<7yZQJVD zNyoOGj*X5x=-6gQJ9fu5cWm3{yZhdA?)b*|eytyCuDNEdntNB(e5#(>%*097Se;+t z76bl?Asz=R*ka$gdg%}~U4zm2yGT0g_$$~xvMA9oP9aU4?Skm9@}(}wf|EYGnQ5C# zD0&}d#euy>tx6*J9tHf92nbQwnFaJO?W=X@y@j{}HdLgMX_4dRh zTkNZ;A<=M9kw(ep$&FJbak2~WD1z_857(RV8J4pCEV<5Rgx2O&j}cU1w3$7DYVhL2 z_IeooBVvg$zWXAH)qoeQi1b&DcUdPnHF}5lVV^S#~$HkP6^HH zMMz#R!1r5b=lB~WT{e~o4paiv%yCtdB}X0|axrOFO;Hg8zt9>x$qyT46DWkoyCTgb z#ZtA}FSnwRqj{_+s6A?*ppK^ncxE+Cb$Ne&QL$y9lEVE?90diXsq#CS(J;NzQi>Le z>WdAc)-@9&uq009MJW+hP;3xb@K3daMVKnKvhXfZwpSdinQUFd8aN#ACs5k?T(s%^ zHJp6x^%;1^1LL@VaAe}_U0&;%UJ!RQJOc~AifA@$Mdnai4 z2~KV)hl8${t>aiiJ3&?@VcI~#SFhu!jLRUOU7TCRZ`jK+60p{uH&Fn4(QFHskWa9A z?lbxOI&L=3HneX%zToR(4PClgn)ha7UanBmDSFm=a6!SURCOxK*4%}meL))b33)XP zW~OTbPIJYvAP27P(kIdM!TXr2eL^xElLo!lKtr1 z+K44Ad~}>#GG9j!6BB)D$@WI7}6)Pu2+6C*4_3+E7k-j7g?Inle)6V2Ug-O=&f( zv(if>Rp+A$u6)x_V=cqd zuLn2Vg_9T~{$PmENi!(SZkuKY5*9t%Zld`G+@9sM0joL({u+zBmWP9athc1$yth$h zMlE|KMQBh(%XA%#-M6??OnEMoGmb)TnJ@+3EG8-}3$|#iSlP|K_+9goOiX$58*(HZ zTItARlL8%IKWRI-rz+0F5a5*TIG(YxT|{P-kBK(+)A7VS#UZC+Ar0Ck_By{*_1G^0 zvy8i+k*~3fqc4ZW4P`a2Ob$Xp_of6G$=KB4_e|wy=VJbJIh=Be-&%t_;Ii)b%pH~he}fIr}38|42DWi{BgY%%3? z)_80r-;<9Za|{YNqnRQS_^^8Mz9gH<7f3(;jtwNeM71c?u3o_BfB}_@(ELfA0e$2I z@-?9xfn#LAm3R{lU60a~0y+3_v{;1o)WcOIq{i_nmGmr!w z%n*qrc(-cO^8%3crX)A2WDj2cjKs_&HkYRnDfl+SY~0H#9)M{w2g4xtu;3s@5X95( z{eR93Xyau=+hgGoSaJE~%VCPO26Z$o|W;C7}mpQj;&O z(x4_|q?6X7NVxho(C-$mr%M&^iC|&;6qyP@!iob1o~vr1#%PdZMNz82&GXX*s+lwi zhl6;FN#eK%WnmDZeASpzQtl?#M~JSNh`=EtXAJ~spgb|HJAw07@+nDiTfCBbyt;^bS>bh93UeO9{+LR*P^` zt!5Ap8K!jphiH+B{9Cj(8>O? zS%t+|(AXm|@pIF*mO)pzdaBpNBQ31@TL8$fZK^8(LBs|16>WI71%Sp(a#ZG( zDc4zP7k~R^uuMF(?{=5;|l+WkV&(kcjfRnU9N?wT#A!(e8Mvng(}6)9U>%I$t-^Dk((*v~baK~}7y@Q&?7LL7)|cTrvDoTTMj6$w*iYKMXGDj15cbUmLAs zqcfRx#wsW0-_Xk~H7@#FLqShp4F{_s;iA8t1+lL0m)EZpGWW@DNEGhiFsIRK)H!VrCN>wc` zR2Qc&dxE?6cq|cqL18a1O4J&kd~L7Xtb(6JF~=UY9bK^});Yzv@ugi4%t>S_$s)FF zHZd?UB8)!XN9dwOvXi}MOQ5PgX5B-Xpzperi&kHs6FofSBqAgM%8>K{k-D7$2Ra*p z^xmbkO&t0BwZ>r^U)`r>mO1I#;h!oczcEK&`N!$?r`TGf5Ab_rkDr<@(?L3M&R~i` zafa)Coxb~1oxqu3z$rrgxF@;a?8<>9VLp%GHU5`JI5&-rh|AASS=oIeX-OlUSD#po z=L?#wg`rd9L?EUcYAXfp7v4sspaJm|l}TNKBYUOj7~-4~OiEZuOb*rUNn^yvE1FNABWcU6y|RUHJ0x>AM9C$*Aw=XL`?DJWNImdmrj` zNi7t98!@RTQhiBOXGI2Ww@-gIj1w2KIy!Ap90K?Hy&_$9;Mvg7@2YcO3ytf5cKtX;C`_5(Ezae7&t~cx)e=`5s&(3 zW!v5wiOxQO6I1tXJLeen9y<8 zxuKnyG#etz&`sxjU`{`-5E#V304PpW$v<_AcSUUvxC%-WpmDS^feOKkC`o; zsh(ff$dv7oQxk&}ZXkllWBPBk_YA*5@WT<>t7t@=p(i#y4g`Gk4A5#){GiyXV%Xtm z(%NW!>^I%?b5A>RT4Ho}#QI5K5jB@R8g|Ce3;#omFv>EHAz+u?cWR;RH4qm8vTv6H z4U(I65-mM*0YW~1C<&J-Pl0BMP21qt7|Y#^pbpXA;n%SW!vS;OAoN#j z(T+>rWDO{nhyei}j+-$g`wIwaNkHei?p$gJ6O~;^=*ng5(=aYq;k+k0!|Zi7%91X= zGuGhE8Q|ocQo|>*wlTJ-(!fauu5?D6I}3FaB(@>FiQ#W-?XEy@w|vy`=F<$@#9*Ms zF*yCV@d~!{`J7sRAR~i)j=Mpcw0g_yXW(W7+u~srhjBBW5^pp=%0a0H@2PJndx#m1ejIUh(}3O%b9(2qSfR$;VM~?)FJf z7MKvRZ;uNk6x(@Nn7+!KTdYspDrH?7xVPU4P^JDFxI@{>qK2&&cwMSsCs;@J59?5+ z?`426U;wgeSPmV+i58P$L4vQ9%|Y;B*E(L~sL@H8ihIVpPD{b?&1AYLlTM+PNBuV zQD`QRGGplSy$%J80G9#SfM|dfB|qZIU{0E3>X8D(I6-(1p<#TZ#(QW)>tX)w;(_$7 zppr1FWJIZ~7tbZTv^R{Dm2Q|tYm11X&YCNS?XnoHrLpf35F6H)MSOs{&do_wE^~Lp zW&p7cep8w7l6AowP(`3k-par;T%lSD%>wpzx3sq!k_>E(1TXJi;&ny=^Unu~Ru4ym z7y2QR`ZhIsM2!)zG~Cxkj`ZFqLP4OAulr+@?R_09E6|L8hj@Zbh@JfNE$ieKhf>F- z6y|D#E2?)*oDVU%$gR^>tFiQ~W1&MD)mE*2FwscJEQ^qsFfB(Iao+9?6){|g!v4(JK(gOa_^fovr#L3>A@wROw3#d7~fnw6P&G0h4 zwX4-^c01oeXEq=@7@Js`NCs5s7mD4|1v6(#dRKepDhjYJZTgw}&TX;Fj4&G>W7VW} zRJ)->|Gs~aZ{Pm=ll9$s@lQ`VaqEl8X5&Xx>MP|d*FH>bbA^v@5*~7Idh@4PnTL81 z7z`L#i*EBKte#SjROfIi6m^#*%iGDyOsc0wHnoo2dT_m21D8l&JNy8O#c~%nlb@5$ z^%jOsZkCF#oje`K#v40@nKuny?XjE9erM0t#G#Iqkl6IdHi+dkzmHI+lr1uD>M+VY z;aD6LPmABCn>_W`G<)p96-RwP+528!%IE4;=){IZJ^Lf~)JW5w!_y_*mkO)#_`XNF z*P83hR$j=ECVjk!Tm-?{l!LG~vk^~~BrSyON9sUJ#k6-Ae~3DsU~)2 zK64-IVUA~xHX527(aX@=V>3Pk^0~vhGDHF??4KKH->?&;9K}uWCyShiMY{(Nxv|i? zL)T6%L!rRHz#L91!6vCmlrTPg*xz(tTbc0@232nVEWK3^_Bz@+3)gkm;`mnkqwD>g zZFDVx?=l!x=lH(K27(!;e(pMvrF;qRLj_H(c{aXX^r>YZQOhYE<$v}Q*8!$`s?-cOw$^Eb3fZM`T z0Lpb%0O|c_`uuObZ-5W#*xSqf4RHcd?(oai2>@B+|iMu2!br6X*nb&||wY zxMqtdDZ1EXMpum^L!OlOHAR~b2){K+4!R8nc7L5~VcEa!zPQKP~^<;yOvNa%T3HPMO-q}QWM{$Bpsv~UbX zH-^h>v0YQhsgwIE?cwBFxn`n@YeyB+yD>vfTv($lIk<}hfx8AzvE*nn7hilsP^J9j zc!fWY2thQpRVa30DJH;Rdr_yQ4>9CLVOC|Yd#3y$^tJB5Q;iRA2 zHG#$Bw(PmWSmohQQTQJ*_2>4W;zI&Ei->+upmV*nBF&GL0pVIwkb~Ch|{% zR4+TjPl!ijkqtWP0{f6ntrnnW=dXmG*B-;1Rvw~%kneu_ zJ^zI(KRn|j4QKT)j`|zQq2~+_FV(%CM0^B4QI{5$nPV9>;3LA5`-=pLpolZ>cc>~d zT&`51@rzGOyT_f5_U^V+8#FL&A7q{m2CZ#`o3r9^Vyc)B@Vwp8)0 z0zivblLjje)2uKpSf`?=ZPS4x>uDNjC1}e^wETATy}P*OcGzm9K?gk9wb#=~I?sg^ zo~v-iJ`RmL1g;24OaACS>|5J?8yEaAf^97>j^NuuUUIkJ!MgU_LGxthN;t}X$5;i! z03c^-FW!Q>#OX$-zGR<0*LSBC&N`1%qCTEOq1x^h@x>lF`>%jdWA_Aih6e8Y4f#~% z*ZXtp6}-lAsvj0Ga#~rqdjwu|UOc*$MSg>B$Ueq-xx?I=b;fY1GNk}yL;QNtYHH2z z&7bogLcF89>Jq9C6@nC#TCS82Dsu9mH!)H;d=1Vi6v- z5$>ZY+{XT$@HVk`>i6y-Z{rngC`QRTo58FqzG+*OcWBY0!}zriDnP(9-7IVq7BPEeQ7^Zv}GUp zsO|h*(!qJnui>h6&qzeg-_fsAWwX(LZ$Qw(s&L!nbRsDnT&X;1IB{@&r|SC4QZ&v?mQeTVq) z=ni)mema*0dB1&QC#8xFGOz%&DZ`#sK0Ffv{ZXx zd9~pLc;7jqSQW4?+EE5DO-ydfsQ7)6k%0g4)_Q?^O`1?gd3_>qI$dq9Pz_&s?${b7 zmRI9`xrfl@ef6}-klRiH>a(aX#NGVZLSFU(`&Rw8;W~YCJwn#b*i-h{y7~YwoFd3> zHAVm&w{SCombe0E5$5HUnkGI?bKKzM1V3%yvWVOr!rj@zCW}dBFtOJDZG8Ry%(h|#vXqqhcQR#DR_bp5nA0DeMAv&q^@#p33G6U5L z&b^Jzg9v1~^JH+>CH`Kq&ZS~s|L`sj`uk>wDtxY1vc^JXdxa#oDuX`piV0`Z(h?S{ zy}|_!!u_-;KBaH%3)<@#`W1%6RP>5?NUoBfL9!Hl<-k?p9V;hGZxoZofaw_;xo7&8 z`xx`TP}W!b*#$H4Kj8I)ePdh{@AV!BWZsM|?LiRmCm0t2pkH%p7XM&JARn1<{Ju5&3d2B0!bMR`}=+~R1Nj|uk|O(?cSMn zP@SCz91Kml|7Mn@%o4gFW%FC^tnE!qs{0rTk}IrNJ@`id_m>Q7wm9ZVMa zalxeC{corE&OW-v0-)AF1`S}Oq{n4PjBD>NmI54WuwwHR4761NcQA~DUt2E759-L7kt>t6RcP%(yI zD+>I!66Zj+e*Nnwuq$9^-{i~rgOr()JjE|vZ2ZyZYkG2yb3k6e5nil_e{q0h6;Qro zo)W{Qv!kRJFMQ|5Q@lZ$ zeg$vTzIyUVS0qiY#VX2{%&&#hShca1gIr`0Ek@qS&wL|UMEGa1nI~j(P1#igmGucO zBD~CE=h^~|IIYWKiZ%qC%gG7_b7pMcvkE&gRkXoz1__>$4np-en};2`fJg5)t})bI z_^?&0l+cP>YNvW5bXH8~g|j-O(aaY46zS2tG6%b9f1is0u<+m>YU!J)ahgsEZozRO z$rHz`a1_N+kN4&$Qq{Aimg}PDB!2=lq&5A>n>O~tjGi!-$lJ_M@;OTv|lsj~L%o^ru9}^4L%I2RXQV%<= z@6~-$vib9~{_SII1U-@YNP!eFE;*Q=h|+5*O(qPW*T2E#Bycn{h{C`=+5hSlNl*~vu>zk=Eo zcsW2?FRRs7>$gNmW%7`w%JeTg=7to5+~>IF0*xw?OW2#{bxtq#R{TdzghQf&zf)f~ zGE{`_ux}4Pd_UGkd!9l6wBDB4C8kW@DPg6?6_N?Gg%`MJ7tO*gOt4$uFIN{^LnPEs zO;p*qX8g=ECQNFIR~W$`t{16r8L*US>TI~fMvjK^aFtD#{}$SRG}42(H==q{kLOPs z4ftMqEePnV<3+$W4SNJv9s}OShmEHCHa|ASM16RTv-A^4klJK>8!0!M`VAddX`iye zVzta}J&|rAtIT@&^&0uFl9LxIy&r|sI|uYMDlEH6#x~c=AyCw@<f@c%)a1ywE6uHU#d&*5Q`>Ks0L#5flT+2Ls&>l=GCk2R_Ffq% zK!eiZP(^{7q9Ib!B_y_VBqSFR zKW*m;rB)s;FygUUGDcloxMD|8Ym=Mn&lA>ger^ zR)UjX9wWTVV?|BwKsyhdm*rfW3xM<2x8y4h#psW(Kh%BY6R7)!Ov3K2s_Zg`B$wk+hF*Q(B0&-Z+XN)LazqET;o1=-&9}q2a zhL)$(gK;-!ZjLyD`;x8nCv1|~Sh;E?i^uN_a!N`I9NuO*fNtYOmRx(08Dp*MyB=SKWQ_bBDQp znh)CHG8%RWHH!SOyCY^d@(iE9@(TPG;%_=<9=)P{2?5~vDuup>G`sX1+Ic2RqMR3irqgLmCeC4&=0o;#teKNk-% zzIzh_EtZ?-27u|IF47#sNiS!*n)lt=BT|GWLYX~V))VJ~J#N(^Bj)VOb}~G=p#mvx zcnURDQU+TD1osp(Q+}iNLUo~W2+I-tNoSQfez0^{F->IxRsn15k>BpHq|g?30ZxD= zYo=sXA)(|dLCMz$xJ>J8SRc#m;P;Vwhrpw*l$kyAiw`R(y}hmd$ohn zuiM-ho|pGQUSeosjP0C{?Nh)@F7zP%t40As+3`!dhqh~5!z~9qEIg@HIRea# z*kYVeyvjFY`sm?A0A-~wmx76?Fr$A*w1_Dk%1rP^qM{(|vmWil@GZcyg8*5nxIT>Z zZaSk?oC^nl1` zT1zHeQS>`0ev@)VY=a?u3oJcPnM_l?>&vGm>4d{EBqR0K+ksS8?SXQ735_Y4hNV%JIcXUp1ewO+w+i?Hd#zFW z6mK`rny=jZbfYIc-s0ABv-cF{VDC=r*%O^lV@wsnw=AoRR;ientC4?4f4S#|1!mKmZ&ScCZQ9gd z`KdT^bPrN)S+oW&R$dVBIA^o~E!Z~z+F2+k>+!1o@9(!em0*%>UBys$ko0#VjBl^7 zSFpgVPu8CK;Hy+>!c9FlT>&_XFvpByRS)#;aJ-3U=t*LQ5h3By7Xiu0g{+eXFva7= zp+jja{LX{yjG^=yViL7;ypQ3(MyVZKd{S%~@)}Ysm+OYwc-EY0)%4wU>WFUorka)U z+{qI*3G*?6Y)2Y^Xat~glv7rtqm<4(M{flFG3)6va}`~D`c^lq|4H2%QfxfbMXJqo zi8>vIj?W*iZm+(-`-O52F}^pwHV@R4#DpDb zaCsM9{3Dd5UTtdF!V-N*3l`erh*O52Xzn>Vt>~ zms@OZgr;t?eP-|ErZRcL<0T)6plXyIpSIs#h9upEcqs#%(5jRaM}_&wlye@~i);pW zd49a~R#n|LYAyMg++yjXsE)b78MY<9ln_=hu>2pV$3|tojt+2bpLjw#OZCVD=e>~l9 zKEc9s8=+~uu<2~^s*`#tzIyjB^N)^!d0Hvcbp6QIEF5n zI^RI=w^Q-E-T)H9fOKQxb@*rpnC9qf(USw*83=I1f2+6T;|!$#?ya-?L8tqPl!IFK zIUw;#cAv`dJ|9${uEc$t&W2cO!aWs%^$#ck1LK*~hBY?dDf8qYiWxL@q}j8f%V`U@ z?ER~_ZIrVP5=J^jlcrg|8so>gJStNH-NVy_GF zlH@*Kc_cin|JNLhY0F}QNUES~MSSYN;ajB#AFxh5Up;?PypBijkd{1$6O0w=jV;2p z!BX$HH{-?DU^JRYwE^4>`)Yu|X8!rQ-ETORT$x^vAMs5ac7p;M_1wVL%Sknpp>Rnt zQ1HiFE$Qgt0r)q0clrfQpz&Q1K~)#rAH=?8v%^7d#oLm$Ot1xFq7SFoSD?BAkFND* zo$voS=0hC(wo#s?a}wHwrkS&iAu)9gREyA=6Xg@uNtIFKfW<-%?8dp2#iCcDJ?G&+ z-AvO2*CtG6{^$AChLqCkMYfwhPvHfAN_2!sV$Yua0j?zGXx0xjd@qii$L7^>6wXz& z3F6`Ob~0^9{StKxdnwEY9~*_j@vG?Rc|={m(CM>>3u^&F5ATNnqLpA{+b<)Jva{z= z;&H99Py}QW7$fA`DE~wwY)0AA6G)B{yXMi85$Q2A4!tZMccrM?Wv~-f% zD3+p>Vi@2?(g3tfv(sOVhQ5p=5m{W#h-lPeW)Gx6F7l7Bs4eS@AXz^hV>1(a8ZQE5 zn-~d*iISe`=*H=%?&a|anO-n0Kq(ZDwTP|rfC8l{ll_}MGoN9TfAU(jDu7w;mL>8C zV9|FGRBR{gA3g`UDB*mj@8F`t{wV*>1lM=zDPWY^_krPmIHw9aGoTaZ4_-KAk=;Al zsNxb4qgw8k!7Od&RQ;=7-vd& zFD~)-JBv@1yt0+U?p(BwJ@6=l)S)0Hhi6ER5Eu~bfmb|OGM+-cFScNpJ26R%$<(KS ze(~fL<2I*W#Y=0+iTRQ$i4|F?Rj9*BWZA3hF~#bU z_L=R{eB&IMxEq`wBeg|72^wNQ7wUc(C+N4-Ubh(VnN=GvatVeZ2?Xm-w85l~z!duX zmj5=cF2;xw&o5XWR`FScpD1zkf#^deWydrnqB=k`ytHM8{3qkrW`r%MJ96EZsIaqK zeD(m(H2+>iP8Aki{Ey~p0%1kB@V+v6+kmSH&~7G(3dt=fC(26l1BctvAO(LbQ-$CG ztgbHeS{VYc6Ga(HDgun6Thb$5u_MLFXLLmxjSGC1Aj!o^G5O zDNR8Qetp9woJRtQ`X<^kL3JdH)>e)ZAbRvtH2nPfh91p3KVFpCdZ&4ycj#~C8FJ=# z2zirv7bb=M)WzL)yOjhnqF+Rml@Q>nR&cjYRtswWQoP2ifuKI+m4&QHq5)Wt+gG_) z7~%z@f#=TcI$ruP9-twI_hE<5*xsv<;7FvXgs9ePm8j6CRy4}Cs!9F^wQok)UmyVH zjaBTTrgC$fpH6u5p18HY#V^1dQ)T@cVo#P7I{v|no~{CY%uG&rr^S(6!C?#Cyb5a` zbtJ&MblL!$=WI*$PkTo^^nvxmn-l`r` zE{`VP{B_I!+!Q}RIX9n5N9Xogd>6lGrGEAZ7C@Biv*u*p7jSyPtm1*&EgXP1U~VwRJrn+ajcV5MJecA@z8wTp>8xXwJVeK1$?>Mze+;cWC{c!=?rZnI37x3^b0rS^ zm(u|j`2RP{VE?2#ZmKuGatxUxJl<$nz+EuAs zq#9#3a0$||J3wg4h&u)a{%M3J8{xb$IXcqF>j`fm;_rji^UD(Jym#+HSdH!E7rfouKOP;`{WX_4> zdVcb{`UfE~MtHlzwJ(I^NhNsvf5if&4w&99`3Qu^IhYI2!n8CguJ2AP z$+{ke-)gg2T+RE_PnnT11nuENCJQ7lU67G`~I^rDLQ`N{D35lHf-v{~ahu7ywNEJnI73FmU z%#UH1KGZ5bo4AjU)2D&pz{icAR)7DqZtsDede+tL3o-Wno!4rb4P2mi>8?iNm>*JA zRN7)oDJ+0ij~;J#E_)iDSA z{cVccvM&M|6$9_(^JWA}^nZ@{!Xp0nkeo>b0PgvCa*OZM;%0~nM?a*^0nXHTTgV{~ z{I}l>xm4mqwX{H z$^>6k35xd0P>0Q0cpdx(%n;Iodwd(i6(1r43nQ%l<4VF8v_G}zx3Jqa(Tt)<_q&34 zu`q6t*DSE0kiFf}g#n5pg51tSpy%Yi%8VPh#ZF)L<^TSqTs64I3AP`jN!vpcdLA+e zZxq#vVJ6jEDwYVI&Fo3PJ>AK@^x$3J2t?>jQ+s(+XQiq=>>Pp2oI zxvtdto|sgDpB|%|U0P}_>K_22Ev{(0jShj3<%W--2R)aKhsSI(54Vjr_lXB#kO(?! zB;k6?t=oC5%SIUL;Bd2x+*mi|S(3&Pup9R9aO2Yd$6l+0H@SAx;%X{Kq)X5R!g4-W z)wvHdkT^UqKDCneyXh_ zcm3Raw72$7iv$FFw0_JB{qK~^xq|BK5i>(z_VxNMbbv4~X_Bq{`1s`P;MDEx4b9rp zqCY2p_;Xec=Cn$LL=4Z`YV%Rb2{mxd?DrE2Ml`s?Nx@kgzqD#=)xcz_)}+(v1j4Ju zV%Z^K!yDTD*y$Kz0Xo#$SZ^X|nj1Zo`&mLzdd9Wo4y}G0DTqbH(CvFNZe~GSd)jyH zubUV0oJY6;g7+`=nI4JOnl#^qxH=e6w6tOZfhnYZKGL&Vp7s7`JSM%q1KIu?fn~o6 z*{?=3On_@up8JibHDeDNRX`fC?1&R*nPW=NoW!9P=_}^DC#M~mjz<=# zjUTqEhjAwdOKY3RATkE3THtflI?=c#pXqrJw6efYyq{%4@Av1^^V=+Z)R* z6>rQ?86AUAC*O}-H#!zICKoK1A1&*vz#CX=y@9lb3#+Z*i1B2J&^yK>TPJ|scKuz|GIjT@9TW!nw;9I-+*F~w_^fe~k z#33*@kKPt00U%ZnAc~^Fe;(2bzwHN#GBX@~*noSERHk`E&cCpQ0jp7t>H<$d{YsI% zomQ}0{3_8Jqh^FD0{5rXaw2upqpcXMMASeJoxG{qFo)jtHVY~aw~T9<2L~>$pJBD2{s;(OA8*|N-xz7QI1HyH0c%5W7YIWb z4d1-KGU$-+gBL)wfi`CG3 z!1x)6OfB2if(URC7u#`i)c4 zYFQUrf69&A)kMg5G*v=7Ip;?4jrN%c%n}|h2b=xbtJi!>Acee|!x-mP6Q-cE&Vwit6hSSr(?JMy3qw zn301N5+7?5I1r?NBI8+4tHr2O9x9IAxnW434<60^HAmTWx$IqFp}xfq&@4tVF#G0k z9i4K`$w!4bI#9d~&uC0t1*p7YBPH3z0eUG}UEV9Zslom>RQ7 zSy`1;JiQvRZ(tS4$x=_7a`frrKj)89rrknefT;cLuiHKnp+7$Jz#w_P!GwypKDu<^ z2e*$(vfq{^-{ia;(WMc;Hk*o|3293G)*Ik+*RfdD3b=pl+%lpm2JJ5tHOzF~jQsyj=<;IjJx#2Dz?(ykgtd#U>4T-nx5PEA71vLaCWw%a`T%qy zJFyv1gdBKk4~iab1RZs%9opbYxcw@qT2$XH&4Y6_6$mZQYuP6x>DunJ_z}#rI(_** zvax<4ucYD+$@14yDIxg#RgsI0o;yyg!7-)TAT&gLL~em*oE`gcI?r%@tD7y{@0d>+k%VS#&CkbEci`vE z)00^(4oj~12`B2s@j!k|*`C}rF>ca&dtKTu6fz)#v-*i%37@7Q)ynPUd6FMR9yFbl zu{Y2);S9o4_%WWs+2+rQ?G!IGeV6dzlQpWE8C9*g4l?hp$)RMg6a|oBa@gg?rmFMeGtvpKdm9leu{<#%KfcH|H4gY_+QN!mDV&-C~~)kkUf)^1)=cW@0L2Ux3sMx#BNAz1E8>`@+g z_IM_&#ikUcK((TNFG;Ow-kBf5*;SdiHLpPf^2!(TcF^XbFFpU;!aHNjvhi)yW%jX} z4A}bF0I%J5UMY5qTeo6{wIgIpokDHqgiHM$w|B7m;npi*#@0k|=zR(;Nd7EvK4_M* z`=cZa++Hl`y|vxl>GSd0uRp?Hs*=<=D6+dJa|f$b;`-WuzxNGVFxFxr@a{PeV zdonqfM9E@d@%yyyuV%rFaY4$gFr!awwB|`bFsx(I1?ZmW^3vB?k&OKSeaIyt(}V}{i2c5>bR%V5Y_MFKR7C`~DL*rR1@ZtDefc5Hev>}4e}mAv5{2xFNnsj4uc9J0*Iu>@$Q(XT zZvmS>a;U}2Ubr@M0Y6+?77uVpKJ`Puu-&r@7~_iL`p_&&q~Z|eDV}tLAjOD~dV25G z-VE5d+vc4I1bXZ9X85OH*JCk7c%YEb^tSFG4g4{ObE&7%PMUG^+PzFqVbI4%B(31l z+AWA;fX}FYyE&YY{Z!CXBBf3->Zk8rhedBQB+3aucLQr*c(Q`o0{400#~v}Y^}cJ6 zEu5b8z^il4-p56H!H%-#)Q0n_Knb#=hi_`HqubdZpW=HrBIyLIs7Yk*>t@|WUxz@}T8C@V!~Cda6)!cNnf{h|f-cXnOr zg~t6-Qxc*1F$V3dcHCrXwVKqbbY&JtywS~7_=aD%Zmk{bI!Ahzt4|1F2Z`WR76(?l z_Kd!^3t=q+S=zq$-_F(m`LB=HFcE4yrC86uzV*_Lot%yrds_7fzj8)R8(^RA2oeH2 z5}ASS@7A%|GGe>K=c^=1jPW4(RTO?vNs1%KIGm>qZ|f|op?AgFb_7gUd+=6ZPq+2Z zY3(ZM=~%~^`Q!ZA^TWO@T@6bh;BT0^8W71hdWj^k*sw<1;drIaegHjo&M0iB*ySTS z-N1dT2|P$R=#N{vZ)>Z~#e$QyfxT|WINMv99_OLB;5*WP++a9~tq1=1N>X~0yRRpb zj*ks__g}t!4DNfJiKZ8$hQoHtQw(g}S;=%4o0o(O-&Io8s+8q*P=#I^Uq^bs_&NRR z*WRa~z9szU950W;O~OJOg&aZxTa_V++jk+4&A}J;Hh(PG|u( z@32K!cS3sPr!Y|H@`Zq8=AlqRdaLv3jnZFQGQ8gHQ|KzU?zi9vYNEQ|ik%<5)X3#e zy`a%?#hL|^i)y9BZ&J|QS!*tX)CuNF3kcT3E;fohIn-@TM#}XSAZ?T{CR!aKBm^P^ zF1Fo6^nm-L_9D%gSQ4^)Ha_D=FW&HWkF!GFJ6BL}oxCkg6}UHS5r<)Oiqrg&v0?C3 zaIwr{tg=9)@q(hpo^5@#Yc>g3^Bg2+`Io!|8JXIrXx8nh=iN!O)5u-#^V0MJ0ift; zynS7_o%V(2+g7E8@PG*qt=GCM*E&`fz1@C8<7sChOMUfku@5^%Yrri|0~f?aGb~?w z&Zi74P9Gmq2z$hHYXlDkdICHizfD+o1O6U3h|Z6PlJAvhEqxyRE+wKl84I&GeTKv* zwS-cnJMvA;Yt>jZ22H0Z{$s2G`8F?VkPDKeD2Y>2P0Uvo^tFLO(mZ$ShJT>cWBUpu zHa~Ekb3iWHl0O(IFTZ0)~` z*rMiPBTb;vea{l|UG;_UNj=hL+x0l^$88ehe$A=TJx?)7^#kAfZ<_#T1-nL}B2e3d zF$4%PZaz5yZX|Mu28eCNSV(&{4()sYqIo>;8>4EK_k3L5mH+;Bs<{3$MnP6+=;Lm1 zJfo2(;O0;xMKjUI_0#^v3Ux}$NpE^t%W9iCm5J+RCW}_c-P@3fwgHxcmpPfQn$ILZ z{!+HKX`&&(3OIs@%1C{T_wbBcCP8T)VE>i7(N<=!3gLGNz^j?x&l%Ight@1x>8vmJ zoF1un&5TRk!$F+_oqz|p3x!P4VTkla=fK3H^mxBV3;b5ss~b3s4Sv4O7CsWGF%1@I z(sj9DzYp0EyZyUDz097c{X5H&57Wy=D?HoMXT_^GB>YkG6-Q_5*5C&3%rJF`%n+Ky z69`u!1Yk5uRW@_2n=2N!ojz1DBhzRlOv;BqW?{}-y|@oo1FT7=-^SRgPap%nx7SgQ zN5|X%H+D9UYWD*=byXf^X`zHYS+Cn+N~fjZY1%UcQ*F z!KL^vEZ+XSt-+~(yxM&ByTU^j)Nr-z&q^3}u{A7gk`&^734#^4uC|?SwwBeHNk0yq zx|xVngLXl zdu5;|-P0!Qn)({{`ks`cf^)IjgP_01&Za}|rcMz&6LxULnZf%d7Y3g^ z+#b0LdpLXyo-UBNT}i*8KVAvnTKJx40_^VGKk{b13%}e-Khw&6*qi4rI01!k-A59( zR@Hz32cBJ3a z9h<Om$=cFu52;+=#fOH4$+&x)Ui!wMHP`BXFJF6e>ch0Gqcu54CVpgIAi|w>jR! zm(ne_dp?3X(kx%~kGmk0oJMO}FRimufQ!5}vti^ETnV5MW_`Vy6An%_60RudI}X0# z_2`BTm)?vru_HvyPzMeDSA?)-q@|}51fF*{yxA-Dbpfw;gl$7a5jp~F+WwptM&I54 z?DOI|N^A)b5IixQ2113iOKWMU7$Ke3J& z+P)C&Th;20S3Mkk@{?v|liI%;)g)|p3I9kmqPvlfjmEY=At$*TX~}bYcr!&Ic`BYO z@MN3}BpT_=nJi?uw~Ejd0m!)EgxsG1bV;9i49|uZzkzo<3jKHMUbTCxZq#y9ts))) z2X9&aqeG;8y+NpUu-k>*^qQVdlrY6|$pNx3&8*l>*we z$BRdJ*;^^yEzGY7Nw@oXOGTwu{2Del5YxNdZ8Iz_7v?Hk;*NXB5M&Fne2|9l5t!Em0=_7D8OI_~`l8sE`U zqD!x2kPy3YcSlVH`r_hZ66Ul1qHyGovu`x(9abmR{rhtNt4`05Mq2PAPlR;@0}UQ; z>0|BgRqu!vaRXxN4Mtc5qZ3@93#Qix;JhbQg zZzTWedMYEh1tIrv;-RumnFwSX@!{#1cmHl}S8Sv6TXfy`lc=E)7tc9bCL)ZCz z2v5PHwXZ~OKQR^>iV@rUKB7^Q?b~)*_mr_6Pq9zTh<*+4e@47YW*q>-e8o*!y2q?y zP@?4+X2yS`yZ*_FuuC*9mbb|i#>RQsfcJ5o)smW&4-F+ypPbQ>!Hh0OrH`bEgPS}) zEq+&Sm~bHyC7MgtRHk;`r4>{d@rr1)sE!C3wH+e-aC_^gPGN6p`Ln)Wn^{MCmM|L8 zRB%lm8B{F-Fvf-Brzqy3H%bYZ@M1 zf~2@gGDd(9;3wjf3Jm=+OOBAv?^4!I!Mf&+`06@xBqo+93vs{)8?W2et&z0%}ae=M;yI|x@cF>7JRd5v#1 zJ;Ri%o{nbVhsBvSo3A}bgG_5w@-#H9IC;(50!|mkwnutoLuGyyxsA3ZE0Cc?K3Q^| zQ`IT5Ra5}11XpOw2?SzY1y||HuY^!|+{s$wqEKW&gVeK;`h)TGizU}pb10H*ONZ3~ z>4hP33d!P1#0og_l93A+(8-oJMI33iv#+vNCOz#PNt$Ao`ax^VH4d0T`P09H%$YES zg3K8eQvQ@t&UXTWBylqd#U^bFUaVwtbk2U_vPvLWQi&pFG=QU|v5&@na&R^-h+DKQ zNxIi7SAC80J9xSOGqMvMv!#lb4Q8+PpPJN4@Yk#^@t-%fRgF#GyIJDbt9%piRGI1@ zEQ=vGm5SM@Ztton>P z)Tx##oBO49u#qJ(j)%Ws8HV|;Q$ODx^`647<3kJ1Uww__N&rtYAF{@VY+STc5Mi{JfW~QVf zx%VYv*Kb?CLJ@Jq`|zFgv%CwDCwkvVBZt%?kxv-6hf3^Dr~Qh*@bBKei%h>6ByG4^ zaaVMuv=Mh-rSyF9UwrgW9j{JUvjh#WR)1@5X{Qcvd65??1q$gn^@?SAjeH>dZCx)X zDwK)+*X@uzLmk6p=40jc-=FEqIvaz|eB0S|bd;gSzC}hjOPwxq+0wt%4vEPwk5f`0 z)NYlK7onH~LSm&@g!<`80!WkB&=zFJGpX5=V72i0cG)sSNEp zek)dt<^JT9qs8=x<)m0!Ufosiy9<`ZNr^PuLJu|a zu_42{E#d6{qLpWzc2vOKi(B*yUFl8ok7Oeit%29Z6L%V) zuuH^?%!T$mz?lP=)h~|j+pfjvUMO1^|I|CZS!vGF_|T$$7b?L^Q`^4Iao=Jr5!|)d zYZk4lK#IehNq89%!LIP z(xw%0y`ny<`!me0CZQbhJ=1%2X#LJNGyxeo2cSe7r(JWZsC<4@;F#+DYrKgCy}USA zJ7m5}uqy2f?YK%!%9{!~|3YCZw#_nR*Ku^*fQdNZo#G5#yqxD;9X@s|qX1{eLdbXz zJ}(L~>Wsvq&I;uiTjl8fqUi4HN?H=$x5Z|~f10gQ(0y|3ZW zMS71yvB>I~(moNgp^Z58Nw%VCG{4rU&m5y%&hzLPcE{s;#|eLGK86poQY)40>ESdb z9XKm6BqRMqO-W8gV$8gQ{w3ZfP9c#Gzuv4133 z{hDi{<`#7xQv70qRJ~GswS3(AZW)t$!LL=aG7VJib6Ig2pSK$E(2w~R4FWrP$FSL@ zkFMc}Q`L5Lqv4LNmA+c-c^}f{G}Ia@QKFbXR~^vCuE$0iAZ1<^r7)`%Yta`8W{?I% zc$^wuL0UXOb*QLlDC8=cq)^_>wuBr07<1?V{gPYQ^SoA%)WZ#YvG&=@!;wX7bTR<~ zhVMU1r7rDXv27=vm|V0PScIJbrl>^=zH;N{qiwvJMLoT~i=d^lzu)(OhwYXzdF?EV zOm6lBdz`pM!T4&|-wy4;t2h78HlPt&24eCqiG42K@^dgvbZA@B41+2=ok zc;V2iI#&iu+{VM3jBtO(&KcRx&hx=ji)v}r(1i#kkJCen@aO&Y$8Wh}A46t3sawN+ ze%TF%?=F`nK)rU=!olluWKp>a6ZqiP8-s9=QgV=6Q+Dg~)Bd?J1{?i&d(R;NXb^fX zUxrj2wRu0{a%bidv{OQZg(eW6+m+i)y|lNtk8y>&8$-_L$dF6tuz9v|)GQ$#Y4OTv zil^nzi#8x|_tFqnLXa_n55EgK`POGvXkI_uuP;v8vT`zPgMqfjlcaj2xYtoT?=0|& znI?*}jv-}$gs5`;u>MhpT=0YZF1<5>?jDtyd6Geq_oO2VQxM^KCK*zwbp?UZr~B#T zBG5^*7^(%Ep|y9=CyTlLw1-|Mf$UXA}uK z32T!i2xROdH!F|uaJPU#zHPV7RX9mRiOBDB_G2fP-QMw z5@Ijwds+i|fizTM3xK0;@v?}BJA@XoBN_~U$dS#RJit$-&dT&Re>$NUlaAz)+bDQw zwRn>0h}^!y?p?oz^tkM9VkOE3vvE}2pR-EZ=nXvq#Wx0$r-PVA1K2IlYDo1hZ1?WD zM>JuCP6i4!@0xrc-~)^W>FKJUR<`#1l728(#zONVoK1|?iqo1<^%kRHcVdqni=DBS zV6()smC1kG#|f7)>C3;}DV7a)vSYrPo;p`xKC*ZM7nsik8TPeQs~H4j zzydW~5^~Cpanw{+lymU%)VTgGr;%9~f^=s*Z!ex;R)IWeo4=G19tS~z&$murdoiWf z&w=3QznuwvNDYm*8ms97*l{Jyr3g=sn@*VR%u%R;xx7;3Y73uoTL<{)w_EEDR zAN$pU+B5twTy3m7;EkF4LL7y~TBwA{NiXA8Y9gH(>@R)T^IplPu;k{t4nM#>NUb-R zv;I|pq!7aX_^hm~zkmKdE@J%oxkC>V{1u3JBdQ_Suq{F__E9G2>a4aG`atc`1s?{( zFGt8Ednx644uUefg;ivhug53CVdo%Kslt8Gx<@E&J|>!L-r;iF!&ye$c_g%X4UYTR z0)q~L!+ndz?t_aZH*t92p*N-9vO0&Bie`Dup^x86`OlG+O#{dG&uW5iYHO=kFT+%g z0n0x7Nprj!+kuS8E_xF2 z(?9hga)v%Z$$5HKesahP=_I%m2r?TvIrfCI#Nn$MrTq$c8g~Y!O+v>`M*q@SDNXdg zFL@X3ALBJb*`uff*%HU;RSk4JAHF1Zako^oZU)_NQr|nElk(Y$BYZ(P7ZHetcRaB< z3dTEp0<&V%Qyj>0%s$tq+_x%p-ZL_13RPWpBVL;0VnvW{qEX^=G34OMQvTANAwm3S zFXCtI{4JaC2((f7mgzQ{&flzw{{Pnk(mD-~zHiuJeq9$9Glbn4E=U)eEp&qsKfvfhW)erYPeHYxd zyW^|CWBWY*bBs5&+GWkM0Za{u@VS!wnANRWHD`U-ej@NHMrP;(^>am4|afTrJ0v13P9 znc}7d_a=X}G~W4~I~fp-dJk?#|J0!BHY|OvHiSEOUEe4kPJC2F%*iQxx|*%`GuQng z+A*EWTjQIUg6G320EI_s(;ZPz_JsS$ZUQb{m^4&MHKtM@Q6{FyA-{i5jI}ezrQT=m ztz{NSxL*6Vwy?M%w_@SeR%v+g+OS{VgB(aU;?T^*%kqJr-OZN_pRM|$N0TqSt|F0? z=-krn`D?o9hbX0u+Qmg(WuS?&Hn)O2@)31Ig9@xx%}Y`q6WE_u^x@!5&f;6GzrVz@j{#Zfj*C~a!PdY?f%mcT&$4!ENS&C-vT6t>DB>Tlz5aYT|4PL3|`&urrLy zPkV12&RYw4s5AZie+;--ZrvU5&ZJh{5@pnPPlXCpAu1mFW0c zPP_Ptc1qAF!4G?KHs-#ll>jcL*1)*+lx(BV#eDx1vhbHlBy~o`6z>+Oz0jVy6M`$> zy6R5I8YN{7uQI&bPa@IR3w#finw<<} zm!I|~YM%mczS)p`2=!P>GYG%>!x^+;9J-qU zjsBz=wAqPzQ1Rj_0Gavx+7xZ50M&@jlsUC(m?Yxa1$@i^jP5jlGDp!+OG zM9yNF(a~P&{D!XUhrsH**yIbm7XO6#F}D*pGqZrb9XYd^Oi)R%~x`e6O; zr{OKhq||UEknTjbEbK^h3_lVby^&pmAu(?G`N#tBu4)+X1tvtWs+{YK@?dpaD10}= zTs)vEQ?7`OTc-a#v=satw0kOevyK|-R#H$Kyh~VhyZQNNr>j=y!(s39yJNhbae3;TlJye_Xivt-xSqnbu{Ow};<}!-4_jaGp=1q6$M}aRx)>bA* zK^W|c>Kdru#>u{_6VNx-R#(T^>rXD|lFt9Ctci<$3sn!sX0()Pr$}Vk45D7e96s3j zmb)hLWvY*se)6r_Yn&}u5@OK52G$^}{mS;g6nhSdf|_v`a3?pSU3$1c86Mr~R5%th z7iM@Y0}qz;YI_2IJeGg70QrE1d*M%=O{G60P*<+?lWU|dHhO#8YNCTISdntaw&TsA zHx{+UsOzTQ4+d2h#{QnBM>Eh6XD?VK_~}6vg{~=K4w(syrOvl` zaVk?@*eh>vyil<3dkyiGopa|1SBbZhHH(53KFwy$Vf~A&#e!?5Ut7*DRjU_FmgKeC zLjCCxZ@L4rC8o&h#EIQ3X}i3ZJQd7@sp567vVMggJY+}PNB=&Zn`$b0Ae9)nRP0XhqBLm)AucXX_l;f{ff z_<3bnFPvY002o&O2S8ZbcX4!|> zgz_kR7e5f1eNRdwrlf0W> z5VFp4Nml#y+>z|#5NBEORcwkNd1ICq)1Gbm?4VykR{hd23E&SZwox}` zp3tcin_k$BiMW{f=r1U`dYD|FHX)W+!%#t#Tsq(%jw75PI@IO5asQ8 zf($3-7{E`o!Z$)bv!QKV`;_KAPt=CrJglA+goi#s+CAXcRnLJ8J;;+Ed@lxrO~9aL zm%A7cuqO1`l9iTH7UNW^Yb&W21_N)b`_qiviE9XIgO3pghlAn$HH2W$Q!7y4?Csh4 zbMzQZu=Tub_Y(ns00r*j!tgT;c=D=m5^nlj`g~J+W(v64XCOi_F0_W%QWPk++qQ&v zI}Xev!_2z|P3mfA8)R;@r`2D(Y0Wl-?dNbfy;4?Vz8~q0R}}tU_*Gt>nfoKCXNkNV zCs|{=k)$Z)%H^|i_=X$ZX{E;3_&BYpe*WZO!zZ!m;7T2wBj(60r?Q$>2|zgky`xT^ zgq5#zkTgNy0W#Vrr2hiseHBCz>I&z-p!#28g(C2<9D^DX;)(!0qC$mbi~aA)9xBdD zlt?aQMAm%^Xm!R*7e`SyPGGf?XPA-xZ>vn5K9=T4M$)E6%Dmh|xuzLD;}xG|N4q&~ zL7fvp9o<4C-5g;i;{QK_R&W_F(!TpEK|mzY+vj`C`qLwUz+P~KkkGG0(8*zRd8Y1U zB}MnYV6{F%mX$kgKZf9;7Kx6Xa%UKzct zol!ex8&R)x6*=m@gKorlp#WFq12~XP$kuL)7Md!9qGm(|XV(&F^Iq9h8rSz@ZqAIn zY#~;F~L>wF`XbTo7m3MW+cUg1bod#^misC0q;kGZ$xK=R}fJ`Sb|z{CgAa zEVFe%$Yt9XQeA!RkJ_4=!Ov}rY%T!yDelpef>d0`d+Z9M5k^0vQW};EF`G{!{JKAM zW~F~$qR9^K&tDmXR((b}wU0`h=n528*OnNrMGMV~+se8tyQ=dmnw_8n_!>8Mfq`bW zkrPfs&3a@z>H8FRw+%O{dS#^~>wWqwnM`@iC3bDtBH<1Dt5D8nv}om5r%v2euBY0o zCo}>r)xSPZyL^ z(D2JcN_4y?WjVdp>+O%QZ4z5u7Xt@x(IGeOLKBzh;pj#|$O6Yl1tq~0L4EK7$CAl% zTWNX?963Z~=JTZW_u}j$?M#A&%>|!eKWD)pAD@I}*{{yiJV!YV%cwJP%AV|*QvkQV zqR_=e^}Gp(j20iE3)H0XOXJbZy@bzSKjpK}d79~y=(86BTU!WpMl}FY%JGF&GQAVe zxoV1iyR3?~3lpTd580Yuv}1S@w0OB^;*y-{3b(SWoP$}-PRk%A3i%%Y zOFYZ8V|oVs&6#e(*XM(>XG3YgP(3XWKTX^(((Rq1A6a9%kXb?8WmYQI*Gfva*w-vu ziq?jPl4i$^E|MS@O!i_kHk|SZz|qh5!7g*C3;?P#r?UgdP$Bz=I!_M^lU;@=5IA|B zkMHe?QbuaVd@4bip32ZdTB{%R8QU^*fxD|ahVjNyW<>#PB#f`DlwCv zs*t}nFjF?pxr|-jjkJ_<{mUWco0_+Th3_Pt;08Dn!t3ja3N}nrzHVH%0rFwA783Id zpG7;>r^GAPiv_JKbUm8!gjy3kQF%o^b5Z=)VZPP~-@P5H-|dmp@0QTM{yD677UBNr zb52wmD97^qUBDNe;@HoP!

    Mkt3nCSbUT*_;H7xmE1v=Ww z>v|jz$_S)dO?W=?boL>{e%IDW)80ycj7ahv!o*v!kY|!?pqFm2G?lD=>+{D}rW0=+ z$n*opm;*O1zRLTu(Uaymsv=KU?iU;FwKb^r9+!Ax^UJacewbTM% zlcWAeI4FC;=fztu=*e3@Vnx`MwXlt%G@5hrJ<>E|AkuW|W;qq7ecJKr{%pG8<$^%_ zpJ!*Lf{8=FPI)pdOMc5Ax-~6eS&Utf|sDOIjK8PuOy#ZYatkZxK3 zlPO&HNb8hr1~s%Ok}=|AVosIWvvm0dOr_M(4xb9;pM>U%gr^b8M;Qqp+GPmpe>06Z zI^OSU{^cf?BN}9uETN2 z0X>u`P%?37v;0hY=^nG5r}L7E1y3f! zofN#fD(dX@*rhKX9=()wx}9zI0U`(FvswQjqhJ#NcijZ)YLRh~=Yh7HsQ8jqZts6BZ5|i#;ofxkpQI5p> zQ6RokIm8b=(E1YFf&&$*f`XWNE;&-;C9^OsY?h^0GqMPJY4N80;D zhuCxRjF}icQoB5Hzp9!d34xs;V4E%{-3(`KMFlUXt311F|1RGjui3M%nMq!py;rhC zNknxz+23^)Q^2sP*q9|VD*BW>i_Gt4U?(3CPOT}f8t+VOub!dkI4gO96ve7iZuz%S zn+h%)nDB)Wx<(p1FsbBg6w{yR@!M#3@`mkh0w;~24y;m?0$Y#W?ame6wwsk zpG+UEg0(C_roGD5?p?X#?diU+cm5>3RP(!(oxGES!$W=R>Tp<14d*(@Nz!lj)LT@U zJi*)E`8Oww5Foq&t|rYw8KA#ItEN**(-mT}+dC{>60m+&HGwhwxPk7VW?6*aXxnR? zLojv%|7UgaY)Y)P_3bw|?>fXVD{d{XZuK-+<5B8RW-Ptg+Qd=oPzfQ>bKBzXSS(|- zO}oQS(zR#Z0se?qC8e4{u@HvkUSJ^yC)`|AoDBSso36G|X5JS}jv46$;W(GIuRR?6 zVfSP#p>uKLOjUDmUhVYZaZyn0M~l%3V=_SF2tpUn@cx`GM`&oVF(<{K@IhbM!A}$Y zPqecW{*+!+Ug!|z`Y2j~LBfQTKU7iK2{VKedNuYJ%dl49<)VGwJK3rb_m9oKes^kFS$wH1|=7%!z;H;3Gj#`LB39G*cbVc=ro-Y$N8(7l7paJgSVm zw0VvE&$Ue<8v#4QmZ&abG8|8SA*MlAi{-jnBMa*tG%30H@8{J7IyHp9EBUmKlu@}j zaqExTJ4<%JP^KMR03?}D)GsdVm}9>?cr*9Eatt=J`x~2lztE)481-dbE%B?GdOQye zRa%f+5u_>EguhjC*v(HmY;j?;rI(l|pK&tTd8u2#Fk4hI3OT3>P{;h~0* zGVhf2y+J?b%c{P$WF4wr%9Q_OmqS-Ln}w3MzTE`Dx6he55`hR4B+a-j9?Fvo9av+; zDq7>%;Xdc#*g6ILia_>@`YfehB!Cu~$6cEAeWZ+A^>JUM9G`&V9_%haxyDmA=Xw#) z&C)D$zDfz5e4Y4deCiNyEft;5Wzc5f`wJXBYotf8dNIL#)@9%80u6DQH`za^%tVTj zDd|3b6b~7&@#u_xV&M7|!EG#=Zce>gpCz`G=zQp0>Ei6%#tX@zI-)LPDN8uF!%McC zd4nh`*iSNVe&LU0k4s8ye?b;QNAkPHOS~QnMZ}3~TkxLP6e~*n9o;XY3q?jNKdgXH zD*m4kFRcAHhBIs`g^-pE{7U~iOT}c7aZx zeqLjazE?GzP|TUSvZAV@r=qK?&`g^_6WC)^K zK;+1cMnajBPQL4Xb9q>m>KE%o~{*6_9di=ynd^JS1OLJ!>|F53%zr0K$ZK+(u z$d|y7VUaG|u0Xpkqp#!^ClVcE-2XjjrZ{4kWo8cJaOSrWZ*D=z7T!s?slzE7 z(Ff-9!tHpxW%&>~3og7R-ZSkW#SM_ALIE;iqK$>LuAAuuj$WT&$wIOt>YK`KIcWqx8D?BBSY}_ z&MX^20jBvwcP_b;U!=_b5cH|I~heuDlF zWA7MbNwjqVc9(72wr$(C-DTUhZQHhO+je!ayXN+L-#0Ocn3x~==f=&9%yUlW*?aA^ z)<&me*5jCad&Stjs$izqDJI@fZf525j(S>{YNl#$$5Uaq6S2+o16ip&HS!8Gb?gu! za-ucC#TTeUkX|`8FhhJ;9~SDJZB+@nlPW=a_5rr+(W6h0z;P8Pux{HhH#6J5-OygN zVS)}3!pj5ioEj(;KXB~mALP9?b>8>^g>g7$*H)ldGXMj^1WuHI5a+d;#>gW~qtfr$ zb;e()DKYjsc>LW?hn476VFQ~83IvALD}kQ?Lh8U@-CK$51+UYK=E_Qv%TNK4Ivb*k z;`H7>bIpfV!OGes)TbbeVHWz~AQOL1FHI+~1ROHw?^TRHvPewH)!-y^`sjhW5djGt zNNRaLPlT8qDNp&^u-59x&19^DXQ?L@u=#S?uvl}NJl>}UG$Ax zS9w-(JH2l?D|+Pt^TIAlxp~4=SymM_;|P+){_tI+!i3N_t+=_GG8niCTD%by({O=) zBnYIC%wS6zs+ugdb#FC~zZ<&Tu6S2CM>6on5zZOkL1NZZQdpf6YVnNH;-Qo*lLEH7 zT?ifxt_W?Cp_VjtRu^kPyd5roW>!*cfnDq5c{Uy&R%OwTu)@ZB#Q8Q|?;ZcLgt0HL z&@yelH#a0OYUx|sqGup$Kv=g|6&B=(U>44U?qkQjwxOo5GnL3MK!dx20Kqvc^@Qtr z8}+8M33hc&B|Dbr_@1%uyQO2~DNL;pFp6LyMaKU`qf6uF<%RW}=BlCFCn*|$n1=0K zHc-@yOXD3fW6EIbk}X>Cx3Wva)~rUaC|$aU57`wYK=Fq#19JBP3NWy;nzUdFR0Yj> zthk_z+Aw0&boMmSs~3n71LoQuFRM?N6Te@1je_x=D1Zp9eER)+ z`yTp@=}!o<^4KR0aP=ps41Hl{pz2+}XbE0tx~sm^`Cytzb~l!)Ub4e^|3t3kjI+<< z=?nO!7PkEDAC@NL#HhKQKeyx|B4}M*&rL&^RPQRs6@LsbPEsb&+v+$6lbr_RaLTcq z-m0IM^zklHyC5OG+I&0<AynP2nlTr z1eHZuT?)bVeY%J+myo_^9j#esDF!F(Q;sM3L!{5Vv7YM2?vgXBNdcQV<;17_6L`hiCfiDMDBzYlBTR&!}mgz+YtG5!5?C zslvv}iU|Y80B!yTjs|U9wM0#^90kED=EIIZeeMVu3__^^Wql`~{l2~XqQa6Ygepa1 z0P{z=zc)#cVA)a!4xI*aJ=|ZX2vUOrAlFQl=!OJCBugz0FXLHg=rAH#DFDlOJsK-& z>4rH<5u@21verugZ*Be_@o~e%L_|Y^WbE5+-h82=7L6sh2Y;Xju&=d&euA?qD>VbC>7jp~Fn5k3S@d!y#f%FY=c# z)jDfY@NVcdHoo^G@6cgZ1#F*Z(@zxkZN98^jzv7Tccs-IN-=8=`&&-Oiq{WAXXH10 zcPf7lhz$q#_hLa+5qz(OOvdh`JxZUd;CCaYX=l28%w7|=w6eI~zb@d=%8zFITpNQy zW|`aBd*3pDfOsDbme?Sr$2-1ECHE#QT9+APC)D1%n?7%xgTYlCOuv>zVSB2imThec zXpu2HvH^EX;}9rSEPuvOqd){a0jA-{PxyVXdyZ}m5->SH6&wo}J10AP*r-7%1LXq0 zYPqPWNI;30nAobM6MPBSa|Ib0*&Rr49DR|@vcDoIC@8;8s%Sx=rQb+!4i%#le`{}T z53rHA%>nyIgGU7AA3^g`&(DBTLskZ0idPhAwV;`(I--IFWu#|g;A4*&I>?r3ny_eG2i)DZYTCke?OZ&-3 z6@4G^)aG{2ZxXVtWA%dsSeg~>UiK*x+^?CjX5cv_fHg|+&={1dZEK`E-tIRjm({Af z!tHRb{63QJ%5lx|YxBfGOR`;kxB&Arb%O`=_mGzCqfexKJJ`7@@kCU3UrxexE(#?UvZGnvo=kMJ@jG8 zO)pZSPhoc14i)4w{=GB}{(MI5W~mNAKGeT6X_`LXd231-k2^Q1ids&;)6S>`WNjuo zekp0|JT4%I%`N5dfwnsDMd(<`zyB>FM2eCYquJ^@;?Sn;_;a(i!BL?Z$=mGp?Z3T) z?sn~|1pj7S3B~WlT9UAw_%R^9$2{FTu?W4FLvQc7NcOpZ zA+oA+cTuFS0hi}f{X6T|5NLqw%1Lu(GmzC*0X=`6Kuga1;Zt;Hz(fM!V*C6NN(dgG z0$(wRAGu^19I4y1dyO(--px>yv#KF_U9vyGzv`>Shf+gpsYdxs$unEd>*fYItWJI7 z#x=&B>#~2W0JG=soVyYW7VJEsgu9R4e9nqh3z@RL^MD1@W5-vR8-9GYQYFakz=1=) zI@I;}(L;Z2CQue35E?@pXPE+(ABI69 z_62VH_Z&KS?CB3jj-AzLS8u~_B(NI3i9;v;OM$z+diR<{2@p|Za?EAAaOiMh$WbE( zto@O+*YR2S^~<1;?u{J*(_o({&DDq3@$R9cWW;U5Iz1VQ8>OmO9>_aw#6ySH5PESL z%X$t6N)md$_({9Ch^R{nE1?zV7+Gkr$*CpeW?^B$r!LCRixt>;wtp@?`LZ|ztg05< zZH`x;M$gM%s`|NN>)!C@q( zwI%9tsQ;}d;_fPbXJG7UXJqzxQq=~b>^5tS8=Cr6Je4Mdl!(3T8Ryy!cisIQK3{&! zWvdXC+Ys7Z?WweH230m;#%d3ZRIAf&4{%a3aoyx@ay(j6s?&iTincm_Zk^-bP19P4 z6-G~bGwboBqWlnZ_SDi71D(Ur@GmH=>Ai~eKS6oEp)N3FC+-v%B;L4D* zc|BW26ysd~ST6*_zc-=N=X7B# zFjKlkJ*3Tw&93|Wo=9~ENwQ?Vx$y&I;332VNVR)9(@V3z*PdR$p+*+)? z=Jxc_vL#+4^>#Qv`~jI~{|F;#Wf2M8r#kb)k3>^(&+Kpnjq?3tg80DlM3PXvFU~R> z%SOK4g_(o|Nz}KnYxhq4a_q=w|8ClX<*~iH%S~htUZGkf940alD!+^xDM~_^1S*8+ zdCwlccztOJn9DpL8_Khvu1lH*1z0i&3W<^l{hpmk>iP-s9>l;dz8(L*qsi_Xs1uhA zHfh2nL}tLK0U#z&VM-Ao@IQhI?`Wz*&KCB!V$R0g_qwD&ZRck=I&4z-xukvRU_3zm z8vXY=(@sXp=#WExJ|kgaVMkwEK`Si7wbRFyjjO7DcK@*>y3|2t_oUkHKHv{!h!61+ zY=T3Hu1=o1wmo$S6@xOC(Y!KNo@-${O-eBC?36{TyLaToUn>+ltSvl`mhDTYg2lR) z1$<5jNDsABg!(T2x^Cd0Y`)m%!Ywb*{qO;_l<9KTnTN8=P#3;Bl2egm|7EDn?CZkN z{y0hxAJU7H9s_YFZt6@(WgZ(fcdL*cTk2^^iz3j!2sSeZC(4IiIV$jMO- zKFYTbnx;{fR};WPsV6gCYr5p8Jh-Dg z3IZ7q9MoLF3pYn#=s$eixmNr`nHvNnl9%@-x;#DLNhyzxli|%m7bQcaW&sm`*SJ)S z7HJZ2G;7+X`Bmgi7q(*L_R(!O?;YeMR5xYVx-OvFD>0sR;EJxp@6IK6z<=p1l`(4J z0;n6tt(mrM_Ul04#RyfhYT>|X?;loZ)+u4q$aT$}-q&TV(V;@Jn)z)WHEUGor>?;w zy?zj@6=@NmWZY#-oTnfKXxPE>oKIaTOs4#W=CzAavTWSEQKQ!Q3C@HQkv+6&YnHWi z!$9Q@^fOB^g17hEjB?|KK{^;H#UY?C9&8ba4K->Qt46Fg9{9{*LubASR?ZipZOi8s zi1yqg$gf7NYQW%!8jxju7jV&-8}bhVDg{CX%#NuIe(v-Sk}X1{=LuP*UKMtQ&{sn?-MOPL%Mz~Fog zA7Z2wE>DfHHmQMh_Zv2+YaNbRmWOQXMiVsF6Cd@U#(%dJ-6!|Ub7uEkQ0_E$@n6-m z?oi|=5{>m0w^h3pm$8-FfnA%=xH~D=jviS6m{dfp+jh8xZs^5evtyr4(ifBdgD)w# zGwlKujvNJ*GxQ!_xKOGIyX&g_2YLI-a3;RLH$FEkjzusV4bWu!$ztq+Yo^I0eiem$ zU!6XG!{x<_K?|Uv1WGnh?M0a*+yCg;V5X=y=t%Wg{*2}*F4=G(OsmsrM-$xtg2Qet}yF|!GQ%G4>z%zT?^DB7}w`O1Yz^X^D7lXw^O9T&e~86P@$k1tZ&*V6~_ zh*~*0+oW#qV^>6rS>UgNi9n;BE+}N~elo|pov}v?{-lR= zf^6rm$)E582Tz+%$xsm`Gq%(1W-VDRc%*;54={emJaY`8%Zu7jT+zTms1IE9=4SHo z=h#kF6~RaezrV^C$I~?$HS$wZmV_`ArOLrK#?ztX@yw=C zdL=qKIYk*WLxqBlqk47)rmF8wqC#M>FlhkKsJMwq=~#k;W`|?8UqezkJ{2VL4?wwk z5=2eo0R4WfK(>kXTi+`XR5v|QVULR^i($hy2crJb`+_C*ITnMLCq9*7B)f~dl|$Gv zHdfkf7!N3jy&o&GJ$C)zi=s{5;qE*}9_|hfUY?G$+auw#8!v7F+W(ulTNJs=~^aDwYl%BM8`TiTM1uIJx<`S}=CN9C6L0 z#1t(x>dVcU@d$N43hUFaBw8LJ|QV z#j!?kTYUj*T#gFk`T(miONpw~-Rj4vt~k~OH7q>4A~o89fTAh`zqmo+{NPi8Rw z6f$HeUbLBZpJ5$uIslW^VZjSP-^r7#ZMk|xtAKwZ5pd5TbD~l0I~V?*Q@rLUcQD}5 zC7Jg3^UzwSqk;VgDdx*&88$57*68NorqiJSN|oZ|oi*@5jOV%MW&Tgl7{P)*cbFOk zjB~%@1ppbcMd^ie(6e(E&ghaT^<&*2&Q}DSNdkawvKv zfz_D(|INMmSA6pRFZ>ID4uLY@|3e}I`S;7eist_VyZuM-nFiph|6$9c)T>oEVLtN} z?HUUV+6w3aU$25U=@Bb2ojuh9AiRG_y97d=0>QP2%YV^Qt_53nn>v@+w#qppxu09k zA5w`l-O7o49DAhLpLns;}B6oc1YOTxiyQ=EXUH19*a>#y=LZ_T!r`p-UsG81 zr${wkQY3WG{b+sY)Q6pw%nPXBhPb{8UDM`Ab(UFM=R&;nk)9AA!9BH<@{p4YcqFWK;Xw_ z__g8Va)d=vgB{b2AZDQT2RSf( z8T>i5=QLyCIg8y`DGOvWV~ZUAhS#~Ls*V2Z{`Ak8^m>x8&#+)mpt_P?dL9y9f&!hZ zM-Q2%?BLCKaQ5Q|S?jOobl=x`cl>T+zX{QRV_w8 zXw0Ew2uv298+(@X$nG3XzFHHi-3gz`SkTD9g6z$NL4&ThZc)PV<)PD?-!%*rrjZ^x z0=;gC+@hAU?(~ZG{k2|FECsW{f8r3G)?&D6cJm6Z;8+T=10yBw>p69v13addhr1`a zmcBgwTwFdy$gV9`jF(k-uBCDQGQXafx*EBCA5VQIuNy8go~=T#%2MUtQ&SW)qq!zr z8x|63lG-*Q7$(G?go!S$Oel*iFn1{_Rk<8ES8x4!8A%LC4CN_LEJRNV-jRiJve}Co zcuL`o#9og$+%j1>f5C`nTf|1ec6f3U5r$EE1#&0qh_UHgbQS3wVHA`!aNFDPBb^-g zBbXAf^2Sm?tTsAGPAHOE<%tiG6z}!AzDO~t8Xz%q5z~b%A9dj6nHRVD%D@~S8X#5@ z3(@b)+9_=8@I~RJWO<)l*VH<6j9J%4MMJ@M;ko{C)kPn?o`AFzvbGORAhfi@UdWOzgD3G?Wn5nv`loft9?!)F`EDQaXUKxm0Fk!CVAeERnnFW3_Sg{y> zDFE+|5_LfeK=W=8)#=Gd&sbew%6WGqs90K~Zt`xOvWjmwD zTQdtQ1*N=;JH9FdMb z#xi0y3jWB1+!P2qdmDKhAiOK7Ri#LkZq|$+$Ppy~)~O%YaR)fgI5ZLiwr*bb3JD`d zjHjfjm@}?y2~NM>+p~KafPP{Yb=u0=}?>X;pDsGC8tk@8i&{t|tg=Y}AUq`Nk79VOKjz zJt)CT(3P1XwjzaCUhQbp^Di+YS$AVV_AWbL6m|D^{^^h2(O}&nY~`3 z4w)Ex6?v5-X7!ennO*^AUu2;hGZ2)sQ_UN-V4&dirfp+tjHXj_3dIzwnIb>CY!b9REezw>FFz?gA$L%g0EL-pRAPsW_uHWg*cHwTX1F^J+z?KHxcVb2&JZ zt~W)v$Kg6^8xfQ#Z%fPRecf#$<*E18#R0^-UQ1)hK91Vkgc6CRq|R}=g;u$TRJe&& zxrs^A2^#<_{L~&E-oh;B-kXi0EH9eA|6uOYn0`n-9YvHu@09PqmA*Nvh*suBkJYof zx|Qp5to9T+ZnCsAVag$0jUtaKf(EJ+!XtEUjk91O&N)GiDbI|412Tz`)k})Aq;l8T2b+$?72*#1jpW0H`GGHNyp*M_Y;EKcrEA zja;vuk)bYy1`cmNgHq85BTFvFGJ>j}LI_)ev8EG`v$VMeGCS@*bi>2tyP?J)fBpkjgeuaZZS-acQQ&zNV=!E3R zIue>{>(hO|xw?*poVd)_LS`0Atc>g!W>KJEjw)-CGi!Z&fsca^IF|Dd3nM)kDu8ke zjYV~tOm<};`rf>{$Jdb}YnlPV1g)-_sJ<``7M5>8Le5!K*du^5qTZFyWdiaG}^D z;sWSNo1ClaUf5PrGVRwIL&)K3;Bt2;-=lz=s2y>d@Jtjv5dNx0ef>&ovw)gH)0dPYdo^VKnqE5Qx>!25u9fKP z=s~D?%H}PxOey5X%CYo*;Lg#~#>U3WOEs2GT|ObQlMn__jdNFGwbqJxvLGvu&}8BtN)W6NF* zFgbg&OsmGF%@;QKh7V80y7@sN)6^8n^kQp|nf-LLq7N@>@GdQBXsikEzZTx>syK6o zDpTvjrOVYQ4?$q5lf^r_I|PPpTaX}uLjf`XP7M+x69e2kV!go6sijD&@<)T&ejMwn z+ah=+h!$YpofTskSAAjl7=Np)T5!MF7Q}*>WK1n-Usuhlp);%tD>_dC4xi(<9ud6wjH{pfJz`4RJ5Jkbrzn`XB0AQhokb| z=F(Bf?+u=o62JBu@}knn+t(jGJ+(W2s@4d~OVXtUR8tw%7qy{!JP!HL7I@7sCMs%H z-n6NPYxawMapTlaXkWMb^B@z^_f7Lmb0y09;RW&lEx7s;di``0RkS&tG$G(=c2 zR|C$k^Wcy>LBhi2e9`{GbJaE-UMa`1{-U%Fs>CMC2~KHCN=t)txz%`uhtO7xB=fAz z%_}F4%O8!CRE;3hr=&$$4MmQ5>RB$&Lgz2xZ|O?CD(vyvo9u;;8zL?5oPXgG-Rg-` zs8kH+Rox$*p(6>>N7dQZ;EJ?1KNB3hjz}=Y2@)@@>F|3qQ!~B!XbKC`bnx}h@VW2f zxhg+2;qpw0;6$;++gc4ZkN%YZh6E$)6^;I~>;z|=aY(4xIZ{fp?{28>EU2t3EU#dp zCnv3S$6B_Z=+b_o<}Sn4^K#RL0=Thg3vJL&gAf^f``&ku9?j6kOg}^n{N1f3LrIvv zzP!aM+Q;VVQgOrKL;uHN(;`o?v}B%q;2t=wngm0wBbWY8rSPIv{QZe>(XuLv#?XHg zuZCI@5)x8Y$~sXa;EIQ3C1U8zoeYFyhtW(8<;kwwk7a||z68SMxph_cM?D-kJ%pGO zlHG2%bB8T_+omKpGoKlhz%U_N&E;h&V#x-KDffr{6)5Y(!`hHh7Nc|7n)z`el9Am` z_#7S*fPk3MSiLS7FhfRWKC;Gusd7jmTDRW@C+9D(w3v~E(lJ+5ODiQkQ%6N7g^7rL zk1AQfc=2b+>Q#6z%b)!D_DT2*k!Xq0B{%x}h_&|3&}eITQOS zkuI1l_Hsvzij0pcZU8m>7%M4M+nZJXM=YtJAF3gSx{l5^ADoN^Hr`4IZXM;69R`SN zYhmTo*hEnUsc4au{W9id)n&QTd{4dcR+NMzcv;`qR|G=jG?(o4#d$W9)t@#>N(x5x zsy854X(9ebAYT<09WxPVB7?f7u7c7ySU6;LeL+H9;K}Uc(ZEEiL_wY%wY7`p@~1(1 zaWgl~>&4Jh&xV;rJbd+_%pXmj)ld}y>aIQMbZBfMXi4N?g+|PjGzAh=%-p&@l<&Ci zgdA-)zp4zUQaV6Efq~NI3T&vVkAUU1L{8G6#XG!XAT^_Uk9AN4kDCC>@F8$fv^?eA z_>@^UuaTY_$hD%)a<05$_PWYM!Ru*?UqAIDl`?XaMNN#k6P2qtg#tt>l%2$%h9=_= z2$0*FyCEC$&5q4rcdgi2b>9Cv%Qa0{+QQZyUBMtRHWD`zr#zTi)c52}Qo`V^DaPWN zXO8Ubpj?``scX)W;4lB&0@>0~3qb6&4UBGQDpi(7CO!`ABb`jBxm2bMH^ML28GVptGyJmmC!al-`3h<6uQjl(=r z{hOi1U>|P=cA9zLA2fmaeZMzfXo`tX=3UjxcH8kXQ`bsaD7Y4}P4)8BxwfT>w_p+r zhwH%MB_^FD+%jE4gTddG(($YBl zda0r*B4NIl3Tb2K*p(K9iv6O&;EUTmjT}}d17B0R%q6{@m@oe!(*#4udRLz!p*kB9 z#dvyNa%2Qd7Zz4#D7MhY6dx-mA(`Ry`I97=wYD~mD|0Ci8x0W;Gc9|ueYv<%Gh8bw*d9kpD$1Zq z@T_UB<=p|+j+@7e%q3|fKbP0xHW96}Voi&0c-rqD> zxU#^pNzqJGqpl~XqW3F_C6>abb7Lj`%@RU`M{rzDMrMk_cs#cp)|mq*|EJsF!2muk zG+I4=(}D#HZ)w)$%eH0vA9r2&Qy)8Q4gWs_OdxSn@An4KCX^Y*5SzTAc6Yd^U`|aB znK58ZBc~n)`tQtkT@yB9N&%8`SqskJJA-sa4!a2C_ersw_wF?N`;9!Mk`Iek(q7_b zftYnuMnK}q_vb#(3&=Ds@9{Wm9MGSN0n-VoN=2PlSr? zGGs|tb_HvoeDg*v;Lz8NrJZ7}MyZcL+Zkg=3|O#g;`_fwuX>s;a9yKzzQ;~nHfP3N z88&dn(VzYK8J+BXck=n`;1gHb9_o>N}Abj$1Tt8FP>A?$m61;w(RLK zak%zh2LL__zbF8h{SOHjAZ^JxZ#4h|$^ecK2_Aa^WsU>=AN)2Pzio?`g+l^|KtU|D z0)+{HD33vSl-Gd|&1d z{}1)1UP$-tn(Z>@3s;uh8JHz-;t$Q@d4H93R_Xth%>aa{AOM^;NUJRI>N3<>ltY(T zb4`3H1u6bV#He9$eQdEZWxQ3BnaKart^a8!vjJ3YXQPVSCGVY3m7M`5U6Cw1Z7?Ln z8woTNU#8OESA3pcc@H{*-AHOr!f&iKbf00bTys*eI-M*79_Unup6jfDyMkVJh)2?*5N)4PdBle`K-(6ac`ZM}sfLareGo z2+hA0G9Ht3Ml!fWh0+e6fJSzKM1|T8opTP4bVd@GN>nOCcn!uM!T)KH!e$IvHEP5F zH_@`WPdTmqm4$!b(oz4C4gBTS6u|ZhMrjU|~ zirQ)<5^K1^Cq+{(0Gvy~87+osHkLSdkDNQF$podNM5$gl@c*)mA2LYy!$rxGAx*51 zm90bs&zv-K;Gk8BP^ehq$~Dc{Ikd+M4bQta@!Ps^(ZKnwUgQNAjwtIaI5^S1T9jy=C7tfi1jo--DDN&}A6hk8gk_@*QWr#M1!w zf9i>cg+OJh=Hw^F?<{`RP0B`34Ey&)K{j^+@>&2R**G#8093Yfti%K#B_9-B>_+P>Y% zjYkLv2#ps$<@*cDuSwyZV;@x5f+eYyCf|c#<;)Z&xwfvtM?+PsrKwh-I=EA%V79N? zu}E-ucZgIhVFmcudd66U)+t~GjJQy>=n$w?!myq1pRx95BuUkpEMDx3T-F8wW>Bmk zH@A2zdbKMAFbqXn^l8?_^M%r~gXwmX5BbkZO$Z_j`7EW{Fi^zYqEH=Z|F)iIy1C#PEtNblFFp&Sk%0i!=5#xgoP0@<~?KLpp6+bK(9_S8`ITA!OGC+ou5OH3S#77?XvX5$ zwhj2Ve_CW1s0{9)eE2ht<1cA#{EogdaQ@TWO=XmopkKnPjpwYXXSVkR*|P-iQpog;gZeC(t-roNw~C|j89c{ER| zKdu5O1#_rIlb0y}a54}qKrE`J!aUp@ioUopezuO|+l)15(c#nzC{{wE14D5omIj1i z;5kbJN0WaQ7_{4Dn$Q5(34&Py@k0lUs5Gi(H4)r_rbBy*w5|E&(F4dv{gc4e-d}*N z!w2r-nZQnH8b`Rr75eR~;P&_51VtVBI0eI3u534K2aGwxAK=_Has&pG_Xy|Uz%#Ij z_ecTbrcQhMwhkZw8|efHjjDywkx`%C*C%OodVn`^KU9|vT^TjUIQV-QAzH+c(9rMO z9c))#8&4}Pg>z@Ffm?`TKM6o(b0SsjF?z28&DYcs&&RB~zO|vG;qvQ7q;PV~Qre=# zv0Kbi+Dg^jSa&(X{jhkHKkrw28&gRVI1-VSytK9xZ=?;Q6twVT@wkYG3z}KzHVP8v z-tumM-QCG#j0EE`{vZy}DpOd)vO~n2F%}_02Gl!2ZCr_c#d`AZSiMsg>(G(3`OpTA z$eF9A$g=x&#sw76n9GdPCbLp=5g6kVDPi zpg%#sL|E8ZT3ee77tRqMC3IzT*dkCNAFA z+Npp?3Y9Let!~}8Dy&D`;^5-Ks=N_u+QYXq(qFpT7#fNSDnUi|vr35%886M(q^ubq zH8ABx>NwL@__Oip*)vy^R=xawA0BuxfKTTS?et`Jl`(pBFMdd?eQjvw%VT<9PkCDm zjV|6g@p0}_R7=az*3sUJ#9tX&8u255hjuqX;3iv^gMUe^Aj;d~h#q1_#TrE@O&eE` z5Dnh--CRG0(Jp5%5B*#K7Di4EkYfq8Qk4vK=s8yWfRVOImj2*oG@?Ygk0S;;ntP6b zMAUz)_YtJQ{<(!+G&hol7+)-|nUu>v&H6Tl4&H>>5l~Xv8aj3oAcpqbCeYeehQ1W^ zAg}Mrv2xOYKC9Oa=9wXCYx1Q0o7NmcHij2@U>a8jNQpTV3W@n`bW~3(-~J~^vYMJ& zsahqkUEEd-k9cWG$4Li9f*wFwZpBvszOuT?3Lr1onmQAeRyo;-+1dM#V1b8)l5%ya zajb4GF|!fcYusHU#lGB9qbl<)?`XUE0`WK0fmiUSh7~kda+CmD60$J&M+e$D* zF{*NVb#m};K`x0o1a2iHC3~6*_vmFU)umue4D4&n>|~5#V*-s-eK!mMa-0NeB_*$EY+@`qrgKZu< zZ|%66R8HO8yI7&q&G|(2+hqxFwE{?;qyV=VikXQKX7mpKJGw2TUsJioZ@7G8H1(|-dTn~maC(&T3 z-`7b2-=M)`2{I_fsQt~154l}qiIvQ0%3CC!j__;>w#WMIDRWsZ%mb^e;#e;{?Olx= zhbNO#I1Cj(py%Azmv;q7$2_NO-s!CU=f?*bIXO5u_&ZSkZ~Rz%iGI5(SF=dm^F2>q zxgf1O?^AxtapuQ*|2&#&wj@bH6i80*3>ovbcK)oq9ko^-mP!UdoPpTqX(DcTO~WD6JGqB2^k5V$MXqT zi8Sry9S0BYV!(%%DM~4MNqLFcj!&mE>E{?3Hh(?*Ox{4Z$pwB#1#G&L(pA+kIP8^; zw{m^VG>i&@adAH`&ZsacYv8)E^-!O8-yYYeE1BS6q@ic3h@T)s)sd_Q(sVJtiz(s% zswZLT!83UXLEIQgX-E^!JXedaiRnm7Gwxe9LP!eBt*n{!M~0MGX^0WsoFh zzCt)Rn)&1=-t>B5)C z_WN0}dz1W*9x|ppKc6}_FFK!LorX=@+PBlCUaR^O{`&j!s?K*G%`bwXo-U7jhxKR~ zdhD=$ z>4p{J!+@_}^rMwCrK#mk3#!J20bh4@CS2ZpHgXbH9@-vC7e?T+i>c0J zT}da*i+z9ZLB#eUt4EN5X2V=>H$6_LG0Tp^dZ!@%B@l6AN6nl$u7J=VBI^nA1{z>y z^5Xl#^(;^hMz+_FMxdE*IMj`$$MW+ka?ywzL*i9Mj`sVbr-`MavWw$GOGQmhMn`gr zBTXeoGxFg*dc+|CrAD52F*AD;OpbmFst^F(Ow`(~@%b#(EL}#AntpV_brEqtpEooS zA|9|$&I?P(FO}NPf^Si=wBZ#gJV+rG4b|?Hk1{-SSz2DNIHlR;lZO;nb|0D@?@~MJ zN=cFn%h2$-o;o`&&QP;Ey^*zPb0d0uSqR=iR8Y2o@S3SPF%8z~_d2t-g`D4ictRIm zfr0Wp$*gy*8*VH?V*J2?Nk*Uk^8c5l0xWABfWQh@C|)!=ZX zIP{drWG;VGRs=PxI@uis)dl+WQ77+_OY-p8Nr(Oq*~y<1^m_TK(P5K)iR2rJ@oCU< z^SgauSG)4NUBazh%dJ;)4Dk~04_2rEO@lunKLL}Ju^sGbS&Q|5dSM_j0NU(`{W)Qq zfi5f6E9r4k$yEmDku-~-+%MS^%vk~e&3Z`d^@H*=+`cOt8;iM zcN+O*daE{iE2kQ288rXP`EKfrMEc^;|4=G^WoZn2W6ys14QYO# z!JhsuHvB1Xwu1ftzNsoX_TlB8)Z#bWuc!o?_HEYZ;7;^I%v}DDqb}i;FU94)fDiF3k zoUs6At~}6AP#D3QMaq=Vd#jY+(hz4MRnzEnGI&vSR8-@Nmej#gc?-A-ct(fdCCxLjE~|s77(T*%W>C>6!f{ z)zk_vJvl2*OHDmJJzZU00RucE8VR5ofJw#yeqif{Er41FkSC)(L0|-bzxIB7817Jv z6{AFsQWUAOs_x|M*q~`wf%y97JN_2|u_qYHst2?`F=FoX7sOZ|mtDwbw^_!Z1*;M& z{Bg;8h0pqi^MBP(%aiPDGM>%MxdEIN{+GhnF9gB^Xrlgqim)}*fYch#W$4sN;y3dS zl4`(GCgAjonwu?1V6d|25u#}2KX#|X9@3wwrhMoPwS)jO^dI>(^g3^-l~hCob>%sG zJARu$SuCOtGg!zCIeZKzp5{UYUVhWdZv#6z`xJJqQPqLzMF`CF)z_5R`iD0A*;QrI<6&Ri;Tn4I)E-pU zCpD}nW$fm&5#ie)87;_~fXUM`g02lQxinRW{DLs?7K7|*>994CLK?>sX-;K(E*4-{ zz+RYO$wXaJNo8QL+%QOn76Z?!y@j_XRuIAJ5h?}K^@*FQR=d=JE0U4H$HO^`SkWTH zkGm?IrU+~zY%inmnW61LB4%RCUxMgZTDD^mwC-q%;&qj>zO5;aOfX#hkvfii-hVM` zukR#&7Cr*diqKN!`il(1$OOt>;@Zscx)DlKsAD{9nK+P1%BzEi46Io@4M}IY_2-bz9075vWVIc;k z)vwhwwENjC1!;r%GBQvtVZi)Iu9^M$l0^7`94>_gHr9DH_s?H7NgoFh3n*Qz_20P> zxtZbT&w+!5fz@z;Mm;E>vhG?Qmfq_(kGK8)fwFw6I7y_v+>UpwFKXtarY31-Cn#>R z*dD-V@cL7Ab>UDk*g1*^TaK}LF=g@G&{2z|Vye=zzOI&<4v#m%)2I9Q!J(d2aMq7^ zY*~@I7%tS*{Pg_Hcw-6F8^g)b(b->AL~|0%_mB|^%MeIM2O1NeS=w#>e*|3EdHL5dbdst;Il>Ip@e{$UN}U^s%| zr=*w?i}WzMBs?h~Y(bKe;s%Q)I%JD%)aF@A)0)f3sFk}7d)XnHq`Gj!_RaGO?cPY) z6~F+C1Se*Vi^r|95{sQegzVj05V?f!=TdF%9Ko&1kHY3V@S;Rm2yg0wsb%!Y8LYfR ztI=XWK+Qe}*-FzuOpCZNe#F|QHTGrv!_`Gt>?_%?I(;!Q&|HckgpgOlEg3mUv(A;^ z#Bo`SnhOM3mzcd9em7TB3I+7&)NFqHeY~HdI6y4kfR6gl;iznB zVP}IdZL(P_My@L4=h4BBu~Cc^DZ->6@EK!|Y=2p-9I*=3ImG`laHUD~&+(KKv)~fO zZpS!Jm3<8>W+%pk@1toFo-RTSUd!SrfkemrOnOaR99avK!HO|M)`k(aHvR$+pRyQg6)}BX`lF7B z6WV&6L|!Le1fC(`Dhb#I-x{`TcXV<8W5<9L5$=BnZ-zIO4di+bi>Wce4jb5XGx&5< z=yX%qWJ?en&^}McwMg&-Rp39|4|jIM85ow}VDXVr($i(v2$RU(uV-y`qo$@rPYj%} z%nY|CG-nG~6@vYrBhG#=1VsCXEzQ zIY^HnAd*UhfJzK8bT>+O4nq$i-JQd{gSS49|97o>t@r-;u657XxvuM+v(G;J?EGz2 z3STh^K}iwTHISZ@`RK#<;SDsDafvG0UB-hSOfyVPKb0-mR6ht);r~SGzNRVl$R=7~ zI(fWj?yDN(w-e3(FEzEe|r8;h&HDd&mM5}n&`GTsz_f!_GscVlmLL4iG| zQ>M+G7gOtd!wB+de!j|du`HkMJ!Qyk0~d0<(al@&Gq;MKHA z%SCMH4#J-#33XXaKRs(v^FgI{8BXyh@k=Z+a2}5z*)Upr0znyFHtu5Va``QbE~~J& zDPOjxS!loJXG6UX`@P=8J`fC2$X4QRwlge?<>!A8jVBMZ@1_~<%+cO)OBT>Hwu7X# zedN3p;vL{HWFD6&1Q+RhO$rAw!i2X-sz&mJsGpSd*a)shN9MFZdBnEuF=(RXXe|?w ze96Q%Y`oK(ywvO`h$IIJ=T2kgzGs&en{<eHP#79G2oU5!u=@>u(0e zqHuoS(o~vB9>uxU0shc*HMG$a*7*aQsD4UAe~brk-gNs+CsjJ&Ic8&1t}t(rihXQ? zth#Gv{rScbZo0ChzA7BSX!7bHZ+*|#9#*08O-yU7Mj!%dME?bnjdu{u5GxY$B@0XF zr6?wq^}T4>I{}nysrDoYjf|bm@T5Zilfj?x_19M2xgx%NusmQ-^ydY z-fG#OBP-_*?y%$IPNJ9J#T7skLmw05bm2%L4Ui5%v&~x_QrHdVB@)O~N0}$=YU2(l zLD|vOmV+~9hVPLpx_5Rh+LDsQ+4jEQbk1Vfxzjpo9whVVmNxC9T#>>^exB(!5)Cg3 z<6>u_KfAFbcsfZZa1uw!^ijsoJzpq|93E1<%qiw*nL@>5xe_Ff+|eD!#Ua8krp6Rp zWfW~gjJ_=TLhUix@yUB?*KcX-*-&BLyUtbG4*nkZU(KxA|pZO4U zt?TeOf2;TW;xLs&zBS{))9d0t+N^)YVt!dL8*c%NH3U)ctvz9JrIZnyr~FXW$L!0@ zO(s(o6*!1~3-udqWIK#-^!2KhwD$b!W1otJ`SePgP=XcDe$D zqp40jnxh$*(Y6<6O;p=0?i+I|8M=D!Xwc0x&iG64u%A(wJ$iEgAMG#vz~DO3sX&?= z<|LV_JoIp?Uh#Nz_YA50(L4&;Ksl@7`@f>IRvO;-ew)MBvFo6Xj>srg2xN6+1l?(q zK9Z%K2@r;Z!X-`a;JvnLw^a_N(Om@5nSc{`lqzr$Hg!b$wU_||MQat$#%OEI>yI7 zhqlz1e-?#ye;CsP0@DhmzFyerpM>3qG2q7e)4jT+E1H(pV2z#ZaQ_2n_RERDh>osX zsoO?`di{yVGhn1nO#Zg1=R0xbC_{-W7p%KI z@wF9EzI6Qmn5Lb|hB>S6r$L{@!a9YI2J|2Oq~Vkw*qe)@>ZoY{vP{tpCR8`nS!bN% z=Z)l{Q`vNUoD3stQ~XP(q#p!a+A*^G&r*#4+6Pwx?V@23fpgx-Wl8)G2;#?n($Q31 z>^QuH&n|Jz@hJLyh|xi~LgT-zT{IN*vlFe{i^O~9QK0RY*0WrbHR(jpJ#J;)1C*j$ zz5}0-y|oFJCy_x5n!jMmC?nDsHBgPO&k;5>l11s~o-?BZ8&3n~l@*ZC_&vxnOQAaP z-@*24E^#FoC&Fe|Y1DX$T>0@8#ZH5}$I$i+d-#i!1(I6%TL8Mbi~nz9x;mx!kaZ^Z zmB^1cHP13E3SL>(1_DE@;7jb^xdw~aL_hLiV&%9O(g1=2*O|9CfAf(zrs3afyng2o zDE5EIsxp{@xo(;j{ZKhS8gbjC41WA%-4QWz=jU;Kb}lDL7kY-aE)=OsH7xFTp#5q6V3+$214 z9kw_^DyE_8X77p^-(6DtUb_$G*y^#$Pt*__x=j7Dhki)DWw-$6GgYK=qtho%?t3@} z^EzeNf6r80dXTfA@jd6&fY+pd5jAQhFEmqS_ABcZA!5W(STUce3r%-P{NKbE2B2Mk zS-K28LYo<^4yq6FSi1H2&Rg7nkcP=_xOh$om%J?UKLqOh6CV6KLqg&tO5_{Tr#*Y` ztnkBK$&A%2y_!?qDldbyITV4(O=^NVl16my#PlyG)^#3ArR^bgpG~R=5yCO zcbKjk(vFHEpppq?CzJ<`kC$%~b>8(F#|mcm_$@@Lz(>K{m@8QX>$U=m_pWq-$GXJt z_o&!%OakrD(dshlx4sqK6aSl~axE;BuJ4mv1>pVYfG;ytW zrd-8r9#1bx!S~Fx#j`vA@Gvc+L&1N^vi~p>=-;rccrF;r5y+e4PSP-YdJ1s@|1|wz$FzU`iH4(<3INa8o z^o>6|kkt~M%S%%HEyTnzD|6iuuDxhQUJp{>I9L$Uekh(MO2*+cKmC(9cF>-C6|I}} z(EoPYG8%`-dHCsHK@5lPXbHI-gL?LEV zF{(5W_;gwcpenm4i^-(n_%%=uiT&DUZ$CyVXmU8nK}>7}R42A2RaMOK>I**;le5py zM!I{RbBmIo+nD^XWzR37_N- zZ{^ZV@K#a!;U&L17`RSftTr(Ny@Y-_E3s=SB1{SEeKESRz3L=UK786z6`^A>cGIyl z3O@=1E7~{*18=K)KC;=r;)v7zQ1gt@brTo^ozd&Dk1EQCDHM8%6$#KDlAK1j-ZWNV z!lnje2jU9Py~>-KX&UnKf3@cOox1bnNZeqsk2j4m z$cSj?46CfR7FfZW=#%ho%!41M9){;<2f3-fzZWy4MW80l>Wn z0N~18e-|47I%;56O=!7Ye^#$00jX2lo338U{xd8#;8=vBOwkkZlWoW8L`ZmbKT-GY zgoYw0zh`l7>juxzE%ZP)FzH-cY3nN|P%nMIKsm;Y-O(AZHWx?zVYYpGKBX!Dz$aDv3y3(8Lnkeqjhj6k?6$Fnkc3nj9a!sPC_o(ZF*r>{Iqf-Is<` zm%O#&e#x?_K z^)fn#;$M6D9&__hW;#tsIo{Xo=~#={3wlxbekxx?9nsyH58i`RVAvlz1rrp**GL|x ziRe5`X1UP$gv_ZXAvNc;Hys2lt9j+z z+TV1`sr`f4mO_Q4&T&~sx3AJtM*90lzd0t@i(qom$vd@sZ$UJyjs9}3HRdU#!_pnv z4No5uyhtVR{>|dpcqX}bxAxC{lsr&HmwANihK{2fge-=Bq|_cb*ZlMp93t|Y!hhK2 z2KT*dwtE5w-1<*B?!T}8KOM~flIg!>`oCoL|L-gj3Q(HH;^sM&sZ*cltXd$!4GfLI z;MR9RX9wzo5-M6IhYGLEEE4yCTVtS?b#3OaRRk)nD|8_vNvD{Y;Q3FK#wk6fm5F-2 zmgFtrJ0<1XquYXl{A0N`8?3CXn;`E6!W$UDVURCxqaZ?)1s~kJr_=iT`&;EOs5wb~ zV9E&JApCc?;J>Bp&v=Y{l#)I+MvE*M@bL~N9YHWf!tnT@wr!5U7%fe(NiYz7uhw{y zj;}efejvMn9q{&E3wLj^)ghLhiw6z#ejtaqNe8WslPsD4l-}Xtp)R{+S#BGhnDg;! zRM+V6>{#*}r}uRt%_Mb!9@3ajD{>;uRJ4~TT!J>kZpjnp_+otSMu}QwMZ*cFVu&vg zNL_t7Kgwq|>svri0zt);VLgf8OnAR;2Yv0$ZKehz>4HH<6V3*1upVZk=iSlQIw$?TvbU`Xa#ccI4= ze+hZc)8BdWnfsK4=8`6;l4}5FYiSM3YkO4TXkuw3kJ3G3VBSjd9OGivupL#YVt#E# z*i}28wVrnlsr4G+bm@a5axNAWy?cG(q5e=WX`PST%kgJBcm#Q(@Tr*zd^h$R1#QnCp0|WKLtXI!4#cy7#62kaSE=YW}leC^n zhV3%FjG?3rVk2F%7hF#DA7}PvZfC=lK;oYr2H9;dd-f{3n01Z1t@T4F+=J^ObD ztaSaVixz{noq;nUGO@1p}7+64hO$(B_g;nGH#fvCum{9e`~Y z8iYb}xy!)Bq^`7Q*4R98tmTeQnHTab@7TJ$jQ?bGV$)2oYCC7`ed@h$El#gTCSf5i zN9!*3^B>(eDr1wyho1C(>k8|c#NXZerDq5MW_74opht~53z9`1D7To`Mz$x7gq8No zX_vPBQvUFBdtzntns7_RcN-(mpbZ3HYHekIl9j&fv0;ITkA|Z+Z%^*5K{uf1?eX?f zU5aUq;)t)Wd&`LTmaO}{dx)-oX(1=5S-tew*3o_3E2Az<} ztG?hTVOl z6cf(1i&}c;ps*3QlWZYJDDldjdVk+0bbopN#y7)_nZ1bZ17KOx!znV|Pdg2hbE!Vf zTSRh(l4dhg<4Ngeb;^F=p5unN(gk%>S=e1Dr$n8H?Ri;KilcRbo}^f=cIf#F62(;H zHrh85@6Z=vv@!k(es!|sc}Ixd{|rT`&%$PyypIc@Cqe6K0nX%eYRiQ<9STMhc4coK zytcA~*U#uFl_MWz99i|)FlamGu7-Lc=Z!KqvJH%Urfi72&7Lnk>`RGAoxnxy5iETzPi9H*m4%BnHfBrY125Z4 zT<-`jP*-EhhQLtOVmKCk_FrK*=yTLR;Qaj(xzscTJJ8DJa0AW>e}fv96G{E z^Wq{5CMB`ZwM>R5TNkt3>1kHgS`8NNO@fLixi!H}8v_TujZqp27bLZsMaL7K4Ep?s zK4gH%wFqp?@6S9oCG8xwa`>k2B7E}u!IGo5Q4tyRO#@WhWT>W9c`zQW1DJ~+n`&7b zro7L?ckCsvby*_&<74UYr!XomeO6X#LN#rt*)NNiw$*jv=@=ac6HQ-~HpSJD34X5- zr?PuNr#d+f)8kDRtD!Udc<^wpL;ul`6Y8c(ynN{a=G$|(o}$Ol1gFGxO0pM*rmiX? zi5SS$vXa!#S~b-!=M6YG^Xfr;b`B+pie@Ig+3{gGIC5t8m-7IRKoyeRfU>F@JaHu} z-J=7%4n;8IM{Yo4S1~5EEZA(IHAgaw_|%-b?fIBQbt&i7?!HTzuc4!lXE-;lZFf)M zBTaB!vo+r7X9HxeI7l@t6d1#rE_QlrC4eMET4Vz9z+`Wul(B2^_;Xjy{Cis>wq{&C z;j#KDVyAVybUucIuDGdW^DPfVVU%P&;mQCjrxyCtIk`hd`HvN$7#?p`NQ!4?j~w-q zo9arHkd53XRvO3?A%1<{Hl>d|;PdpHS?vVZ^VSJIi0go5RFH`G@@UfL2s$gQRr;Mx zE2g-b$Iga(6x7kj&H$M}*=Dr3>Yc=R{GgM#2-1pD=la0qe@Wv225u4GUb;<82|0av zPI*gSv3)Z9k-w??4Qy(U6crL~brW~_H|(J@?PK(3t9OzxAghhF-7cjK7plH1OO^cz zpfv$Lw-e4)F$0KZq}8eSErkJ*v6lAF6w@TUH77r4;Kij` zD`$>u5c-@}%-kgjCc^{eN&$?xr>iFK>|K~ix`8STla5w&;$GNI4c_417DOvsG)WlB zaHKV)4kC1!5^;3WE9m2wb~O~UttRmHAiLkQV@h*Xx`$-cc3H>*c7dwyDXs2JSGyyu z`_;$xs~1((^r*4x1ps6y#=8b9S1pq_Ai21l-!>ll-utjDh6*aViT^k$KOQ<>?A(9& z6NsZYWNkI{)jjt)->iiCPY-PpNBu^pt54D^M^C*i&SPbDJuZ)frNGWr_nX0;o!G*P zCufJjaj>tJ-n#{A1?j1|4UWD&T$S3IS{`v@HI}j1g_GRB35fPUi5u~M<}iGa07^HCPL@to$rC^fL=J`iKtT0R;=04ptOu*iO|0z9*6RvTFXs-)+@m^J3kK%@|hWZheu+l z>?eyseepmq-?h@$VffrmY-q1kxB}Q}wW(^TvQG86NC7{Nwx3y|^{(aB_i2d}mdy(d%GUHf)s#DRokS7YhU|ZF z5-32!ezTr`Bu`)@-waQj`G_N*+#eEsnpgY9Fw^ipsN$`a%I)4_OmWlyJsDBWH;s+i zuUWAevp4s#BNgOZ>r60ujV%ODWy427ZS5t8mPD}R=WzepES9U?LQ10=LlqNVfs{TD zGZO`lJ}Scf2s!C%fry3PFtn7)D?55CYXuE+*$UflZ_XiQglD7Xh`(OUM()}SwO#(Q zLiE||jR!XtqKKA@F!=l^84w${y5{^)j3^733aYFhgEMMmr z6lhE{EY_1@a5IGhG@Jb0&qc`>w>BdVLGGZL@{cC%$2sYRFC^<0O6w-|rXu7R0k~*; z>T&Zra4pZxJ-D{;l@>}am}XHL4Cv$|18i@t3($r)`LCbI;>ZroTBAIKe*eh`Y&MwZ zEbF@5u9!l^BTS;X{)oY++UtH!%GD76IFt6aX$oV=LTL>eUQ9s|o4T3V_#GzQh2b)3 zuInNtdbWJ`njPw<94b06#oK4wF`D1-y8tW`orS7!$4%T5lNAlodXJOUw;>ds@9Ws3 U^twxL4D|20tddNjlySiS0isNj6aWAK literal 0 HcmV?d00001 diff --git a/windows/client-management/mdm/images/configlock-mem-firmwareprotect.png b/windows/client-management/mdm/images/configlock-mem-firmwareprotect.png new file mode 100644 index 0000000000000000000000000000000000000000..1e315bc4b1328c55718d5ff483ec932cd3b75c5c GIT binary patch literal 14066 zcmai5Ra9Hiwrz2Dr?|VjyA?0)uEn8Pp+K=>#T{DQ-QC??gS!QHc&GRNy^r@8BP1Ck zIeVX#C3CGgcesj@3^D=%!iNtZkmY10)joXqr~z6dsF?V4 z1iXQ=5>piW@S!>e@x=rhcn|L+tK<6N0}j={$45CeO7Mpd+@W%kVqZKB&oUof^%va_ zUKL8Ncy^Ot*f}&FA>+c&#+KwVgVfben8(=SxsSG#EC@>v#5-S_CxxmfZf zV3A~n;`GiY1!@_1{YAPF=W8V5!qBs~ z=^#SI;`|^gQf8I$fl3KIMo7 zZ&Cz5K1*^Hgmu7=U(kEb|G+JgfUK6V$H0V+ZMiaQow(GG`WXm5B+%$(iDA}f$TeE+J+AJSd-<87K~|tc5V8~NO_KtD)-i$X|H5Yu%%a26uK7g z$TohRfm-8)vX!O*Ei!=fpf2LXy-3|@?os%B``&4Ahg#}2pNjj8(Pq0O`V`;6Ccd6K zZGAWR@bJ*r*SEX7J2!__Q+S2DtcUp)UHtZ!vy%UMTNR3>eMU&ye*Fp?CptR%=KeM+ z5~-4rWpQzS{)?7twZ7BM;n@)#J+rBpW+hkJE1RI8AU{99<&P`H<#c$GafRTReKF39 ziql3rL--j{cz1!4&NIQBO{p`|#ww`C$7hlI(gQ;wudDWZP-%JT@R)2&Ow6EY^CoGK z!1wRpXPJ||+XayN!QiRBKHfnMY>l^$w~AppFNNG?8c0aUpr9ZL35gtExrYUNN2ZH$ z!HeqbMg&927K#!DL{ywM+xadDU?t-<#Lm|<*GZw|3a4Ua1-UAfrU#9}LfuptklvolQ2c9xp-$rhbNiTa{k zX1+eP`$VRBg~ScF#a8>D)i0WvnjOU^*L68L+Bf-NS^wr}baZqY4JGkA+}SZJYdxvu zm_-uCoqFi$5j;y@6 zl-R7;`1scep9>Y-s>I>3k)cu7DJ2UF3r|m8r8~E8gEW2j_o#UV%M+O*&zFNF_4N(x zP~Bu?JQe=233wuWT+1Mk-|cnj0gFEE(C8p_HIzVYZS5gDBjf2<>bD)!okbppZ|?5v zO8o$t#-VWs>BrH^%ShH~0E_{bBp2f`UMZppEbM>oLMlRTUM{ zdI$(t-@p5cONeg>TpLPT?yn2Tco^k+LGcR+zz?0DpMyY#>UR_r6me%loH00KuWeX& zIl^e;5!}#Jx`_WAfyPs{wR)sza&-^K-urC#;{7rEeQzz;H9$;^QTJdXyVLDR&0X;f z_3e#hGJ`M3EH+kk;~8}Cu-4|hceUsLGA)uR@VZ~`d^_n34-11sMtNMG^h-)jOpH&zZohbsVd-q^o}#9vemmCc zL_vasLqV`ajk9b7y!d@5=56aVl>=DV`O>*E!) zf{(|_epeTH*L8KAkp(xe+Yu}!^rde*#f1on2u;-7)cb|XB0_@f?83r#H_Go6+{{Vw z7ye*jxsH~anrul`1x8vpm z-pQ!T%ggsGmiOnUWFsJZy=?&d4jY1NBnr8_$P{`$*%0h(sTmoyGtz(FtyNZ6SNDG$ zwZhjq75V;j6Gh0gyKT2vktyPz6)@|9B>UbW-HKXXTi`^tN_V zXf$zPoggZGU|?W>e?KWHsiA>;26EZ(m#wH0 zsQ2v)zx2%b{$T|z=ErB)&#n3-emC94ji45JDlmik9itn+_eM$FITx^!GAm`!vlEKV|kk9$)No8liWm}u` z^}bcINPT`m+s#b)))qQKE|2o7SQ647O%eZdMv3>eN*-gtqVgzRmU>8vEkK=4qRd!X&cw$xufU% zbB?cdpRlpNu9Z(W6&Dwi1y}jo+uD-fjeY6N-QTNid8PDHE&aRlwaBn>iQ3bB*u%R2 zODmnH+=VtN5A)dM`*|>~@B^5_D_rrS;~FKrqOR^{<9+9yPeFkfAD#HE*2*u0P@?d09f&5Y^~qb}FUS9SrK)~@pTjcW5I{fdKZ|F@TB*T}2+QY|CDy*)K6cs;j} zEImWtOR31RB3eg#Yhwsz{WhoVJ9+ZRe-v=)6I zwq#h^uMpJPgoPhx3;hX*i7V`9tvjAda&iJ?rSEQUZ_Rx;=JmK7g?rOeQ`tm{u0g}O zGSdZmmwI?5>mkQWo63P&j^1LJn)N|ClV$;HqaTM;b23l7!iBa>wuXm?&%P36``y|2 zSP{}7A|MENx&-fy?4@=19?45tP!;s|55(qpC7-d?935I0+IM(fntsU>VBqHA>Uf=4 z1@daE%j5N*uC9s-rC)G&Gj09s$r%|>D|VIYX7SYqvm6;vWv`pPsPB_N0?eNj_SuQz zd3kx!)Y4Shu}T&O%)J$un!2pV);*%6&(poW)2-XX4!MdvrzU z*fz1Blb46}&DPF#L-_mCePz}SDqKotdTCjS;3Y=BANfh}BvbZdvsW4ax3`xI|M!(; z4y&cMwdFQUBBH&M9iNNy_T|)OW#LDt!G7*27`WP+8unNrDTbQD9xF4Jy>{y?ZK-Sf z{bA{ap0|^W-Nem#0Rb^ga!=i42TAbFcnL-0Myvm%c0ke|mC#U7|M=>FjP(G8o5R-9 zdfKx@8T1`_#xB7!?$q1MTF?I1`@~TN1xA`rALQJPoqqqa{OXPjY2EFMxH=#$v;1*< zVr-@?qi@C)cS6-Z2C0?A$CRCh4bNmYSYJZm_4PXdc}(#(KkYDJa=`W!CsxO zoqlTn+){9ezOkmPQJ~*c+g2CJpIs&&E10pdPCkp z2CqW?<6?bVPP+#O6h3z)pfoFyjoDc)l3CRIC$cK42hpP!hf<{c4} z=Xd}m0|NsO4-X5AGN+NDA#?qA2?@wFM@PrxaY5{&)LkKutGM0ljLoAMi;(^hDj5e6 zYkODKTt3;Qv%AR1$c&6nsN(?OYwD%sptBW7hC zD$fWgM6XoPyu_j_?)n75FppUq`l32u5Te-t zK;-dA?O;Uh zBEt(Plosdr^CB8_bo7G#uiWWe!vM~R-vtm{UdhGTSt83;3b0407<}SD9#t4Tz<75I zo-5G&e+Zu>z+Z3+Hk%8|>&sh9BX&AEKs7aLNZaczEh|Y$nn|?HV~}eAj`*u_>+R3T z$c(kSmrqGkxH_AbMo=x^Zt~-ri;D~C6HJkMD=VAugdcp&oE?kxuVC)^q_p(-T0N#- z-Ky1=T8graF$+ygOL=))4UKu?cAu^)9&T=xmEy(cAI+v|DJr)sh#&(a|1Me~2!nIk zGgX#`AU0{VQX}7`sN1O9nX8$!6#@w5OnzBbySxq93FxebhWhneg7>Pbs-dBwr6p~; z(=!hr0Ixoy%Gqn&y1Top&Ff{)r>}ZqFk#*+!e?pzz(H;=o!mte97PH&9AI^1@xY;? z?5nISFI=8s*5|!&QB+Os>+kpQ@NoVtPE1158;~z`FLNITrR?JBIyw%#TUuLj*NysD%|C~R!0cU^J1N@R zf40!zYKTHYcEu%PBIq3GGM^>Tz=_IRJ;Re*^prX3|6{@$-^V`q(IG9jkCL-#kg}qo zp&~c8wzM_9u_8}{|ZqX7o>sR| zjn5x{E2p?sT$~>2yS>BzUNvQEaQ;yr2}v=g(C9O8frwE64-enR>>3;lq&WfYi>g`RNN^zo$8X7P7n(f@CqDOu_drx@13VwN++% zdUx!R4Xy{fu)YK(Tia*kMOKs>r6OZI^)7s7*BBG!#+PAC`@{1iIVB}(p9pnLadGjU z-rn4t9CHp9IbtR(92|KKN8!?B$8~fCUU8P1s6orm8YDvggt3qS)?Z>x-)VJXYU) zDk=}3r{!9!5eE7rPBu1Se*O@uKRG#q?Bwj!)GJ#f)2gxOofT|bhHbF0p+FN>N?(c>5Ypmp<;-R%kU7!z;`>=~vWkPDqtO=t z2=$GXjS%krk~B0lY|5#r_^PV0Hz_H<(J(R7!ygNaxgLc(+;g`6W4^_`s^bv1Qu%u2)d7<|m#em?#RgNuMeR*;jYzSAyF-Q!GWqUPr2r!T4N3qOT~ zguwf?kdzdOBv8(Q!YBb{u3~I#ZOv+yl917dRSTge9_I*0IndtG;pgTyCUi6%>-Fe` zF`4r1_Igqd26U_8CDnB>40R7n6_x zqvwW_l2VO3G$aHK?Qb_3l%lS#Zi`TSLRv;#4|FO%es3>@l9imeshVZT`r;yuurL`d zD=$kYsUTw{T0%MQd1FI^lytL1Lq$VUxQ&C&#Kf=%@0E5Qyt;J9kNnc2utajwuI$^1 z$wd|}DlUHdma;NInniRR;t(qISoAV|&ciepDk|!z=*SAjN^{FR8XBtV4D^{X@&NIK zvCoqUNlEJuS1>5#tjvceB&0n{bJYe2NJ!!~b+v6ZJqQ{qDq*;hG$y#{#5x;O+S_jA ze2X`A53&_i%cozo0|Ek6(N#@M&dYO|#-*z!#+w_>@Kf;2{+VzNy-|&g#VHrA0H(S*IH1ppOLW^7dHd+aF@>CTBtWup2{M}!Y{*j zcdtP-K|MSUO7=fIJ`@zL;=9^g z7daXa&;<_ttgpXil%uusbtx%mNa`L$bL&ZYczT+jTd=S&$Hv)p#kKsBpp{o>g+`Bw z86Qb#cL=Ojs%N75vB#s+PMM~zsP4=|&(#$ZQXDbztG@ncLoq)mCpfRs*aKs*&O-{i zblf}*14m&~5ic!mQF(h%n}L>*ow5Q=&kiOg$IPsO`Yd#C@SC5XGyElw!@BAD)%8`e zsrKP42YVI5Y8fk0-0snO`vZZ7(083u@8y9}R{>4K1tN9uF8o|5OebCUY*Of^&NKjw z`t$Rt7CRq$bhb~=k8ba;3qh7^_$L@v=+|00s?Dq-2Zm(p2zAqz5)wi#RMAdxI4Mf> zz6-hwS3Ts74m+kfIxMiTA#rhWI%3XoqqK_nvo?#I4b|ir{LYu~#dHlJEz-YsLk3_d z7Z+A=Fg}SJ*K^mSsUcAXg>|Q<>YNV8rcV1n^2aF4=ACaEmT0=zl#E*@G1W~fYvNeu zm(^hf^bZcGsaMsh#+wnM@4RIerqSCDO--rv&8|&JvQkk~)w1$b^Y8K(6k2WXY!|az zBRtc6o5mPq)cEr8=;&xD$d-y_L#(OxZm;(6r_8`Wf2;xneJOPzwcK|Kid-bFSbDzS zmsVId@yn!X#VXcT_P&8wVm$|e10gW2LQ!e7JT#4kg*>FJQ?V!3c3){6Ssx5C&!zDK zPS;LbR`@+k=DF$t%!iEZJ|^r~@9wr)BSeu~{1^W9_Zj@}oNe-+MN0)Uie8N0iHYGC ze9g;*gy$}4UA0zu5q55Au|Q}NB__m;k=AAxvXZIqU_pCGSy*U#a4WD%vEbg{-jn^< z7Ppf4P9YWCM?K6$!;}0Al4Z!z-fD{P02T%o4aQx@S#J1niC10jm;y#S-18o^?&F0b z<6QmhNWvz$Yq%Y-bGpXpJvKCAuBWb}BZfRg|2r{LM^CveA2}v+Y-}Pf01iV_w1kN~ zDlw2yVRS@WzoxckNflGd2H(Rn-l@E#Vt*j*m>x-b9x0fKE73bRf3_WKe?K9yb%&2f z0G28jF}nQW`MK63MMDT0t9+Q-Fl&BRKm+ocVe$;mAH7Ym$bTlVFv*y+m_ZNPZO*)kLC>U8oTie>wlDeh7aJjeu81cYUTiFZ`Ex}dy>>?wf zun%ID>~2+uI}gOV$y`8@t7oOzn)wC=LE6+-RAgxbNZK4yn*Fn)VwOv>h@^lp+rXiE z$nP?3yVMDmj;4j>`F?RdmEV)(2AZm3-5I~pWQy&v9*-D5enwT$-Xp!mzj#uvWX zEV^QEW0!wU%S=e9GQm>0_3H5e ztB$j#p#_JCNUqP^%BuRa%5W`2v~uMA&7ImLt_l|=mFj&B63}MOeOZiKpsgH=H`_7G zpX0i8w%E(xF*7@-Vg!8^WLakCjmT76VeQ{CA^W_sa!l{VD@+zJmSL-Ka(rx}#>!4E zh!kH^YWI8NDebwL!bII@Lv&rtq0Rjo#tv;BA5+&*lV6att*%M(5*vfySB5q}kU(D9 zg7PN$?P}G-^4Q{#%6uX_o_^&JEIvIy&75*`Gn!GDMUs7wB|c2J5vBfwPyBa{l!P}T zBYI7cJcBTmNRXa($V~Z*w*DC00iR2AMAOL7(CP8{-xe|&^~5P%GYN{-kB@}(%_y)G z1E(xZOfGC&KVRb1)MRTJZIOtoO(v_96_u(t=jP_v7b&?5Vp4M$%bi*!iZzy27iX8x z4Vm#nSt|Xz+rnfteZPO#*%?Cna(k*UR$|z28JTXs!xn@uC>mJU0!9<`L97|68*Of}eMG=bm^y0+L$T-M=(e1*Jrz3vn8FqKvn zGjWcM7x&J%;Suf!-ykC~Gcw-YH)rG4I3E(?k#<%mB9q55L8Qt6jj~vqv2aM(^ z3Lc)FJDUrz{%Nd?sm^zn9~wy`u%`?g23toi46OMNxh3dX{}w_gMEeJC)Z(iN4JnTDEbd-^+gBppl4aIJ>M&9Ku`JjQ1Mczv!EiHN=6u3DINReQtuHqWrK zv~;gLe=q;427%v2d9D5Vv%I4+iSrPGQlJGH#YdILR{dF^dZEZLBc7}++&5WTS%$)f zCgI@1K0V``Pq?{%!;f(1+6rBVGxoAbWw-URNktdE!yxPv+>sM6^xYgO8KLI}Lk3Ae zWuX&BBxGQr{6r%x1@O*I2(N;I{PO2<7Dm(E0)eHADjahw%XmRJA74ouNF zJ}%BMJqj+3dCC30CEn!fd@IGH)8nrbsqBpsITeV8?d2u0(PEn;YrerqF^8N}3U&&_B&b)^97c*C!F%34MKXJsijHff^pF0^u;1K2(c1WU>!MmxhtBcg1JE7?Z`Yd3mV@~KO z+^C?eyrBwSUtfpIatQ=qqY28-1uj~n@bfr=62AIsYiob`f)%K&q?B~AR3m15?Xd}^ z>@R?jWw*pvTRn(VDK4Em-PG*76LQ;Zps)WaFj;wD5{!+FeY$mzCV1=vl$5?(G{IyI z4Gjw`EAB>4WjrJOkGkGj7Q!&I*!wh;e)PzT>*3&qw2afXXvM4 zFuCVrN2V{9atL6G{YE>~q)h<l+UHZ&w_Yin!aUN1zkzBLpP{cFON*TuzkRp5^h9~&EMR}4KVGw5|gwnnVU z<4o69-d06L#nmErX(y)FQ+CO{Z3Dhh@%^2Vs zD6K91Tg^s8Ll_YsAGe~rTI*T^3Gu>ES|TA42*6b*7B;f(*yM|g11(*(xTGv@HZ~n~ z1I$lYb4zn!y%k6J+z@zw_-CzAm`=C8VYd0U;&d<0%?)j|@HYi!r)Q3jjGUgFFjN*f zB_#k^pxV>KPnbfey|A${KR>^zX=*QRVq^^HlS)cUBYyolCc%pgi)5r{K0iJW2VN=5 zA|ayY4o$l5won%~@$wC~!xxp7=1&xw|29gQwnpJ9*jz3pHtpVMZs$8oGt|@5OF1ZC zZVvXc-=45Zwwr(WPH5{#u$2UK1BrXsbEBif!*ZXxHakFX3kylrm&1wqiK$06pq%mW z;bNfl?D%Ktmz=YK`ater{XmnjL!8n^ZqG2wd^#Ao?-kQLJK!D&)f(_8p43k?v{E4lA0NJ>vji6)Mp2DU+pLB^QIMC{jC?PJD>8-vcPDXhu$sFGbAD*6?lOEM#Y=)qDYZOKqG4M&c+omun-~G*vljwYT zodfv5|Lq_(HT9f<7^-87+p=g;uPUMK?dfEH=SMn^qqK~SQL{^Mw<#90eiJJzE2*Om zCv0ji>BF;L`a?@g3qUoXRNYp-9ako-bzWy?zwFXHuNl|kez@)FnVOnnsBBX+GMZ#l zB=dX9>9MM++Fk#)kvJlr%eVO{Jk&$a31fDzZT86A?)4SmZ}O83 z+d)b$E?33sg-c!jFPDQn4r^Tv0GabM6CyKitA3L!G?0SI)7sXyCtz6a{vB`pOrQFI zWC)PE#5p)PXjXpfdCgX%qGqSX>m8k#n5eF18#_5X>|$*O(!#UJaTrT(_ zrss!;v@9}6yg0o3yPKQFIy(5x-yQ4iIAwn1QhNr}WZ3I#Yloqt1g)*k9z^f#z#& zZmzGN@h_Up*`P@X2ul9NnDZT)uOHA$1Ery|yd2=}ZSCx4|J5rVR4iX9so;Mfmuv#c zQDtQ%-NVw-QeGYjqTB`9!}+!)_DImjQdU8r*?Ffh2f%|DqLz0jPL4 z*Vl+hNSq2!ySwI4${{=oPc1F{P#b_yvCt@3O1-@lu?+P@jGY_!YFcDcy( zxwq0hzZ+fx5v2(t(Z5dyKqO8}h49wY%k8@7v#f(Oum>6Ug#!1@hs;kd+G%=UZD_ zKwSp%4M2v&3DeLN0vttM9aeX3sH1}e;Dv`rM`B<=@&e~)Ym3lbo6Zd#LkSRQIyPng zh7B&BXECXmL9T=+>ED#CK6hjYK57o^!ai2abZczDGh7*buItTq^@hpS|vWau#gr8W6o|FC5{1EnO*j>PDlcEi2g?QVQbPUe1Q zP^#hplNvOUA(+X<*5IkvvS5vZ4wr@8<{K*vNLJX`Vv(|AV`G6Tx=GcW4uF(1qEDYB z!N5!~ZY#TP^9ZJUHa~Q8c(*bydNHOfn%O?9PO;50Th_)v*52@;$a?>m>%Nt$*~LM# zFkMy!v5xBvv;UVv+w2uj0U!3k4S`wBdlNcsrVOxaz!xzs*$o7JR)TdkY21&gSOD#Uu;}%h$!F#&;a08y6d! z>;ZsrAt5l2Md2XA8|M7k+P zt+j2=j_$p$o~Q~iRu1ayjAiTXt`~1>E9~*xmuFIprGEKo?V6dx$AvQ0WV1w zk{%yKz<)=u+8)VXc5nr!(8j$G4Lf`&{zI{nZxlrVlEavoWN$-m@V}KB{l=9#WLW~O zV80>|ty^7bs`MY%3m3Ms++LWMC+j^qKF)RGb**f4`VjUO5QuyE>zCq}K^Ort3Za`{+gKbL%{7hS{Xm8{9mHWC#TRZ&4hSE6#< z_xR<-(QZZ9iG89vd2!b_@e~H4_ms3n01-|%fe!;|dV%>T)FguBR=4fXaJ*m5cu_~Z zqKRriCCJW>+2>$qFH4IF5AXJuCSzp$Y(6;^b`{VKp#uR01Mui7MN^!=o%U#^BPPPl z)sH24pFK)f0E!pu`s%VZ6*QcnHaQAI+?{^g*0?!MA?y9mTAul%k8hd^k?doJx4g*B;c8Jc>PS&p1-StD{LELey5Cch#mHv;9aNIp-qC^;JB^v zn>SA=R2L4Bc4$;f4L~DM0`hgEkt3efsc;JF$%6jOsr;4Y`9H?A!jgQ9gxiLNfy1L? zoq6XrSDmu%F!;jjAQPyGg#yK)s>p`;r5;MKIC`jXj*G$T*l3QqUyyI+<-uU4b?$mW zd2{^c++Y%s+>jy1*@UGVk#md8QxmtPj@oN^SluT@jyM;fMW+CLq;-}cOZ|6%oJ&1+ z<4=m3;`y7884kM0rZ40@TW!X+e>FC4J?zpWrNW(tz76-lD3;e9RNFbC5Zk>nX~N zs(Q4^@ZFHkn!GrG$D9(s-a_&{Is;hxJGnBlf8#6~4yoU#go=lEc>tc87k<+wE9f+1tT!s5DH>TSrmkZb?um5|r4qki7U8qg= z^3Zy!Uz7Wsy+qU_(MaV&p+h0TmCU zrJ!fnR`h2wzDjSz++HdGpsrO~1xq<1yq4P)gkrYyvUu1p8j#zHG|cU!hJ7ML;6aiG z*2ZB5Ci8*@BTAsOUBz*QEFLc9tU}FhhUFOw9~|z4m{rWq6qD;(3a(4`YU!+7i9(QL~f0SGVYb@6AC$8ciYXNQ4#)*1pUVrPeN^?DIrzi%86Kwnz_NZN_Xt@QN5 z6H5ZWkK9#`*YGuQTC$breiHF=ZHin&BRvTo+;k@?qL34~b#4CR{G8G4})8O#?}t0Y-2ppq%wZgp$`@+FrIQq8-x|? zCTZ*8F^`Eav(544I6#bqW98fzCmjsT0D4^%dQN1)iLkZ+IM}$1!!>$$46-9McNLV2 z0uQ+hOE%OT4|OoPnrbPm{0t7D{9)~@057yrKCW}dpn8%Q6Ax0ZrjI168TGNS(slt# zolvZBlW;53bU0XaJ`>cqdBx&f6g3J{G4>kA4b`&+Q^Pq21V5gHJSITU-aXf*v*cq< z+`3oGUwUd`7E_wztNsE(L0Npp9iA~U63(Nx5m z5iy2;)*)On#bUl6>gPq%=7q>m$Ij5)vA{c4 zC|V~mW^%i&844~k!ky_q?%N*NSBt+(?lOD;*DZ0p&=(!%@kJnPGZ70pL9#Ko@3h|! z8nwg=(s4ZERO-6m6v)Ii_nIADXeq4ZH8}q@kywr{bc>cSu1aX?lGHKSeGWx_%{E+f|P{)Jle9VehsC_U?AD{<-ZqT%7lbdu?Y8QeYEz`%`UHv#v<4oQY zCxMZP_TxoQMIh|I6B!J^c1M*Nxh+^m1{qX4!rkFj%#6jPWpeo~bWl1pp zQ3CofOEyDcENJFOz~P$2aaH4-nA|iX)w+S_k4-VIo#5jIQF{os>4f$dEag51G}I{U zuBfY3(WpV@p(3CshQ&_vA+Ij)`HnaZ5yp=cRhqyYmLRDqZ;6ut*RGPYo(YRc{Kd?$ zXo4y1yJ_hXQErGBW zVYsH%52RsQBWA!6CkkDa9#*t=IC*iLf2V!m-APUrz<&rp(4~qljI`H{Dp_Xna%QB+uAw;m78cs;{g`Ps0<*$ zh}sX!fq1q1(|334DF}SBz=kueG74kfY>y3*IH8&#YTxe9?oE@|OW+3N-Y@Cg>OZ@e zlAbw%uzNYuxoj#uo@# D(wGlP literal 0 HcmV?d00001 diff --git a/windows/client-management/mdm/images/flow_configlock.png b/windows/client-management/mdm/images/flow_configlock.png new file mode 100644 index 0000000000000000000000000000000000000000..4310537887bce7bdf9556303dec470edf8762f13 GIT binary patch literal 27467 zcmeFZ^;cA3+dn#VcS(+llG5EE(jC$v-QC?KB_$owDbn4gbPnCp9YYLtw$Jmv-|zVY z&W~r-VzJ!paSwan_jP^hB1&0N3JaYK9Rvbl$w+@v1%co;fGV}E4bDYX z>LcjqIK=_*4@3(w1u+n)CLZI_=-&^~9Hq5gKp^7x|Gwa4RNtM0K-L>FpTyKX4Nf{D za@9XCo%y^Z_?+?Wb)5N(3vk56p~DBij*HQjqMT)W{rX3yd=dw$H2$B&kiW0_xLivQ zvs}jc_9&ts^c%j~X>%%D&*&=%P3+y4O|02ecR-dHedp`kPnMtos|5dEE;0n7(NR%R zEv0CA1O5H|db5a=#=wi&8s3r(c#&|y)u#ck=nRmKyuAFVgaU|(hK6Q0pC*v_-`iDu z1oPV3m}*GfO8hWz)<;ELsn5<8RL&xY1)UjRg3EY2eobl2Gh4M3jitiN#;tvaoGGZJ z54B%8gr%g;H!dDVK!@Rca#gvWR!RDBek~h{jd3Xs`uiy2*8^i24GH$H839u7FXl<^A8Z!3%XcO1T zr)AikCSBgvT>`u49?IxyHkthi`kPvep8cSBrzT#Ufvq>u&>;4rE#@^6F+%zPhy9*V zh%Yv)$XbA=0A;VzLe!9zWaRGHhb?uh@l(}_)a~N&#RLY zJOvXlqRnxEWQFTOF3Ybk-|Ny>iHFE3g+Lk77`N}c1Qk~HIw3aJ$r&Do<24PRL>4au z!an5u9XA0V%`I9>V#-$5a)}3MSu~lg<-99Ke+Z6(iBg**#^{3eXEr?JD=b6<>gXjQ zyifUWsEQo|Wb6L@A2+#mC`wQdy0rZ$8^uXwoH~zBEmfqjKK{1Wt~FetkAwcX(MU&a z(c)m=-P%1}ieGy6qPNio8P+;pymJuDCsW-CvziTOy0lUpPRp+c?w$egt!>Mf150#p zuIop0+CdJZIAxCblZFAbfu~@&{m)V`(n*ml64Bdumo!L-^|~J3`}(+BvuavI)^}A-s2V>0`L6D*xX_rm zp!~aiTzlyk(~5bp?3B(<^d;Fi@j7GGJo5wP(#B1gNb9$7~=K0xn7vhrMVm4MZS7p*3Y#;g^!dc(d z#_QT217fre2($Wa-}e6U$kDIsqfIh&P{P&Q&f354mlgWt-9hMb64~Cb+qq9`}bO3J?VV>=0 ztN8Zp1Nu&B zk7Zu_SvkyX_iG>hO(1g5wWBjF`<9+AGsL*AqE99walbZ!B`m_TenbZav1F;{{7_S#0fvy`m-VMzGy_(tJjHAG5G^89vfYjSyW z=QEV@T65#5LBOdWb6|ab4;kE&ZfLL!nViF(fn7DI6gSI$4aKiLq_vMRDsLvz&`_Pz z(OA{^yzbwlK58pQgqA1K@gDBFdvXTR(pNrr|Ldv!NS8(^dH<*8qU)bFZ;F5obJu)j zeDiE`$QMtLBRw?I{QXk&r?>xPi?QHg4!_aIG~&C#M|=V5uD`M?GT>Q zH&c4O)Su;z>%~zYQ?O1YR~H~B79Z%3ws)IsY@_82oksW*QB{X(|NQEx?^V(o2;xeldE!YGOvEF! z6>q5!IfbosrEXVN(IynGx62W>DjXFrf;-%4m5~>uUen7jQS_b0r@E}Af%WER@xH4f zSfD6z9gyR_BTCmuN}h2%cK5gOnV$~%^Lp(!su1eFrUgpe1^PI%{V=l?tW6VlCE%I7 z>x5)>-Y@#*{n!Fkwe?2U7E4PKQpq=r}<~7Rko@g>0?v8)cH%mTdJ_g{wsH!aAfD%m-O#?kbIJ2G%>|L|8!d5 zBnbRzWf|a5<2@R840836;%UQ+S6{H=1U`vR-{T>>t3s&IGVdtDTeAoH+ zhyNaax<+Q!vg1<5R7QanA{mmX5WIIV(Ifyj4AYLKP_e_up^ zZMY%r2QcGg*2%4IE%?%GcL{f0l{g7c#M}-%6!ZAk3%38Pp?=er^Zay-xXv;!VaJ#B zM>JNkI(FhGSXd}fe5^{}Rewx_DZJmGF>mig=JARb%d{W7+7`%^>WznScKA!Nz@isAV~4gL$qsW%-D7|XU~g|rf^Sn9ydj8 ze14TzO<)Ae@*`luaP~)x^jV3K6-hw^tzxrCdEL$Wq2E+@RbHJqUQgvKjj!NMv}{A9 z4))x$2sQZ!k8qy0qL^hPTD~w3F28~vxl#RZ4YZ5%cE_4e;~cSB3f!2|y$341L`sz> zfk(ltL&ka&JQ*QXo4#oML{}^Y_ZUT%*6N}e-?nb^h5F#s@;$v5R_@O@Pou<>fMsL$ zL;v(~JM1K*Km=yv;wF9b$#06{g&RI;GiDHk!^+vhNR zuoo&h9UNWGwiJ2)h-W35*^9xlGTs{nG@dr-B)EK1a+0sQKAryCeN?x&e=hJ!j7<(|LcMdt~NJ zpB6I={oWV+!vNkHpxATAgJ?#al23)Re^a@{RYBKhTnRB1PxH=j7XldKT71}0PCMRo zs&tL3sajSFEG^Jj-PcTZbn=%HVZ%tjGe zywcil-W8K@|K$5F8QcmAomfi$mZp}gzoM=@)f;8G0<+Y}sE98fG=tP+YR}f+%AT%Q ziAemYH_;3?#9%He&4SNv37v8Y25LZwVC3<6*B7Cr;oc6JLd*}xx#aiMwVlxgl{IAr zjh$6zpVihOE7SLLFe-zEiO`5M`SrY58oM|nBe9~IHp_s-PNz>ZxDmS>S9rH@>R9Ac zr#=a``)DaNkcgN}TH7OX4A_T8G(?4UTUDO2G~NU0P;!|!yZG4|A*kw zG^b_``(zdQ`PJa*7rHdUhb-p6o#{$(*AWk!4Dj@&ZOpeAGI>vhW}#i@vAIgF61q}6 zYlDpN`*7tYn3Iv%vWD0cEEvt#<#(g+t!{YJ8gy`<(=_o@ur{4iZ8 znDvn&Zpq?S3Ni2D*3Mlk-l47_5zbY!DeTX|y~ATp_D0Fs63{(|)JwE)roNsB1d!if ze06mH{Pf6=l>HkZ8Z{MfT{(4$GD1g^{SJO3{9ysL4Df79 zNq7o*a2=@V&HrFmN)}( zU_!mORd`pTtT@Nh9=xVcDEs>8V=Xm1TUnBlhOQhJ0yD~?+_nxKk%bd_c9vywglo80 zhJAQSg9myZN-cmPZP=u3**{hWb$!~m(i}mpr*xLyn|Gp$iMK6TnGe~N{N2|ZKp(&M zE8436e*4fvROHxil5CO!X>vmG9BI;}N=f{*BVPmm6Yr6x`uwc+=k>LPmHRsFr*Bd| zZQ-KRg<~~ni*60Elngp@djo;S-}-xB+L8|L%?`t5fQBSx;qh7jVVIg;Tu^~RVYuuz zs(ez(G|@-ioHDK0#agslF!^$^DFNVR#G;rKOYpx2O=oK=y;d2u+UDvB!%%io+)jW_ zo_GjZkcaLqg1pZO1M;(*)g~ubWQqx+DmDnskE}%ci~e%W^0;v~xvruzA$7_V5uRlQ zOt}#Fk{m1i#kFb92*;kD75UXltO}W3`m8@cjzra*Q$ZQ$K^$g)L60=7r|B9FllbiC zQUdY@9a$mO|0ZqW&4W{rm#msU?LV6^C)RA({m#8DA}sRf?6(4RJA15zV@;Q$^}scJ zAfKwYhkEyebRnl&l|-k|ck{1RSunq2k<>8Cjw(ff!5&O(`+_)^i5gA-Hsb9I)>NLF zURr}LlI@(BYdaJMLIL{Ll=bJGnVQ~?veL{Q)>LRU-*_2>^ztanQIe z#xaQuc@}aEb0mrtVCWR~w&CPa77SPC>59Na1+nuZe zt>?wXYT>z}CD~>{o~wc__aSCr>|UB6F(SS)YVX-DURo z?@%-eXPm;G6O|i7@XOcqa39CFl=H<#XWNlAZo$>4FSZJQEh^?#qX2M>lS_5p`!0Zc zO$S%-W#}EgwjU={$#4-=70LbQ1!#w2cJ57vzk5+880`SqM73RH9bOj^DlL5<<@*7*^iA5O`O;?UxExoiL_q ztD^d2;SV#mQ@3c^u~t4v^AdZybgvg|=G*79|(- zq+9WcwChuzAWw*A2v24F-^#S3L6==O9v zM2e#f?p){dx`Fom;0I@(a^unVFYr$$j1d#8FMf)XK#jMTN^ZhgVL>y@tmq^!N|@E; zfoLi(fs1~ksYg^APA!0^*~jNf;!o!?L;Psq>N$+>*tjjtA{=2cQz*FlA8}^a-#qyx zi056Y8sd&&eqmEgpn7aQHgfh8T}Njm7n}=-jG(8h`TAZYj<#~6-=?PsT!ot3OpomM zvy%>EyZpihpd@15sg1n8;;RteZB0P$v0VM5Nu@$nk9<9UG>33ZU7Wc|LMj$;5`;Xc zx!K2_b&$086y3^n>o`sSt^{OhotEt6=^~q9^mD*?(Uqak^CphaatL5mt%KM)p(iA? z4-WOh9Y5i)m_rCEo;zp~Kl+RRnJ=%t+vmU(_uXW&n9ZixO$?}xdaZ^csC#cVtiVYDSw8Mz}`gMNby-j=YJx%Kuo#zTK85JTn8gPpjj@$*A{5 zVT?iR&7D7QK|&ncY1=*;`DdP2U2if@Kasrcyo%)fL|k~&c8|^bYVgOOx$P5!s#`5A zM4VPkc93PYP*nfA7hC4ZW373^w_H+?T`uWabW>?X9L7Ayd$g@X$zsTs0KuJz2o!S5 z#+f&tt2|K%ZqJb#wV;Jr@pu8GI^0)LhM==*563CsVesrk;!VqY1>WuY;%9C8z+yjA zcANMTmBy9n;;$Kv0achyxh+AR{=U!4CRPDtdmQElxcwF+qG}9+*Mvtxu_EzTVeS0^ zavkQ}S|Vt&d``Jh?KdTyfkz(etH2k1Pa=H$z4lwmUnJmrVyt$-^h6wxeAABt2gB z^2KW5w{~On-=$|ZmNe#GZGL!qJys%@eX%$JdUH*7BGDJ&*c!;%S$94MJn^?wXV{?n zukty}outixWmdCGL~3 zM8WFyOAca93a<^F}8CWT^9eAzvgh!;uL6=SgM!_VC z_{l{90@o3C(j#!!CyQCCw(Ni&J$a+um$cGpk)OLcE7QA~MrJz=c0lXig)r}nd;{50 z>g-0t4g8h6^0bdN5&L17-S;@?i~8aEh%VlTWP^soPi4wPQzEAQMamIkgR#3*s<2h} zE1y5I>)v(n+k;66^MGk|n*Pahyd8ranB6+osdmTKTw7t8#HQet)nUTm!$odA^4q*J zu+C(usPB78yfLw+;+t7AutP5_FQqEy#8JlO*T^gCmG06hts6GHHpEWOxtCnIz7MO! zI_bV{HkUH0sUfm-FT;KGAEYm)t}VOBKP!@6tJ^V^%YIUNlpL0fgQQuzw~*<5Rg#*2 z8~Qu>+jUePf8P^rZPmf!p(eiP1;3wQF}S)^Y=o6tVN^TVk8C+%Q@F{c!~GA^S(Tmab>(WPWN?0hkm>p3(BD09KKuLt{6djOsy z9rnSX8mYeiAp{YNEZe|my5u~2;D`DWKrk*xbb<*goW2+tN~?0w(NdCa&CDe{v!%>d zojQA7XjUn7nFd^j%)DVjn*3s8YfkA;p6)G`4Ct)8I|qlGX42NR-?OwgXIDQmM~oPH zzfPBnmapg__$+)9(QK4ce484+rY!P)?3Lg^z;yAeR$>Fe_iy})=~{;l3(CZz<{%Xn z<_yM2l3StMyAegR{id@{>9zp*c>1FKYV+p(r=J*>I^N?y5l1?Fc*N&C3yex%)5tvK zhX5GGAnka_j3eHuXBL})SB;puM_LS_wX&6qxgw|7+o<*h5REvDR7uD<<;y)+)VkuK z3uGvrR_YA<&#Y>(3cON5ooPQ#sRXwAJ9G!sI` z^+V8%oH@t>Gvf>?_~TBBWX^Gln8{)8SmXs?js#h+Fl%f>KD`)u#;@ZF+38XsQF}xx z@w~=EmvIL^rpY(ZYxqAI!s5Q&oK9+(jE27@?ic6M6X6fOkuhqoX5SSu;(z4i|I2;E zD4&ZhO3i%#9*1CCLV(d%6~|Rm|HYQ$y1vw_yq9+hH$~?2H&my69AErceLtKG?-`by zq9Rv?&JI>Y5-d^ikRG+U^$SPh#e;;AQ|Y5I#?@<}wgX@}YuW_D$+>vYA2rGy_J(rY zjgD`#e~&#@bQK}0tg*${Mm#B5cGDkrt?MVDqgQ;m2DwI~tz~YH6VDSKF#sMJ1v8y| z@!hyyIJW5rws#EH%W9Q4W&0kBzwBXc(C3bypTx-~cOX)exi5of=@*@by5J;JFS$0= z`41MBR^L@%rzjkPZYAMImEA(A&WD-&+LBK7#XtN;(lN=RS~@!FGWiM`YeE=icruS& ze4V!rk#X~^P_3VJq^;z9nw}Xb2&r09)|Vg>{H-^{CvwG69tNZ4UyGj0_R3q`2j69D zt)>k-d=X01n4Gk$**NTEm3i{dfU+bUW%A2b=#reMiO`s94DvBlsZ_%XkqV}5?oHnm zY0Jpmae{>WbhA!7OnXMfiktdI9D}vkw-Foa-D(zWkM@ll#y!pZr#k_c$xVS$p-R6Q z9*}G)w~L5Pc{L`KE_It(qW%P)hwmzyKee>sOQ*XmFSP*ziOzCcI)cHiYL_GVHc|h_ zZ@m2_e?Md``dfpZLIKCY>WGgkiS5xa=SHqm^c$qiYCm$MyZ|2TRF_a^DW(bll|tj2 zP?7o6XrNSpx2$^S0EGu;%=A3}B)?ZWMU?a-C!UmpB@HT}swjjcH{xL0A&&SkP>t;B zBq0ZgeIv{eyyoe22?YQSnRLEg9Q>{*nb+!dY4_Ld=*9l{jxX9uy8zeXeugXIgYH({ zVRz`ztt;Wx0BFaHNhEnx5KanKIfp`=S4L-@qE_mnV|ta2c?kZSeZ%w?mz!-c4HcTo zu)9zWNIhBY@45M!Hgk5UI$1-$p{0p`pmoX{tcuUC0nt^cKf7;p=*{V)Pud`tZxUr94 z{#FJC-Z2Ok*Dz9FpD^`%k_$7vep`j?5G}ETi*vOc{qa_BJZPSfg|jTf$+*&NwqXos zoW;)mXn&l+ewf~BFwBURh40&A@4GJQreq&%62Q)>UN=M<>fx!P%F+tUyt&E8?VTgY zhB(+NtumRGL6e%i-&yX)-SwzFJ~%5i zk=X>8&V8XAtNNo!0NnK^xtHfH=(^8r^CX)XyT|FM5Pz&_b7~ts^xfw=R1-zxhiU>} zX#5W1Wc+tGCi3pE<#jgJLVFTu%Q_iXqqSlN{wII?pW!k$wl- zaE7jch#nPkf|Upv`)kFgHvB&{dtC2y)>-8DeyIwF-oIuwc=~?buMfQ$X=x*nR^FTD zA=3(kH0{2@J9>f@k7E>Xd5}a*=fUD1Iu{AW$=MD?jche2p%cFHLfg4pBpi$`-tJCn zrq;2oA*LNe9!!PF1Xf6;5s@0}D^U?ee&-KOi3n?k`D+*#TB1qRCkD$4o8589AY zk5@;&$4oZ0Eq!=HMe}-jVLIyS;dLHC?U7;nkItQk8D8)c5!NaGh?eB+5aTR~T3}io zzRN6m=pyny(hgIMo%xqIU`@b-AKT0J2V|aMKW~q-FL1@E^Bg#TffRHnl^j2c=n_O- zEibJN$P#c)3hh0*5`exX-ukj5oz$QZIX$qVh8l|d{48p=VTl6 zzZ*1+&X$VEX+OTVE;+~LKHWm=5M@Rr==t@9k`{2v#}9Wqi&YE zXL`I>T(A!4Qt*h)Y-(sg=Dx+#s!E<=j5p?X-CTkkPB~n-QiKJf0OxZaTC}!bK{}o^ z@BQ=Ns`lM`5gMVZhHC#GZS$vy&ZcnBk-A?xDuR$KcR#kGD_j8*|I5|R>OxFwZAPP} zMOi@H>+JO9ZNplB{hzr%^xRp~O|8b%gv)dGj%D)>jGEvqcYnJ<_9W+XVS*-A% z2bQE2(;F354?4+IVbkgXCC3t$Ftc$A)H?BkeDQRls3@nxw}{R!e2t0UOA^=E|@>}*nm zE%m>{qX`Er!A-=C6pTC{{TO?)NTmozl+8mvf-#A|t$~s(N*JKF%7g=OOnzy-j-d7< zB_!qA$FHQer6D?jBDczb=r{9UE_7<>!YT z+VX$5wEaob#fDtq(S)Hl(T2b6!>Dfv%|poV#+%dD;_#_FVOR)ig$Rh0T&{#zbf*K!D4 z{%EUVs8~$GxkX>G&ZTwAb`&CwJ23^caIy>m*>YVVrE)){PORBT)t)nSoT7p7rkc=+NEWW*HYiYaP;|r^A4(W<}Qf=VCc`dP$&lljUHt0e~DlIjTHEq+CGX zI>}y5DB~(rGhzDM{=gFMAql@f^fesW)I{_75__L&;LTgy*x&JyyZp{pqG}t&UR}RrD!iNq zh2rKXri{afy7U-P{5@CCo;fGpLBh)yfs*4 z!2t5ueJ${L529jfSNRP*Zia{Tn0?FA`{q5DP3N2Mfp8ES{pJ{{pUVyr#2bKAI_erzLYIrGfik zQ=~xz?Q^_WPlWwnJKi#X89{qLLMz2Jd~x0=WkuQXEI<0ZQ2az}{Uf`hHk8P2eB85~ z(|W*hst0c=J`f%@Vei8WYQXQKNThxV?^7vYS}=QS8VgjmG4x{qq*9ovmh5W75k#b2 z6Nht;>>n&|MK%5vWydh4lwM}*!pEA5ylJ^^qx*3LuM^Dx$W5UyVH?SQSXo=)?cfbPMi;xqE(rBU3Rc-z_QS zx9}|eGfk%WRI!w4JZ;j~ne(~+!En*#R9Pu$4U*p&i&*9xEAe)rw~FcG`fD!9%BLvn z!R#Mv_g`j`sany?RNiItO1X`c$CcD&UdmNd`|*RMWP)btx~5R}$z7$hQER)br!|8h zort>&yRO^)L$aWgyo9=B52OTA!W@zQDSp6(o8)Ou<03gxm<|~Dn4U@{|7QGAD9V8e z^M}cX`hkbH9vU;CPRl$AD?c5`bkCldM1|jW^UDydOK^ffOdk=j0q;2(v}C{#L6Tyn*^+?^lb9=fADRahDm5!I!&nigKd9b97J=1}o^; zVK(_^NNV=@Qdy@wzf;q%vZCm^NF4ONQ`s;14HGrs|4q^$PTm+>HC+B8!-$F8qq$>R z%B}w!2op982so9GDljICm$@CnDPR{N!-eEkJCZ$Yz z6Rp!tTxgrhA$@hcW~qp$+wUgBcmER$LY(YMgav)<_MnBnbhtkZr~`WSAz&jxDAcGp z38}1~emWeNqdpZUZw(V0J6jI?Nbd4IDaegqapeyg$9%xAI}&L7Ad$iZ)F8lhMIvGX zw4pN=EH}?1g8&)8dVd$_Zh@9}66PUjED8GL?_-3ThTOw;&@iY(szIgb<&+4WloihRom@>k#CsjK3aIKrHWXD5YwTR}u%?KToh zTL~DT!W?TJr}jukc6)W8i_&yBfq=%R>fv=77*m#m{fSPYE-M<*T)y+kD*hvF>C>q@B_e{UPWtDXW-4a zy$ft4!RjAvJ^nHb7~xX(I}<>Nfj(VS*upkm#8JrMWo`v0HH;08WhpiE%=cV!t@$kf zB4NlOa`2&e>fjB^&mEwzNGZKKvwPgxjBf7qHh4M4SUCPXxy&@R1Y4Vmih-yR9i+k=t#p9J#jf@q3 z2r5m&7Zv!u6lb1+bFfZybe>vL*4?8v3ofsz*#0G_*>hH$0?mk`f$ZVO;tJ0>WLLhy zzh8Z`1Lbp&W&j z&c{+{d8l1szVGv;UGc^Tha_rFkm~)X_ePo_b2bHl45mA7>U&}L_uB5_ z^~1tRu-nkgV^siQo1?=tkUeA3S{EiuRDXI}jFHJSk!Iy<`cdBLw;Wb^LQ;E_!T)x~ zdPs|s@j?DU1>UkL(-ER!+@VMM_yW}n5cqh3-e-?NJo3j^ zq2vZAu)_C&?z;c2D>uDOlpHK~il$zgO-K$Ne}YV57eI&<{mAC-R)1_NzP8ut*AcmX z!uRzw{T0)i6@gRz^Oa8`V;8yYS5e%)-rZH_?AY)3I17n5i~n-(lfMS;FHXyg=D-s( zT>bLDv<$Ra1KPss)-SmZv;W(2&p8GLVxiaT3eVp3t6$vk@zuCDI6m-N2=iR=Bb zY`A;-RqcB;uwG$7`*E1H-)z9+!+7q{{o{^JF0eA5isyrbt^Qx@Kys9IVmbR&l1kI# zmti1eMH;5?{&Us8w#4Y+ri<@<2#BPaolMWAP!Ven{o(WujyIew8Frwt_w8&V%`FWa z1;3o0qOSSc@I|!9H1yXE)Tde>m4_>{(F6j<2TQ2h7*^b<8VN+(s{SRr;4OV(Gm4(S zFB58(z3d5a*V$iw*Lu>#M5*2rTL#*eLwr$e4&^?jiowjJiovowPpu$B)lD~arBvRyTH=!mY6V`u=GcQ$Shtj&EKm4Ah_UBeq5&PTDj6r*tf3|KBzEuebg0 zQUSWd|L!?~|NDejwSm1c=YVkC429o+#tVc5aIMETLbE`v0i3^)Ku-fYaIPY#qFrq3 ze4;bbNlpFOsgj2{0G>Ze{Ru5NX-|7fjHqZA`R#YTL;#^iwvL}EKqq*MR;u5(8FH+{huhWm)Zp*$1Dy%#aCMI{92fD51@QE zn(yNr9X5UtNPBD2brvQr_%HmdR#Nr;RCl6@7w{Bu@WAC0MgIJ3Jak-LQ~v_JVMJ99 zESRKxax106bF4~NJeek$I+PKX;N{p!c5M-82eQJ&y3hN02(mkbBd_9c87Rh73@5Wq zWSj%_kB-(p7EM5a_z&Rwap#UFFHicFP1Vh<=WS66wWe@cnVAmW{!;T)a8 z%+Az--S38X+)HY<*GUgP6A;#2GIAi48nyQPX$x!g4(O&rvc!zAe~NMy6d*$*iT``& zTmNbzp16WGLTyD&y;w)u8_BPQ*?NB9_z;GzThtcA)#wT^i3r9q9qR>7u4rDp;E-mD zh(>>9?2_iH(orD0zNYhPtA*=S^^1%}>cGEbzV?6u;PJ&iF`2A;@y&eB(NNyFKIe1R z*oYYEB{@@yldW!;^HjQdC2GT1X^W;<&OM}=zFn^MEco%6ji{+t)*&KQNS*>3#o)m^ zB4id<@t5O6QEO}Gs>T#E03x%2bs`xAexq|URTUsmIV*C*7S$Z3ZbqX%U^eIG+Dege z5*wxtj1e?+$EBW2g+@GUDc=pK^JYO^QNLZ1CTpc=U*8SEWx>~9K~`4$Y3bHQ>d%cX zu}4Q3%bNy>eOf;Vbj97cSvvWwVvRf4xV3}@Ypv_bc+H#yO1Tl8bw4h_h;?mw8V!(L zt<0`kbkkE$%|+xb9L)PmJ}(+a3+WRl>B&6s*Ee^Jua8%jepjJ&XW?qQ8I6^4OR3}G zxRTY|XH0*tT|>FPU)E0bbEcv>&;G_7=+Do@U6lBr>*}8auq)cgim&1I!VjN?qm`;k zU$}aZP9+I2i?LgXmY2;5SFcr_4$>I~hB*YR;4NzmIDn~*B$`0?X<(Y8!yFjppj7~! z0H+Rkj{!#%GeArK=02bqz>zHA-N32DM_j-WKH%NJsZ02R&(PYhWYmcj`KnY5aWs3gd|5j=(@<@_#if(!7q7y~`trGSNQoJE8Fq~u zQMaPjD$HoT>e>pRAS+;)h7v@0L5CZAhA9J^J2i4ZCFQ#RQ}>S|#9I|Unh94gty z_8!yGf6*y>=Djr6(ry|c;yWQxtJzW>27D3 zl#ho!3pJJ%xr|NC;&II8dZ|fUJsFUE<~Nq?-k^UzhjlmT>2|b501vo60-hgeYsbT= z$a^*}6tn><)i&41d17kv9E}5-Jk5v&Kd$oqWB`2x0WTu|tGE7W0A_uMrn7Cs8S=kX z;En96W>W%aRzgkDFnJcmn|1#;Z6iphGT@dJ5nx)w#wB#z@0~^|Ad#>RXe^O!Sn&YA z2T&kG@GA^+%!$`q;<>ENH!?9kq7OgZi`AFIZg5f~`YZz0)jCrT34W@2g{c z`hX>)gA-UBVk?-!Hac@W8T3g>XEd^}1SRW+ss7*0M(kuQa2KSaA6A;k_!!T#C4QhS z+FykI0G8wt+~kKEAPOUf9)bPt5CIFy8Q{Ub3c-IeZDZNPykO-cl)o-4D%lfI*=aQQ zEdRHpp}x`EM`!sFN+dX~;OlAinR4nfpl#4TZ2Cf8-@|^0aC!oB9nBye8Bi5)zRte@ z4&o$0_m&VRf4+yS2U?(=^#A{(C2y?B>cu~slV=bh`vc6~0C&5CTgt9Wa7=J?<`IT4 z<)2HXq8=gcJ^yBMvah#+%BfTe>yzja8S7uida#)xRV$W$MyDx-n;2Ri7Fu2d6h2RC z0*%64qU1+vNv4lk-oLH{5QtiFdH~89`M_>Gfow_jIJRr#jqZTfdoKN1U{#z%IRr$; zq!CF@G@g(d=e$-P;`#ZMLJBAOHqteQKx!QG*TmKonPZ^&sjKaiRrw)BKD21xXY@$2 zj1EUZ)Wy>_R<~Wm3rHUgA3J`Hmj2J9J&A{h0h2suENC4>2E?hKQ&kqy>{9}4ciN%} zRVm-TXiOQhpnO-(nb45J%q0F7qBUF-bj?`w53CXLERS-s3>DOfF^E4i=~J_Qt7;?I z8E*n2k9hURurd~1zH~YQS%J;3L70K=2R~bza9t^VL*5jHVau)-gVx^R9l#k^2z6yl z%@YiZI2g}627Wa44)fOEl+M z`&LonK=ht-WCyhh}aO;WGo+@mA4IKXWX zyQ@YxG5J_=^(--FrwnyNKFlIKLyOTfSYsLcD0sD(;JWLDH3bv<*17P zWfmCCn0xLig&v-Nl+g@V;{c}N<>-9p)y=!wu@%QV$+fwSX+YL>pUC{$!Veh%V58Rd z+6aTaw~0UN3{jNhn~g63_VC+}aoEJgvDk|TWM49~-a$*nKTKA_z8o*cqE2F77;PQ} z436q2e3mwG56j>D`u@0*#qHL4G}%p2S#mu%lEDCuZ{ZtVY#S9ebu%@|szhMV{@UL5 zw4G4PnW?b8tbviKD@gBDQbQfm2xsZ6S@s0`M2+#_m|fsBi`s<4dHtmsZ>#XXRRP!s zBAH)b_g{iZjB5W8O;8K6wo1JHJ3Lu zRQW9SBzMK#X16g0rGcJAM7lUk%MZqodcI_Qi!EW#$=r`9fk4(i>&z|9*=f78dX<*6 z4%{zgi6-XP1EG6>)6t$1cH2uQ46w?ifzAp(fbZ7r2}I3+ zt;q!}`+>Zgr&FznBCHt-Op%ea^N9dNmM@S-%-k|DUp-l&?Y>cd&LWU$Mb1otO?~vC z#U)wPZ+oPf&M&f3CL*VpnjDSH%taF35+GW39SD}uJ8LO-AVKJJo%LFkMzFe`58!dDN(Y#<@UiUVfrB#+HfMtuwA8(C zkY3Z!e_NVEas(XBoDn{6A;l~pYciSyjAd$G1x z5PzW0?Jc32B#|Fz#s2&>fnCUySJ+w8-3u>_pQycn`t}8g`?-Y!^Gah&i)McqtkD%q zpB=SdrAUU+n$C0B03m!Pp|p=%8lN%%y!%zU>PI->Y3?h|;&6b|HD()uh}Kq=O+Phk z5EvWc?LS1}C-|5&MHJypmzHQH^Z5u!99^S(lQCxAriM!WQ)& zpH)BS0D1}vjrvJvvdg|C)oSAB*`}fCX8vNt`Uhj~j)bH95&#R|4`_5Yy-U{H*D3SD zdPkI@DrDl*p0q9f-v(Ia0gA=Ja9r1U^)ViZy}dF?d=~PGzO3BT^fh0-5J0+1yyF5& z=#H|oF;@gC5OQ+f&^ZOX@V9CRn2KGQ=*|wv<=s-tHxH zvwb5zQR=NW`k|mI7WFy8;V+y2!kRP93{?VhUOF;h?~v95DR!e*+lcS?xL6ZD2z~3F zLV+7=!Sq})4fmF^xCLNGDP3Hxx`;1FbwS0$3>O|cO3p6%n<7y}-w>ZBcuq3Gfm}Hn z-1(Gp?g5QP4_5%yNY$!y{e?H3wF5M17aNkQu2WC4nY|1XE6Qx*+*0&F@kVE9flL z^z22MQ^AFfkm^Vzuz|0$z26sKqNmW7(EDd^Y5LTw`=*3zp?sq6O}IIRkWv0WCN>mB zTRNy+gv#w>-YT|$|0xy+7$Q1-a@^U&p#4$R+4!p%Vo`E@QJW(qQI3z@xccA?>!4Q+ zkL!h}6R-jGU+*484AQFOTm;2H!J0E=Un;F!_ICV?M z66IKM%yumUMj0@w7Y*7)w8ig@0?n~}m8feNR{mNdVBN`q>O1|2h>LxDUc->e(nKL)&XBDgH-Kd3DQJU?I)7%BLnV1LjL zEBo18&Lvp1+k(~^02@Y`PSI%UHT;T~ql2&upz=otf~RwXiw3JsFOhOr_s1;g=)CY~ z5RqC^@syyQVx2O0azygkYSaFprz%AXJ12lo4}Nf$J@RTl|ms)jbzN#H&nYoD1M>g z<04MZca4T8zqnR0v}$eJt;}C{MU2}d+qgZ(6a;Y}n(1q$ z(Tjfpk{kz*yBYT9+2ZjlDje}3mKeh1d2rof27fSqc^Y}Qy@H7V-WN_O@S&IzhnH0H z_7)orSDun5i6fB=AM^uWbEq9jvJXf!GIQeF`ksl)%0*sY(hiv4w7=_*wdQ6h2e_$(pPo5o+lMK- zsJ^DxI7y(TZy+6A7C#wFl@WeR-dS-WFW6ya_vVak6R%_HD+yfdgcNU^xMFKjlF#*r z4(Fr{dymme0&QX^k)($h9e6WiAI#;-;as~-;GPDSeh)%^Dl_Kwd^IppT%wR;a|}l1 z^J+TJ8JMQd(-syHm^w2SWs93=7m9L=r6iG;_!S}(Rv-jV#*-y~F-#gk=pRg^RB}qZ z<+V9k({U}zKH``qw);-9xeYFZ-za3)#{R_HM(npz6H%GAJdmGy7#iV|&&`}LWq0e~ zoTEs;!N_}Qc$-B^mP+idHrH>;#|4Zw>IWk&PV5?I#FQm;iYe4~?536HcL;%&e7TxK z2eAB<0*s>R@JrflJ5Z`}w*oH#76)#tvTsY^vQ-%US<-Fsgbs{spN>rXFaLthT*s<>}RVAOx5d;yGnYDn&3t?pL+xbr4GZfSGw(^TYW;7p=S=% ztBAl*C;E&0lNQ(xveSjH_mRLdaeOu9u1ompd1PL=|A)7f7T908iI;5FJIp==0RwDx z@p3ns=}og_NPCw^sAlUf!{M?Cj7=0GzfT3r2K}PaAUy3%RtEduHkjpFR%<=L<>Z5CTTu0!0@Hj}B_P@881SE8V!ljcxZ5_0o@AoJA zmX<^M6&2YeFp^>;%2MNhgyYcek@tnh_oc@M$Isj#Nr{b1%!9Qk5~f z4npOXMZ5c1bW7#T&nu=lmi^sdnEsp_cnJFaa|9>Qj8kMK0l%qlJ+N7}u}S~8aWAVP zT&->uPd`0_cr<&zMVXptcn+%u_%pRTkOqcQ)Vp=BV*-B@Lf1oZjKXlh-c*NaJIe*? zG6{I@ugTueDs2GcrW=B)?Rg@}KIttPRqBQBf6I6Qd0i`1d z(nSyuA%xzGH0elJYG?te0@4)(LT`KV*LS~X&YXQ__M8uA&YaI-NG9cZ*7{xdeXaDz zEGhn{r{AL=n5gC2+3kRm7of3Ia81=&FvbH-=6USJkDw2mifHG#@xf4`0$2f{Dlmo= zGU)?71KK=+G*D`)S#VME^`x&{mR`m?k<%X)@w9U7)RI~lM!=P!L&?IF5it@Vn$+1j z+^{K|I5-!-`h8jY(VrD*040j&sJk@k^T!g~pEh=D4poE~FP}j?X>Zg%V7*cTDwY)u zKcK^r@uy{B3G7QkHqdzd^U80A8->`(cW-RO6=@FfKQzFx_Jlj?)a_D@VW~lzHT0iymm~u?`CD0xC)2eluTddEARS^!t3pXkZJE7uUule#oc}%V$Y9?%1Ob z$9W%y)F0EDFf_db5{MzxbltX2{n;s=uj_k2!z%g0#lx??Hv&y=I#;Np_d^_a4p-BZ zOebxWrnCulSDVdBr-Oa-FHtNHM0tYUwCQs4X$AEIv*V1bLRX%aKyRgOb7yjVr||XR zfe%{l(P=_`sSHou4JW{~X!0swO?5?0+KY|I>NuU3nvDv7maJf7e={0EfosQHk@1N- z^xD9oMetB&7RUhUHJG-R_3LiWnIIQ#+?HtDTZ^vr7khn;gaw~uoAVa-B*5;DU6D!XKDH;Csxazi)kwF=&WhI( zF8`jCH2}8lM!n5@bq3RRZ?ZS=?jQ#AyfSBDbV{njLVZ1>w{H2m5lV)vn953R!H!c@6~St#H(oy!S4fL&5|yQm(rVT7OO(0D$oEbf^`N#;{rGk0b=TF>PqXq> z>CU_AJ!91@E(UI_Du7RGOd&#< z$4wRom0+cqhdaElwyOSS@-OBlmh~S=xfFnePr?VX7c~*8W&Y2K{jV z)eB6i(&>1TmF$QDfzS^8F`jFw>nQEzXs2fj{9b<=qt9t%j%B6x_&6pXdhah zegm2-96dq8Z!`gI?l#7 zSou(TlXDZ8KT{d7-{4*61y9rP!GHn)p0|l}27uKW%@}Eoc~3V$4(M)6bexuu|Fb9t zunuS#O8FC21yZ6#XhIsRp);97USmHOPo@5hItY+3Wx$bd`?bp!bx-lMfbHhxjuYEv z{4L}XgxzNiM1w&nFJNB)bp3z&kR*=xv^SQ=1wN?NP7emoas_U3kdQ;?lEC_lEU*S- zHz#he1a8uhYzve~O@cr0WVZjU1Gt~f7oAFokuq2e<3YW=jF*2ZQ9=)zOo29OM`)L9 zrNV)CNZk|cJUgE|#+Yx*s_R@jki;cW(lx_qV)g3F0XD+fl@5g2j869Oj^C_?6S6no zWkJq`+30xlvSCq^c2Y=cMkikv@YI#nl#48(Mc7@E3`ra?^#%hGW&lA&G0a00RQ?(Gxa!w@!e3!E}so zW~O%-P)~iZl5))pEEtjlF$MxB=6TESx1#0TXFSN|XU` zTYPyQpg8e+jgS!telkr*mC@>r%Ycqa8B?sid@_gEr5~-Y-hrp_IO}t!>GgMFquSNy zUktIpO_6n_jwT9B(I>OO`<-35w-UGj=NJa@EJHV@qahbCJs#V8tE0wB6XMt_qHM#Y>kQ2le)R4psP?E}6E2lAI;H@*gm>^sfIOFvBfXompAg zOKsd2{mf8*MGe*~8X&RpO#FqgM{hK3n&)hhpkLQ}@YF0; z;1VbF2J)3SSkZ}(RyPgI^r$>8tN4en{STb0FrOM43BE2sI`;nx(E6{*nGruueQxO< zz*!sTbz~!QTg6pBZyGy%%f$om>CxEDdZ&rHfzY9fJJoo_ zq04SL4p`R!SE)mF?ZA^4(j7{LM)VOgS>%=LHkbd2#*Zbdd}yA>OHa+?t_fIc&BiF^<}U+cq;7Y-XEGIRrO>YDGJdGOE897jR#Opq2{v+jB8 z^0yO1Ix*enRj=;$3BJ zRmz<)JSD#4;7lb2AX^jaOjq3apP(0Vdy(oov6_{S_~lh2zz#(@0y3S28?cu{poK%^ zui_2Hlh<513-iZ2PrIR0?sulfoZ)+jf37)L{fDUy+^*$tCz`$YkcE9BL)grjv|8+R zUwfsGV+^V;wu2Dffq`hJHk{5kT>>at6ez9%)m-G(bhlYTa~%_FOJh2tY*C@}h0BWx z?t9q(#1k%abJh1+sd87O{`q3#AbAsgZmC%k?+QtHFb&01-&^>-h6Oe=j+Ylk$!v!o zeV>OGqz+2t`w5?0Yuad)8fz$C!Yhc)vP*1<>zlR=9H2V`!~VH6l~0$DY_nGkTsKIs zP)ORYtsOb(0IS*GOXA$Z;c>(2{77f;CLY*wR;@oSybLVVAO?qHsb3!(1m`6?g%Kg& z{Uu!b5DXdisz103f?f6p$Yk}OeBdRb`RAVbkF)IWL%2vVh_$z|<1ew{EBa|4XX|Hv zQbPpdARvA6pMNsWpdPDSAPSdUJpENHgrQrkeB_Dp|DAj9RSyTZqwu1&6(`I6k7}l>u_~Mt(1WCZzg9@ovVoD}3vCBG z%SYb2jNE+H75P=JCs)AD^3QVR5*=crcJ51n{Mf(Vi~r3#`CmLVwS|ST_jD7*AWc7H zA$NQF0>_)^$j+R^(oa}0$J59mcWmHtFioQu_4fR(p-v&kb{flCG@MGGU+UFWR+{t+ zATs=w{ErVUSY9&I;9*#}R>h!EfSIU5V8TDU(FhfU@p{?)ARvfNbegsklY_4c&u?KOciX z4$?L52HZYCDN?COmD{F|$1Xyp2sG^%tHpxISZ;2&n9#_*1o>}CiPkMJa#~UCG;N^p zpIf#3Daa1SqNHkt><1w~kHMWSkY^-NMunI3VHZGVVjHb@p5=#K<`7f5Jdt%4jv zYC?gk4+nK*4Kct%H0HaCRk8%Ex0(}V%7Fa@b0GE*xammezD#-ZMarm?Cb3vw@humM zl0pqx-YIl|Rf&Wn6h(Z@{eQO~w=*V~GHBi-CYjm57ke)0JoSo)D^I^v=MS+Ifut~m z>)S+>u(pl8(YleKJ>0jCP!uR|H(hHCfKi@@4rpN~GSsfuu<>K~)&zmhR(GCu4 zxZ6Mq^r^rCU$l8*Vew&yt^FW9i5**rr7-c$x8Q40tr2m+#%&%K#mBzwyiP)6N&p#mKEMzs&_io?8~DqJ?kiO?$cpf z@1Fc_nf*VzhZD!Z+*mL~uk!M!tO9_;#TVmZpri^j@0N&sl>TA0J0mtR z?84l%oa=+QKARZ0J&|`6x@@eY4y)7c_?A7nhK4r2~FtodoVF$xJ{o>L(iu z@s*gI8L}aT{*KW+(ZA$f1ZPsj2$0E88}T#Xk{LXvxgIcGZ_}78ck;GP+kU4v#kJby z#vF{UN8mo>Y@DFkK_PdnSTrFsEOQ*u0pINdm;I*!a7S$lVrF_R#nP4eE(`x;7xRo2v(=}w!st!TJ{^HNKtKnR^e zKk;W4sYU$+8rfaa)#SWKr04cq}Ht&7D^Aer8otOIGOYLE6(>j%SW>qhfSZ?D%O#JIr_Z(_wlj^ zsfB{#_STOcc}l`wMb2!yCpvp9<&Mw_EzRT;@~xwy8-Gk+_4}&wn^nTkxY6`3TF4`N zNd!@=4XsA4I^<`nksYoKmuok_>d3f<%ce6p`yQ$YOuAs`nh~-Qn>XUKtMp+@HlfJ! ziTVNR?**O%xwZkpXAt}iCQD-VHc##VU{E9TYD@M=Yo3ge_ltCAB1Ii^o?AH-tM3u`EEw4{GU@CdN z(+01WnEdM0EVmelnJQzk-BQcF2TJmwhJ60q@(^4~$+yD`pGIlEjk_1ndYi*dEajbO zn+5^{TsBGN!%BU9ZC$}4JAJO}q-5_P2-6P~Hxf~%}o>Fe@UtfA;gvOZs!aQHaVrnyT>`g~RY%~jAFNxIxL?ZMnu8hBRnSTvwH+bh7=Hg; zv_rS0j>*6)7Burfw|aR~4Qa(?KebS?zA9Es^bMJMIPNhSQGY*CsnWCS0^Yb4L$tnu z*GH-UVnAI?NM)*+eS7H_H|>8eK<1)(w$>{^>MKMqD#)okAfX4l?gDP$*U*F3;jJ~@s)h2<{opxfz z#;nSdBDiMPrys=r292Ph^_?XxVzOpS&FV9Lmnq=9&3)-DJ3}I-6HVkgI{-sIchJ>t z13tiuvoRPU8Dn%WvoNw)B%zoh5C@4xLCN0G7C{YvvUE!t;*A#Xdi;LAyK7VVn+bN3 z3T~<&C-mcXA@*WXay_u!<+yoJ%bV6iBzrosqGMI$f~0-5ayjh?=H9?gTfdCnB(X`U zC~T(p*1C|!qr3<6s~2Ag2*_AZ&vLle3R*rIy!>iA0U-9maFE?km$Xu@z)g6&&(~!N|WH8+}JRmeH+lYI~PYsX}0Jie~^``rxs36fH9`S)Q$UUW{)8S z7h4lkwbyH_To}z0Jjays*``je(1~C8nk%nv!g}St){H;hzjNh#s{Py z-(;38q?izJv6T(#6|uecV`KRZ+VHL+?4&PQhg71hvak%zyPGgxI2=1N&Pb|m6HM(cT>zK5JNF4FJ?C_KjS6Oo|Y*UX= zutfZ92Hb5pNRabM>dDCXVAPO2CS^_U7&U`Yai z)bKaUR(^Eg)vS({{8C>!<1Z2y3e`NB+IRgtvrTlRV z@M6EES<)KDrcgoEk@OiYz+I?hileV8WMZYE{L&#^gesnhZ9I@vwUAxd_cwqFv57_e z<}Sj?<0Ct_3>Y;CjSu1W0r>BySYuc`Yo4`jR%aN>*WP!tkBLMuk}Ra9YGXhwBB zbr&UtWslm>4_(-dv1P@%(FDuzvhNIA_oY-y$-vgM4;rtF&Br{}X=Vu$s}W~R$jiI4 z)hbuhgIoR6anPc;P9TStksS52rdA(}Igs?`PER@Y_NyvY6orH86$7d`NL1Du zrIEYLh-K3gjAMEUEJox-8W@a@H#0Sq@*Cz#BMDK!V4f`XO&HSerf@`v-r}O!RJL>6 zQsTF<*c97T{l+tw4g${=B{s<-w;m0iq4WHJxuQGG6@rOLuY66B zq#HZf7A`uIUB2M5KA~%ux@ZS-P_FNYc?aOD9T=bIVeLDotQYEfa*$OZm}lf8V)+*D zMPx91{vx%$cl)QTv@jy?8=|8vF2Jghe?@Ac+iE`$QO$zL;cQQKRYi0AoDf&YNTWHEN&B5eU=cXKgvHXy?Z>nWH$>KL~Qsncj z49*0|n1KwqR?&L(I%C8QyVy3hng+04@`PqoZpgO zh}XA@JFa=-+j71Mw7Q{Jb7y7}fwX%rneh}9`+MYZ)zTfB;&$S_uwZfTNJj2AjMiKg zvPA1E71VMnoebtYyEtfZy0DiM4a`-uS>hirbZ*4Lq&M#{Kb+!?v4BU)Xg>!fsLYSb z)>pSZ%*!_+HcddZ43#i%p+y}V-~DYd*A)6ZnQTU5Vu8~S(?P$-dl@=nSywK?!!4uD zVKAmbZYv>yivOnj_G!fwn*akCJ)S%U!iO#aRi z_~O#55AxZX(G6%0S|umn=Rr42sSqfWv7X4jYsG4Dk#c2CK_VDdQYxSO0jL z(n=Pf7@>?#3e|3W9#G-0k<#n?qMp_(eEaJ${cWb@63{O@cZ9Eynd*=CrncU=zyz=2CqH>FE zU;Fkoe9tL3XSb)pPAGo#7)AFaeEhv0vRVJ>PSya(olfM2pun)= zHOh$m!b897<*E<( zOy{jEj7S=EzBEKWdT0lXS{B(~Z6rz)*7m`K0vtw>VVnHb#`Pv=L-zZ^EdP9wdfbp> zn-@3Y;4H^-`o8tzFF%7F@nPo#_IBDcPTS#^piAU_+|yoAMLJ})rSde%!jLuS!SO9^ zu&8;WM)tZabMpP#JUi@FT|oaw9d-!2o6P`5-GXT#HKKB`(b(i$k8fc6NxYZ8{Ijg{ z5~if!53!8UPtUeHRB#qt=fhNV$!Pq*wf>hfVRsYJYuYr^4SK`#^RPZ+MwcF9d=LC=>k&gN>d2l; z)EYE^hrsY&@f0I^E|~m{!TlnSEy|rf-6bu})0{=ieznz^S7Y$z28N{7=IsJy2VWe# zf^g&>&SN@Um&auH+QMTWueaVk;M8KtReM6jAD%5g@g!yM$ex^|+4H4`=#;p2%^g?c+Db{Gc#AWyrPvw2TL&SB#?V}AmviEj~n z%=%^$$6fqQf~{dLt`?F=Go3Y4J68eU!RMUTxVEh&MpDI7-!#>&+Lxx0VprsJvQ`#Es((#os>zfF6tj zD%NX&fOjXQCckPDm{fnKk*qcp|Jn4J;G>LqqPr(}Q)g7MSEcjEOT3sdB~c>9EiYT& z)6e=iM2|qH(q&Z!9D{R;cAb+O z7x9_^C)gC1WKHdc)n*_nLe{nC$$^yL)*eStuxO9?GNInOQ5T$h*dnd~I;6v2-h-oh z@TQ~P!dG_N-`WF$LnkO>wJJqEGT+VJ7RhDoK*GdsRgJ)kuCDQN6n`fOIwNwQ062E@ z?)SFFnLAnnB*>RA`6jHR^hy$F!3gwu-%EKUPH8;Ko#~`7NZR4$AE0RCAYW3l-r2D^ zB?JDE*JXYB6r`{b^f>U>Vc`f2d3vVlkPd||VT!Ac^u_%hr|jOd8ez_l-ff{a5em#X zdp?HRsxp$Q{OTf=THBLp$tnC7PkGV7l7y(qo}ons>_E* Date: Thu, 7 Oct 2021 10:08:50 +0100 Subject: [PATCH 038/284] updates 7-10 --- .../privacy/essential-services-and-connected-experiences.md | 4 ++-- windows/privacy/windows-10-and-privacy-compliance.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 9facfe7e9c..c842975578 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -55,7 +55,7 @@ Although most essential services can be turned off by enterprise admins, we reco |Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
    To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). | | Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.
    To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). | | Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
    If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.
    By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
    To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | -| Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
    PLACEHOLDER | +| Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
    To turn it off, see [Emojis availability](/windows/client-management/mdm/policy-csp-textinpu.md#textinput-touchkeyboardemojibuttonavailability) | | Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to log on to the device, the user is an administrator on the device, and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
    To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | | Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.
    To turn it off, see [Location services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). | | Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.
    Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
    To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). | @@ -64,7 +64,7 @@ Although most essential services can be turned off by enterprise admins, we reco | Troubleshooting Service | Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running, make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience.
    To turn it off, see [Troubleshooting service](/windows/client-management/mdm/policy-csp-troubleshooting). | | Voice Typing | Voice typing (also referred to as Windows dictation in earlier versions of Windows) allows you to write text by speaking by using Microsoft’s online speech recognition technology.
    To turn it off, see [Speech recognition](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#186-speech). | | Windows backup | When settings synchronization is turned on, a user's settings are synced across all Windows devices when they sign in with the same account.
    To turn it off, see [Sync your settings](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-sync-your-settings). | -| Windows Dashboard Widgets | Windows Dashboard widget is a dynamic view that shows you personalized content like news, weather, a glimpse at your calendar and to-do list and your recent photos. It provides a quick glance view, which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11.
    PLACEHOLDER | +| Windows Dashboard Widgets | Windows Dashboard widget is a dynamic view that shows you personalized content like news, weather, a glimpse at your calendar and to-do list and your recent photos. It provides a quick glance view, which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11. | | Windows Insider Program | The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to builds of Windows. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s [website](https://insider.windows.com/).
    To turn it off, see [Windows Insider Program](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#7-insider-preview-builds). | | Windows Search | Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account (including OneDrive, SharePoint, and other Microsoft services), and the internet.
    To turn it off, see [Windows Search](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#2-cortana-and-search). | | Windows Spotlight | Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.
    Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.
    To turn it off, see [Windows Spotlight](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#25-windows-spotlight). | diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index fa1a4416d7..228e0a16ad 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -121,7 +121,7 @@ Essential services are services in the product that connect to Microsoft to keep When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring the settings that are associated with the functionality provided by Windows connected experiences and essential services. For more information, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This article includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. -The article [Manage connection endpoints for Windows 10 Enterprise, version 21H1](manage-windows-21h1-endpoints.md) provides a list of endpoints to which data is transferred by Windows connected experiences for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. +The article [Manage connection endpoints for Windows 11 Enterprise](manage-windows-11-endpoints.md) provides a list of endpoints to which data is transferred by Windows connected experiences for the latest Windows release, along with descriptions of any functionality that would be impacted by restricting data collection. #### _2.3.3 Limited functionality baseline_ From ffd2596aeb6b83b43391bd869f2cd24cf2e7f1db Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 10:14:11 +0100 Subject: [PATCH 039/284] update dates --- windows/privacy/essential-services-and-connected-experiences.md | 2 +- windows/privacy/windows-10-and-privacy-compliance.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index c842975578..8958a39396 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -10,7 +10,7 @@ audience: ITPro author: siosulli ms.author: dansimp manager: dansimp -ms.date: 12/1/2020 +ms.date: --- # Essential services and connected experiences for Windows diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 228e0a16ad..ce508c60bd 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -13,7 +13,7 @@ ms.author: brianlic manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 07/21/2020 +ms.date: --- # Windows Privacy Compliance:
    A Guide for IT and Compliance Professionals From 86c4b28cdc15d1eb52c9a74db1eb5d4516102df6 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 10:38:00 +0100 Subject: [PATCH 040/284] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index ce508c60bd..84781d9b7f 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -113,13 +113,13 @@ You can use the following articles to learn more about Autopilot and how to use #### _2.3.2 Managing Windows connected experiences and essential services_ -Windows includes features that connect to the internet to provide enhanced experiences and more capabilities. These are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. +Windows includes features that connect to the internet to provide enhanced experiences and additional capabilities. These features are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. Essential services are services in the product that connect to Microsoft to keep the product secure, up to date and performing as expected, or are integral to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. [Windows essential services and connected experiences](essential-services-and-connected-experiences.md) provides a list of the most common Windows essential services and connected experiences. -When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring the settings that are associated with the functionality provided by Windows connected experiences and essential services. For more information, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This article includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. +When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. Administrators can manage the data sent from their organization to Microsoft by configuring settings that are associated with the functionality provided by Windows connected experiences and essential services. For more information, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This article includes the different methods available to configure each setting, the impact to functionality, and the versions of Windows that are applicable. The article [Manage connection endpoints for Windows 11 Enterprise](manage-windows-11-endpoints.md) provides a list of endpoints to which data is transferred by Windows connected experiences for the latest Windows release, along with descriptions of any functionality that would be impacted by restricting data collection. From 339d6d924e798be608eb796ee300af2d4b0e8b1f Mon Sep 17 00:00:00 2001 From: Lovina Saldanha <69782111+Lovina-Saldanha@users.noreply.github.com> Date: Thu, 7 Oct 2021 16:09:44 +0530 Subject: [PATCH 041/284] Added-per-5475844 Added newly per 5475844 --- .../images/config-lock-mdsl.png | Bin 0 -> 63277 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/client-management/images/config-lock-mdsl.png diff --git a/windows/client-management/images/config-lock-mdsl.png b/windows/client-management/images/config-lock-mdsl.png new file mode 100644 index 0000000000000000000000000000000000000000..d61d54aec5e935051337f0ff159e0de896212367 GIT binary patch literal 63277 zcmeEuRaBJy_b;8&NaKJ=DBU12G=hYPfPj+H4N?*V(%s!4q0%kgAR#H;ol-;1Ff-@z zeSg3Ixjbu~i*t1@SUfX4^^N_Bz4s#Gm4-4A0UZGv8XA$x3x(HcXc*tn(9k3BFo18y zL_@`ZU+8YHmF3VXe=!^YAF!-s)n(DpYT^j*O|gN`_|7l%-O$jeSpWW@tGs@4hK6?C zqoN@D#>?m!;rZsxLL-W(bL(c$Cr@JFa&_%=)ouJTcX{ulomGQoTWOHEl|$=^$X+(9 zvY@46S2o2iTH$AXer7YAHkyQM|a1WOMc(J6ZAPIJWF4zQI2VtGqS7vF`H@U zzgPY&5*4Rj@QQU>t~=l2Q_aTyE3jpxnXO2}D9}H^NRk;Ew%~4|m&pSX@v@ z#HB|Ut7S?LJt+vZ*5ZDYCF+!UCDWmBMy$%;)sZd1p8!I{Lx!avSQa ziG|~Gb3$&e|G`x8T;etKVEXvj{`v0iZl+FE(EYtH)M~fpbNWQM37KQ%=1~q0^V4J~w}e7@rIA^G~)xrn^Wx?=MF5>nt;F9%07*2`6KD z?)hhVgLSdVX{|^(Zhd_{gpm3X*#G|ImaE$HbXD39##iW#@~E+!s{|f1SNR?eIW9A5 z|MXqAB9+_FQu_MMdI<0uj5IV}d%qa#zEPg-PqKubZT}9Bi9sx_Aw5nOg)fm-@(ewp zMD%j<@>Zkirn6Lm-j}OY&(Oeg}NOC$LoIA?+KN zSwYCux2jGg>=c56D}(%kN0=G}4Aa=e3{Xc9L{(WC$0gDsFkR~LA?@YFnl-@{Q4tDmqU@%VC+U`aBZrwDv;4+<{pS zstA)5Yec|r*sD20EtwwP#yKyvd7^WDE}N||)Yec@=^pO_*~d%z1-)(c;I?XX-5LJ* z^Cxh_zHnJt*=&pB`=JCDU|3I(x5stkc$7w*;-T}Ou8;3leNHzhN;Gm>fOVAexwcZN zL|cc`S_eJ_8&mwBySqC}30(V?mWKqlTOd?=e7uS7Le7~n@`5@z{YDYfxNq|QL}zKGe}+iE!IH0=%TM4ULiL~2M3 zZY?==BF3EjFI!G&lNoZ=P-0b2wM)`(c)K&>8Jw*pKJK4|f$vR$py7+TEB_duks%I2 z-sfGXu8((Ti@PDArC^8U=E*is8JpXEQ9{X?UpW%Y;6Z!xk<*pd8+xd0JV<2;2&Pe= z@!qUr$maX9o#h{H$@~vSi_*7q?@w1e*SH4`nhGL(f9Nn^B zUd=~7kGO`WOEt&nJ-d2vNghc$ugmC-qu~l-Pd&U`CH9C>Nyx0D4AysXaoNT6DIeV= z75zJpwP9pjFsp;JRSA#dctb*=E`A_#PB#0aUI$6^6VnE(e^Dp$s;c?YY5(r@}#=HllVf>j>B%W#w9%HuoBr{R7(M-s`R zPODtp-I^tkV}gy>9vH;i;}GO!z0LHf58Q{3%S%@`)w}A}+sgqqs6#|26pq*R$*_c` zdhleip;x98{-+h2kSe{wiOxtJ70|Um2h2!M2;ms~;xiCrTbXNKBD#&?;o(fzenC!1 zJr0<0jTv@ER}8)As81FVYNEy6F6sdT`o@OnbN54NKeaK}`<9t<1b-+AXf$MI)U_wUeTUCT? zrm*mL+c)<%8rJRy7fUqr{_O3AQTXmqJrZ}_PSTWKXt2|pE>Vvvgh)R9!vvt+bbkiF zT@(&JR^tnw5zs?TRB*hFjZJoC;=KhEyEquURw2r)(9ig#v^4F^f#j7O3^!ej@aUTU zA(wy(4l~%L#XMTmPo>RBWpQ0Me4qAnbxWD2e#VH3gep?JKUd0U=p+)gn#x&?n@t$I zJ5~I$>P@cH*wB#7C4jP>U!xi5O;{r74EERP2pwK-4n?Z`^2b1cz0S~l2Iz98O7hA_ z+kI}B#FyI*3ArMXli7k%bgcK8^icy--H&(M8QpeA1Mipp6~^>g;LGhko&YHOTpe1> zK1VZ5IbF!OQS36HV8F)lJ)HTP=*#@;p$0T=9zg%=qd85-_kq9GASl1{gvXT!?Ki8O zcXO%d#iwnTu~!8WjRZszyMs=oV%cEid7O%h%5FR6DjlLOG&o>4hVhF^pAM^#xZ*jm zr`S)~cl-58Y0RQ_gC0+mYJ!N-20L^s3@V{Zep(cxz3v>)Hq8~C=Ym~-i&s7=o=2DkV6v*R#EHh|0 zyx1A}Dl3XF=pC#pMz?L^J@nMH#K;w9#VT%N*yJdDYHZdUN`wWk6)2ZXaI&{Am+Yws z4h^M(Tx3+WO{#YF84cl9#{P}8mj+cvQg(PHPxHPQFbU8+|7d-6_}fN4TCRI-ZH+&W zli<}1{InD7v?_Vof%UfilkjzyOaQmtY&k9c2WdDz9&t}^@8rAaz=7a^C~DqaGENF| z^2b^GRL9{(z3*E+Dts;Q*?Q;rpn0f!tGjOmqtv9NGJ#B6^b+&0bR#f$qU%#;i0GGo zxRo*wG2&6_x0`j`zzm?{wY?tu0f}na`gIk$o9RhOK?42Rs<%~uUWqlLUu8|EUb1vc z_!*tO8sbq5d5~4aY&#K!eX!VY1c;l_K}EDuSuwA(by)x<&0LRVP z8Sy+})BRj~-?(FBw$Z`xTIp~FqxSB0D~{ExT&pOQ0zuI<)o##Wdq%-da1+_k?E$DE z&k@>q(l*YSmqQQo65eh85R2zCi=yJr-UqRDdEgQ=G@B0+(`_x-$Oy=?1@;QlFW4us zYYtF}&wI)2W2tX$ZS718Pf?|l!-F{_`gPzpr&gi`^A9<7*F!AABPiI3 zA4$%CA_+JNB3yWy8e$(U)uT;;E@VGHAoH2w*FkyT${fEhm3w73IDd`#-xsW#6k+zzJfjH1OmOlEf zB43|U()$Ra^26W8x z}NjDNw-Fj0bs_7eCqaj#pas z0B~`bkdc<~By4VT*&4vadBAu266dpjV=qA{U;i57k7qXC55J%;^WJkua5_W+s#&iZ zu#-9Gg5&4wJ4)X_-lbUpx%)<(;10Nl{+BI^CMNm5>>+}?3Mi}!duF9*Lc#A0Xg6E@ zjHqwH6dK#Hlg*ZB6Xeol0?rS5nYll@5siv>kv{vg+SasCSX8vsV5jVQYWsnVjEqKT zZ~DrRxY^$DDvvl*3%A7m2^I3nKWG^%KR$S(_Vlm_3!on>5WYmdN9lO=Hixjyl)~yPxkV(* zjrT#cjVkSysU2Q=b}E_2-n_^DMEBG}1X7~HvB{qy&rgPb78~s5 zdjYS*QKvAL7sY_$SAz9Tbdk_ zrl3oFh%H9v=dt?9ES2wmV7Lvf;ZBW2AkPmb>b`I}%9;?n z7(7D9F?-hp2_{%SFh(5erJn9e&Qutt^=Ucg$PCCdeh8_rmVUP>l9~+=KCl0I)WLKq zV5_=7WT{hKZM+yjfS_e1w!XLnyu?|{*4l5e&(pD6Ndl|O&m=ytFjw4MU8NYZ!}jdm z{P8|*&vJ{s|6<&yw2O!fT>G#RdG1FgARv$_>VyOYG_#~+TUlqYlGK+Uh-5O~n-x!8 zrI&JDiBu?dovN3pizY)ysho+nQ;{ zEbLxPn~JFQF)M2b&g|UIyKer$vvS6#%tNhs;fzHDWocJ;fNx-NGRtTHlc1xcm;cqI zV{lL}H^Myc)?wDlb8`KuBW~4&>V@TJz?U(T1posA?k|h0cu>M24y+&Mg~omC5~fV3 z`ZBi@RD2R_mG0G6CipZ!ubhO~xhlKRtb@^QqX)at{^-(c^An8f3YU8(Nyjj+c03P^ z0zj!^Dek2UG@Sd;X-7qZA<4bTiyL;j)a2Cu>FUWtLLwpuKm%%>s%_HZNABp&iv_C9 zx)W}jYaNYYvcuAvSflQ;K+Z6z%@gV?Spf<7Z#`p0W#z1!evCOj(;h4g>328>Uypu< zMZ5gjjUmLN;%4hwq0j}yfN>gdEuB^&_9!mhj zoM;(WyoNq50h{$={Z|%kf^@>cSF4gk!^1sj3@c46>3AM??J9qPD5T%F;}vE2OJ_Vs z$bC?JEW#ZoL}b>uT84&?kI$eq*z{Jc=Pd?*jJH!5AbL6eO6|d@+nSg5wHi6k``h@p zu-IW%JbfUACfB1#y(x&T?V-eJ+tzLFJCy*ZC+QxMsc4RYm;F!a0kg4G<(x{&g=aTp z+e&QO&5cMRnj-vck`jqQAEVdpA6W{a%4kp|YLY%%?+)U!*IN1pEE5$XDQf-IJ4h1Y zVy{?voPEwdSW1eKkVAU6-#ei@X;zy}98gxztTZ3}kb67p8vCWqOa5sqc6Znn+rtcy z$F2w`qqyq_fQ(1!se^-q>m8P6+n!=nDWU*LO4XpxBgD0+-j82bxPm~;hacx&hFW>ldZ=>*`63s>PTQFT`1Km{9vf&{yL2H>9Y0Z?pV|(_>7#&KA4|B;UUK^ zC#Cs7w9W5tDX*lBvMzTNo~Z?5TF^e!qKu_U<8G>?k@TwW@6dp13MpM5+=jF!qU{b? zN5LN8ZJ}UCRb%vUT+;d6E#45o@nK?mly9KbwrN}+D4>FkvttXJSATZB)1_ys;dzQElhrnFF}4w5ylri( zC~W|2t8=zfwqH9&VMrTDzb|14+GH(WefTzaOB7`q4oD~2)r~)-R8&gWajnS%)fz!K zM9Uqek->l#NEhYl8ZqhHRVU*RN0{$BgEis>jzaZ5=N4dT+u**6uwxroYjnthG78&L zPJ7hrbFbxKd#T|u4FabpU8m+YRij#} za;TSSJpEhduDgZzG*F9=B}|{lvGVJt!;H!04d3;X?LHuH&U)5GiS)kA%a2#&2~{qT_o^&A{X-ctKmT^FNs0me-24G}!#w03kSzCJi5S0o*`TzU@kjyJd>R(4a%CF|qc&(EU3Yd+qKEF@FN& z*@k><_I-OsR|JxuPHk^Eh11oLl1cn7h$>OAeBo+Ljd0r`7IL%pRhxYuYnO+BChw}E zi&oI`)z<7)uX8MI1jQ;B!u*D&{yvx0DlR$XX;fpS3<`(~eJ9=0;^Kr8eIxvGqxMX7 zm;2#L76io+sZra76ZHm;tJ#2nvU^yf@8sOWQjMIRk@yPLnGhD1-z<27AuVW(c%l0t zHZ=nMkYr+`G-RoImhOxXGwT;f05d<~U=!*6{k`f1(O%*NI15`deMAfE9)Z}Y6CtIb z=p}Q0gVQrmktKSqFT-4B<>7&D7n_ypwxNIu=oPd2#lS^H7!e-M@zXf4b|iZLx@xEk zNFsiF^VN)uxp6R7jGK`dOZdZUQg-RG#f}BTP)m2MT%#!y5K4LUFL;Y z)H(m?R}jIt`y4fe8Xp`lhVXe`e0Wv??$igYR?=ka6!;BvxRd} zIkgb4{;SLI!hj!50A^Lh`DZ~p-H&vqp1#Nwpna$!|C7bjR|xqDpqSnER&cb-7sw0B zn~iG;;aI>9a@?hQUzW&zx&g>vcK3zquqn?^&ua1OW|~1y;bpmfV`*_$Ldl{nSl78@ zr!>B*28xvC&hCCB@57#$OqU}ndj+4h0JTtO)$8jR^rmSY+O3xA$(H}&hOtv6l8|RN zh?~86suS%xQ`nA5NTy|X2+NTfdJ0uW#jckV)uJ-iwg%%Ei@XW>Xvw!LE?8ftn&9g; zn{PNwfdwD4aUR0I1+at?QC>E((nnqf0(ly8G|hff-k%_t+goQAML*0%vOWSY1K(Rt zl;mI!eJSK^5Ccxy(JhaqR+s!HztPPWdkE($8lsN&to=ihLadnb-K8BNfRs4vup>}q z^=g-bfXBNTTAZHR)XsfC7^uXCp}}~cDf(nVNhTAWA|R#IBRV}!zwx(=-l^Q|G)-l% zx_NIUu_?XH{rG2KpMNB7ZnD@oY`uhoPd2(bT~l<3 zD`&s64D1YGRS=M0)z1s9W@+|s1b`2qVF(a?e0iMc)R-E9SJ+Y;;)9yafF-J~Ni4&S zEQFvN{sc_(s!!#QW|sY5pVxQBe5iq>caD}b6HvKeuk%zl)OWj<%O?2|xYQ}_l?5F? z^gHjTc0>uh;PW~&nY-c34j@i>rt@596QvIvaq96{(lQ1LyH1T|Jw{t8d@}HAw3V{b zs}33$h&a%MxDwq)el8N#zGrAdhv9B)Y%n~D<>6TevPmwmcWV(yd=WB?)8Puk7qG{j zw@PZNCU4c6WoR@cP0w)?`PJt}ySOC-k>=*+=ee_@0k1-#&<1JUuv>AGp#n+&doOZ{ zQnks0uJtNSk7$!jLY@j5lV_6qM@<|^m?;(jXgbSVB#zD# zX30>LC#s0@lD{yyTTZ4;d2)`yS^(KcCxlddRPHck0o4>#Px~-uKNXm(uNS)PcuT2? z!qEK+K_PczBuIVv#>|Ei19aXgtEs604riIJ)Yo3EE3nB0{%d&Y3*`a1oFtLeWUmXsRj19Bssbz_b zou48#v&CcsqQ?`LHnn!4AZlvm+f(RLdoy?2B_|lJi%%@q$3M$I(v6#wZtnHZh#8+#UL|GDb61-DOk|yCT&gN< zSBK#O)7$gAd2EIMO`%n(g(qR~{jO-Ii&R}@{@CAQi5{}05PK?Mv*_@2=1nK6Xy`!tMTr*HAq3tF)ymRr)SF@e)ON2(_FJIyGy9nw#osOD?t^uuV9Z9y5NE+aepxFuz%PhrEW#9miC z;PMvGSzpUMkC_cP`vIJJFm;mmvs(3HoGcO@H?TMf^vIdejLAN|`Aga9vcWd}wlJ-XbT@xT%tR@dA(e04TyO!{lY`DIY%Eff;TcW80an-qQg2 zek({6$vHq6O7rh$G_xp!fan_i4pdxN4|c*U-?vg-t>$hvoGn60qMFC>rl+P%tlM(G zTYaJa(|gdwT{8kC-2#G{SXuiYi$8Dyc7@j-aIJVQ2Oa4^A}OzN2ZQI+6d+4o$lqZC zC@S?#A(wk)VP|=uh{va#U9#hNad81;v(B|+!R!Klu#aM^6{3SFOHB zX6CTe$ZGEj&lQYP3*LUQE$X;z@^qd$b?6g4PRLw^q4F||ao0u)2fFZ36BlS$-0HEt zke!hvqUwEXDl=1Dc{!IyJdvWb!YYv1b!97k5}LwncsNxYwPif~zRfEk04MM0wn$T4 zT)Z0ZC*t~KiTjyc()|29kn+)Q6augot9EO1O<$fWkh?d~3@x@YBeQU|XNT--1PcNr z<{Z%Vxh9?XC^a|tk98RbiUdxQMcGhM*_BI+Azc^UhvD+9)#;~|@v7g=ip_M1zFM5w z@zd@6mz_ZO%p zWIL=e_?}qPX9Y7BmvH1i>-~8u+N=naAHDg)DmkdIkVquzE)R9Et;SW|8LNf&X%iG# z`>DTFukdiZ`4*k;x(qU- zkMe$Y)O9|=2g=k>;sy`jb&@0}By{ulMF1(h$ch5OKg3cllMFR_NEhCX1Yc0nANCb= zpWU{s3Pv=9xk0RlqTptuS%;GyI@xy z>p~ZJxT;)EA`O^M{TWXZ0|I`YoDl-WW*O-(f6^J;3WsRkg<%3#jVE-S-|V9Z0Pa80 z_h=dOjY^(&d6@G0?gK?iu4`Aqci_tSvuuiAZ^JhOHgwa!F2&At0&MKKMl-mVcqDHZA7kUv zNgO`;`4CB1O@)9lj+qrTuhDU`fDs_^fc&@hFWY?brC@%($gQ}Qo-uNCra%sYjC88l z(Du+(hR&SG8?I;idt{7^2OyFtCq;V%?24a#XkgNdqe$}{WG{{m8@%8rpO$7ot71}@ z<3~3oeb85Hf_f{gZEhG*u<)@-L@mEJm#X+dqDtFaCAJ$$Ck_POTbJcaq=2htJV0?sexw}~+a>9TzM?iM+wxIODNNuBHPM2y}qb0C;q zsJ$@jaxl;My1TpUyL+oAKW;o6ksVL;P2zd>EHWUPk#g{eAk?F^ZZwuB_OwzKmEEm} zB!15Hwr{HMT|_)h$Q^mu&u|SB9*sO>(g&tBl_)%!bBeQ1(DB?2@2F3$_#g+1XR-Oz z9laGKg;MBjKUw{$=2Fws-`?|nA;(YjQdCm3#Knc5aUgOx^!jz+3j9Od)#V`EzDWE!+iw1I8evvK~sy=rWt?2up z9ajOp$6AG{dY12FWtx)`-jdq6(B&M5l@kuCZ>yHPy{A@~SUaf|!{`lICksbsTDUSa z!Q#mNG#H(oGHAIy`n&`8QZ-+&qk}^lXSB)7#%vqN8O^iDXx8R(<)2x{^H_WCNb|70+RaUpIvgrN`?L<=9oO@j#>jOE8owzq+&q6kJyv{cj z-@bjzZ@m5H9_yc5;{0uT05&22n*A$0fbV82-%B7SbrpXmq^4eqAHyaN&_?yUGr8Ez0H{z!zN>lS$3-_~4-wnvI$7ehieOIdh%tAJz|0Mzv@~QS(}rv6$(!5hjdp{lP`Jx2`~;tucrukcT$JnnI~WeDdZM$6xf04LaV6)2NkmL zZT3i~L1RwSP}z6U3|h*q)B)ZWcrsiBj6t_z<%enzI;bfJ;R0vXp(DO4JDOE3;I+P& z&6B69c+Hf4Td!ZXy$phgRxR!kN!v(mOzWC||7~qptnXaBZdHGmkNP=|)Y_U(HJ5e} zzndoKXq-1BXJs-nq2)<-dI-+yottljj8sV*n80cTwv1m zRNep&x^^9eUb@C;0htjkUfhcT)?M}vQLr#n&TxNk-16hW$z9sNVfPpaA5L7!%4?md z8+e|O_3Akp)VS&`JYIelj1;<`P5i9(m*}xc!&Scljae#iwJW&g}seDxIDao)<=W|jsmRGmU@?89~ z#qoQVf=8Po>qZT9Yku=~on*0MGetqNd%!{ydzm~Pz@9GBObHE&R<$&^gp$R+h<%~FD{W{0#f2vSYmg=U%UHdwaf3hPMQXh;Br4Cwm#x`==Ym*tJh2tSyBu#BY6kB_6s;HrufzEbc2(Fs0d zAj3%#?g^oD;Dpl|6IV||?26hg|LNOxCUh!>+zM=qe?7Cx6NPObMWi53=_Hl?(koOE z$ltd9dc|LjQ$pp3Zkca~d!61?{O+h7cd&ZQg^qySuSmYVF4C}*b`(WTmoVq~3U2LK zp-RDU<*{cmVR|;3h7B8CaV?9T-s`DI%s+Y+3x9yMCnBmCLAnRWJs)^1yK3Ov<^{Ex zUXKF`j0&hwA#)zaRgi0jNI0T?Cq3?YB>-XiI&?(v>OCH2pGDv6I0GPlMcj`_k0f23 zn*W2Z8x_#;hh`I(@Sv&hvnTo$FwvB-J-j-)wNN!7J-*wx^!rE^j^YE@P zsT;by8^I>>U4l=$3gg!<=HG-|{mr}LXZK$HUd(xh4YpFa z97ENJ7=8EqJ#{;+4EG%qMV)LU6l6V&^7{Q>ay%`D1kE3p`c6e8~#5su%KMD{66H)iK26xsJSQ3*=z zDyWKQxKhIITeVf`p6~xl*{ZNGV$4U7d2=g^&Q_cz?3J)PX$LB^YDTDW>5+2ItR6v| z;eu#Yt>z={ujR+aXp{bnLd~_OBgVLN$>+#*!n5M@Cht5^FGv@Dk42S|8%?aPpyZ-Th;U=~~$HcVZa4kMxkGPo- z7c$TC)po@(PlU+zvH=1Q=_2s~-5=)>fe)+OUa!l`*K}Edpx~cvH0N8_Bj0qK5VC75 z0}}-zLZbdJ^Np&8(QiHw=zNF7&?)hm-dk*OW8{;-ipdCQpeS#73_N*Js&3J>+XYbC zq}2U?F)VEgveTuklL@@qbcJe=w9e5-VAso77{f*3at?VSB<$RkQ_inaa1cNQn%;-! zA~eyS!PgM=`pxGf;43%{nCMOGB@jZYkC85|ihpsX!6**cu#Yc;(02#1+IqSHezsT* zU67_pH!3y);oTy-)1r-Uzpixx+^utXr9^voATv;5Q2H_j2lM;u1(S8<_ac$HsMp9r z>O}CqPqOUy**|ZJ9dEw5`_O^mTjuu}XmR_$j=vQ;BUbD0>icOdO@p68Ey|VTW58C` zYjhhuo|k}*$iPT8uF#c$3Vr;(mZrBwgnzIj^*;=BH3msMAl+iTAi>EN_MeM0j55P~ zM0ap|mX+e?sPib-Z~@hEp8N@Jh?tSj06mbj>Tolm#-5a0ouP-+f^Og7T@}|44p^*^ zd*7~nr@a00dLnAr-}4!qFY;XzYp5@-*7_~v{J0=`|~{TIZcOi)y1r$bjT*_NoU;3swEcIdNSyV1~VmR%2I zmhm-;w&Y*UjZ=UE6EzX#9f|Il#n4*O9~SG;8u3#fs;{nYR!RRGv6*}aYl9*mbxlSW zTBc(~r-28yJsuazB}Fy-`$9a!>B#BhG#!ufddCXY!KJjh=;^Ui3F&8r3wFk_1e7e7 z>O?n!m9(Xqn&9)=<9a&9cS3M2^>11f?z@92#A%aAhp{*R7=l%tRbqs4uC1dM@jce` zneEIMk*rKxk$k?Zbc9HQ{WAtihH=U?MquK zZ>fZ34r>qo<~Wqwn2d;FoWsRda8|X%;T&m7FV-)WWl|6e;Tz56ABAU14gAjhSf(-_Zjd8q3(eA9vT|wX zF%|Bhhv~%C2oL_TeIO_+=~p`Ic&fMJY2(MC%d^eoFngDpBX8RUxwceqjVWIcFIQ@s z6lQ-SYC4e~O;xXeo~u+!K_Mj1)SmyEgVad0GHGn^#8%SF<2}~vM*^jP=5u0*EI!*o zb6(T4PFA~F#{}}bW9a?9F*MSAywufK-IEGQU5 z7qoTq{fVCh)|))v=7VOb7%c%aO^VLqtBj|FMs#EW|7@o=qBd+;*zZqDGxk#(d87lQ zm)yQ-zrUldP|=I4W!lbH5n-8ff)kLz^}}Fn{)4g7Jo{foe~RpSq^hIHco-a?ADAQo zgX^hEiW4GQnwfwo`Y9w-5F5X(3WB)rQ>1(Fdr+v?45dP|xo*Bt`Bzkc6W4!QFAFUeg^^VO%CXW2>Y{*m71u{cA zGR(<@<2H-9akyHgqVoQ%r%HQC4wClKT6i_)ikzrOzSK1Hh7#@~MP~Hk;{K7pF_g|Y zsvkejPRvVVCE}-g;k03}y|tLVtd!7~*ZZAE;dH&bbH%RrNH#8(LvpYhAm zRg3jf%?Pu(7cLBO6XAQZv56|)=}L9dG_|UTsSeE0=FFrEvzM9Kc_~tkkkc#$Fn&VY}I}4t_Ac3ux9=2#|qqzdZ6*FPq5CDt`fa__qT3neen@VwY`RC zI}_gS1s+CAcXTuJ9usMpmNVDy4XWJpcqap8H-6=A+1>G0kqlBWC(w~&l(r*KN0K#gtMB4 zCRaa|^HuJ|&^<$78$%V;KEgr4qh7P>LHEh#s@>fQt$dd(GF9YgDMKF7nnA+bfeVgTMVs?;EJ& zZ44e~q7M)ArCcOlnCKc33qhVps(RWEDaUO4WXjfjD6Fe9kTLl1)2-G}?z{Pk6B58D zN@5la8onapc588t5*{qIcv*ATKLGTR^N;>mu3f8NMCUx}jU9mRUB|U=EYgy0FHp6! z&x$1DmlO9UB*>%Ih~SYQy=SfmVxgLm_7f=Ytr#c=9F9BI;!8Z;w0|vbu}hz{`uV5a z_W=pemYr-D7Ac{dA)LDc_p5x(nbg>m*#j~y3ay-8+vv45p}tqGzuK~O6-de-Cg5iB zF%G4t@_G884sj5gmHp47HSF8gKXI~QuogZ1>6cbbH=4X&bkk>0PLo+jw{bo&4TM2U z=v*}fZ>nvt*}$*#H`_KHsSOrExlHHKVmWg+R!=A6?e7Wk(8ThG^vcyCND5+_yb8Xx zA?>Pj?yx-Pf9SY>scWeKax45nzPI4=NciY}9Ken1OzS5L3TV~g2^YV<6GqWHA+2bl z@xIH>%b^n3Gi5I?s6M8V31jHe8B;THvPz%nzjNwAvTb+lW}$wn4=t8{5eji(?rD_o zq-*-_5{5QZ>(Qho%=Sc7R!(B=aC>>e^!utYo~R~x(syd3Bs%qV@4dH=5_HvKLg|xovRPkcy&4rEV zM|Rg8(lEcY_se6w!cll!`jqI!d4ycJjkV1LN}Pq-X&UwNF})lS%chFWB7d3ET!Qer zkLeK*J4*I8G_@VwO_-ew9c7OMv~n#>H~UB><&yAmGwc6c_Mc&2wZwe;`I=MDyAmm;BIS=IzUyW2_U*+3gEQU*|<0#D?kQ*g^pq8fZ zsLu8EW0Ve!zfb)wdVu zfa1kYL$J_mUdh77^K)_hCIIBIum(zLtTKC#Rt9Gu!$Ch9$TIn`se+%daA? zKw3%8=;|~%BAAvmPB>8h)R|lB&;_zFQlElHC%EI4BV2ex*7~3R)rkL4=H6$Y;~B>` zC;OF)VQfY^3wR!esyV^T%Z29RG(?eI-5f3a=30}kuq;9YvM`Cf3D)J!q}3d!rEO#$ zTODYYa!|l|(xGI2zyZ1PpOp?q_`od}q_dw+BhxTKv(q5F?C-r;L-UEay@T0weY`)^ z*K3Yh+vkO7xeap-^|Khz^)6hI)r5Y#Rwetj|GFAS*n*DJ1j!r#O^Ny>;Es{0f;-lU zFZ8CCke>&hr}08Cf}Vqh@YdDZoJn^*TEB#8g!4%I+y4xQ5q1+FmCtOZX+C9rVPidh zU~~85*i->UJFth%2a9{;eg9vGd>D!RG4$~yq9KDPZR_QfXQ}FV=RYEN(;>fbveW31 z|9@gVKn2z7AnoS2Yw1Vp*O+VcDP=?W((L5vQWo;}UhTh1_Hi(Bji~yHMv(P`3kZcB zbT#$;K~wm8$kwZD7z!2{z3WesIUL3 za@+#c8t%d&_Mg0ly{L>*+X05EiZmk&kK*6CY1eVN6eahAGXFXS;kQs@_On;p9XQjP z^r${v;AY3qC%JY%oK#X2ru?n46jGkEz}A*bU|-oZAYmsiY4O3@J9b99lxIgQ~YZJhR@hwO>WmS=3^zuQPA;A zJCQr(o7;jJ{GT)>`fJD#s>b_GSs&Omhr>oMgUQ$#3mH^+$vmv z%^D>tDIhEaYHH>0QFgEs`s7noJx1gcTlKK5QucN?^v%?J%O@7{y_>zU0{>PqHo3bD z_d!ZeZX8ba7{5_;gq`4wl?&S1u{86UIVH&o9)*@W@p)JQ&Lm4i#fAV|Lu}%SvyR`b z7l2rRs0%9CctP$m94|WRFu|;*R_XFY@X{_;&PaC3E*J z+tUMJLLg1q#4pV3KX4*l!p22-Gd=%G$ND$2DiYKDh^16M|6CI~c;YC)Q9}GNHk5)y zL^g>GKc;7kPNV+DOyMy-l$LDG`Ruqwf&D?>N#8cxgt$Fpb!`WLevBC31nqK(Gj*(H zu9c!6HhyJ}EWp3CT|f|Gu)LvbD&?;`5~524Il@+%JU(&^GwQR9&r1RFO&?m`r~i%#2xH4DVa?v}xy;pqoU)c*Iwv zfue0F*q&|g4B-08K%?IGY8n!94u&>IFMo2t^lAe1r61dz9IndRP9eIiQk;u$0SZve z0W&^IG$;#Dj?HmX+aod=fDfZ5O#LutjzIdjk4aYMW!SL2HC6b7gB=B)!>Y>H9NwrW z+bnEdR*Mx`4rRA+P*fNCM>*!fx%gMfm{*)6w!bsG9g!0O7GxUWFrg>;w36R>Tr>fd z`AJjYQw?4)%K-e}s)Sa;hPo3n&z>r2p~p$T{gFA50m5TKZ-QQdc$_Fl&(la_BqM`6 zA2PN1SGq*m;0;`uZU3aC0=n`sM?%C6jbT(kK72lt(6L?#Z$yqsfcZznY3(O0bXhyP z;BqIK#_v?$^CwgFafW2M%_fMWB)%dRtX+U)jJVAYv0erkm#a42*9O7`f)J0C(#X{WZcl8PwQ? zr@#gh&UBI3QoEdpA&PKM$0jG$sM?5%@VAw{98D_)%s=Va#LG}Tqa~C1o|YiXSyLtd zk)s+)z?VI!Mr}cK<6iW8b(%V0-W3*x{aXV)r&?Epf_JR7Z^_vn0isM?ijw#)VMT5u z-WV_&NX|p$W5FrU$C%9^0+M&{!EEi`UcM}wn9L>@2fs{(>hyn6_0?ffuHDx(Lw7d}FeuU}-QA^P(WxRK zN=U;Hf;0$-bSg@Uh)7E-sZvTKC`xzCx96PqT-WbAf1Ltnp69;zUVH7e*FF?^sVrAc zL+BlD=;{6m%a zV+vJPN+PjkR(fCJE(PM6f80y7guxRT8}EYh`v3FI-Ot!u_cNClJCmFA+74*nf5;&l z;Wv-6UXn8@`?)_RE| zTE(aDLvPY+IPJ)8pFbK2Y3`zqyT@eLblIk*IJw5VdS$}*wmV-TMkn=y;uDJ9xR8z& zO~uMCN0j@O>sgi~8V&#FBkfdPMgQANnZKZdZCp403rGI{e`rlQb7n8&@~hw6NihVN zG4R^l&^hPzmj?y^A`t=Mqe`X*Wv3gvW$F(|@OH33WTH2BpZ(I3GSRqu>??i`P+dYR!$-GpFXGcTHseG|rw6?xreqvP6wVU$%KT3er0^U*O zn>Q>iQE_C%%7I7pSw2e#*r{G;XX_^4&9-o2r_0s8TZ<%WptbZZHW0m<8K2h%^V2mo zH8AkEa=DEU=YI@dS=Em5i$IXfaB*=pu!Lb9a=@zrEK&?rHck%jU(p%~%rcFSjRn)2 zoWM469UoE+@({ca5eusiU;+y)XEruAKm;$u8{0ppy2 zg)RzLt!Wi@92c8!ZwufcfV|}g(K+E$^_L)F$86_fn(qHJ`kD`B2QW(yb5kWvFmb6F z%lKS5m@`KS#{OaMM9?6EnvG50vI>;Z>ISJj09)3{UsoXYw(y;lL+$8lNTp;W9FBTNd5*h2RC63 zZ?QKeTJ0sDc0AaA5cih+SmO8x>}_5&Nm}Ll#UbS~)Zn>b83hwJlx!D;m6ViVGK;lL zQA&!Ql9GgE&UF392U|x}z|qbsXj~^7AH1xrTwfV3Oi50jtap3=@XvJ=1`L3T)(CJx z+r%brN3hujjuY>_S0x<#Qo);t$6;-}`u@+){Qc`+UVa1dAuliQ$jAuHu_S7xs#we| zEJ(r(7_)qd;j@Q(YZDz&RD7hD)6NM0{gh7dDKX$4fSg7i!Cax>deleVp~8ZKt?lh= zEVMhbvo?5meM1TZ6idcgQm!Wln;x<}ctT3-%AWHYtnjX*W@kUfGHpn`6*S5Q7atvC zV{Ii>EhD4PU@NkU_f(Sof~%z0Voz_1pdb=y;&hXh`bN*tkn#ddv?g2P@|%9KXvF(J z?-g`_YptR94vXMx;67f(BXj@~tJzr?HU~YjfV@1Le+iCr%KIoZTD2Djv5P2f2Ep4L z8ZsF<9UHSiR>egS7Om5hl9J9IzxP?ErB<0kZZ>_+Rp#P#j-Km?GS?Em(0j}hZ!^FA z=@|&Qka)}z4n6g5Q+w+(#yX+diHX!&esD730UH*d$N8@WY9GOX;Irp*?*bVaS?}@v z`}aZDj6lqO2Q!9__hO1X?aBQ5;CE1JkmRs10AfHojT+@n85kkR*P$2zhZN*02{p=p>_k`{y7}kYE3E?NqqNZG5afe3Kig zSB1Fe;Nfo>1~r=CYY3##FER`<$&Q#Un&{eJY`=}4`0(t+Z$1(nScu;IzG3=5NfJIo z`k5jl1QkAE%LWfyH8s4X&}%nr|NF0cn4B1An3HB8`QK58|FD7j$8784REQ>~_Nu_d zY%sdOz_#{-Oj>%uzXcf?6l9c-r0&oCih3*IZl#NDx-y;qgsVtinS`S63NlrzZGc#v}LS?#`mIZrrhx%=C4)G5VCBp1phC# zsjjqmRsGoyt+zgeHq3-|%jVU8>&eI=%=^&67Aj+Qr3X{9LNWfUmm|LomFu2%xmB7ackvH}f~>d{e7V!S&Krk% z3kwTNt=|gqs9mH~0ILb@1a{&FgyDMllcNp3nM))`waW0jAcEkoa-Bo(f*iilp*I;~ z6CC*s(vMrwNA}(E-{F+NkpZbXH(uT*7?U-iWAYs)kpcoEo}g|t&QX{XN^81K$jbdV zULw)Ey02*~HGXw<6>M9`f7U-4yZO!wogUrjzx$%>D$RdymLc&>cjoHrn=Bk05c*2i z*4Dt_0fyw~;F5ze4OaX3gjHI^s%gC3ycEt=KkaaXZi;}3#OlGDJKrFN)drm&K~M*+ z=cbgXXu^RC=P;2h1m+*$x?*d~qhUnOGmK*p3?^0AKR>&afLH)&V+2Q?5DJw?@m*8N z@%r-5pT?OIFgPay5nj6&ey+Q_TVL4jbN&e^*#3?G+^3SiVN?(%PIRt>STw`PHT8w1 zclUojT>rswln@;q;_d#ukEfg64?6a{tF#=Bg%dkW%o}Gx999v*qzYN zc+Rr3v*Dqd1^*foDhmY18JL1Lkq41?cao5u7%2N$DGc%jrg87`94490$ z-V&r(t$F+QIXgeSei)db;TMJx*>@aZ@?m6boDdru8y6QBA1|=xd$c2zYD^F2IPj{# z)C8iSfE_oY0o=M^9!QAVphpmIiSxect=BnKvoeA)@1n@NH-KL5)R;ohWsmP)r6p;ipqhBE!`QKXm(4kFl_XO zQwerLIqB&SVYma_=Kf67b~pd1hf#-Hjoz-1!iJO!RW>YWiLuGUDV2n<{_cbtE`NT2 z72(GK<0^%JHLQ^2xldEvQVKho^Yil|3-XH2fKMId>qeh-qpb@Q7%*+?NTDK*`W^|TgrsB)j+&a<>^cAg2#YYLagm#Q7GCMY?)?8Iv!MyF@{B*Nn z+4Bc_>Z;^Fp!xW%Xz}0J`K*3(?V(+k10>*~-Cp8mjg_xMfApQ}Oe(|h0KRqL(K z{fkclk|(s)V@R50JWiHFQ+&uXQj4(6o#7902QRhJ#6^sx#=kh3LJiYGR`Z3*K%^mi zYu@uL<?(dlv41~v@Qvj>U z+R;r-O>msSOsW01$ypqWBpx1KnXaK>F>d0_j-#8h_Rkt!2-kz|NXy)*2s$MZysOm)Y8==@^+ok;N;NSs?yK`4+zQ#o~Aq^H^UG8^8a0@uu%-W0tXJAeLzX_ zpz|l?;o;fplBYLf%hA%-?(XXP4DNy0aQD!_fV@}kj;7c8`ns}1Pa>Gag@uKI6N{jL zKuKxoV3u^O6=Zl`ygV{be4h4i*1=B*T!Q*ih5FMk)KcAv;3ztPgq%-XEhHplG2#dl z{5ye=XaN`dY803I_(lB}p*AjIbep%gwtBYUJOx08UCEUWZGxZG#Z9)Vb)rB6(p2ey z2|oAf2Jt`LPuP6sJ4yKVgLe=lsZWaQCdv{L5(YngN^_?&iI0mza%X^39n5E!W1Wd0 zx%X_TtE=7+!Z*WhKy>C+gFJB9v zrp)9j_<4cBCSaY&_1>|$>j!6m$FE(x2EG{us!)nSF4k!SkFePTIJgC&?d@tchX4Xt zf-eFd2U9^;(V5Aq8pqgxI_&#ROiTpWK|>k>KQZ6B?4>Q0r0S8sCSr4HnA-b_a_3o!zJyU&qH-t5(Z`*Tg=pUI3FRET z0Y&hu%mW-LTBp8(p=ztY9$J3>%IoX3e$H!MNT4-d-ucp1MDeWNn~PyT znCi;WRbSaW48$P?zpc&ycl~@6AIw=FbjHx#TWv9`dgbLYC*QFZtc+ZzQr`lgT_GZz z_|mL(0mBKhrwuQ7jtT@HM=_7u>V0-c`XxmwHd~?~fH$#o>SOlTXQHTz0=}JHGJ@hH zAUxPQ!sB;BVUPqk{p|rUpg)+4$16*x3&Ax@ zuBgbf^HYI;D^J~8wrWqWLsMp_9Wg^vgJoRi{%jZ=MRfo!=EuB=n*s~Wo7l&jc3wHR ziVy*gya85LR;Ct5dP6i$j;k;R3a9dCx{0fbqCJD=9|iu3-hqK8k2$UBdEKp;(L7+R6`E)Xz6}HN;?&Y;F@V?><&G3`c&o|5e>jA-5GmX+57+vLZ85 z+9VSJxz!&Zj>8Da7M1g&?@7_Qu4v&FpuY=oXU4}Ho@DUnUjn)SD2txlu3@vqp}4D)GYy`6C{%Pg10&;z4dBo%jE!(+oQ~uU2?a%Q zEYmP%J?!o-e#*8eN8l!Ey_f0|K!J+arTboPRJGwH?q8Kp%zYIVAen{2cy(u2R{?VM z0RZhhGftS=b#0Fzi6C@ngzvw{dfZUG9V&$36j!j-OiFi=_Ffqh zhp9XkiHIQwNI8(}o4i+PrH6-yg*ghv?g%i`(zajsV>lmhT(Ay-p{ui zp3P_9TM86f?N_-NBYprqBjXMs48655KkqbW7iWpJy=ZT3p zwjHSutAEmv_nnVZ6KyB-@?N2HHArvXkfN}08QBM(%d^VX=a-~}gbV(DN0PV38UUMj z=yiVX5YOR6v3YPO1scOyI73EJ@dJd3ibXh5&Y!bmq zn2YfzxX}n{m*ABl9$s>yNpKNR#XmYYIH1O*<`>gG7ef`H?f6EKpt30Vbb?DWGu*sT z`M3}zxM6t&c%CaxGmCPjBOaV7Z#4(V?igeSFy&A?p$B!kGkX9YO3~6guF7+Z%O~`Ne_OFv-eno|L(bDSE6CH zJ#XYBH*3fXu)_Y}&`ZlpLLd2zL^RqW&lZ`t0c6?A18}KMeo)5bN-c@|32I0eEOFV8 zX=4YVtIROKo@;`roQ{h-O2U3PHeE-6T^09SJ_hO#Gw@Azb8tXPwLqN=$yh@5kgGzN zn@%;jof3~ShnL{%)BSTG_Kg-yJ)5Ctzq<9L@)sLTG$Pi^Yin~r+ZV=(>MKo=6cw|5d9Fcf(p0t##>4! z^taw+mLwHhEN1cft6>ARu6oA=Ifa`!_dCIk$b+Pgk=_AhRSWpj#XbK}Gm4^3jVoGnv zS^PRnbllRBG?h!W_V~G%WA`__@59@G3h%{SX)P=mE3v9To9w1J7)VCiR5Udy)c)$8 z73z)%=g!*DlQDXdVmD3u@P3%3Rc)VSD*>?OO9VN(81^8E?_jMy{o!P06LPId2oGcg z0Jap+vs#b_me)`+K*Qf(j>EOfe1%Tb0AD6SR&8oS4ylK4v<`8`)4|*CV1vg|VG>5k zSJCgG#}XpF>7#*@%Hw+T3s@;IKlcb_#lx#pqg3zD3j<^3ejmJeE@dOhY*xocx`2%x zs5~u3a`Xxq`*aqBI^)jh6Ir;pj1^;)egKnTF7S~ag@dH#r@rLi=-6v+Vb@%je^pQK zaRu``B~KhSy}0%xZi=NCA`|B7I^>y+V*|q*MdBYi81RrMaEN$T)|V_nXeUpOvt1ZT z{p6w<(Ot#Lx_q-f+Dj%S#RPs{=LrR3lc---C)~Z1_E5Y_MWLoqpPvwEZu8sK0QY;9 zTT#9-aL^EvNx1wvEkh*vt!avx(ky8R&-rQa6B6iU`p4reamYWkvFItK%_9;-yeX!z z_l$i9J|3ynh-MmIV@=~b93CkA9`EH~~Ksc1LqOvnsA?Cy*nGpA1A z`)oRv7a~Oy-;vxbQO7e(N%N79REqA^O4v+Mjumf2`d1GHN4dJx@@qLvIzCpe0v)=d zlSAXQB96b3L|=^HWJ1IIj+TX4#|6h_P04$T6fR2-b`l~X6`vi?V2s$cSnOY#754#= zTaEiGrV&N`7ThM|T4Td6g0n5?NMkQTLcxYA$Cb>o_=fttypYqdJ;YcQ%flz*)llv9 zsLDJtM836Y!^@&+<+%+vOPIAC*y}+Rf?!~j98#h8VWwkX;Lt5j)ZPXLA;{JeZ&jr~ zB$t8DhzDcevhNkwB&9Saq42s=VcABF(()TF&|EPoHR6cyh)yJ5`IuLxhtr30QQK+# zigOav#6}F4sMGWScya|hm!jd2>>TcxIfS#RJJ9nHpEX)n0)T2*%jORM@=U@}&%z=V zDg@K(fS7{KTTkb%Z3rDm)auQZ!!%e_2Uxn3RGa2NG^n!e$iQ2Z0UHF!a^UiU9(V+< z(@>Ry`>|rSc8$J@N>DafO0%=ac>-OY8*g4}^u5-Z3hUg9)2;H_AU$3uMcFje``vdi zWZcp9L1i!5ai6m_kzwm?;>E>_lv#~tKS-;1esSYBfXumB@b)*Uz5V6fIa5(#Ve;g^ zKR(D;mR$l*j{<^mro(7W-MXXYXYPp??@i0hGou`I_XByfq@v_hGeHwYBtlR8YG zz@i+$gvk!K#d!}N$8$diGV!;+Lwg5uEh4lf3E$biu4olHJpzv+g~6el^nJg)N*$13 z6lfsnY5iI|0Uw2lvc%%a9zkN|acu;fo;W;;j-kX$I|kfp*4JUZLK+?^5{b;CeF9ZY z>}LXAF;5p4l)M_05_r6{q&-DeKXmfM=`?Kpobg_K{`^^>M+xvh@P!CgXwK;z6^q*v zOK&K?0M|ChXQylmV+#S`?0QYH9Z#VBNUR$wdy7K&;JI{=?zBWOd6EOTL{C%+-J|8Wn}0e@a{_%RK2gx z+Di~5qT)2b{R%bZA>c4|H8sm^=n3xZcoP+Dg54B0GMm(RE@<_|jerN}vc$tR%Nz+Q zqj0pk|8I?B|Kf)uXqBcg>hn@QOAav4OXkM$FX4Zi`fVauDOqF)`Idl! zfY?K!i0m4+7zSR%yA%f(80?M)a&6|e7iwi<;`;loXDNeXB0o9OX0M{I)v5W-Gt1;y zYWT8}I?JGP)$ZOEW|6Hk+y{z=ch2qF}Kz^r5R3lE*kap|8xT`rrm#qVYtzEpL^ue{wz0-fB*ZoeJm}KaEHC$`_MDw5gHCy|uR5p9?j8 z6^i+9`4&Ivp?8I50;^n~3i;yz?>t%(`UXwJ_gDGv((;A+-{J}JW%?65W;N?IPZI7h z4JTkV5p54OpyPf*Bvsh@a)oci;ihShUaPrWO|3+t!4p=i^0~{58rRLJA+2@I1NYWP z++(4ms$>1|9KGXXs2CG9k_EC#T%)2!G0*U}c`@lt(-mgE$bY_>#9nDrb^E?x71Rs$qEvV5`2Tv%)eX zm{-{bTlTy-@b5PcHtnZsxlZ`#06mW{yn2QkbZs*tuRFM|ap(WM%Il;VYdr$va~mOA zI=Xjhp07&rUdAQDovE~}4zu!-hoA`QS7vnqOC$t4V}8v%Ut6dz^~qIiz{)@$FenYw zD!yY>Q2aZy^9+s#e0U6`dT4zEX9K1lkCq2m4wHrHtf1O84Vt;oGpJ#LnmH|9 zYW8wj)e4;-ofgM_Mpot&ze5p3;o{QLaAdVh+@#AJhzJ7cWvS(dK$rD^5QFf- zD(?kF3WI#+qe?d4#jd6Mb=AaTq?!{UwdMyXYs_D3Q_k7y9jY|2vLR+w*L8_Ik(QEz z8aKac7kFRT4aCmOjNoVw)4=~%+aO3%mz$g0(t-io<|vpjL3o#mte|ssgL0}i^XPWad8nUSn*Ck z9eaPjlTmb3mJt~1KLfA?Z9%H zatq68Xpm{7n->$3adurA&K3ir`o0^og~x&V42b zdSV8lu3K4P!zaZU`o(@&K@88A|Md6Z8LE$60|#2KkG=4WKc7LwoG8|38c$u6L7@;Y z_|Q*cVlp8Xf!ssaAz!884^&9gYJ(=C4&>^s4IUVPG$eT33_YB`&}7i!mj)_YhDd}R z00hJsy^mnUelGzjPA=pTUANx5r zdy6wo+RuL25!K}pTmNHI8;z*u-98fx{TuIWP9%|RB0n%`XKElh{4TDIoth-+GQ^EaM}-D(FOZ&*8| z>+YY`ii)Ryc}umBtn(d)?0TGCu)G^7~Ej*BpFuwP$fa=3)kQQHM0ZBVA~G32qUL0 zwxV@=mF1~ONJ8lWY3hYhG9?E9kYaHi8%;to`>3Nr_CuFf5!&;C+;{Eb^VOr&Hn2dR z-S}_3M3rzLjfi`D|1(Tan>-zb3g&>YMsboZFAo`t7}5E()H0qQIl#}y7d|(;irr=g z^$4|W1=T4XS8E@T?T+#uN3f4eT>|eK>CFpLT=eu213+Vgw;RoQG2S`C+u#n!$del5 z4w4wxQE2?vU?2xI7X*Lv!b zoKHtbCo9UXQs8j!PjZ|p4X?SDz=c=FH8S~~ZDv}_P+qwTb2xglKB6~))}5&lM9T!h zzR#bH^z_0uJRTxHB{KFBrwuKFrpz_GWmXEh!At@rxM>On_MrLMO$9Xa7~k<>U49$^ zJEH`TD=mFC*^?wJbjz6^D^nGC&Df_Q;HP}|0ttKj(#x{~wloJ>RQLeke1Fpfx=!ts z;01z@7ib%}GfRDq+nJVm57Pq@RU;#klLy+^7;^fnb z@YaV|D2csI`Nq=(BowX0ri@qhaS@@W?%7)MMafs?^b{Re_4Qdz>dC~s$nF($>QET3 z8f7*S6z~TMc68mCi$hw^2_=f)%*hy9{o!4Yk%}y#D4^~!zjw_tY0WbI;S`i`gjOYy;Qgw&8-O1XPs4vpsII^mY z)Y0EZ&-T9Hag8JRsv+zrNmK>4<4`lU9YKN0UsoLHN|B$G;mznPEZuauyroe=#RIBQQsD$2|GuA zBYjf6HU7Wn-cOn+p2O-Br{Dg@^Ny15d7B1!>&fTD>#kjv0)boNm1akNeG&+(8+4sS zgGsN{uBMW-&jziebJI%jl}7!_^Bbq%3g5OdB#)b*Vc$T!F3wI#f#btA+1d=9XMvp} zGbM)PYwA-tRvLJlxFm8Hij!FjR5XTRb4()`Z;D@&E`5d*c2$kEj@M9-LokDzw}@Y2 z*aO&m@N|{3?*tT6NL$}+Zsx&hng`G8h6%ppRJA>^8;DngYzaKc#Yydl8ac2^Db;g1+Z!=dS%GViD5Tvt?JzE%)&Mqi^1CMDzo4; zC8^Vw8w5sI%mTn&c(z=h7UfF_11#5qYc4YKAgk0USkxQmaG2Tv%hc@{l%^aSiU-)w`1A_sm_-(ET1OX4C9z{vRn#`M02sM8OiA?T7`ZAI%94P?AEbL+TC#_QZUWKYPf(Vt>w-aj4a`!Au%Pa zToGOOpni|!=LcC(M6t>t(5zt$UlT)c<}`>p-{`12-_KVh!gfM|Zb3)2!r@PY%#F{H z%%whFRG;`2^i48X#8|Sko;}mY)rwf|Eh0haRLJ^t`Xydc13HW+aFr0P{v^6sUW)2e zJ%zlD1pR7G=Nye@e`;zfc6Z3vjZ2%v`rSiP;ekur50H`?pjDKWYQw!Qj$(OdBK>KI zr9iU>f*17o`rP1lIMRCCArKi>7VTf-qBkJcdWW=cZ*SXr%CNzFCP`|Nu}vtecm6T7 zHBgd{TL*x`CE7q=$~lY{3qv76_v;aHP11TESrS9QNbu>J@nqq<(&95vW|{{5$0gwF z#44~|1`#Iitv0lUnT?$BpWuBeTN9Q0nKaH6i0Zbd3dQetipeM%ijyy=@C%oGkicbtA9l_I%XeT!s z?xJx}0l6I50d6(~Df6v#I z%EcfRd)m{tl@6}|JgC;t>6T!OD%9GZP;UUD0C3YUWr!75aAFM+)$)DWJc=+=R|l2f zVvx4&lgXA1t) zr(D|>bhlFYCGYyZg$g(TU)hn-QRtvRHQZ#Kk1_|O=mKfvUdz$`y{cEYO{@%C_`aOR zgWPn&O8O-Jgl}U$m;y!-ePyvaj_I@9l^h@=NaHpD_kj@OVFw6RL53QQ6Ew(x6(MUF>_Odt8c=XTPg%VIDJL>3Hn<J)=FPCP?Fg!N^2 zzL(?1+^5-|gWys3Gx(fKk!Kf52&n$F=0U-NMI2*TZHqOne&w=0 z$vi(eIM@P9;oPRRaN-_8_=I~-%6kC-_0`fYmv#XsC#UA6nZQR2sGPH<^)uIw9c=5f zyMDv;-_~ay`;am*?c?43ePaUy;W`Z83H0lT2nbrUw$Ktz-R}aSUUfVSd_d}zQEcE7 zp_3^>tD^Jb`O~MDKzjof!!}}w$hB$TLmX zXE5v8D~22bS;J++VfPG%%j=ppr2kZcVOy#gF=7kod78{&hZO(~QyMAyZ7sqv01f!; z801~mMOgfYRW3F8R(qU4JE#nLmAq29iHTJ%!@QQ6Um9S!D(IYe*vzo>W<^EC;-W*& zYgm674!ag8;3jrFhlbNDV5LJTXAt1 zpCCbLOZj^n1Wpabdi+;I)YV`s4Gq*Mz{gGkYy)OuunDq4hqr?nc^~xvy2=Jjo_kUW zH_a>vj-nLC1%%TjB0Iei%c!2wTzm&wvaCy@JopS$TFy(3wzpQV<@8zEd~nyeTp5Wa z%klz-l$~j_cDA?WK^y|NpXYA=2y9}7zl#EeR3Yqkr68DrQoX0A2NXF;_pw?_0f9*E zqFE50-TCt33-rujb8k$-jYe-F`u-yo%$DdCSQ1OJ4`#tm-SHft?=&?vrDk~2``NEp zJ`Hpnw}H*aJKp^*SdFK~C~VnU2y0go3m0@vw?Ia#BS3w)H|73wFn7?++uIuoerR}d z`?_$tLdfF)f}~9YfH!lJ5bRg;0TmVe)k#;@%^pJnybeMhJ5vEYhvHx=;wyd2UESUG z7R(p!^Za!%U6QA5~Ldv`*@k}eF%6KT$4Q%3KE-pv%PbXZK+=F2Sc0%=bK89<#v0|S^_ zVLcfG^{!{M8pc;DIIn zdqRr6NY(IBC0tNb_yefB z)OS=OLQ^y^jc9bX?~`{%!(GKr*`V42eSVGUHuKuNj`k_w9a4@PhrQ4+eX@pIgFUxE zTa6(;8s#Wt9z1|og1!I3D?mF$MxkwN?#f9wH#Y+@=`iXi1^9kq69h5PVz4(dk%(-= z1GPTx*KP~3Nmz%bt)X!f{O5<#S$R!)@fTs!XMxuB>#ScjRpS2efaIwjpO~_Uf0rHg znQT&mfTk4HOC;Wj-6aZr8HLA$c4gUQMs!Dfk3Flc>>LZ64N_gwhGhvmDGUgv?v0ft zjkmnxwF1XkXr#&J1ydqJynC;D1j7$U)O*VLjzhR!z>0Hlw9PuCeEv+Lr`oxO<1~nW zpr38}NVVe6XIRoHu&(KUj zHjaC_ko?Yj=;4h&mpX+zNB%grh~LidBaJ$K56=>>oT~72WMLG8M;j_~%XcIrgZV_D zP*TWhwck5~ei;8q3`Oe_ZfEu9GVamSM@QXzV$3pTL37MsJ0q5%i?^BJZI3eqzWYc!eg}{6N+cqrfjU`B;7@+=0QsZvZ+?1DA%Ow=C$k*kU=+pi)&S;4rDOcH1FlF<$ zuBg?VF;oJsO|FdV2r?tB=2jJtM$QPwQNFnGs^&f@Cy_X198p2A_l^1156WWsPbQIg zZx8fNL}`d_CB~q@UuqJk)2tVDMezcQQD4EcroKFb2not82{#vAAJcLDHd4qG-D=QI z1YuW%BH$k_rEZ=NU3a5TW@4L2&jLLOPaNjiY<2ho(D+cWMni zR&q|VHj7z{fk=%*V26h;1O(5v;^Jwnq@)ii@YutqP!h#T5N3B$BueS-fk-U>1eodi z+g~0#u(}G9spSROnS@=DDHKhg z2M4WT=Ab3$G+H8G&TkUfU>KdjvK3j{thS_+_r|M2U0MeRsrsDrpqm-TF6#w!8|^6d ze4bcBRY3g%VAeG_v1xYK>O;)`N-1rR`fGH)D{mxRS=E2lX*n z(vaAdVmwSOpSzOmi(otC-3C2ns_sOLri+Tbg9P=(0cvc43D^eukU~Qlr3wW(4WSBF zJ2Y=%{EeT>p{4F=3QuYCJ7&_iQQ*^*Hemlbo-)J^7581M zx$F6EewU*4N(9o(>_6y9=JZXM&($UWCMFCwgx0%~C;xA5IeTTT9v9D$A(#0Q`> zoP_^JNKDN@Tv72mlsD|F%IjI1Ewnibe&FWq_<*KpGG~S=+Q8!IYAP{3BcqZj$b<*i zFx9;@P|=Vn_@49Y{}@M?>1_7TY;$e-)e$Pn+=jn1#QzRTU}u-V+f0?J`kbvk+w;jy z!EDGD!!PzdO)#Fc#(RBYm+|i$G%I!(gN>$jJ=`rA29s-=t2&g4rp_L@RPVqf)-E*7 za$ydHb$kvUk->ZKC_pSq<{(J!Dt#eRwSxHoqjmwL!HR3El~KyzTv*c-sd#Lk_vb0d ze}OZB{>`)W^z;`dsT^3PWJU&d7xAdbtt!Yb(4etmcq~Ccc^_62f?lcQ)+7x0LBaE~ zRdT`pit){=!1gA$f5fw6htH-W1<$$@?N)=~Rf9T4;6-2s{L+n5$eN%>ko>dNjrHSK zQww{Gp)D<7pM@))!CP74I%ylYTNyM9)z0(k3C_P=7FAa`acvRCg`0Q`JsoXP3|Zz05;@X!C6&Q z>`ZR7AYme&l`2^EB7^sH8@zrPMxPA^)Y~BauHYB0({>8S!TC8kkq(ApT|d10!oxGC zkN8d{FRf75_k8}`3`wK%<67DI((ALSB}GLJ4i1PrjP&#{Kr{#U5^kcgzJC9}K+%u8 zw=pvn8A9Vtezn=b+o~k3L*DfKAE$4n;f`_1KNLQHJ~r&~{eunLWtT4qYCNU_TPv%a z2q7sIrK4>`#-AqQ73;H=+`zVo0ol~q+#UK_&nwywuN74bOgFxcLA0Io^74Y-!{vct z4?K07Lv}_MGFfs{3!iT>^wQFPxzn^{)cO?iRu)XgM7N*nA36Va6tTPd5hn%JbH3+>>+!OH~s3p;*piTk+%F+ zkbg!}a_EJ!4goC*q5Aqy!))}lQLfT0B~1Mqh?4HYIn3Xr+ULoV{FcG~H8z6lKtjr$xO-|pyrN5jfdL&XnDCw4}1Dp?r0 zfnHwINQky~lGFU{%+J6Jmp^6o&JeecJPDUhGEh`QdBnQ}EcVdQ^p65PQ*d!K>F*E1 zD}~v^Eq58u9A0pMswau#=Vi{#b2o(2%<6AfT&%#CkCp#;Qf6#q;wV{Xiv%y(+vDw*`(ov|w&8Oli!- znCId}Mm{DAM;R6D8sUM!!>y(15vI8@gB%4}A)y$aqD-dH-t-$s#0FGLJgYz{n~Veb z1C`vw)h14-h)SNQF5&TEATi&#&*Y$RTXZF}=`}vb+o=E-H3m`^hC6v(gM;fZ*#v7& zBDH}A9q7uHy)SU?+-;acboc^Dy#1%w6zq|_2iV}_O|jg#w@SG zjlL$wImgZtTk0X3?Ea%k7yr6h_>*hGMhjq1K+Z0c_=V`;6Lurp*!?^YbX@;R$oSK# zjSUaoNgTIvc_~{n@-}nQ0S+3&lT3WTt@GhQ@MY1$a60g1YdBw`Tv@kV<;~k(7 z*A+y0#F|zQXUpW&l#ZEnb%DtPkbF|GzcMbW^ZAG6w8NT(y6*hVRKm8Pu6Pdpb72z; zlAbpkG~%N6bh^G9W{BZ-wB8~nB=ltWjqr%a3Cai+doYlL*SC?1gQw0=-xV=ik)U*h zxL+VXwR!k6mrg|tMHCazKpr^6;tGi4W2Iedfij^~xAG`+FL_&of*K-+xOE>Dx0Ow^ z#_}}YzlWa0is0cZg;8ajl<`|SS=V-;$OVvoaINC;4f1$q#&c+TTkngs3*j0Q`oH`@ znIoBIa`1L0==@HCrW!_vPodLY1Vo(b@ugj?aM`qX9$)^U|YyPJRop1TqmF{pADwzp|0yR zU=q0*&A#UX8*yEf?v9I17M>f`t~e2Oi_54fGqeRc{Xoy}AGPxY>B>jM2f{bWZzPa) zn9>qcOV??xpr57Kg2W@}4c*L^)Pq}o@492KkWKdD)eM3h>hrw$yf*xYwwES6 z_io*-02a-HH}pvt=eSFw{c9OH7v{IR{4_)tXI@-BKfsxJU{Ij$kB*F_`I62)wHo-Cf?t2Ao*+|3CcD!ujo;ep%E=I-vtm;Kl5>5ZuU^(3??3MJX` z=Q`%_ZeIEtPnI^0PC-lELMJ7@GS^3P6R=01A*1gYCz>T#Z4$2;Z$ z@R4@LNEIaexRh20r+o!*+jYo0&fyccDoFV{CVNW75sloqulcWcj+&OVs?D(^bsRpu zANFbPVQ9eB5PTJWEv%t`qXm=K8?JnGxZ4?plB`e^Cdyz>i6 z@~o7Z`(6l58vV8Q1`~m-QRdJHVR{F{GO4G%`X*MZxhd$$23lHH-eH)aw7oSXDUuM_ zxilB&aid710!JzKeylh(jopaC$6F&wdJ25Y-OcI+Fib44*708TP?PFtjVVQc2)qkU@XjkbU-)pN(1w7lyw zUa^t{%*gsa%K0NpTtp3UYHQLHG|L*H>1#s6IE0kKubJ<37s-wlU1CQ1DLlk0k97`T zB@q$lS;LhtWx7Y#At2y{5RT#w(en-ok(DQ?5f+XlU9vA5qf@dgX6C#?`g`>Go<^>v z5WZ;%?X%8NV6==rBj_~fMl?sn*p-aZSbEur6x4#%aOG$xN1ozo89geo7fE@VcQUHn zSBti!B^1VIYiFD1r{Yx5@lr2~mbU565Qs2Tsq$I3;#E2)&N?72EF9+%it+-)xh8TJ zT}QO;YR&NMK!RQT;$!Uv8yodHTzzkxqd{MR9#H{*NsMKY zCo)khTE(d=UrlEDW2mb5H1AK+t@OJI9%-zyk^|^;OUY77s@TJVs-{~5=``VV+~(?; zy%O?HbzmfunncAh;J8Jb>VDL1R8w2aW0Y)j!nzmoy(WR$4@xgOK|CAc2_M$laD`&U zuhDL;`xeQkh*NXp>r~}GfBx)vp26M~?x!*c3Z2OMa@&t$zT`wqLOY^+!gE4F6v2Hf zBeeJ5tZ;>QdwWikck8y@g8iHhzlN!Qw`!(O5|OBEIvx) zqbKUccAb{n&X-=MikYqXDbaLtn0dnKY&MCdxH6}0ZbYPINz-{1$u)w6CtrBjr&?L7 zb@2$NS)CGGs}GpZEk8D#w*i-$cB|QJQ=FFqSsDmRx{fY>vl5ns#F#%Zr5~4|aU_F8 z61ZpQc+b?bJiK7#;cliw$Px^OH;(wc7C zQJ?Hb{W=M4;#8S`*?>$CRY#F;N8TW~mwM564jO8-|BtY@49cqg!oKMSN$KwHZX_h6 zOF%kB8tLxtlx|Rz4(VWD5Fm)UKAEYXmgWcV5u?(R^=zB0aFggTw2Z$bauk>idZc6~wW&6|pD zEiNHaC)asaHd5`so&Msvgg2ub)bG$Dh4rmHFRwAuN^#kau%2 z7?UWWJZ!?9D`Zwo$)cR67`mpHNzlAC3IQ~3wi5I!4}F`l7xYaC0jeE2>0M7NPrg!Y zJ=`Vyv^vo#?z{yt7op||QgKxbJOc+NYyZlS_N!B9awGF!_Wr9VEIl_g=yr9qq z04531*a}KNTAxHDgcBCER^puFwXD@NZ5G*R8bvM@i7K*FP^OR{+rsFV1{2xS?@-cy=A1$q`% z83o*H3`(fOX*;v|f(S~PX%U6cyd;D>Z)vMYB<@FCi}BAZ3Pj&H9(*vC-OdJ1KIH5g zXC=s=yIPcHnl4sEyc0&YFny+N#?+0hLv;Vk2jw3YgM49f^$^bp*RoHMNeFE%?F}Pc zUVY3>X<=PXEQZ^OX80eA(Tdsgqko58FDt-S!H%Ts+*<`h!8Z;wao{f)88RxiH)PEY zYl>NtpwTPW;imB?2R_m@ zS)x|KjJ$MP5lDW4*qXk3dYgZ&xx8&1cT@PYMqynhpG&IT>qbvLw-3u3j1Rfap{@h)5A%@e@q9pkJWod zV1(R1FW#rDllB+y{Ko2|4ui<+xCQa|b0@(seetR!a|qB<0ROC)55S9RK%=PP+8@Pq zu>=)7j)!J8QDibV=4;IUs08a*i#=2kr5LTSZ=-f@0*$6|PN##>AGPf=dSl-Ra;mb9 z?6FP$EbnOS2T=g&@oWJnQ!p4&#{WY6ZaMM04qNW8k+&~$Q45C9DJNK-Fz4jpzkI|8fak&9PA?|v<{M>mB9bXJ3(8PjnSDfzi*Faa-`ga?fG>cj0 zjSLiNNEzYKbhy)Y1+(?eEw#JM(;De`fam5ou>3l(vv=Ny6Y37WLkZ!P_#5cL0&9a% zUhubOr$It4@lg+3RmJN)iZJxjW~EbUABI{ItW3AhA(UW}J-H`-27IY5+EaR#(UVKP z`q%&$!iZ_Cx?4RuCwK0bo2pldk1g1TEw~G#zquG&`F0qkNEW)iyJa==$)98(KuQLx zQx;dv1ZXza)zxioZi1}`5e`l-+#JY)0h>5zs^tQm16+sNo9t<@+Xr*oKRiPdd8?qK z(!(%bpfuw#Bbu5opQmtz)dI#C4Pd27{v!=lrIxDHM`<$z*pGo2!plXF@IER*9k-^o z=m`R0V1Vq&K;O6qmmhdYfvA=eSihB87SjsuZ5;&i+*fHOL6hQj3?6qAip7ro&tU46 z*p3sZ=U=c>Q8vRqjB827=(22$mpBQjsh^LR1^>K19Aw3evr3`#kZFH$&rg5``*Pgq zdqqHi8yf1ePaG>SLuAZ|Hwwbqe%m5;F2oTE)Yx-!cPO_AEa$Au%t+3)I0;}X+DS=I zx5`n_MxgFiU^i%9`=e)w?6tkKLj~>KTOU$_$F9Chc~adTHRo!F>|!ctQES?K-c%!l760YTn4_bo%JgAG#jFiL3Xw)@(9g zQdbF##-{6^EDw~pltc=LqjW89f5dS|iHVK|hGF_ZB)VwF5DN75%O1HI(koz|l8Ff5 zF@@JeK}9von%C5$dcDptFeB))!}6ge#p!5tt>4%JG$iWkbk~5NAQLN$6SVUhTLC{2 zn81L9+@sB@$;6oow1erSYmXM7k;IaTe&NF{Pvl)6Gkv8#;MM;@fsM_MgMQvbJ`v99kLK0cw`G!t8`)z$Vzgdx!>LKGDo-GU# zyfruIjT)XQnB|u*Op?2-4N3UtI9k#DN+Xyd z<#4J9aT8elCu)^s%c4K)I{rF`JV38F&4IXoy1oq~Jxp8zBGqFDW~ru@x{&4K~~8F8-bScH6pcR(Rp_lQAuh@Mgn_NmNf z@$U|TpXB2LtE&QW-rB=Mz&T-90%Uh&jX_W_7MZl#%zz$C79<6M=b~H=r}79isX=2k z14QFrAR<&Wz(^|qg<3ia;t-&K1!fp;*EJDLTE~A06N1w64CLr%Wg>Q9!gcB%`@vfK z8i5Ynz10mr5CuHX&FMm0`_MQLmdllrGhV?aa1porJ$aoKsIttIQ3UP-_3P}XE^4$a zw9R>}Yp!XHhb+bwNC3Q7Y2(w5+U}YZu%N-Dnn4Zj8!MNjjYC^UYNByr0Fls~`FULt zF2C1`)b{!K79vFi^ls6;GNPZzIs?!9N?)Q%NS1p*<8W+__)uk%=EvLQ!PAmzbo9qKNFC@b!=gBF+48#G=g-0Y6+E95L>9hm?G3e%E49&ibm z5FJWulklRSYbci!r2Rh${zAH-h3T?d=LEKaD6^gjPT`2OrvV>MMgwd*#V-xO6_Lad zQ{)eMzHI<)hOJ4oU zr0<}uc$`5&y#WoPka~?^_acqgtcSvbiiBj0qRZ3-gu`AV>JYCu#Bex=4)A;g!X7sp zGNIj85%fQ&D%`QqQ$0s*W~3*;(!nb0Ezb83lF4WW3pB)Cm7OKdW<9K&=1(#05#?uV zyr#F=;ZMfdpm8+FcWOa^_l#8*qvaB2BP*)cs=2BVBSDTQaVBp#+o0)1DaQmF>?ha1gT3bU=52l*cz%hg@;;LrU z4G8vdacXXvWin8s3lM>qMhF-a+YaM)-MI_0)hgV=V`v(EXb2c2L(f2_N|qClHNf;9 zVXLDPkpG16#`HjND1rGHe`W)ZKJsTz6^)*UOpw%JHWAUL2(YC}pTEgW(`BKFg&S#p zFG61iHPa)r2~0AOpH%7~eib-jT_lwUAQt*=ikx}F_B3Q#B|%bQ4qq&0Js0o%&j>{j1~`C0C% z5GqY9xu~Cr>DCaTnwr2Qv!EaW_`A{ho@AoF*Jy9bw$nmFDrQP$2K$U=^>2eb@ zGjkKMIQ`lpNC7HUN_8`IT(+FkX_{s%QBJz{+tI3sKyF$X{~+u%0rd`+E}%{zC_w9{ z(4g(2ju&--7jDJi`bN>&&ptM|mGZ&60wr3NOw{n?pvvHz!i`DsK1OJAje)tfuk&6p zQ5098wVdLlzs2uZ2i}{dobWx`*F+Aq@JM8+Ru&#nm@(lnZb9zU0c+C9gKI^c;-6w9 z1%d7;7*T@W%@$ju)kZ@XV!FJsY7?>UvIwj~OshIaGy@&u1#2=Z6-)0-qhYckWEeb3&b?DnNf*gwLA|EzD<(X~N9`_7j3jkNl?U2% zR@^+n6uqWQW_7ApE!`Pj((QVQ{PxuAxhMs><3QBxLhJc-3U%d@K zDvGwQz3%OGub~wa*KEK@1Qxc_5~WO- z%Sd{!%dKI<%Jred{?T-HgT_zm(3RsFS8svC~v3^`S5#e)v)%+t2O#uRO!-&s6^;H zQhZ2vsq->7Mv$1_lfVw@y6P+J}efCvryHeZ9M?O&(s6^)+DE|5#}g{J1j)3%D)5 zgB`v_12KY0X<>HsAo%ui{L4PK)nD(^wX-@a{9k#1Ym8q2E5|4%Miwo@sT z1k4!spmBlOnB)##!l^nVx9a;cUFh#6(A%)vrdJH$t7Jlp{Glo~b5DimsknnqoGK34 z;G+e>*4x%6>*TNKkHJ=VtBI_1QmnI2OMLpD4xg?L*yG6kt+o}G?yp|WRStjQ+6Els z#__BwY1wBGwWyn)4?ma_f8TPskjBccUD?dz@ORv1CYPS>Z*1hxX5;Raa)zb9?Tsah zRs92ow6t#5nVz*v3tb6Dt zjN^!^iLtY*h@H{?0y&1}ytG-0z%nj&2RZlx{{XX4BuZs zvr-6b_q*MjN)~ocYO;&QK-Cxd{4W?4|Jc%somAZKx>$bh6?upI(|wX!(T;MS-^tdn zZ)Btk3=ALE(DAb8WmjNpMTN@A>gsD!Qtr?HB0nG4C*C|f$f@LJOZ^47!;0o+LM$xe zQWgKG4>{tUG)zoF0s-ck3Cwg_3Gi{#n_N#tACuBlOS$ya#7-S+5zX-@Gh%MYu zOeq?uxVqYt{!Os}$_YO|e(9hp5F>KA5<%BMlIGUv5lw>|EG;$3y*wM!Ob&(z575Un zV21ui0INp93ygQhUozl?<2t=gPuGtwcJY6G;hmYgIsMzt&Stormx8;w+hq52-xH0W z+~g3Cfu{7g>t6TbZuHZxueXV{`-wt+k)Dgom7;2oYy8Up?~$Q~wNJk01(jSD z1Fzro2k!g%2dNOV!QAhLPc(veQ(t&*+>g9!O?s2ty~!OG`|kWm$RRw8`)X1>y{!5S zB9Za_Lr10WUb!FpG`k)3ihAeT&7XqQwp@m?^LZVwEk|DXX!>ed+sEIV)N*7Cqbk}z ziXTI|Ho5`_YiiWJT6ooDUy#WV7PbdFDOaE5HKG~ytnSdR{-)jReT%nn##?Y- znF?fAj4ATzjf^FtZ)2esqucKtKRviRtkhzKvAyrPVxcSLpbKM2c3vOL44s-%_Y-m{ zwfidqNPLZG=U=mK>_>ZEmpP?UU>&&7TnyuJl1K(MtTkw09}=#d)r7E%R$O>lF+h5TpJLq1juQnfS~ zZ*+1sSU9GWZ3b`f4?BNj5@Nf#-b-Fv=ilu26rP<;?(E{<>>P@8{&#y+98?bM%m?9* zkKTYfqpIq7(i2J!9NO;BB4NJl+%x0fM7C4YrkU9%5&}qySK4geb~tT@f79`Ab{l8# z_AfOgDi^qfcu^pC*Z0k{aQCusa>pD^(~gcEFN`1NW-P>izYm{l_!oorxy)Wo{eBhL z06^d+G8HM5i6mEqF;$VKwPU2jF}$az2cQ*8{BI~=0%Eq4YOkUmTzo=34DbHUj>?xB zq~IOrUmDRwKt*xZnZ}G)BDsF~}>;vDYL4P#HG%%dWL9#$<9hzf&3L1=*3bH$aU-CP;*wE=k^?%9vyPE_W_@mW7 z)!ssGUWmF;d9cyXfLB=b0|E$$;NR21)K8sd>4s!3?Lp5j&dzaUqFx3C47SGMKY#u# z{m>%uTt4?G3>{h+6M&`XPi^0QHV!c6{^th;@qVI*HQ<|V^Io3i!5BR{>(;!4^V6QL zA=sAxNn)tRfxxEA@-GV_(cx_IKa~t*r2y{WAE@{L=YIyGK6@c6 z)Y%SSXDV(i#?C)Ohz(etMpvJ3Ccbokmr{ETk`D_&4v4yIg#fSCvoVC03&@j!1=!!g zVb21SQONU=|E>Gp-_KORWsO!h|DCZOL_U4V)0hyQ$Mw8$kO~1zK9JGxI|xSHaY!im z`Z)I8R&u1i-adM8CA|~sdfp0>tHcLu})fdh^NC}7w6kQy5u#9MyK<2+AcZfS0=y2oXD~?osuO>mf#T z<2nq#wx&a=%e5~_#Z(SgG>75*(BxP@R#=IZ8pXB7g{X01e?R!zWErG8V?iwkXmmJq zN-tnX6kxrerK3~N5cTHU#ni~mBn;8teu2=WOlA<_9;~$90Narz00?%=!PIqynXsNgZ)XQ&pK?*$z+Ygytqdz*t1 zQW&NsnFT*Sn6Q`tP!$QY*I9}}B0@1|d$y3XBH{3K228%NN(t@j(S0+l3?d>0BfaU| zw3LNDU`wxhUl)d6(hWi^HZcyVWz*O;B7jcLSVo{&IxrLP6|mI~v20rbFYx*WkO<5} zeMp(8^vB@whZ{#CNClq+4miG6aty}Bls~g_8D_yLK%!55E!9hCBL$=u1DOX}<_(Zp zJZREjE7`zCCgIJxwQ<{`97j5acNgDlU?EA&4`?>1K;&`zXFcrBBf_Y$<~S9D&}RC9 z1?Dm_D{EAPB6vEK3$|MrXgU_9O3(oJo-I>d`bKe!I3+M?tO{y+f|UMK>MTj;>zIC$LZ~&xFk5gbbc|msq-HZfw1gyG2F%XwQeHanv>vvU!B_E8ij`$w^N`^4N zofz0m3MWI-7=nFj9ZgXm;Z3)V-kC+XW^x^kQ8+JWQSP@7`VA{46W3Mq;XzT^73lMc!0!2V^?*xW7Y0xWx;#QN8DJU%P+^c^ zZ2Nrhx+BRB#G>+JM5~3{xZdY(+#+Eyn86-$bs?1Z83;ButBqWmRsm=6f-4aRLoX+r z@xeaxc)~E18DAy08vC`5#rPGp9!Oz|xPRAUN^@D%_|HN&xZnD(fO|3ZJj>U)e7+1eWkuLef&>A0an*P(Gm6H_>ZK?OIYP`Z?T@S-pVticO zK&$CLh5$^$#DN&Lv`7*m=Pb}`hkPJ9-{Gkdt~Vd?&@7w=<8qvut!2%&Tu=VyWGB=R zBn+iHFJBxVoH>Z3L#hoM7IC z4|^}dUji+~V9%_hP@!PsC<_ORTf{x^00ZC%;=Q=XDMd<*A`uW}WQUKX>YIt-HoQ)M zx(14c`r3r8;82*gW(PvUA^-zrq(FeB`GUmhMq<>IMtm#C2ff7T8BoQ!$4OGQ=1eFE;8i(VTJ@TuUJQNUqe@ zy&=`)uU|9wkIj#OK=8)LxrM-jjRy|2#;|?N@O3B0ZXV-@YG`uuJco`ugrc4?%n13n zVQZ0hYIeK>})=fnk`{JbrV4C2{zW;RcBK;H60dUH;`gxA5gU zfG>Ld1)Bjt#6v}uCJ)<8?O=FAY+lHLz~YeU$n+lPb*zT05eAY<=kvX-tj@iEu<=1b z3kdRWeAIP$#1@VYrlPSxtdU)2c^Kj}f2dX|Ps9mtmvp`rb@KtCgF{W=pgrS&s}dkL zV6%^^4)D7E@X{TVf~mLW=G1U1~t7Y!*^&*qvfy6sf zN+a4P>04Fvh_V4q7RmYM@4YMoyG_uGXK&wMXRY+$m@q5FKIU2`@cfA6kbme_wTRFqGw;p3TMKC|rgTEVh-&(|wW%6{fF`AL52%^=S7{sAB?M0e1aT;7h zCG8+d_BQ+FZfx!`tn+aS45Gn1GAtL0mH~bqN_dUII>~Nsu+d(Bq0=1j|3j8$`rYfBvZk?NW3Y86Ir7; zgprF8YIQd>yqc7=B!+k&v>1I7syO0z;9eg$9Qhq#6)88KzU2 z9&4;oZB+@w-xC)h*HbueYY)Jw$>tiLL``YkskDuwx5uGAL78~b zj;Q{UCk64|%J)n-o4?C>vp^4oX@7l^1u^1?&H2wZ!@qu)s|DL_GAf5G=lGhspOsY$ zxCK-9YM*M~8XysDm>WeRS6iaR>8O7LfCMuJ-B+&B!UJ3!(gTH}fs|DwP?ZTZSzD25 zJZ1t)Bv!HQwHumA=G25IvfeB)Yq0V0o>)uRPTZtH@j%S#LMLF5gKzC?OG-)-5HBCE zkf1vfROI4S!VKEYc0^FcL+0ti6wDsO>YPZVBYA#)I9X7bEkaN3U#CLR5)8jJ(v%63 zu5^7_>k|B*B--dPP?LK**Qh!4MDQQwN>~KY=Nka#99vc0^1%^2;w^lr2Eyq36`d8` z#|VhKTo;6Wa7v@GYRl$f{cv6n?%0eG?k_d5>&GjaQV5x<@tBE5x>J6rM0JQ$aw9jB zU^WnUlR>XQLzGm)@JAfyHhqEU62`@4FvMpNx%KC#AX|9AaeS6CRK~=j=W+_l7HgSA z;Gmjja8&Qp=JdGS;-QT4VnC#p)5l#)mB*5;j&Tl&JdXr;m6sPx@|F6%)hZ_eN+I|0 zW$Q^ttJ5X|J!*W2ow0cR7TyFPOX@5zW)lm;7rF3pGO>g#m~eY=W3U|KruA<*3ZyJ( z`(R;U3RBKf8_U3G_cczVsYJN<@MF(y5O88YlA&|3enNZbD_rv)=*dZXSHPiyoX%-h z8KH`2TSlmc%GXOBhc>-tOjLw+9W&PtdlA7l)R(|egnfmZA#9TyAOFfCpn^IUhV>=Y zCXGJbY{BM19QKB=@(b)xUw=9m?|vw{1mPYF^P$?Q*S#FA5{`E1n0d9}H3IeKZ4F`u z3z@1O%!ng5Mxv!IvLy3Bl*;;R@17Lxt6ry2-9^ui&Rl zy9MZErI9RAMyCmEIE0)TaD3L{DhfEoh~ODE$2}FYB{S8k)kd;u2YPlKgZ5;h6kCG( zU4B^0PDWvI^IV;mlBA+V2_}WBS-QD~qY3;#gDcXA6dSShU4O z=YMDPQB^mE@)k2Q7vZGD|ChL?RcOGn)Ll})DOx}f7*f{#2;vZw77^s?=K4;}V>ymE z6QQvE=xVYsVREW(7XueIgXe|aFf}Mi`XEs?-S;45)T?6BQeP%~3>w*-L9hNKbEU=D zyNY;Uvxvl&NG{!)DnqA*r4Q!3(8&_;tK^!Men}JFy~N(e-=22uc&spgTTgcT`t%(2Ne6pQ0!e>RXHu2!<($&IFza&XM5Q3sStj zP#XN#ei{EQ(Dl9JNCq@C$+vMb6A>EvKA+d9j>{adNjNC;lwg?JSiE5~mJfy>8Z~93 zS!;!rKlIy*0M+G?dBC@IlpQf*0MA@#IdJh2`F!idjd zjg%i`O&Xl0irI82UWa~;bQ}wd$fOA48w<4*a8V|&VL8vlZybkn%F5su!?_zvgbi)P z?lunRk)V)`=5$#Wcn3#|7Gkd}yg(73Pss#!ru+RcT#~YsY*q%EsWKM~9->dMoEnUq zrUIHCa43$f-gH;5%LAo6M#yFY;#_yryu8ld?l7x-=Q7ODN0DH%iQksb#44dysW8X= z6}%i(Bqs(ovQPxGemoeoVUagD30j{s8grDPnM0=mWGTi7m%X()J) zsIQvmA5&>f3emBxKmFFNOFo|UAX1$N7?@}WR<7u#rVZTzfp zdkSkWMaCK<0(IV!b3LaHoO&r)Q6b?sX=zi!;5|$7K_2>Cs=#7p9~SLChDtt3jzl=% z5@imA{}ZQsHa$BTeT_!Xg%!6VwKN1bPk;`kaE{AS$WyBRu{l*fvOy!*T-HQLL`q;6 zBa?yR2*4L-4)!~Jp!5Yj&uIj4w1`)Z22wV&#(aXXhVC97}4q@9*d)G4zK6O zm0Fl(m>L{U^HkQiwACYRQ9Oz;O|#Ll?|G+{x~K=^!UP_?ZHhOWKO2w*vh26E1+tH0 zN)hX1s#B*@g)0mqv`r(tEkWD8)%=(}GTjBc{`-QOd;1a=((N=Diiybh`1Dti9#O(M940|SHD3gWQxp^{c@l^Q zC1sGR)JvhObJY_JfhA9|qYN57^;r}KbZpTm)L0c`9a3w1V629{_dAy*mb1G~Ju#Y4 z0(EBm?*fu7m^^<5T`^)kfijbso&A-RS0M=X0ZR-J+oH<+P3Z*hqWCeK2tCvpN57|( zQ%zy5euMP4UJ)M%bp8GPb}#wI$jC^LLKF0VZnH^u10%0+K0Q#K8r)ts zP+Qu)ieD&w$y&w&uj}Xe9}og{765(v8-$M%irB>?hX_Vop)~$C;;QOMrx&t%eGK<^ zl=BGomhj}1h&wDHW!9L(EQ@m>#@B8&`H%*eiIQ~)J5^L_fNdn{dtqoL778zyoiu|Y z&@@Ucem(d;&vg!V&baOP?&kc<-o0PWyZD*s{qy*s<7CzM>BqwzWI_;9xk#({UhiAQ zg}A@Bywi3Z;geO8JYD8vr@R8>{m8UXYUA*pc(M}L@D@Y`W#2!Y#lj{>-Zmcs;0P}; zj!$%%m3D!>04=iP^fQQM{ONt!3D>ascN9#&yoX@DQ1!Qv-@^Vz-#2?cl6H=&r~NSu z>IxM$YO8lH`#lYMMZF-|@xn%l%rvjPHV3i~d*|bMGpq4X-GZxxxMRv4QtpFE0hWcpA5`O0M+|s zcI;1(PR_YX?(F}TEBUkZYtUX8rq8R~xp@ZRzcahz31^F>VZE0jCrTL{CO~5HwBDiF zgYc*0&i%ZNb?ES@YW8qC+c(4(vy4=w|f4#&|7$s3o?u3x8NVMU8Xy{7TM$ z-FRy#5u8~rmM?9D=tMk2p|x;}LBS_&7r&bRdPO^EkqOKwr5a9&z3!U;opo!UnRonG z$14vj?yDst1JeSsk%K_zA=F!~Z(Yzy(tyIE|{cHEBJ zjp#hTdz*T!Nzj(}0@Je2!er%@jS4w<`r7`u*C1_&gXwDjzDZyp$H;W3ru0T`+WfIy zHbv(Np14gZHE+c|02owG+GFD*_7e z_o>AzJ(8Al2?!tO@mpv-@ok-!pLD`tI0}f$hw%%Q2?BvL1HONABH?p??yQ*;>qAt8-a(zIvbCjOsmBvhgT^8 zFH}OZdXc(5NQxF;%^(0(3Fdzc_!ku}FRB-!kEefdTL7K(ia$TO3iWcopnnC{LaAW3 z##m^UKpRp|7X(aJ^c%2McM%;yFBbilVR!k6T{)qyytn$i*gB&ud~`NQ&d(@;R|gW6 z*l1g3rHcXKZR73W^cTn!$k`QUhgmD7K!wRsQa1$6UQCEXz)e4kuvkMOwN1xB ztlZI6l#FgwziArceUq<>$XOp_SvHkf^!R;ovN93xM@@-DhAEatvF9U?6vXn!S?o`R zqPR9nuQ+;lwRApwzS~X*w(6D0M(ruOWjzVhsBBa(7{9MDcLmu@U&7G{rFwbi40@Sm zxxEUbW75Jd%9pR?v${m&o7hSD(SB*YKF~r4_$a#__e}1w7Ko!P0ByhZVPQgG6Rjy3 zB&7n0`0r;mR0_tT*;@8m4t@ylWSDV$W9s@$>TV}=HLG#*b2k@=ik%=ereo+?A{7AZ zH0yo!TPK_zAe9)Zp1`F&i>wTi-H}}DP#d(y~ebu*#V@Be9&u6VGFlA8uybN(N zFcslweQEN`ipOSbP#6$oKKMUf0q+-%P(bOUUDFEPFTjJ%i!cHHtD6<~JUi@V)#KB) z=lg?=cvQA#iBYq7(LebXT`K~gw?m#ykX79GCc9GvNy`Q9wvsJ!{hvKM(2xq?E%Pxj zjs!@~U2h4>Jvj5d4r>NI^l!2HrJ7fE&+7yIZ9_XvVAD861KQ6=n5mRgs$vZ%#2#2^ zVNlBg5EQ>kbK4OhWD=|pMp~5Jh2k4>@VLuUF4?#2)2W(&zwY|fc?t75&860%?Q8&% z+~@SP_mu`l``4}|xP5X?(~!t59TVTztr}!|tHl7f?*s0OR-?UV8=MT?Cqy#9gpugOmObM@{1AL(~#IIu{=K z*pnN}0fK)wM+A@t(6?a`&>Vv{Fmqgf35pQGiQcLbMAXBTM)$| zEcKxyRn*}7TCa^-s7$q#EaV^>Dk;-25l0nTlMPur)Rik@;g@qOX20Ffz9l1i+#DAb z$Cs%D1-}bY4(vz{am?PLjI0M@SHNHy<;z@+H3!3Q z0LPn6X?*%&nNigSfe8~;F(S_|V{7KtJpYTZJKJfnHh5WsMmPHjVKA>X70bsgil zmf6OjUn@ZsCV}TaJk?LBuHVr(AxxYhYPZ5j2$e|eBF-H=z*2HF%HCPu)`FvT7^wMU z`6(A0{Z#0}av~RfBP>JQzvE3PEF5&e57Z2=5VH?Zdc^ao>jyb(+~a%xzKQw%#OU7_zP!4aq}{1P4<(v$D%z9tvM64RsaH}MUKYPts@2&t zAMTkarS2L$c{$iU5xZkXpcLfq3jB#zs*J?D>LRVRVvrE>@ifu`(G@A#N8q@{G!Qrp zss#0;yEt1cY`O|eY@bJBNs2Z-La7ki8KAjg*H^kS_VAQQtlMQkf;Nmd3AAMNUx zw5K}DK}0CbvBpGuCSe|w{k z-2ZWE0<1VMxV>8+#d44JP<)uo$-qI^PPx;BzGR{}?%x^C6tFBA!5kdu>N?v92w&n} zW2^~%4pbwuF2!MZkI|eWjNGG7Cm4v4v^K}Nc9w&Z;r7iX0U+{Z-@Gg^xTied>jfCG zQ%55;q!6qCXHhA2cU=3S(%!PQ=`Y6bAL9D)5PnMKZ-Y_3eZ+d??xgdZ=An_*Wt>{G zam4%>)$8BE-J^H@J-eB2nRd}lCRoUE<5?G`+}R5{4@)1hr2{u&LzG>DI3|=_$7sXEAP<9er)%~W;8i(O*@WYWK zZ->uRMJC&g1WH-tO#0zh7V>jt%%~{8B69ffPc?Y@2oj8awUU>eD4d61e0ms8aa`Ce zpk87AyXE;Y;WUX*KM&>os~=cP1y$%HoZ~*Q%LOwPmHS?d^D|-*4u-=#+5smu+Qv< zv$ag5LW`J$v?E360kU?BF#`0J8|k6EV6XH?z^LYLlorU`2s^7bc8z14^L6Tc+l%3>K_k2x!~aq%F9ms#9SIs3oZQbhvAYn{V7va$Jjm zm72`29v6BqdT#rt-uNNRjY51J2`#NiN87qJ=B6z1uM`9ijEi|CSoPTeLM799xxv15 zF4TtQ`l$=WYO&}$urc9>Uni}fcVe+Uftm>WDwVyLW(1?@1m%(MavYHbuZMfk1FNhj zMTD+NX?a_Ka$Cb2ux|XpdW|FWrvgJbzjX-n-UbQ_uR0=G+%LzJBD)`W))meSnw$Z4 zQtEX5#4M*SJZMDZryAHb@UVb~M12kaNdxEPU%w_SXD==S8o?x>N(k$NjY`fa=@b1{ zX3<1XUPv!h=v_t?f{hq!q+uv3_J_C6o}QsLgPQSQCpG3{q_q~szQ-mp(Adb=C&oJ` z*)|vtC(*Lm!TbX|hJY$|*cv9z8D}X-NNY`&2=3|@r`x0oH=gOpg*~Set0+^-oUY(1 z4JI1;Yu0-v`PKlrln|+SHDbb**l%V$rP4oR20kLU$!N{LZt&X2eiJVGB~j|4{CAf` zfr5Mdn=mv&etQG(T;C}9GH}qEq2rkkaYfudsvVp+2#91H{pQTE4f~1_rUBWQ0eLI{ z?h($T5H%8;6qURpNxlH@v@SPvB-NHstG-{t=6lWKY`~L=XAGHLy$)F+M=A9u83-`A z!)rnZIt$I&$~We>P5IwpwI1xy`-C0(OnI@z8Qc{>oT*5T%hihRua8EX5E4_MC5g8K zpGV_QMSN_)$dQ+Q8>lo>V%s0^_gzE4xB!(eh)Rfn?PO4Z z75A|D5i%U`FADgDev*-d0Eh?)por>&T2_1esA&~p7R&?MF33zyc|I_B9B9@FQ_j4- zLEc;)dHK{Yx4-6Z=-U?0TDm*M+#4>*d)mPvET)RQ)}efP#)0D-CJ8`}NRzxcV`@cQNHKwS?s}E%(usWzmX0q;w@*i_L)bDeuoum8ppv_Qe+a|2}?)_t|^5 zsN+l4W6c@fcK;Mk6rX5ix#>|-JE*)Nj`!OIouXTnB5dhEmLNX<+hU#dCi?52ac~|j z7aQHwwtK(j3H}_B`Bnm{W9w+&n+wN(DwTivWQ|k=yl2OrY|lG!Mm;G*KQnc;k`|fY z#OeP#ZjF8+?^!YW_)&|bX^5=9wT@K+Pru#eZIHluF!9JD$ zsVwGMCzI*-%C~1v{#Ab0JXunll;Z8wgA=`rPuuS39zP)YiBAX}xHh}Ji#+z9OU_q5 zHW>YAr~UD#{7rmE)3W%d%~ew0E;W2>mkH{L8|J;%CrK+P`%P_~ip8CYvP!~GJX?oq z-(=LPBcp?2`_Wjf9SvDXs7;oa_pBhI<;QG~_vdyO^*&1oco5g~D|d{Jr*5lz^hadN zD?PW>*7Z9_k6WkowX(cL#ngXfGspLxSN<)F&_J7Lm4P`4&tnbQgC1wYRC#QWx6*nb zU7&rx+XGH8-<6xtWo2%Y*!5a+l>l{4RSRUUmAo@4qX-RrB#S*=+(CB*C%a%AwgvQ z(N_wr%CZntIhU|d9EW99GS->D<3IoJDdf@Q_T9zWYma+|q{RDZr` zoMSw3fmG96D=j%_G%Y@VPf^J_>qpR^J#_u;d%j8M!(n_nDkOGxc@U58ZHIUX`S!-) z2vYxbMdp?1QoXl{0^5_lW%!Yg@j;>)-AA9PhNtwp?_=N$plXB?jV~G6ZlvG%ng87U z`8nr9ob@-K~&OwP~x1|1GFzee)N?ryfUl7+SFR~x(8-RysyZO|(6 zEmbW1MgKKtxpq5^Pl{cV|7J; z{mh5TNfhL6_W6C1NwWk;M<9#!F3$ZbT6Ts-Z*II(Tkmk6&J)fw#FEI*ANAuge0j4S zC&c0j?PpfvAI=8*xyAC@mmO)R-O&9zHWM8>xUY`n$qlCux}W1a-~KMH;BNf3ofuK~% z*QbT_6|Kv<&fN51hu}2PsON_+AGtV>)-W0UxsK~N$*+F?(yhfbq(3;c?3(v~3>vyD z;neN0-9C;A66Lwvt&A>c|F<3(JfB6YF4x(5TcmCs0rc*#*Rqg9yb$Jg~nQPno z-}@i#E04!NmbBQhx7RJjzH&HUDoPUXJ&g|beAUj@avZpI5rG{$`f+4W{M{1Y?bY$1 z@AY=Jd#R5>(sR>~i&Kp%-Aub1QQklWl*aLRfgir?+wI3*wbr9w?r_>a6y@nSh}dt` zhps-UZnLvSGtK(=F1NaLJXs!T0^bN?>|DS^FGf=Y(JJMg@?TOseoJ8sKT|Ig+e+rAt+k@@W5^x4g9&}$ z@u~f!15)$PuMGD6BqY(wAV;FH+M!>4(jT0yswohev7v7~`3xQw);@pnZp<(96l5WH z^)b(Pf41IXW0rC(waE_V4nNSN<i;U->TKT$(6=+ucE=Y=Rf%7mr}MNN+Z)1KcqME zqVv7LQ{BQ_A!N~pDqZi1mR+02+nFL9bL}7T&%3`MmZR;;3daZHSFEH@ibM_{_+Jev zeCA)efEywAI!|q*4P_nu$Tbe`z}!F5kRyRfse7FUi|=~$pEW+u1?-+b*O=yr9^`^@ ze40Mbn_Kd?r5sBU#1>^wya~Oe0P?o&pDZHT{G(JX_dR<`%=3kf)@9Yl10kv*TE+B^ z+k5eIbAyuSH1C|YwWSlfHsL2LYwzeUk`VC^!P6ZjWsu_0TAz}Z-`C>4Qycv^;%DkX zzg7QxOxxV+?2CV8`V*IMIcdhO?6?=#afh|y;HN2Hq^(1D`mL7hey-{AGLNpzIQh-< zBF&w_AyxHi8}2G03-NH2#bxJtJ>9)ZhhJ^CU!->`Osf|0v*~V;*qzTczLD?K!AhKB z2SvLldJ{uzR?Bhlr%)nE$d$eu`{HSU&#ImCJgex_?hkF{&;i0H{FjTVd3z2?52rEO zS4l{Fs9xRB`~mr=uaU;~wCjK&M&12)hc`}q7a?}yWP#twNB=j*{fW=^lMFF=O1O1b z>&s!b^9gPh{-4IqDlE#dYug}5igZW{NXO7fiL|uR2+~~=QVI;xjdXWP4G72(0@5u* zr*ugVImFEO@V@`?AIG=%vBM4)T4}PPF0#3gDq;0$S=dQ|+>Zw@q zR7rl04JyHfc*2klkJ^RJ3#5&bQ?38xcZPt=>7~b6Jx%DGQ!lTgTBkJ-tCRZuo40?L zyzOM)8%=Za+^Yg_erf_Yf68d@!Km)Sd5`Umo4%gF`RF1x9qH#+zNl^Cv6kznzr;WI zn)W-UaMv{w5wE1uES%!#l*iZq&8kUFDM)a2b=OP>;__F zv3>i6XfKFtZI~H6MA5U%E{W6*My4sOV8pl7mOEe+I4YtXHGtDnIz1t+$Z)Y;%*w<2 zapIo}pW~;Sl&m8!W7*Edsp=Ngp7b5`di3;IF6S<>L{+H`?&Y#aUD5o!C@`bemG^{~l+GCm9`beJGc}O%yxNZ+>VsjkU~}*le+Sdwx)= z;xjy&=hrb^;m2kzS-WEM-d*0DI)ZsCF*@~% zmz1C?2)IyNI%VCkUEhuFWAGi~3qyd{E{w8z{ysG$8HVDV%-oemfFcyY>J={{p3KbG zz!VonbMBCArXU08+NF9h>`Ll~D*Tb&;g2*F(6xcE#qHKDtKF@>3G)A+7;6yfR_fFO z{sLM~zrnOuEYAccH{bkh9&WHHWo;0?fV|#9WzEZd2Ke(d}<6r$Sl!k(K zXf3OINot`LoTm8GFOEYm6?`L8tzTN7=ap);-9Z}ua125+Fy}Di&{L`%=sp{-Z@Dyo zoC}+#Y0c5}@xBRL6jqa+qrC^v0q8QraEnQv-(Rr9&MR%{ySrukJfyL?pReb$dr^tA%q`k- z=Yic0p@%E9P9_BTdm;+|$H5u0W>)Itp!`&JnkOl~#=Yqb_+9-jAeap*$|zl$JBNPe zyZ{8ClcFpqCqGkjA?7OY+TO+jubG)DGN{$e?4<_P;tB%Mg}Qm{N!x&v(~;BrP+3c5HIKoX>!vr`;Lk!<0iFhaB=7D!XSTM~Qw(h%3SSH|-sQ`(dk5Nw z0-O6(+T+6L@i<<#UGR@mXQyKLE|oBq zI1l+foafQLy%_w)tcKp`mHb1(jbJ1?pt9#=S8!r ztU=T2_YFR$8sSaKCzRq`Q!hJgO}BQgc3T%^swdkA8E%#fw=cX|R-QR6+*C+CmE!7K zs2>v>yn3%6gZ8t^)8Oa|`RCZ}qax~ivfRzbi5pJRj_=3g%TMjdU2nASpLYB$L0n?z z6!`TFe>@J@HGE6PcYDZayDjm)u-f6u{~&bf2RVb=U5USN?_u`O~mn z-4}SxEaOl@3EGb4h-^elIX0!a+a1()%T!1Ithg8$f2XHd4DB~})(a}HPBP7oo2I#3 zpUczmjzjjh<=jc7$i?loD8+ig+~UP|oEq*EfU>qkS-+#6#qZI)_VkryvnaaJj60FwavUpdA}resKbC@Mg^lsx+fc)kCa*1BFUJ@(jEUU?&| z`R}LcB<~QV-|cdhA0nvP6g&xD9gq~SWTSk}RXUnaY#Fd^lh;)v8+*BYWNczPG3z|2 zUa6F)q&u30au#3GKcjd7b`pN{x2wULCx7-j+r=Ar_Ef}*QDJ2l?C1*D_MiKv_3V+N z_>=)xa*QL2aT(wIf*}q^kW-!VcUQ?==bp+ph`7{ zwZ9xVH`4#Mi|+z5Z$e*xMJwhPJwwh8>gg!H0!$>CKTPx;E!Zh&ynjDzZKpSy6FC6 zJDMSVx*Xq;EeP)0sbBPNl|Xo=z|S%{9~zuPtSI81f11$l*9N2Qk)J_UPAUuUL5H_X zZZbogv2RL8?hWbBrLSI2rK1q94}Vv59S>fxdlPaUv|jw>>8$C>WqY9;o|~dK=mc-I z)N{Xu%%n5SrvFTtN?ikrmiZ&t3f%{isPNpzy`%nnr`ytp%UpQy*xOt^UFrO3tVPjL zh~`Bf&B3_NO7*3CwO?P#jg<(WlNc@KAQ143)<~uaKi1N+LJSI*` zDZAh)RWx$eJ#LsNf}mQP5__yZajrr3NFT4>^ln%g*thrWY7K@k(uucoTw1PoD&brQG~dU!s7vIXGyac*A7EVczlK94#i%6lb6(B`iAb~u zA4$5%D`@%qqHE_1@-4(HGU1LTOr4Nxo=es6hOms_va;oP&)1k27#gDXugb`r8%<#% z;kFMmG+ptk^7XINW9bc8HwWTId{N_!)7y~e zzZM`XI5>egDN0nL47%{RchU5Hn}5^#A?U%xdpu&PaybAV4zMNJs=D&+-Jg;}Zcom}aIBhobojpy#p| z{W8(n$|Muq0~9%nLtvYORKS@!yhP)(Y^2F?2kMn2U}V9MFJ%~w!1~T2jy zfOzE&gB~Mqg1)hvg0X=h!W6%A#cR=-FBs?emnZ_1@U*KE(#{ziti4I<7lQc90L8|vG+91U8?_!i zh_Ybhj*sX!ZXomR!6*FMy9+DwP@hpC?!jq>6E=I3?>S}xhBRC2t#eRz$7&G%<-Bd) zQ#$b;)#fjN-VS`?VBp)!s{NW)UVq#SEjrT&F=#DlB%C22ox}qgIS^h9y3!Kc$@U0A z(Ppn@GZDmWy|RJ==0t27HzA3G+Tc8xH6X+SKkow&_crQ!h#1`#-za3&dMPByPAG?x zd4bG5B2(>o7-j)erx-fRPc6wSfr(lC09Z5 zLs)3*{70lAg%aNJc@uSbx+#2SB}G;wOo@H2Zo~1jXdL%kGL_AGk!EQ)-`Uhvkb}kD zDH9#qq|uUqzYCC8giMYt^)NvjD)$HVe}>FlbTY%>R8l5_#Z0ojGl=kPV8JDK1CWv8 zbl{+s^r`(SNlgc-#OtJ-0Jqr?tuo1~ocJ&8c@poJ3#SR)ZJ9GEGOowugSVy5$K{sd zd={8*DDO8jt2`{q)J_07JOWK&^`aAl@cd|bk&O0k))f3fjrrIrBXkcy3$L(e7hi;+ zBj=e`fMR0r)35v2?`)K~@ZJ=2;*qN3JNc-}W_U)sk0`1Zug=hh7?N2Ym1fJ>#_&Xm zYA3L#vWiHbP9k00t7#l?r~xHLm|mZA?0~0fsjK+zOn{iO&oGdb@?Zj7yj4{~?7{K) zxePz5R=`l~zMfF5(GC{mKhmgXo9k=yZwMgn?}r%mI|2{j$8J5U1Q?WB8 zokQTmZQo4XG+n3GfabrL9^80I*!OQy6tU7;q!`<>o#_ZAIhO?NYm{z!r?s$jwAlT$ zy%20nfwDI=@qFgII?JE;tAFNwOjNe*iOv`X+fpV258xG`z{Txd(`E0*n!1~xWf+|z)C-K@10N`y|bZJ${ zSEH?yx}58-8C-+_Ecf~La+1g+z|qEWo5`H3QuI~!c2ey9iMFPca2GK_A;Fh#kNO%a zS{5OnnpL2%G_4I`-ImWuOo@#;*g=#-Z!t!{{(3J5sa>4Eh+XZ?e_o$0pX^a9Mlf1Z_3X3Zm#X%I}Jpb-GAR50}Uok zq#lQT#X!#>*?TKR{~uHCTaBFrCHg@hLGpxjfigcNVyAxeGgC0&0WtgvRVRr)-b^p; zZ5l`oGJn%Gl>KQ!IhpT|N%SFmQ_3UZjm*}1s~Z(6r_uzA1u!E0)IWR(O| zZetrsWQgg3@ZP3K47X-+)UPa+n>{yUb*gx)omHYac} z(~e>`@Z5;{>2rOK4L`T%0(QA4W^aK3MkccM}@Kff@=w4eWB{e+lef>lVANIa4U zzd*bBY#7ARe|1;e4<&on1gQ2kx-MknkKZ2^(ULW$Khb$fbQDL~RkW}OLS|cTHkx%W z2VyO))mShr^C#yE0Tz`hqRKTrn;~(KiOq!=y zKq9>dYd_&)K8VLRkB~^|Waky3h~>{V5n^9@YiX#d>sH1xZdX9%WScQ0`*g;{h}J`h zy;H*FXwV?|>{HVw%^{iYTu&$kr9oaqptV{^OKweO^WxcSpCFa^BP7}x;^%Ft#5nn;?c+$Lc=gW5CG6Gi{A~s{Ra<89sI4vKbiGh7HTwJd*gC;|CuUnYQx%#opxV_Vv({`+g^AAl(Mg^Xt+>Bdc@yBx4HjAAO|spAcePHEZ&OD|MCnKf(fqD&7W5D0}D zlSq(<8-HT?Sh`L#X_aN;$6tR4bp}>F)H3dpVLW5{Aooiiqs73W()@=8bN%-ytPCqH z)=<^0^_;B}={UCVqZo-Xw?aC_P2#Wk9c&PM(|&acR>`o+AQ27Pr=+6nvx&1?TD0b4 zlY82-Cs6}N-Yg3=@2J*fgO(9$ja(BQ9{-Mh)0~mC5h%iDIku}L`^q#zx~ytb&-U zQl4lI$UMuOoa8463Vpi%>$|IB!IYoz1?rA=$An z96a1L zy#W$DHE<350_nKy$hC_I@krfT(ocor8w&%0kA?VNEs)`1H99;gmACVQDNvT=Rlj$O zhmDvlT%6|+qTl-vxE#x1j@HjGA9;s_{KH$zRmvCpD`1HCR*p z?V{QX7sA(sGcqWS-9w>#DxBw%aCwnO+h)UvhAX`h1V6iwM4n!tFHDqtvP`CLLTr;d z{kzFKRkSI4;tbg9=6OTxii7s|w-z35U?Em>dS_y4n?&Vi^4y`wr+`*}yMNsv zh3bX6*>CjI?pz1P53kRsYz#x!LQkAz2`I6=33(Fu!vkN5ef1e#-6fxprW~^GG4u-Q zMTZh#z(xYkxgHgQ6T+F*1a;$@O#%cKiM=*^x#H?mY4z29w?UOOsDQ9+=n;=fEuHE_ z+79ijGBR(B9`kY6iY4wOE4#P7u+t>HU~OUMBQoI#d!cV@gQrawrxC%{vwe|ftzy;j?ZnFnt!?T``nJY|S18=C~^wLkb!!6c(- z%QVhzNQB8eWPDslY;zn!YmqNDQaVW%!9rr&nK5l9$o*a|05d2UnPXDwE_6e^AmmxF zlpB@ffx&vr_RJ}P@s%tKRgml?rV8^voY&$N79?8&6e1?;U#kSS-x%SkY|`mGv%^hG zP-fi%^3=u=TL{I!nqh-#hbCc~Ph`OF2ylq8XDtU3KTc?;X zlmO6G&6-FgeoD0awPNEPno`1#0M4VFP>2sq%zZj-->e{J_r=SUj{wLdj*crPe^k>0 zW^$gNN6 zdiH2P{Peo=8xn>+8|%evrlL?4%<2>+Nup*+Rw#v{b+pa|U=`7>FH$BZr0ddBB}`OE z^u}Aw0%iJCoG3QIe=WuuiN3ujg0*ptQrw%f%$pHcO^#qjrvP8OV-7wb6 zMH9tpmOd~Cjx3YVWN+yYHh+{{GJxtaF-MBA;dz>yXKPg{vtbUx@{LdkZWbE zES#`wF3G6C#+Z}d7Pn!6nut4GLe_JBS`Bjy{-Tre9`V-X)+oL{7Io*PgQA%QJbb9* zSDZ)Ngc(=vN22e6l#TpnEAB@7q491TXNQ?84n8ee^P8t(oMH3H*OF8I%Es`$vb?Ak zgE)%A=ap3$dG?M==R%}fCrR98OL%7p;vp!D))?Ps=;wG5+2%R+8Y4#ZL?D$GB@$w4 zL;13fyAi-*ULAev6VDm|c+v_ad^X1+I8P$t-8_ciaL_mym)JTaWy?_Bt2P}x@B+vJ z8p_n-RK)pFn|SotoAFp|_iW%5TYn}U@B6^?H-Hi^9B7PQxbW^7A+DIOOYO2W@5=F* zOK16*So6gQ*5%}}jz0QGebQnn;uGKxanDG9B)A^66;v$qBxm8ZLGGBU&sy%rQ_hb; zZV7M6DSNx7UH8o@6q3p~Z8%AXnTpUW*=?OC3SPUK7%M4|gsHAzhf~FEpKEl5)sDuj z_Xa*ms59p0t+WuHv&R!)9O1)E;&b_oJ}LS^mqM#BwvG6)vx8hpXV57tRrG7g3DU+r zt>S3XLcWqsYL)u`px2*qlSXL>) nJIem+ngm9JR=<+h*HP#ozdrf3=cmqSz?ZUuhJ1~zS Date: Thu, 7 Oct 2021 11:40:30 +0100 Subject: [PATCH 042/284] updates --- .../essential-services-and-connected-experiences.md | 8 ++++---- windows/privacy/windows-10-and-privacy-compliance.md | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 8958a39396..abea067f98 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -20,7 +20,7 @@ ms.date: - Windows 11 - Windows 10, version 1903 and later -Windows includes built-in apps, services, and features, that connect to the internet to provide enhanced experiences and additional capabilities. These are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. +Windows includes features that connect to the internet to provide enhanced experiences and additional service-based capabilities. These features are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data can also include information needed by a connected experience to perform its task, such as configuration information about Windows. @@ -55,7 +55,7 @@ Although most essential services can be turned off by enterprise admins, we reco |Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
    To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). | | Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.
    To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). | | Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
    If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.
    By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
    To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | -| Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
    To turn it off, see [Emojis availability](/windows/client-management/mdm/policy-csp-textinpu.md#textinput-touchkeyboardemojibuttonavailability) | +| Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
    To turn it off, see [Emojis availability](/windows/client-management/mdm/policy-csp-textinpu.md#textinput-touchkeyboardemojibuttonavailability). | | Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to log on to the device, the user is an administrator on the device, and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
    To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | | Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.
    To turn it off, see [Location services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). | | Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.
    Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
    To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). | @@ -89,9 +89,9 @@ Internet Explorer shares many of the Windows essential services listed above. Th | Compatibility logging | This feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed. | | Compatibility View | Compatibility View helps make websites designed for older browsers look better when viewed in Internet Explorer. The compatibility view setting allows you to choose whether an employee can fix website display problems they encounter while browsing. | | Flip ahead | Flip ahead enables your users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting your users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website. | -| Web Slices | A Web Slice enables users to subscribe to and automatically receive updates to content directly within a Web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices. | +| Web Slices | A Web Slice enables users to subscribe to and automatically receive updates to content directly within a web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices. | | Accelerators | Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options.
    For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word. | -| Pinning websites to Start | When a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email website might send updates to the tile indicating how many new messages a user has. | +| Pinning websites to Start | When a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email service might send updates to the tile indicating how many new messages a user has. | ## Related links diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 84781d9b7f..36203bd9bd 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -113,7 +113,7 @@ You can use the following articles to learn more about Autopilot and how to use #### _2.3.2 Managing Windows connected experiences and essential services_ -Windows includes features that connect to the internet to provide enhanced experiences and additional capabilities. These features are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. +Windows includes features that connect to the internet to provide enhanced experiences and additional service-based capabilities. These features are called connected experiences. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. Essential services are services in the product that connect to Microsoft to keep the product secure, up to date and performing as expected, or are integral to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. From bb638555ae0cae6f2c869132cdf38dc5abc48aaf Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Thu, 7 Oct 2021 16:27:01 +0530 Subject: [PATCH 043/284] Update config-lock.md Updated per task 5475844 - New topic --- windows/client-management/mdm/config-lock.md | 136 +++++++++++-------- 1 file changed, 79 insertions(+), 57 deletions(-) diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index 74aff00b7c..a45eac0f5b 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -1,67 +1,78 @@ --- -title: Mobile device management MDM for device updates -description: Windows 10 provides several APIs to help mobile device management (MDM) solutions manage updates. -Learn how to use these APIs to implement update management. -ms.assetid: C27BAEE7-2890-4FB7-9549-A6EACC790777 -ms.reviewer: +title: Secured-Core Configuration Lock +description: A Secured-Core PC (SCPC) feature that prevents configuration drift from Secured-Core PC features (shown below) caused by unintentional misconfiguration. manager: dansimp -keywords: mdm,management,administrator -ms.author: dansimp +keywords: mdm,management,administrator,config lock +ms.author: v-lsaldanha ms.topic: article -ms.prod: w10 +ms.prod: w11 ms.technology: windows -author: manikadhiman -ms.date: 11/15/2017 +author: lovina-saldanha +ms.date: 10/07/2021 --- -# Secured-core Configuration Lock +# Secured-Core PC Configuration Lock -Config Lock In an enterprise organization, IT administrators enforce policies on their corporate devices to keep the devices in a compliant state and protect the OS by preventing users from changing configurations and creating config drift. Config drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM, Windows 11 with Config Lock enables IT administrators to prevent config drift and keep the OS configuration in the desired state. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. +**Applies to** -Secured-core Configuration Lock (Config Lock) is a new Secured-core PC (SCPC) feature releasing with the Windows October 2021 Release which prevents configuration drift from Secured-Core PC features (shown below) caused by unintentional misconfiguration. In short, it ensures a device intended to be a Secured-core PC remains a Secured-core PC. +- Windows 11 -In sum, Config Lock: -• Enables IT to “lock” a fixed set of configurations on Secured-Core PCs under MDM management -• Detects drift and quickly remediates -• Focuses on security features -• DOES NOT prevent malicious attacks +In an enterprise organization, IT administrators enforce policies on their corporate devices to keep the devices in a compliant state and protect the OS by preventing users from changing configurations and creating config drift. Config drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Windows 11 with Config Lock enables IT administrators to prevent config drift and keep the OS configuration in the desired state. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. -After a Secured-core PC reaches the desktop, Config lock will prevent configuration drift as follows: -• Detect whether the device is a Secured-Core PC -• If so, prevent the following Secured-Core PC features from being disabled without IT Admin permission: - • Memory Access Protection (kDMA) - • Memory Integrity (HVCI) - • System Guard - • DRTM - • SMM +Secured-Core Configuration Lock (Config Lock) is a new Secured-Core PC (SCPC) feature that prevents configuration drift from Secured-Core PC features (shown below) caused by unintentional misconfiguration. In short, it ensures a device intended to be a Secured-Core PC remains a Secured-Core PC. - +:::image type="content" source="../images/config-lock-mdsl.png" alt-text="mdsl"::: + +To summarize, Config Lock: + +- Enables IT to “lock” a fixed set of configurations on Secured-Core PCs under MDM management +- Detects drift and quickly remediates +- Focuses on security features +- DOES NOT prevent malicious attacks + +## Flow + +After a Secured-Core PC reaches the desktop, Config lock will prevent configuration drift as follows: + +- Detect whether the device is a Secured-Core PC +- If so, prevent the following Secured-Core PC features from being disabled without IT Admin permission: + - Memory Access Protection (kDMA) + - Memory Integrity (HVCI) + - System Guard + - DRTM + - SMM + +:::image type="content" source="images/flow_configlock.png" alt-text="flow"::: IT Admin scenario: -1. IT Admin use MDM to enable Config Lock -2. IT Admin use MDM service to set policies -3. Policies are targeted to user/device -4. Policies come down to device and get set -5. Configurations are locked -6. A local admin user attempts to override the policy -7. System quickly remediates policy to the desired SCPC state + +1. IT Admin use MDM to enable Config Lock +1. IT Admin use MDM service to set policies +1. Policies are targeted to user/device +1. Policies come down to device and get set +1. Configurations are locked +1. A local admin user attempts to override the policy +1. System quickly remediates policy to the desired SCPC state Helpdesk scenario: -1. Helpdesk support engineer investigates the device -2. Helpdesk support engineer contacts the IT Admin to unlocks the device -3. IT Admin unlocks the device in order to make configuration changes -4. Device returns to locked state after a defined time (default 30 minutes) + +1. Helpdesk support engineer investigates the device +1. Helpdesk support engineer contacts the IT Admin to unlocks the device +1. IT Admin unlocks the device in order to make configuration changes +1. Device returns to locked state after a defined time (default 30 minutes) ## System Requirements + Config Lock will be available for all Windows Professional and Enterprise Editions. ## Enabling + Config Lock is not enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it ON. -Config Lock is controlled by the presence of the Secured-core PC Device Identifier (the “BuiltAsSecuredCorePC” UEFI variable) inserted on the device by the OEM during initial device manufacturing. Config Lock can be enabled if the ByteArray value of this identifier is set to “1” and IT admin pushes the MDM policy to turn Config Lock ON. If it is “0” or the variable is not present at all, Config Lock cannot be enabled. +Config Lock is controlled by the presence of the Secured-Core PC Device Identifier (the “BuiltAsSecuredCorePC” UEFI variable) inserted on the device by the OEM during initial device manufacturing. Config Lock can be enabled if the ByteArray value of this identifier is set to “1” and IT admin pushes the MDM policy to turn Config Lock ON. If it is “0” or the variable is not present at all, Config Lock cannot be enabled. > [!NOTE] -> BuiltAsSecuredCorePC actually accepts ByteArray values of 0-9, and any value from 1-9 will indicate Secured-core PC to the Config Lock feature. While we recommend “1” for consistency, OEMs may optionally use any other value up to 9 for internal versioning reasons, or other purposes. (Technically, any value from 1-255 should trigger Config Lock, since BuiltAsSecuredCorePC is a byte.) +> BuiltAsSecuredCorePC actually accepts ByteArray values of 0-9, and any value from 1-9 will indicate Secured-Core PC to the Config Lock feature. While we recommend “1” for consistency, OEMs may optionally use any other value up to 9 for internal versioning reasons, or other purposes. (Technically, any value from 1-255 should trigger Config Lock, since BuiltAsSecuredCorePC is a byte.) The UEFI variable can be set however an OEM likes, but one option is to use the Set-UEFIVariable command from [PowerShell Gallery | UEFIv2 2.3](https://www.powershellgallery.com/packages/UEFIv2/2.3), per the following syntax: @@ -72,32 +83,43 @@ powershell.exe -ExecutionPolicy Bypass {Import-Module .\UEFIv2.psd1 ; Set-UEFIV The steps to turn on Config Lock using Microsoft Endpoint Manager (MEM) are as follows: 1. Ensure that the device to turn on Config Lock is enrolled in MEM. -1. From the MEM portal main page, select **Devices** > **Configuration Profiles** > Create a profile -1. Select the following and press Create: - - Platform: Windows 10 and later - - Profile type: Templates - - Template name: Custom -1. Name your Profile. -1. When you reach the Configuration Settings step, select “Add” and add the following information - - OMA-URI: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock - - Data type: Integer - - Value: 1 - To turn off Config Lock. Change value to 0. - -1. Select the Devices to turn on Config Lock. If you are using a test tenant, you can select “+ Add all devices”. +1. From the MEM portal main page, select **Devices** > **Configuration Profiles** > **Create a profile**. +1. Select the following and press **Create**: + - **Platform**: Windows 10 and later + - **Profile type**: Templates + - **Template name**: Custom + + :::image type="content" source="images/configlock-mem-createprofile.png" alt-text="create profile"::: + +1. Name your profile. +1. When you reach the Configuration Settings step, select “Add” and add the following information: + - **OMA-URI**: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock + - **Data type**: Integer + - **Value**: 1
    + To turn off Config Lock. Change value to 0. + + :::image type="content" source="images/configlock-mem-editrow.png" alt-text="edit row"::: + +1. Select the devices to turn on Config Lock. If you are using a test tenant, you can select “+ Add all devices”. 1. You will not need to set any applicability rules for test purposes. 1. Review the Configuration and select “Create” if everything is correct. -1. After the Device Syncs with the MEM server, you will be able to confirm if the Config Lock was successfully enabled. +1. After the device syncs with the MEM server, you will be able to confirm if the Config Lock was successfully enabled. -## DISABLING -Config Lock is designed to ensure that a Secured-core PC is not unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as MEM. + :::image type="content" source="images/configlock-mem-dev.png" alt-text="status"::: + + :::image type="content" source="images/configlock-mem-devstatus.png" alt-text="device status"::: + +## Disabling +Config Lock is designed to ensure that a Secured-Core PC is not unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as MEM. + +:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="firmware protect"::: ## FAQ **#1. Can an IT Admin disable Config Lock ?**
    Yes. IT Admin can use MDM to turn off Config Lock. -**#2. Does the Secured-core PC Device Identifier UEFI variable (BuiltAsSecuredCorePC) value matter after it’s been read by the OA3 tool in the OEM factory?**
    +**#2. Does the Secured-Core PC Device Identifier UEFI variable (BuiltAsSecuredCorePC) value matter after it’s been read by the OA3 tool in the OEM factory?**
    Yes. Config Lock will always read this UEFI variable to know whether it pertains to a device or not. So, changing the variable changes the Config Lock even after the device has left the OEM factory. **#3. Could an end-user run the BuiltAsSecuredCorePC PS command to disable Config Lock?**
    From 8fa02b591c958e8a8730fe884d4bf750f74f7c0f Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Thu, 7 Oct 2021 17:08:15 +0530 Subject: [PATCH 044/284] Update config-lock.md To fix acrolinx score --- windows/client-management/mdm/config-lock.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index a45eac0f5b..e662f8090f 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -57,8 +57,8 @@ IT Admin scenario: Helpdesk scenario: 1. Helpdesk support engineer investigates the device -1. Helpdesk support engineer contacts the IT Admin to unlocks the device -1. IT Admin unlocks the device in order to make configuration changes +1. Helpdesk support engineer contacts the IT Admin to unlock the device +1. IT Admin unlocks the device to make configuration changes 1. Device returns to locked state after a defined time (default 30 minutes) ## System Requirements @@ -67,9 +67,9 @@ Config Lock will be available for all Windows Professional and Enterprise Editio ## Enabling -Config Lock is not enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it ON. +Config Lock isn't enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it ON. -Config Lock is controlled by the presence of the Secured-Core PC Device Identifier (the “BuiltAsSecuredCorePC” UEFI variable) inserted on the device by the OEM during initial device manufacturing. Config Lock can be enabled if the ByteArray value of this identifier is set to “1” and IT admin pushes the MDM policy to turn Config Lock ON. If it is “0” or the variable is not present at all, Config Lock cannot be enabled. +Config Lock is controlled by the presence of the Secured-Core PC Device Identifier (the “BuiltAsSecuredCorePC” UEFI variable) inserted on the device by the OEM during initial device manufacturing. Config Lock can be enabled if the ByteArray value of this identifier is set to “1” and IT admin pushes the MDM policy to turn Config Lock ON. If it is “0” or the variable isn't present at all, Config Lock cannot be enabled. > [!NOTE] > BuiltAsSecuredCorePC actually accepts ByteArray values of 0-9, and any value from 1-9 will indicate Secured-Core PC to the Config Lock feature. While we recommend “1” for consistency, OEMs may optionally use any other value up to 9 for internal versioning reasons, or other purposes. (Technically, any value from 1-255 should trigger Config Lock, since BuiltAsSecuredCorePC is a byte.) @@ -100,17 +100,17 @@ The steps to turn on Config Lock using Microsoft Endpoint Manager (MEM) are as f :::image type="content" source="images/configlock-mem-editrow.png" alt-text="edit row"::: -1. Select the devices to turn on Config Lock. If you are using a test tenant, you can select “+ Add all devices”. -1. You will not need to set any applicability rules for test purposes. +1. Select the devices to turn on Config Lock. If you're using a test tenant, you can select “+ Add all devices”. +1. You'll not need to set any applicability rules for test purposes. 1. Review the Configuration and select “Create” if everything is correct. -1. After the device syncs with the MEM server, you will be able to confirm if the Config Lock was successfully enabled. +1. After the device syncs with the MEM server, you can confirm if the Config Lock was successfully enabled. :::image type="content" source="images/configlock-mem-dev.png" alt-text="status"::: :::image type="content" source="images/configlock-mem-devstatus.png" alt-text="device status"::: ## Disabling -Config Lock is designed to ensure that a Secured-Core PC is not unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as MEM. +Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as MEM. :::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="firmware protect"::: @@ -122,5 +122,5 @@ Config Lock is designed to ensure that a Secured-Core PC is not unintentionally **#2. Does the Secured-Core PC Device Identifier UEFI variable (BuiltAsSecuredCorePC) value matter after it’s been read by the OA3 tool in the OEM factory?**
    Yes. Config Lock will always read this UEFI variable to know whether it pertains to a device or not. So, changing the variable changes the Config Lock even after the device has left the OEM factory. -**#3. Could an end-user run the BuiltAsSecuredCorePC PS command to disable Config Lock?**
    - The PS script is accessible, but the BuiltAsSecuredCorePC becomes read-only after boot, so the command will fail when run from the OS. +**#3. Could an end-user run the BuiltAsSecuredCorePC Power Shell command to disable Config Lock?**
    + The Power Shell script is accessible, but the BuiltAsSecuredCorePC becomes read-only after boot, so the command will fail when run from the OS. From ece1814ff6e3c2572fee584a7bd8a154d4fd7725 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Thu, 7 Oct 2021 17:10:32 +0530 Subject: [PATCH 045/284] Update config-lock.md Update --- windows/client-management/mdm/config-lock.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index e662f8090f..75cade9415 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -122,5 +122,5 @@ Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally m **#2. Does the Secured-Core PC Device Identifier UEFI variable (BuiltAsSecuredCorePC) value matter after it’s been read by the OA3 tool in the OEM factory?**
    Yes. Config Lock will always read this UEFI variable to know whether it pertains to a device or not. So, changing the variable changes the Config Lock even after the device has left the OEM factory. -**#3. Could an end-user run the BuiltAsSecuredCorePC Power Shell command to disable Config Lock?**
    - The Power Shell script is accessible, but the BuiltAsSecuredCorePC becomes read-only after boot, so the command will fail when run from the OS. +**#3. Could an end-user run the BuiltAsSecuredCorePC PowerShell command to disable Config Lock?**
    + The PowerShell script is accessible, but the BuiltAsSecuredCorePC becomes read-only after boot, so the command will fail when run from the OS. From f89f51c70cda70d370a792d6b162df878daeb0eb Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 14:01:59 +0100 Subject: [PATCH 046/284] Update essential-services-and-connected-experiences.md --- ...sential-services-and-connected-experiences.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index abea067f98..ef71c7d2b1 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -24,7 +24,7 @@ Windows includes features that connect to the internet to provide enhanced exper When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data can also include information needed by a connected experience to perform its task, such as configuration information about Windows. -We give you the ability to choose which connected experiences you want to use in Windows, which then determines what required service data is sent to us. +Users have the ability to choose the connected experiences they want to use in Windows, which then determines what required service data is sent to Microsoft. Required service data is also collected and sent to Microsoft for essential services. Essential services are used to keep the product **secure, up to date, performing as expected** or are **integral** to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. @@ -45,7 +45,7 @@ Although most essential services can be turned off by enterprise admins, we reco | Device setup | The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.
    To customize the initial setup experience, see [Customize Setup](/windows-hardware/customize/desktop/customize-oobe).| | Diagnostic Data | Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.
    To turn it off, see [Telemetry Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics).| | Update | Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date. Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
    Other services like Device metadata retrieval and Font streaming also ensure that the content on your devices is kept up to date.
    To turn off updates, see [Windows Update](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#29-windows-update), [Device Metadata Retrieval](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#4-device-metadata-retrieval), and [Font Streaming](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#6-font-streaming).| -| Microsoft Store | Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.
    To turn it off, see [Microsoft Store](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store).| +| Microsoft Store | Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service, providing a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.
    To turn it off, see [Microsoft Store](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store).| ## Windows connected experiences @@ -54,9 +54,9 @@ Although most essential services can be turned off by enterprise admins, we reco |Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user. Synchronization across devices only works when a user signs in with the same account.
    To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history). | |Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
    To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). | | Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.
    To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). | -| Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
    If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.
    By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
    To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | +| Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers, which helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
    If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.
    By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
    To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | | Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
    To turn it off, see [Emojis availability](/windows/client-management/mdm/policy-csp-textinpu.md#textinput-touchkeyboardemojibuttonavailability). | -| Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to log on to the device, the user is an administrator on the device, and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
    To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | +| Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to sign in to the device, the user is an administrator on the device, and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
    To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | | Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.
    To turn it off, see [Location services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). | | Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.
    Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
    To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). | | Microsoft Defender SmartScreen | Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files. Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.
    To turn it off, see [Microsoft Defender SmartScreen](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#241-microsoft-defender-smartscreen). | @@ -69,9 +69,9 @@ Although most essential services can be turned off by enterprise admins, we reco | Windows Search | Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account (including OneDrive, SharePoint, and other Microsoft services), and the internet.
    To turn it off, see [Windows Search](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#2-cortana-and-search). | | Windows Spotlight | Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.
    Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.
    To turn it off, see [Windows Spotlight](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#25-windows-spotlight). | -## Edge essential services and connected experiences +## Microsoft Edge essential services and connected experiences -Windows ships with Microsoft Edge and Internet Explorer on Windows devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience.
    You can find details on all of Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper). To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge). +Windows ships with Microsoft Edge and Internet Explorer on Windows devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience.
    You can find details on all of Microsoft Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper). To turn off specific Microsoft Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge). ## IE essential services and connected experiences @@ -82,13 +82,13 @@ Internet Explorer shares many of the Windows essential services listed above. Th | **Connected experience** | **Description** | | --- | --- | -|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
    ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.
    Note: To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. | +|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
    ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps which, can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.
    Note: To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. | |Suggested Sites|Suggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.| | Address Bar and Search suggestions | With search suggestions enabled, users will be offered suggested search terms as they type in the Address Bar. As users type information, it will be sent to the default search provider. | | Auto-complete feature for web addresses | The auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar. | | Compatibility logging | This feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed. | | Compatibility View | Compatibility View helps make websites designed for older browsers look better when viewed in Internet Explorer. The compatibility view setting allows you to choose whether an employee can fix website display problems they encounter while browsing. | -| Flip ahead | Flip ahead enables your users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting your users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website. | +| Flip ahead | Flip ahead enables your users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting, your users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website. | | Web Slices | A Web Slice enables users to subscribe to and automatically receive updates to content directly within a web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices. | | Accelerators | Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options.
    For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word. | | Pinning websites to Start | When a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email service might send updates to the tile indicating how many new messages a user has. | From f217d5a70e7551f713e4dea1ec0cc8df580d1da7 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 14:26:20 +0100 Subject: [PATCH 047/284] Update essential-services-and-connected-experiences.md --- .../privacy/essential-services-and-connected-experiences.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index ef71c7d2b1..3862177845 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -43,7 +43,7 @@ Although most essential services can be turned off by enterprise admins, we reco | Licensing | Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows and store applications.
    To turn off licensing services, see [License Manager](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#9-license-manager) and [Software Protection Platform](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#19-software-protection-platform).| | Networking | Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows devices will lose network connectivity.
    To turn off Network Adapters, see [Disable-NetAdapter](/powershell/module/netadapter/disable-netadapter).| | Device setup | The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.
    To customize the initial setup experience, see [Customize Setup](/windows-hardware/customize/desktop/customize-oobe).| -| Diagnostic Data | Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.
    To turn it off, see [Telemetry Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics).| +| Diagnostic Data | Microsoft collects diagnostic data including error data about your devices with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.
    To turn it off, see [Telemetry Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics).| | Update | Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date. Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
    Other services like Device metadata retrieval and Font streaming also ensure that the content on your devices is kept up to date.
    To turn off updates, see [Windows Update](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#29-windows-update), [Device Metadata Retrieval](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#4-device-metadata-retrieval), and [Font Streaming](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#6-font-streaming).| | Microsoft Store | Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service, providing a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.
    To turn it off, see [Microsoft Store](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store).| @@ -54,11 +54,11 @@ Although most essential services can be turned off by enterprise admins, we reco |Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user. Synchronization across devices only works when a user signs in with the same account.
    To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history). | |Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
    To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). | | Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.
    To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). | -| Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers, which helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
    If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.
    By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
    To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | +| Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers, which helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
    If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet. By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
    To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | | Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
    To turn it off, see [Emojis availability](/windows/client-management/mdm/policy-csp-textinpu.md#textinput-touchkeyboardemojibuttonavailability). | | Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to sign in to the device, the user is an administrator on the device, and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
    To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | | Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.
    To turn it off, see [Location services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). | -| Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.
    Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
    To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). | +| Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization. Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
    To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). | | Microsoft Defender SmartScreen | Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files. Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.
    To turn it off, see [Microsoft Defender SmartScreen](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#241-microsoft-defender-smartscreen). | | OneDrive | OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.
    To turn off OneDrive, see [OneDrive](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#16-onedrive). | | Troubleshooting Service | Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running, make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience.
    To turn it off, see [Troubleshooting service](/windows/client-management/mdm/policy-csp-troubleshooting). | From faeb825d0ddc810de64146f9259b0866b2b41a4c Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 14:34:05 +0100 Subject: [PATCH 048/284] Update essential-services-and-connected-experiences.md --- .../privacy/essential-services-and-connected-experiences.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 3862177845..ac4a221c33 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -62,9 +62,9 @@ Although most essential services can be turned off by enterprise admins, we reco | Microsoft Defender SmartScreen | Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files. Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.
    To turn it off, see [Microsoft Defender SmartScreen](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#241-microsoft-defender-smartscreen). | | OneDrive | OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.
    To turn off OneDrive, see [OneDrive](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#16-onedrive). | | Troubleshooting Service | Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running, make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience.
    To turn it off, see [Troubleshooting service](/windows/client-management/mdm/policy-csp-troubleshooting). | -| Voice Typing | Voice typing (also referred to as Windows dictation in earlier versions of Windows) allows you to write text by speaking by using Microsoft’s online speech recognition technology.
    To turn it off, see [Speech recognition](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#186-speech). | +| Voice Typing | Voice typing (also referred to as Windows dictation in earlier versions of Windows) allows users to write text by speaking by using Microsoft’s online speech recognition technology.
    To turn it off, see [Speech recognition](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#186-speech). | | Windows backup | When settings synchronization is turned on, a user's settings are synced across all Windows devices when they sign in with the same account.
    To turn it off, see [Sync your settings](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-sync-your-settings). | -| Windows Dashboard Widgets | Windows Dashboard widget is a dynamic view that shows you personalized content like news, weather, a glimpse at your calendar and to-do list and your recent photos. It provides a quick glance view, which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11. | +| Windows Dashboard Widgets | Windows Dashboard widget is a dynamic view that shows users personalized content like news, weather, their calendar and to-do list, and recent photos. It provides a quick glance view, which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11. | | Windows Insider Program | The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to builds of Windows. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s [website](https://insider.windows.com/).
    To turn it off, see [Windows Insider Program](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#7-insider-preview-builds). | | Windows Search | Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account (including OneDrive, SharePoint, and other Microsoft services), and the internet.
    To turn it off, see [Windows Search](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#2-cortana-and-search). | | Windows Spotlight | Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.
    Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.
    To turn it off, see [Windows Spotlight](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#25-windows-spotlight). | @@ -88,7 +88,7 @@ Internet Explorer shares many of the Windows essential services listed above. Th | Auto-complete feature for web addresses | The auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar. | | Compatibility logging | This feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed. | | Compatibility View | Compatibility View helps make websites designed for older browsers look better when viewed in Internet Explorer. The compatibility view setting allows you to choose whether an employee can fix website display problems they encounter while browsing. | -| Flip ahead | Flip ahead enables your users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting, your users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website. | +| Flip ahead | Flip ahead enables users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting, users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website. | | Web Slices | A Web Slice enables users to subscribe to and automatically receive updates to content directly within a web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices. | | Accelerators | Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options.
    For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word. | | Pinning websites to Start | When a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email service might send updates to the tile indicating how many new messages a user has. | From a70b7e94e16f27307b943e6a85b6978f6c6aee12 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 14:49:04 +0100 Subject: [PATCH 049/284] Update essential-services-and-connected-experiences.md --- windows/privacy/essential-services-and-connected-experiences.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index ac4a221c33..7dc04a0384 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -24,7 +24,7 @@ Windows includes features that connect to the internet to provide enhanced exper When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data can also include information needed by a connected experience to perform its task, such as configuration information about Windows. -Users have the ability to choose the connected experiences they want to use in Windows, which then determines what required service data is sent to Microsoft. +Microsoft gives you the ability to choose which connected experiences you want to use in Windows, this will determines what required service data is sent to Microsoft. Required service data is also collected and sent to Microsoft for essential services. Essential services are used to keep the product **secure, up to date, performing as expected** or are **integral** to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. From 1b2f8b5ba365ef67dc145f56bcb7edaffcdd9737 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 15:05:03 +0100 Subject: [PATCH 050/284] Update essential-services-and-connected-experiences.md --- windows/privacy/essential-services-and-connected-experiences.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 7dc04a0384..0ccfb8e476 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -24,7 +24,7 @@ Windows includes features that connect to the internet to provide enhanced exper When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data can also include information needed by a connected experience to perform its task, such as configuration information about Windows. -Microsoft gives you the ability to choose which connected experiences you want to use in Windows, this will determines what required service data is sent to Microsoft. +The connected experiences you choose to use in Windows will impact what required service data is sent to us. Required service data is also collected and sent to Microsoft for essential services. Essential services are used to keep the product **secure, up to date, performing as expected** or are **integral** to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. From d80acaa8b2bfcdf7338a0ccb80313b28ceb821a3 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 15:19:59 +0100 Subject: [PATCH 051/284] Update essential-services-and-connected-experiences.md --- windows/privacy/essential-services-and-connected-experiences.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 0ccfb8e476..d5d2775754 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -28,7 +28,7 @@ The connected experiences you choose to use in Windows will impact what required Required service data is also collected and sent to Microsoft for essential services. Essential services are used to keep the product **secure, up to date, performing as expected** or are **integral** to how the product works. For example, the licensing service that confirms that you’re properly licensed to use Windows. -Although most essential services can be turned off by enterprise admins, we recommend, where applicable, you consider hosting the services on-premises and carefully assess the impact of turning off remaining services. The following list describes the essential services and connected experiences that are available to you in Windows and provides links to further information about each one. +Although enterprise admins can turn off most essential services, we recommend, where applicable, you consider hosting the services on-premises and carefully assess the impact of turning off remaining services. The following list describes the essential services and connected experiences that are available to you in Windows and provides links to further information about each one. > [!NOTE] > The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. From e4e1af71ed95ff4e262ae6713b6093210282d3d4 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 15:39:48 +0100 Subject: [PATCH 052/284] Update essential-services-and-connected-experiences.md --- .../essential-services-and-connected-experiences.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index d5d2775754..a124f59bd9 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -45,7 +45,7 @@ Although enterprise admins can turn off most essential services, we recommend, w | Device setup | The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.
    To customize the initial setup experience, see [Customize Setup](/windows-hardware/customize/desktop/customize-oobe).| | Diagnostic Data | Microsoft collects diagnostic data including error data about your devices with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows behaves in the real world, focus on user priorities, find and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.
    To turn it off, see [Telemetry Services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics).| | Update | Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date. Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
    Other services like Device metadata retrieval and Font streaming also ensure that the content on your devices is kept up to date.
    To turn off updates, see [Windows Update](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#29-windows-update), [Device Metadata Retrieval](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#4-device-metadata-retrieval), and [Font Streaming](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#6-font-streaming).| -| Microsoft Store | Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service, providing a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.
    To turn it off, see [Microsoft Store](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store).| +| Microsoft Store | Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.
    To turn it off, see [Microsoft Store](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store).| ## Windows connected experiences @@ -53,15 +53,15 @@ Although enterprise admins can turn off most essential services, we recommend, w | --- | --- | |Activity History|Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user. Synchronization across devices only works when a user signs in with the same account.
    To turn it off, see [Activity History](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1822-activity-history). | |Cloud Clipboard|Cloud Clipboard enables users to copy images and text across all Windows devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.
    To turn it off, see [Cloud Clipboard](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#30-cloud-clipboard). | -| Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.
    To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). | -| Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers, which helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
    If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet. By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
    To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | +| Date and Time | The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It's installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.
    To turn it off, see [Date and Time](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#3-date--time). | +| Delivery Optimization | Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources, such as other peers on the network, in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.
    If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet. By default, devices running Windows will only use Delivery Optimization to get and receive updates for devices and apps on your local network.
    To turn it off, see [Delivery Optimization](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#28-delivery-optimization). | | Emojis and more | The Emoji and more menu allows users to insert a variety of content like emoji, kaomoji, GIFs, symbols, and clipboard history. This connected experience is new in Windows 11.
    To turn it off, see [Emojis availability](/windows/client-management/mdm/policy-csp-textinpu.md#textinput-touchkeyboardemojibuttonavailability). | | Find My Device | Find My Device is a feature that can help users locate their Windows device if it's lost or stolen. This feature only works if a Microsoft account is used to sign in to the device, the user is an administrator on the device, and when location is turned on for the device. Users can find their device by logging in to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) under the Find My Device tab.
    To turn it off, see [Find My Device](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#5-find-my-device). | | Location services | The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.
    To turn it off, see [Location services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#182-location). | | Microsoft Defender Antivirus | Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization. Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.
    To turn it off, see [Microsoft Defender Antivirus](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-defender). | | Microsoft Defender SmartScreen | Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files. Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.
    To turn it off, see [Microsoft Defender SmartScreen](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#241-microsoft-defender-smartscreen). | | OneDrive | OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.
    To turn off OneDrive, see [OneDrive](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#16-onedrive). | -| Troubleshooting Service | Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running, make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience.
    To turn it off, see [Troubleshooting service](/windows/client-management/mdm/policy-csp-troubleshooting). | +| Troubleshooting Service | Windows troubleshooting service will automatically fix critical issues like corrupt settings that keep critical services from running. The service will also make adjustments to work with your hardware, or make other specific changes required for Windows to operate with the hardware, apps, and settings you’ve selected. In addition, it will recommend troubleshooting for other problems that aren’t critical to normal Windows operation but might impact your experience.
    To turn it off, see [Troubleshooting service](/windows/client-management/mdm/policy-csp-troubleshooting). | | Voice Typing | Voice typing (also referred to as Windows dictation in earlier versions of Windows) allows users to write text by speaking by using Microsoft’s online speech recognition technology.
    To turn it off, see [Speech recognition](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#186-speech). | | Windows backup | When settings synchronization is turned on, a user's settings are synced across all Windows devices when they sign in with the same account.
    To turn it off, see [Sync your settings](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-sync-your-settings). | | Windows Dashboard Widgets | Windows Dashboard widget is a dynamic view that shows users personalized content like news, weather, their calendar and to-do list, and recent photos. It provides a quick glance view, which allows users to be productive without needing to go to multiple apps or websites. This connected experience is new in Windows 11. | From d241b64eb755ba45f185bc0ce1411f04ecf98862 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 16:07:43 +0100 Subject: [PATCH 053/284] Update essential-services-and-connected-experiences.md --- .../privacy/essential-services-and-connected-experiences.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index a124f59bd9..2a94ace0da 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -82,7 +82,7 @@ Internet Explorer shares many of the Windows essential services listed above. Th | **Connected experience** | **Description** | | --- | --- | -|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.
    ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps which, can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.
    Note: To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. | +|ActiveX Filtering|ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without a user's permission.
    ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps which, can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.
    Note: To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls. | |Suggested Sites|Suggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.| | Address Bar and Search suggestions | With search suggestions enabled, users will be offered suggested search terms as they type in the Address Bar. As users type information, it will be sent to the default search provider. | | Auto-complete feature for web addresses | The auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar. | @@ -91,7 +91,7 @@ Internet Explorer shares many of the Windows essential services listed above. Th | Flip ahead | Flip ahead enables users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting, users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website. | | Web Slices | A Web Slice enables users to subscribe to and automatically receive updates to content directly within a web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices. | | Accelerators | Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options.
    For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word. | -| Pinning websites to Start | When a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email service might send updates to the tile indicating how many new messages a user has. | +| Pinning websites to Start | When a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email website might send updates to the tile indicating how many new messages a user has. | ## Related links From 9d71d77578c21700e24cadbc18dff6e31fa16502 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 7 Oct 2021 16:13:43 +0100 Subject: [PATCH 054/284] Update essential-services-and-connected-experiences.md --- .../privacy/essential-services-and-connected-experiences.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 2a94ace0da..5ad54e7a9e 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -99,8 +99,9 @@ Internet Explorer shares many of the Windows essential services listed above. Th - [Connected Experiences in Office](/deployoffice/privacy/connected-experiences.md) - [Essential Services in Office](/deployoffice/privacy/essential-services.md) -To view endpoints for Windows 10 Enterprise, see: +To view endpoints for Windows Enterprise, see: +- [Manage connection endpoints for Windows 11](manage-windows-11-endpoints.md) - [Manage connection endpoints for Windows 10, version 21H1](manage-windows-21H1-endpoints.md) - [Manage connection endpoints for Windows 10, version 20H2](manage-windows-20h2-endpoints.md) - [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) @@ -109,8 +110,9 @@ To view endpoints for Windows 10 Enterprise, see: - [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) - [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) -To view endpoints for non-Enterprise Windows 10 editions, see: +To view endpoints for non-Enterprise Windows editions, see: +- [Windows 11 connection endpoints for non-Enterprise editions](windows-11-endpoints-non-enterprise-editions.md) - [Windows 10, version 21H1, connection endpoints for non-Enterprise editions](windows-endpoints-21H1-non-enterprise-editions.md) - [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](windows-endpoints-20H2-non-enterprise-editions.md) - [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) From 79be99f04f6adb67b1be8945b1e40a0d993cd9a7 Mon Sep 17 00:00:00 2001 From: roh-kan Date: Fri, 8 Oct 2021 00:02:51 +0800 Subject: [PATCH 055/284] Fix Typo in command Related Issue: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10014 --- windows/deployment/update/windows-update-errors.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/windows-update-errors.md b/windows/deployment/update/windows-update-errors.md index ac67414ec6..b30011a355 100644 --- a/windows/deployment/update/windows-update-errors.md +++ b/windows/deployment/update/windows-update-errors.md @@ -173,7 +173,7 @@ The following table provides information about common errors you might run into | Message | Description | Mitigation | |---------|-------------|------------| -| ERROR_SXS_ASSEMBLY_MISSING; The referenced assembly could not be found. | Typically, a component store corruption caused when a component is in a partially installed state. | Repair the component store with **Dism RestoreHealth command** or manually repair it with the payload from the partially installed component. From an elevated command prompt and run these commands:
    *DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*
    *DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALT*
    *DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*
    *Sfc /Scannow*
    Restart the device. | +| ERROR_SXS_ASSEMBLY_MISSING; The referenced assembly could not be found. | Typically, a component store corruption caused when a component is in a partially installed state. | Repair the component store with **Dism RestoreHealth command** or manually repair it with the payload from the partially installed component. From an elevated command prompt and run these commands:
    *DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*
    *DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALTH*
    *DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*
    *Sfc /Scannow*
    Restart the device. | ## 0x8007371b From 43bf2b92df0a7742b43f37bcd39b1e6f1e921e7f Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 7 Oct 2021 15:22:05 -0700 Subject: [PATCH 056/284] Update config-lock.md --- windows/client-management/mdm/config-lock.md | 23 ++++---------------- 1 file changed, 4 insertions(+), 19 deletions(-) diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index 75cade9415..5cdbf0d2fb 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -42,7 +42,7 @@ After a Secured-Core PC reaches the desktop, Config lock will prevent configurat - DRTM - SMM -:::image type="content" source="images/flow_configlock.png" alt-text="flow"::: +:::image type="content" source="images/flow_configlock.png" alt-text="config lock flow."::: IT Admin scenario: @@ -67,19 +67,8 @@ Config Lock will be available for all Windows Professional and Enterprise Editio ## Enabling -Config Lock isn't enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it ON. +Config Lock isn't enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it on. -Config Lock is controlled by the presence of the Secured-Core PC Device Identifier (the “BuiltAsSecuredCorePC” UEFI variable) inserted on the device by the OEM during initial device manufacturing. Config Lock can be enabled if the ByteArray value of this identifier is set to “1” and IT admin pushes the MDM policy to turn Config Lock ON. If it is “0” or the variable isn't present at all, Config Lock cannot be enabled. - -> [!NOTE] -> BuiltAsSecuredCorePC actually accepts ByteArray values of 0-9, and any value from 1-9 will indicate Secured-Core PC to the Config Lock feature. While we recommend “1” for consistency, OEMs may optionally use any other value up to 9 for internal versioning reasons, or other purposes. (Technically, any value from 1-255 should trigger Config Lock, since BuiltAsSecuredCorePC is a byte.) - -The UEFI variable can be set however an OEM likes, but one option is to use the Set-UEFIVariable command from [PowerShell Gallery | UEFIv2 2.3](https://www.powershellgallery.com/packages/UEFIv2/2.3), per the following syntax: - -```powershell -powershell.exe -ExecutionPolicy Bypass {Import-Module .\UEFIv2.psd1 ; Set-UEFIVariable -VariableName BuiltAsSecuredCorePC -Namespace '{77fa9abd-0359-4d32-bd60-28f4e78f784b}' -ByteArray @(01) }. common ..] -``` - The steps to turn on Config Lock using Microsoft Endpoint Manager (MEM) are as follows: 1. Ensure that the device to turn on Config Lock is enrolled in MEM. @@ -116,11 +105,7 @@ Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally m ## FAQ -**#1. Can an IT Admin disable Config Lock ?**
    +**Can an IT Admin disable Config Lock ?**
    Yes. IT Admin can use MDM to turn off Config Lock. - -**#2. Does the Secured-Core PC Device Identifier UEFI variable (BuiltAsSecuredCorePC) value matter after it’s been read by the OA3 tool in the OEM factory?**
    - Yes. Config Lock will always read this UEFI variable to know whether it pertains to a device or not. So, changing the variable changes the Config Lock even after the device has left the OEM factory. - -**#3. Could an end-user run the BuiltAsSecuredCorePC PowerShell command to disable Config Lock?**
    +**Could an end-user run the BuiltAsSecuredCorePC PowerShell command to disable Config Lock?**
    The PowerShell script is accessible, but the BuiltAsSecuredCorePC becomes read-only after boot, so the command will fail when run from the OS. From 62d0a8c423f70fac274770653d98535e165136d5 Mon Sep 17 00:00:00 2001 From: David Mebane Date: Thu, 7 Oct 2021 16:53:37 -0700 Subject: [PATCH 057/284] Update update-compliance-get-started.md --- windows/deployment/update/update-compliance-get-started.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index bb55b0dff1..b50e741721 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -23,7 +23,8 @@ ms.topic: article - Windows 11 > [!IMPORTANT] -> **A new policy is required to use Update Compliance: "AllowUpdateComplianceProcessing"**. If you're already using Update Compliance and have configured your devices prior to May 10, 2021, you must configure devices with this additional policy. You can do this by rerunning the [Update Compliance Configuration Script](update-compliance-configuration-script.md) if you configure your devices through Group Policy, or refer to [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md) for details on manually configuring the new policy for both Group Policy and MDM. +> **A new policy is required to use Update Compliance: "AllowUpdateComplianceProcessing"**. If you're already using Update Compliance and have configured your devices prior to May 10, 2021, you must configure devices with this additional policy. You can do this by rerunning the [Update Compliance Configuration Script](update-compliance-configuration-script.md) if you configure your devices through Group Policy, or refer to [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md) for details on manually configuring the new policy for both Group Policy and MDM. +> Devices must have this policy configured by January 31st, 2022 to remain enrolled in Update Compliance. Devices without this policy configured, including Windows 10 releases prior to version 1809 which do not support this policy, will stop appearing in Update Compliance reports after this date. This topic introduces the high-level steps required to enroll to the Update Compliance solution and configure devices to send data to it. The following steps cover the enrollment and device configuration workflow. From 4e77f2107da79f8bf2fcbfedd06413d6d51e89d9 Mon Sep 17 00:00:00 2001 From: Alice-at-Microsoft <79878795+Alice-at-Microsoft@users.noreply.github.com> Date: Thu, 7 Oct 2021 17:02:06 -0700 Subject: [PATCH 058/284] Add content on safeguards --- .../deployment/update/deployment-service-overview.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/deployment/update/deployment-service-overview.md b/windows/deployment/update/deployment-service-overview.md index 546749d1dd..28854e1093 100644 --- a/windows/deployment/update/deployment-service-overview.md +++ b/windows/deployment/update/deployment-service-overview.md @@ -29,6 +29,7 @@ The deployment service is designed for IT Pros who are looking for more control - You can stage deployments over a period of days or weeks by using rich expressions (for example, deploy 20H2 to 500 devices per day, beginning on March 14, 2021). - You can bypass pre-configured Windows Update for Business policies to immediately deploy a security update across your organization when emergencies arise. - You can benefit from deployments with automatic piloting tailored to your unique device population to ensure coverage of hardware and software in your organization. +- You can leverage safeguards against likely update issues, as identified by Microsoft machine learning algorithms, and automatically put the deployment on hold for any affected devices. The service is privacy focused and backed by leading industry compliance certifications. @@ -52,7 +53,6 @@ Using the deployment service typically follows a common pattern: 2. The chosen tool conveys your approval, scheduling, and device selection information to the deployment service. 3. The deployment service processes the content approval and compares it with previously approved content. Final update applicability is determined and conveyed to Windows Update, which then offers approved content to devices on their next check for updates. - The deployment service exposes these capabilities through Microsoft [Graph REST APIs](/graph/overview). You can call the APIs directly, through a Graph SDK, or integrate them with a management tool such as Microsoft Endpoint Manager. ## Prerequisites @@ -74,7 +74,6 @@ Additionally, your organization must have one of the following subscriptions: - Windows Virtual Desktop Access E3 or E5 - Microsoft 365 Business Premium - ## Getting started To use the deployment service, you use a management tool built on the platform, script common actions using PowerShell, or build your own application. @@ -87,7 +86,6 @@ Microsoft Endpoint Manager integrates with the deployment service to provide Win The Microsoft Graph SDK includes a PowerShell extension that you can use to script and automate common update actions. For more information, see [Get started with the Microsoft Graph PowerShell SDK](/graph/powershell/get-started). - ### Building your own application Microsoft Graph makes deployment service APIs available through. Get started with these learning paths: @@ -113,14 +111,17 @@ This built-in piloting capability complements your existing ring structure and p You should continue to use deployment rings as part of the servicing strategy for your organization, but use gradual rollouts to add scheduling convenience and additional protections within each ring. +### Safeguard holds against likely and known issues + +[Safeguard holds](https://docs.microsoft.com/windows/deployment/update/safeguard-holds) are a key technology Microsoft uses to protect devices from encountering known quality or compatibility issues, by preventing them from installing the update or upgrade. For Windows 11 deployments, the deployment service extends these safeguard holds to also protect devices that Microsoft identifies as being at a higher risk of experiencing post-update issues (such as OS rollbacks, app crashes, or graphics issues) and temporarily puts the deployment on hold for these devices while Microsoft investigates the likely issue. Safeguard holds apply to deployments by default, but you may opt out if desired. + ### Monitoring deployments to detect rollback issues During deployments of Windows 11 or Windows 10 feature updates, driver combinations can sometimes result in an unexpected update failure that makes the device revert to the previously installed operating system version. The deployment service can monitor devices for such issues and automatically pause deployments when this happens, giving you time to detect and mitigate issues. - ### How to enable deployment protections -Deployment scheduling controls are always available, but to take advantage of the unique deployment protections tailored to your organization, devices must share diagnostic data with Microsoft. +Deployment scheduling controls are always available, but to take advantage of the unique deployment protections tailored to your population, devices must share diagnostic data with Microsoft. #### Device prerequisites @@ -174,7 +175,6 @@ Follow these suggestions for the best results with the service. Avoid using different channels to manage the same resources. If you use Microsoft Endpoint Manager along with Microsoft Graph APIs or PowerShell, aspects of resources (such as devices, deployments, updatable asset groups) might be overwritten if you use both channels to manage the same resources. Instead, only manage each resource through the channel that created it. - ## Next steps To learn more about the deployment service, try the following: From 66deb0fa5a5c8cf167b45489e662c016bafa38d5 Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Thu, 7 Oct 2021 21:06:48 -0700 Subject: [PATCH 059/284] Update healthattestation-csp.md Added policy and response token. TODO: Add image. --- .../mdm/healthattestation-csp.md | 221 +++++++++++++++++- 1 file changed, 212 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 7c0aef670f..dd83b691f5 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -51,6 +51,15 @@ The attestation report provides a health assessment of the boot-time properties ### Attestation Flow with Microsoft Azure Attestation Service +#add image +

    Attestation flow can be broadly in three main steps: +

      +
    • An instancne of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
      • +
    • The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrived.
      • +
    • The MDM provider after verifying the token is coming from the attestation service it can parse the attestation token to reflect on the attested state of the device.
      • +
    +The protocol implemented can be found here:     Attestation Protocol +

    ### Configuration Service Provider Nodes Windows 11 introduces additions to the HealthAttestation CSP node to integrate with Microsoft Azure Attestaiton service. @@ -206,17 +215,211 @@ This node will retrieve the service generated correlation IDs for the given MDM ### MAA CSP Intergation Steps
      -
    1. Setup a MAA provider instance: -MAA instance can be created following the steps here Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.
      2. -
    2. Update the provider with an appropriate policy: -The MAA instance should be updated with an appropriate policy. How to author an Azure Attestation policy | Microsoft Docs -A Sample attestation policy that only checks for secureboot is here: -TODO
      3. -
    3. Call TriggerAttestation with your rpid, AAD token and the attestURI: +
    4. Setup a MAA provider instance:
      +MAA instance can be created following the steps here Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.
      5. +
    5. Update the provider with an appropriate policy:
      +The MAA instance should be updated with an appropriate policy. How to author an Azure Attestation policy | Microsoft Docs +
      A Sample attestation policy: + +``` +version=1.2; + +configurationrules{ +}; + +authorizationrules { + => permit(); +}; + +issuancerules{ + +// SecureBoot enabled +c:[type == "events", issuer=="AttestationService"] => add(type = "efiConfigVariables", value = JmesPath(c.value, "Events[?EventTypeString == 'EV_EFI_VARIABLE_DRIVER_CONFIG' && ProcessedData.VariableGuid == '8BE4DF61-93CA-11D2-AA0D-00E098032B8C']")); +c:[type == "efiConfigVariables", issuer=="AttestationPolicy"]=> issue(type = "secureBootEnabled", value = JsonToClaimValue(JmesPath(c.value, "[?ProcessedData.UnicodeName == 'SecureBoot'] | length(@) == `1` && @[0].ProcessedData.VariableData == 'AQ'"))); +![type=="secureBootEnabled", issuer=="AttestationPolicy"] => issue(type="secureBootEnabled", value=false); + +// Retrieve bool properties +c:[type=="events", issuer=="AttestationService"] => add(type="boolProperties", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && (PcrIndex == `12` || PcrIndex == `13` || PcrIndex == `19` || PcrIndex == `20`)].ProcessedData.EVENT_TRUSTBOUNDARY")); +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="codeIntegrityEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_CODEINTEGRITY"))); +c:[type=="codeIntegrityEnabledSet", issuer=="AttestationPolicy"] => issue(type="codeIntegrityEnabled", value=ContainsOnlyValue(c.value, true)); +![type=="codeIntegrityEnabled", issuer=="AttestationPolicy"] => issue(type="codeIntegrityEnabled", value=false); + +// Bitlocker Boot Status, The first non zero measurement or zero. +c:[type=="events", issuer=="AttestationService"] => add(type="srtmDrtmEventPcr", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && (PcrIndex == `12` || PcrIndex == `19`)].ProcessedData.EVENT_TRUSTBOUNDARY")); +c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => issue(type="bitlockerEnabledValue", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_BITLOCKER_UNLOCK | @[? Value != `0`].Value | @[0]"))); +[type=="bitlockerEnabledValue"] => issue(type="bitlockerEnabled", value=true); +![type=="bitlockerEnabledValue"] => issue(type="bitlockerEnabled", value=false); + +// Elam Driver (windows defender) Loaded +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="elamDriverLoaded", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_LOADEDMODULE_AGGREGATION[] | [? EVENT_IMAGEVALIDATED == `true` && (equals_ignore_case(EVENT_FILEPATH, '\\windows\\system32\\drivers\\wdboot.sys') || equals_ignore_case(EVENT_FILEPATH, '\\windows\\system32\\drivers\\wd\\wdboot.sys'))] | @ != `null`"))); +[type=="elamDriverLoaded", issuer=="AttestationPolicy"] => issue(type="WindowsDefenderElamDriverLoaded", value=true); +![type=="elamDriverLoaded", issuer=="AttestationPolicy"] => issue(type="WindowsDefenderElamDriverLoaded", value=false); + +// Boot debugging +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="bootDebuggingEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_BOOTDEBUGGING"))); +c:[type=="bootDebuggingEnabledSet", issuer=="AttestationPolicy"] => issue(type="bootDebuggingDisabled", value=ContainsOnlyValue(c.value, false)); +![type=="bootDebuggingDisabled", issuer=="AttestationPolicy"] => issue(type="bootDebuggingDisabled", value=false); + +// Kernel Debugging +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="osKernelDebuggingEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_OSKERNELDEBUG"))); +c:[type=="osKernelDebuggingEnabledSet", issuer=="AttestationPolicy"] => issue(type="osKernelDebuggingDisabled", value=ContainsOnlyValue(c.value, false)); +![type=="osKernelDebuggingDisabled", issuer=="AttestationPolicy"] => issue(type="osKernelDebuggingDisabled", value=false); + +// DEP Policy +c:[type=="boolProperties", issuer=="AttestationPolicy"] => issue(type="depPolicy", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_DATAEXECUTIONPREVENTION.Value | @[-1]"))); +![type=="depPolicy"] => issue(type="depPolicy", value=0); + +// Test Signing +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="testSigningEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_TESTSIGNING"))); +c:[type=="testSigningEnabledSet", issuer=="AttestationPolicy"] => issue(type="testSigningDisabled", value=ContainsOnlyValue(c.value, false)); +![type=="testSigningDisabled", issuer=="AttestationPolicy"] => issue(type="testSigningDisabled", value=false); + +// Flight Signing +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="flightSigningEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_FLIGHTSIGNING"))); +c:[type=="flightSigningEnabledSet", issuer=="AttestationPolicy"] => issue(type="flightSigningNotEnabled", value=ContainsOnlyValue(c.value, false)); +![type=="flightSigningNotEnabled", issuer=="AttestationPolicy"] => issue(type="flightSigningNotEnabled", value=false); + +// VSM enabled +c:[type=="events", issuer=="AttestationService"] => add(type="srtmDrtmEventPcr", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && (PcrIndex == `12` || PcrIndex == `19`)].ProcessedData.EVENT_TRUSTBOUNDARY")); +c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => add(type="vbsEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_VSM_REQUIRED"))); +c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => add(type="vbsEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_MANDATORY_ENFORCEMENT"))); +c:[type=="vbsEnabledSet", issuer=="AttestationPolicy"] => issue(type="vbsEnabled", value=ContainsOnlyValue(c.value, true)); +![type=="vbsEnabled", issuer=="AttestationPolicy"] => issue(type="vbsEnabled", value=false); +c:[type=="vbsEnabled", issuer=="AttestationPolicy"] => issue(type="vbsEnabled", value=c.value); + +// HVCI +c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => add(type="hvciEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_HVCI_POLICY | @[?String == 'HypervisorEnforcedCodeIntegrityEnable'].Value"))); +c:[type=="hvciEnabledSet", issuer=="AttestationPolicy"] => issue(type="hvciEnabled", value=ContainsOnlyValue(c.value, 1)); +![type=="hvciEnabled", issuer=="AttestationPolicy"] => issue(type="hvciEnabled", value=false); + +// IOMMU +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="iommuEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_IOMMU_REQUIRED"))); +c:[type=="iommuEnabledSet", issuer=="AttestationPolicy"] => issue(type="iommuEnabled", value=ContainsOnlyValue(c.value, true)); +![type=="iommuEnabled", issuer=="AttestationPolicy"] => issue(type="iommuEnabled", value=false); + +// Find the Boot Manager SVN, this is measured as part of a sequence and find the various measurements +// Find the first EV_SEPARATOR in PCR 12, 13, Or 14 +c:[type=="events", issuer=="AttestationService"] => add(type="evSeparatorSeq", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_SEPARATOR' && (PcrIndex == `12` || PcrIndex == `13` || PcrIndex == `14`)] | @[0].EventSeq")); +c:[type=="evSeparatorSeq", value != "null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value=AppendString(AppendString("Events[? EventSeq < `", c.value), "`")); +[type=="evSeparatorSeq", value=="null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value="Events[? `true` "); + +// Find the first EVENT_APPLICATION_SVN. +c:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] => add(type="bootMgrSvnSeqQuery", value=AppendString(c.value, " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `12` && ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_APPLICATION_SVN] | @[0].EventSeq")); +c1:[type=="bootMgrSvnSeqQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => add(type="bootMgrSvnSeq", value=JmesPath(c2.value, c1.value)); +c:[type=="bootMgrSvnSeq", value!="null", issuer=="AttestationPolicy"] => add(type="bootMgrSvnQuery", value=AppendString(AppendString("Events[? EventSeq == `", c.value), "`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_APPLICATION_SVN | @[0]")); + +// The first EVENT_APPLICATION_SVN. That value is the Boot Manager SVN +c1:[type=="bootMgrSvnQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => issue(type="bootMgrSvn", value=JsonToClaimValue(JmesPath(c2.value, c1.value))); + +// OS Rev List Info +c:[type=="events", issuer=="AttestationService"] => issue(type="osRevListInfo", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_OS_REVOCATION_LIST.RawData | @[0]"))); + +// Safe mode +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="safeModeEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_SAFEMODE"))); +c:[type=="safeModeEnabledSet", issuer=="AttestationPolicy"] => issue(type="notSafeMode", value=ContainsOnlyValue(c.value, false)); +![type=="notSafeMode", issuer=="AttestationPolicy"] => issue(type="notSafeMode", value=true); + +// Win PE +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="winPEEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_WINPE"))); +c:[type=="winPEEnabledSet", issuer=="AttestationPolicy"] => issue(type="notWinPE", value=ContainsOnlyValue(c.value, false)); +![type=="notWinPE", issuer=="AttestationPolicy"] => issue(type="notWinPE", value=true); + +// CI Policy +c:[type=="events", issuer=="AttestationService"] => issue(type="codeIntegrityPolicy", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_SI_POLICY[].RawData"))); + +// Secure Boot Custom Policy +c:[type=="events", issuer=="AttestationService"] => issue(type="secureBootCustomPolicy", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EFI_VARIABLE_DRIVER_CONFIG' && PcrIndex == `7` && ProcessedData.UnicodeName == 'CurrentPolicy' && ProcessedData.VariableGuid == '77FA9ABD-0359-4D32-BD60-28F4E78F784B'].ProcessedData.VariableData | @[0]"))); + +// Find the first EV_SEPARATOR in PCR 12, 13, Or 14 +c:[type=="events", issuer=="AttestationService"] => add(type="evSeparatorSeq", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_SEPARATOR' && (PcrIndex == `12` || PcrIndex == `13` || PcrIndex == `14`)] | @[0].EventSeq")); +c:[type=="evSeparatorSeq", value != "null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value=AppendString(AppendString("Events[? EventSeq < `", c.value), "`")); +[type=="evSeparatorSeq", value=="null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value="Events[? `true` "); // No restriction of EV_SEPARATOR in case it is not present + +//Finding the Boot App SVN +// Find the first EVENT_TRANSFER_CONTROL with value 1 or 2 in PCR 12 which is before the EV_SEPARATOR +c1:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] && c2:[type=="bootMgrSvnSeq", value != "null", issuer=="AttestationPolicy"] => add(type="beforeEvSepAfterBootMgrSvnClause", value=AppendString(AppendString(AppendString(c1.value, "&& EventSeq >= `"), c2.value), "`")); +c:[type=="beforeEvSepAfterBootMgrSvnClause", issuer=="AttestationPolicy"] => add(type="tranferControlQuery", value=AppendString(c.value, " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `12`&& (ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_TRANSFER_CONTROL.Value == `1` || ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_TRANSFER_CONTROL.Value == `2`)] | @[0].EventSeq")); +c1:[type=="tranferControlQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => add(type="tranferControlSeq", value=JmesPath(c2.value, c1.value)); + +// Find the first non-null EVENT_MODULE_SVN in PCR 13 after the transfer control. +c:[type=="tranferControlSeq", value!="null", issuer=="AttestationPolicy"] => add(type="afterTransferCtrlClause", value=AppendString(AppendString(" && EventSeq > `", c.value), "`")); +c1:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] && c2:[type=="afterTransferCtrlClause", issuer=="AttestationPolicy"] => add(type="moduleQuery", value=AppendString(AppendString(c1.value, c2.value), " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13` && ((ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_LOADEDMODULE_AGGREGATION[].EVENT_MODULE_SVN | @[0]) || (ProcessedData.EVENT_LOADEDMODULE_AGGREGATION[].EVENT_MODULE_SVN | @[0]))].EventSeq | @[0]")); +c1:[type=="moduleQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => add(type="moduleSeq", value=JmesPath(c2.value, c1.value)); + +// Find the first EVENT_APPLICATION_SVN after EV_EVENT_TAG in PCR 12. +c:[type=="moduleSeq", value!="null", issuer=="AttestationPolicy"] => add(type="applicationSvnAfterModuleClause", value=AppendString(AppendString(" && EventSeq > `", c.value), "`")); +c1:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] && c2:[type=="applicationSvnAfterModuleClause", issuer=="AttestationPolicy"] => add(type="bootAppSvnQuery", value=AppendString(AppendString(c1.value, c2.value), " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `12`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_APPLICATION_SVN | @[0]")); +c1:[type=="bootAppSvnQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => issue(type="bootAppSvn", value=JsonToClaimValue(JmesPath(c2.value, c1.value))); + +// Finding the Boot Rev List Info +c:[type=="events", issuer=="AttestationService"] => issue(type="bootRevListInfo", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_BOOT_REVOCATION_LIST.RawData | @[0]"))); + +}; +``` +
      6. +
    6. Call TriggerAttestation with your rpid, AAD token and the attestURI:
      Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Azure Attestation) | Microsoft Docs
      7. -
    7. Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties: +
    8. Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties:
      The decoded JWT token contains information per the attestation policy. -{ "typ": "JWT", "alg": "RS256", "x5c": [ "MIIDcDCCAligAwIBAgIQOLMUhXOEQ2axV6zXp/KvnzANBgkqhkiG9w0BAQsFADA1MTMwMQYDVQQDEypBdHRlc3RhdGlvblNlcnZpY2UtTG9jYWxUZXN0LVJlcG9ydFNpZ25pbmcwHhcNMjAxMTI5MTExMjUyWhcNMjIxMTI5MTEyMjUyWjA1MTMwMQYDVQQDEypBdHRlc3RhdGlvblNlcnZpY2UtTG9jYWxUZXN0LVJlcG9ydFNpZ25pbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsuOlDyU1sYAuAV53n7TrmTU180bOREgfZoTsdOyllMcsKciTUWkTO0vKDa8CFwGEHmSVTAEngDIHw1putio84HKZdcI6nPt2B74kJ/+5ut8KGMWtBm6GFWwS0TXti1rE4Os1mPpCYAsUyKxaEw4lBbEzGa5mGx0SGLdseuUIiw23S695RLVCciDaAvf+q/gBScFgZJm2ZxgkyNF7+MSvnDMU1xv5YLDQeh3j5vZlstSq+rrRbB5SVnuD4cFBjvGW5lXBLxMEjpBXI6yzFmFuw/OjZ7VClk6HSNjvvhSwJu4F1oHuJ0oAuABOtPpRK/898Ru+9qS5ZMm79775nZK75AgMBAAGjfDB6MA4GA1UdDwEB/wQEAwIFoDAJBgNVHRMEAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBR/8W25+uWj5sg8lEKKYy1gdCqWUTAdBgNVHQ4EFgQUf/Ftufrlo+bIPJRCimMtYHQqllEwDQYJKoZIhvcNAQELBQADggEBAJGfbRRvF3EpG6ZsOcSmWtu/1LDVZq+fGspjK/7+ImybEY/zC2CsWWpz7pT54KEGYe91q67nV5GZoSz7+O4A4A5QtMDFzOnrFVicDo5Cg2EDU4YQDN4j4DyrbttkQYiEiBFexJImrjIk4bfW2YqZjtzR7XFDsCsOAUHNY8cnnKaZCRbXrLwP/LUYAz/NVkttO4CW4U/8OZygrarfAsVrsCsx5o2mXBlaRYl5xECWfvT2YbCFuIt3gZR9sau65uMWthgyV0XAR7farxycfMEuBkyb+IVPwYW5QGFo5M8a78r/rFPdczGPlv0Qvg7zrBm775xs8O33V4nOmC1tfsxXUgw=" ], "kid": "e5j-rIjIITYTB9RQSgM-OzOWjXM" }.{ "nbf": 1629758941, "exp": 1630104841, "iat": 1629759241, "iss": "https://ulptestwin.eus.test.attest.azure.net", "jti": "e325dad03894f09b12c53f3b5eac5e36824c89ae", "ver": "1.0", "x-ms-ver": "1.0", "rp_data": "AQIDBA", "nonce": "AQIDBA", "cnf": { "jwk": { "kty": "RSA", "n": "vTCRaX0IZMsNHfJPOVyiYSCM2WABZmNo3PSVTOt9mh0vR4Mon080EGHM_V3afjKJ4NxmEZ01XeB-1TsuNM2-19_JMWZF-wiBTrBWEjcUQ84AxzukaWD1sMsH2kiqjaxXBHEUl8Hhq9SRjVEEdT-fKLOzBO070TffvRCKVxZIRI9Ry6E6K8gMEX3CH6Yk9b7clAua0MrUxd28hMxwx4hy1HyCsFSnXb_bIaqxLYjCxisc9mRx2vO6IuEqEVskSYDc-5f8u2G98ld6PuiMkAhvOOEBmaDlEksvUpnA8e9nWO98rg17pjyOms9GLvgKkSgOKbK8wQ-NuUyXutQfaN2MbQ", "e": "AQAB" } }, "x-ms-policy-hash": "BpV0Jxx6oZ2AjkgXx3Gj7JiJ1NpZWGppjdT2OTtBR4g", "AIKPresent": true, "BitlockerStatus": 1, "CodeIntegrityEnabled": true, "SafeMode": false, "SecureBootEnabled": true, "TpmVersion": 2, "VSMEnabled": true, "WinPE": false }.[Signature]
      9. +
      + + + { + "typ": "JWT", + "alg": "RS256", + "x5c": [ + "MIIE.....=", + "MIIG.....=", + "MIIF.....=" + ], + "kid": "8FUer20z6wzf1rod044wOAFdjsg" + }.{ + "nbf": 1633664812, + "exp": 1634010712, + "iat": 1633665112, + "iss": "https://contosopolicy.eus.attest.azure.net", + "jti": "2b63663acbcafefa004d20969991c0b1f063c9be", + "ver": "1.0", + "x-ms-ver": "1.0", + "rp_data": "AQIDBA", + "nonce": "AQIDBA", + "cnf": { + "jwk": { + "kty": "RSA", + "n": "yZGC3-1rFZBt6n6vRHjRjvrOYlH69TftIQWOXiEHz__viQ_Z3qxWVa4TfrUxiQyDQnxJ8-f8tBRmlunMdFDIQWhnew_rc3-UYMUPNcTQ0IkrLBDG6qDjFFeEAMbn8gqr0rRWu_Qt7Cb_Cq1upoEBkv0RXk8yR6JXmFIvLuSdewGs-xCWlHhd5w3n1rVk0hjtRk9ZErlbPXt74E5l-ZZQUIyeYEZ1FmbivOIL-2f6NnKJ-cR4cdhEU8i9CH1YV0r578ry89nGvBJ5u4_3Ib9Ragdmxm259npH53hpnwf0I6V-_ZhGPyF6LBVUG_7x4CyxuHCU20uI0vXKXJNlbj1wsQ", + "e": "AQAB" + } + }, + "x-ms-policy-hash": "GiGQCTOylCohHt4rd3pEppD9arh5mXC3ifF1m1hONh0", + "WindowsDefenderElamDriverLoaded": true, + "bitlockerEnabled": true, + "bitlockerEnabledValue": 4, + "bootAppSvn": 1, + "bootDebuggingDisabled": true, + "bootMgrSvn": 1, + "bootRevListInfo": "gHWqR2F-1wEgAAAACwBxrZXHbaiuTuO0PSaJ7WQMF8yz37Z2ATgSNTTlRkwcTw", + "codeIntegrityEnabled": true, + "codeIntegrityPolicy": [ + "AAABAAAAAQBWAAsAIAAAAHsAOABmAGIANAA4ADYANQBlAC0AZQA5ADAAYgAtADQANAA0AGYALQBiADUAYgA1AC0AZQAyAGEAYQA1ADEAZAA4ADkAMABmAGQAfQAuAEMASQBQAAAAVnW86ERqAg5n9QT1UKFr-bOP2AlNtBaaHXjZODnNLlk", + "AAAAAAAACgBWAAsAIAAAAHsAYgBjADQAYgBmADYAZAA3AC0AYwBjADYAMAAtADQAMABmADAALQA4ADYANAA0AC0AMQBlADYANAA5ADEANgBmADgAMQA4ADMAfQAuAEMASQBQAAAAQ7vOXuAbBRIMglSSg7g_LHNeHoR4GrY-M-2W5MNvf0o", + "AAAAAAAACgBWAAsAIAAAAHsAYgAzADEAOAA5ADkAOQBhAC0AYgAxADMAZQAtADQANAA3ADUALQBiAGMAZgBkAC0AMQBiADEANgBlADMAMABlADYAMAAzADAAfQAuAEMASQBQAAAALTmwU3eadNtg0GyAyKIAkYed127RJCSgmfFmO1jN_aI", + "AAAAAAAACgBWAAsAIAAAAHsAZgBlADgAMgBkADUAOAA5AC0ANwA3AGQAMQAtADQAYwA3ADYALQA5AGEANABhAC0AZQA0ADUANQA0ADYAOAA4ADkANAAxAGIAfQAuAEMASQBQAAAA8HGUwA85gHN_ThItTYtu6sw657gVuOb4fOhYl-YJRoc", + "AACRVwAACgAmAAsAIAAAAEQAcgBpAHYAZQByAFMAaQBQAG8AbABpAGMAeQAuAHAANwBiAAAAYcVuY0HdW4Iqr5B-6Sl85kwIXRG9bqr43pVhkirg4qM" + ], + "depPolicy": 0, + "flightSigningNotEnabled": false, + "hvciEnabled": true, + "iommuEnabled": true, + "notSafeMode": true, + "notWinPE": true, + "osKernelDebuggingDisabled": true, + "osRevListInfo": "gHLuW2F-1wEgAAAACwDLyDTUQILjdz_RfNlShVgNYT9EghL7ceMReWg9TuwdKA", + "secureBootEnabled": true, + "testSigningDisabled": true, + "vbsEnabled": true + }.[Signature] + +
    ## Windhows 10 Device HealthAttestation From ae9a36ec88363e39c94af2714a228ce7e8e60d18 Mon Sep 17 00:00:00 2001 From: roh-kan Date: Fri, 8 Oct 2021 18:49:03 +0800 Subject: [PATCH 060/284] Update punctuation Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/update/windows-update-errors.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/windows-update-errors.md b/windows/deployment/update/windows-update-errors.md index b30011a355..fc07839d42 100644 --- a/windows/deployment/update/windows-update-errors.md +++ b/windows/deployment/update/windows-update-errors.md @@ -173,7 +173,7 @@ The following table provides information about common errors you might run into | Message | Description | Mitigation | |---------|-------------|------------| -| ERROR_SXS_ASSEMBLY_MISSING; The referenced assembly could not be found. | Typically, a component store corruption caused when a component is in a partially installed state. | Repair the component store with **Dism RestoreHealth command** or manually repair it with the payload from the partially installed component. From an elevated command prompt and run these commands:
    *DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*
    *DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALTH*
    *DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*
    *Sfc /Scannow*
    Restart the device. | +| ERROR_SXS_ASSEMBLY_MISSING; The referenced assembly could not be found. | Typically, a component store corruption caused when a component is in a partially installed state. | Repair the component store with **Dism RestoreHealth command** or manually repair it with the payload from the partially installed component. From an elevated command prompt, run these commands:
    *DISM /ONLINE /CLEANUP-IMAGE /SCANHEALTH*
    *DISM /ONLINE /CLEANUP-IMAGE /CHECKHEALTH*
    *DISM /ONLINE /CLEANUP-IMAGE /RESTOREHEALTH*
    *Sfc /Scannow*
    Restart the device. | ## 0x8007371b From f6d6c426d78f33a770ea693b721bf81fea31a3ca Mon Sep 17 00:00:00 2001 From: afirodiya <42394035+afirodiya@users.noreply.github.com> Date: Fri, 8 Oct 2021 10:13:58 -0700 Subject: [PATCH 061/284] Update windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../enable-virtualization-based-protection-of-code-integrity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index 03ca52bd5e..5d7ffa6cd9 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -311,6 +311,6 @@ Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true ### Requirements for running HVCI in Hyper-V virtual machines - The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607. - The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10. -- HVCI and [nested virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time. To enable HyperV role on the VM, first install the HyperV role in a Windows nested virtualization environment. +- HVCI and [nested virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time. To enable the HyperV role on the virtual machine, you must first install the HyperV role in a Windows nested virtualization environment. - Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`. - The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`. From 69e1bbd3d1f64537cbe625f1af5415b069330545 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Sun, 10 Oct 2021 15:21:37 -0700 Subject: [PATCH 062/284] Update windowsdefenderapplicationguard-csp.md --- .../mdm/windowsdefenderapplicationguard-csp.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 468313fb87..546bdf3f0c 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -50,8 +50,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. The following list shows the supported values: - 0 - Disable Microsoft Defender Application Guard - 1 - Enable Microsoft Defender Application Guard for Microsoft Edge ONLY -- 2 - Enable Microsoft Defender Application Guard for isolated Windows environments ONLY -- 3 - Enable Microsoft Defender Application Guard for Microsoft Edge AND isolated Windows environments +- 2 - Enable Microsoft Defender Application Guard for isolated Windows environments ONLY (Added in Windows 10, version 2004) +- 3 - Enable Microsoft Defender Application Guard for Microsoft Edge AND isolated Windows environments (Added in Windows 10, version 2004) **Settings/ClipboardFileType** Determines the type of content that can be copied from the host to Application Guard environment and vice versa. @@ -279,7 +279,7 @@ Value type is integer. Supported operation is Get. - Bit 6 - Set to 1 when system reboot is required. **PlatformStatus** -Returns bitmask that indicates status of Application Guard platform installation and prerequisites on the device. +Added in Windows 10, version 2004. Returns bitmask that indicates status of Application Guard platform installation and prerequisites on the device. Value type is integer. Supported operation is Get. From c66f5f99b1ee002661c50a9faa0adebe380d5c7f Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Mon, 11 Oct 2021 15:42:03 +0300 Subject: [PATCH 063/284] Update Best practices https://github.com/MicrosoftDocs/windows-itpro-docs/issues/9916 --- ...ntrol-behavior-of-the-elevation-prompt-for-standard-users.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md index de0490479f..37b331657f 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md @@ -46,7 +46,7 @@ This policy setting determines the behavior of the elevation prompt for standard ### Best practices 1. Configure the **User Account Control: Behavior of the elevation prompt for standard users** to **Automatically deny elevation requests**. This setting requires the user to log on with an administrative account to run programs that require elevation of privilege. -2. As a security best practice, standard users should not have knowledge of administrative passwords. However, if your users have both standard and administrator-level accounts, set **Prompt for credentials** so that the users do not choose to always log on with their administrator accounts, and they shift their behavior to use the standard user account. +2. As a security best practice, standard users should not have knowledge of administrative passwords. However, if your users have both standard and administrator-level accounts, set **Prompt for credentials on the secure desktop** so that the users do not choose to always log on with their administrator accounts, and they shift their behavior to use the standard user account. ### Location From f5bd247967a1e8f05ee132a989ef0d6909671be4 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Mon, 11 Oct 2021 08:10:56 -0700 Subject: [PATCH 064/284] Update windows/client-management/mdm/windowsdefenderapplicationguard-csp.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../mdm/windowsdefenderapplicationguard-csp.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 546bdf3f0c..946c8013d8 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -50,8 +50,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. The following list shows the supported values: - 0 - Disable Microsoft Defender Application Guard - 1 - Enable Microsoft Defender Application Guard for Microsoft Edge ONLY -- 2 - Enable Microsoft Defender Application Guard for isolated Windows environments ONLY (Added in Windows 10, version 2004) -- 3 - Enable Microsoft Defender Application Guard for Microsoft Edge AND isolated Windows environments (Added in Windows 10, version 2004) +- 2 - Enable Microsoft Defender Application Guard for isolated Windows environments ONLY (added in Windows 10, version 2004) +- 3 - Enable Microsoft Defender Application Guard for Microsoft Edge AND isolated Windows environments (added in Windows 10, version 2004) **Settings/ClipboardFileType** Determines the type of content that can be copied from the host to Application Guard environment and vice versa. From 69d27ba5c9f625fd8fc9c3b9d50b369bb6ece943 Mon Sep 17 00:00:00 2001 From: Jaime Ondrusek Date: Mon, 11 Oct 2021 08:16:48 -0700 Subject: [PATCH 065/284] Update windows/deployment/update/update-compliance-get-started.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/update/update-compliance-get-started.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index b50e741721..c01d76b407 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -24,7 +24,8 @@ ms.topic: article > [!IMPORTANT] > **A new policy is required to use Update Compliance: "AllowUpdateComplianceProcessing"**. If you're already using Update Compliance and have configured your devices prior to May 10, 2021, you must configure devices with this additional policy. You can do this by rerunning the [Update Compliance Configuration Script](update-compliance-configuration-script.md) if you configure your devices through Group Policy, or refer to [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md) for details on manually configuring the new policy for both Group Policy and MDM. -> Devices must have this policy configured by January 31st, 2022 to remain enrolled in Update Compliance. Devices without this policy configured, including Windows 10 releases prior to version 1809 which do not support this policy, will stop appearing in Update Compliance reports after this date. +> +> Devices must have this policy configured by January 31, 2022, to remain enrolled in Update Compliance. Devices without this policy configured, including Windows 10 releases prior to version 1809 which do not support this policy, will stop appearing in Update Compliance reports after this date. This topic introduces the high-level steps required to enroll to the Update Compliance solution and configure devices to send data to it. The following steps cover the enrollment and device configuration workflow. From 111b18461fe8d3def2f69d6f3de704bb3cae543a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 11 Oct 2021 10:05:18 -0700 Subject: [PATCH 066/284] Update user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md --- ...ntrol-behavior-of-the-elevation-prompt-for-standard-users.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md index 37b331657f..688bce1b38 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md @@ -14,7 +14,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/19/2017 +ms.date: 10/11/2021 ms.technology: mde --- From 3db37ef4d18ceb33b0bac31bd302baa68b447db2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 11 Oct 2021 10:06:31 -0700 Subject: [PATCH 067/284] Update windowsdefenderapplicationguard-csp.md --- .../mdm/windowsdefenderapplicationguard-csp.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 946c8013d8..ccd89eb916 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -5,8 +5,8 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman -ms.date: 07/07/2020 +author: dansimp +ms.date: 10/11/2021 ms.reviewer: manager: dansimp --- From 00486ad7c37489f306758d6e249e9dc986abb054 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20Notin?= Date: Mon, 11 Oct 2021 19:35:00 +0200 Subject: [PATCH 068/284] Fix default location of Authenticated Users special identity --- .../identity-protection/access-control/special-identities.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index f0c84a4b48..d97d4fecb9 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -106,7 +106,7 @@ Any user who accesses the system through a sign-in process has the Authenticated | :--: | :--: | | Well-Known SID/RID | S-1-5-11 | |Object Class| Foreign Security Principal| -|Default Location in Active Directory |cn=System,cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| |Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
    [Add workstations to domain](/windows/device-security/security-policy-settings/add-workstations-to-domain): SeMachineAccountPrivilege
    [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege| ## Batch From 50093836827e70076bd6b549f749104ef662bbdc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20Notin?= Date: Mon, 11 Oct 2021 20:02:38 +0200 Subject: [PATCH 069/284] Fix Authenticated Users name --- .../identity-protection/access-control/special-identities.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index f0c84a4b48..6bf47c2e9e 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -39,7 +39,7 @@ The special identity groups are described in the following tables: - [Anonymous Logon](#anonymous-logon) -- [Authenticated User](#authenticated-users) +- [Authenticated Users](#authenticated-users) - [Batch](#batch) From 1e76f571a9691abe59297eefb3c8ae17efd2aef8 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 11 Oct 2021 13:14:32 -0700 Subject: [PATCH 070/284] New 21H2 HoloLens 2 Policies --- ...es-in-policy-csp-supported-by-hololens2.md | 13 ++- .../mdm/policy-csp-mixedreality.md | 80 +++++++++++++++---- 2 files changed, 75 insertions(+), 18 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md index 507b737aa0..b312ee27f9 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 10/08/2020 +ms.date: 10/11/2021 --- # Policies in Policy CSP supported by HoloLens 2 @@ -51,6 +51,7 @@ ms.date: 10/08/2020 - [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) - [Experience/AllowManualMDMUnenrollment](policy-csp-experience.md#experience-allowmanualmdmunenrollment) - [MixedReality/AADGroupMembershipCacheValidityInDays](./policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays) 9 +- [MixedReality/AutoLogonUser](./policy-csp-mixedreality.md#mixedreality-autologonuser) 10 - [MixedReality/BrightnessButtonDisabled](./policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled) 9 - [MixedReality/FallbackDiagnostics](./policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics) 9 - [MixedReality/MicrophoneDisabled](./policy-csp-mixedreality.md#mixedreality-microphonedisabled) 9 @@ -101,7 +102,13 @@ ms.date: 10/08/2020 - [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) 9 - [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) - [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/AutoRestartNotificationSchedule](policy-csp-update.md#update-autorestartnotificationschedule) 10 +- [Update/AutoRestartRequiredNotificationDismissal](policy-csp-update.md#update-autorestartrequirednotificationdismissal) 10 - [Update/BranchReadinessLevel](policy-csp-update.md#update-branchreadinesslevel) +- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) 10 +- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) 10 +- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) 10 +- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) 10 - [Update/DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#update-deferfeatureupdatesperiodindays) - [Update/DeferQualityUpdatesPeriodInDays](policy-csp-update.md#update-deferqualityupdatesperiodindays) - [Update/ManagePreviewBuilds](policy-csp-update.md#update-managepreviewbuilds) @@ -109,7 +116,10 @@ ms.date: 10/08/2020 - [Update/PauseQualityUpdates](policy-csp-update.md#update-pausequalityupdates) - [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) - [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/ScheduleImminentRestartWarning](policy-csp-update.md#update-scheduleimminentrestartwarning) 10 +- [Update/ScheduleRestartWarning](policy-csp-update.md#update-schedulerestartwarning) 10 - [Update/SetDisablePauseUXAccess](policy-csp-update.md#update-setdisablepauseuxaccess) +- [Update/UpdateNotificationLevel](policy-csp-update.md#update-updatenotificationlevel) 10 - [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) - [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) - [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) 8 @@ -125,6 +135,7 @@ Footnotes: - 7 - Available in Windows 10, version 1909. - 8 - Available in Windows 10, version 2004. - 9 - Available in [Windows Holographic, version 20H2](/hololens/hololens-release-notes#windows-holographic-version-20h2) +- 10 - Available in [Windows Holographic, version 21H2](/hololens/hololens-release-notes#windows-holographic-version-21h2) ## Related topics diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index 42e192202e..2d549c3a18 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 10/06/2020 +ms.date: 10/12/2021 ms.reviewer: manager: dansimp --- @@ -23,6 +23,9 @@ manager: dansimp
    MixedReality/AADGroupMembershipCacheValidityInDays
    +
    + MixedReality/AutoLogonUser +
    MixedReality/BrightnessButtonDisabled
    @@ -50,15 +53,15 @@ manager: dansimp HoloLens (1st gen) Development Edition - cross mark + ❌ HoloLens (1st gen) Commercial Suite - cross mark + ❌ HoloLens 2 - check mark9 + ✔️ @@ -79,6 +82,50 @@ Steps to use this policy correctly:
    + +**MixedReality/AutoLogonUser** + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    HoloLens (1st gen) Development Edition❌
    HoloLens (1st gen) Commercial Suite❌
    HoloLens 2✔️
    + + +This new AutoLogonUser policy controls whether a user will be automatically logged on. Some customers want to set up devices that are tied to an identity but don't want any sign-in experience. Imagine picking up a device and using remote assist immediately. Or have a benefit of being able to rapidly distribute HoloLens devices and enable their end users to expedite login. + +When the policy is set to a non-empty value, it specifies the email address of the auto-logon user. The specified user must logon to the device at least once to enable auto-logon. + +The OMA-URI of new policy `./Device/Vendor/MSFT/Policy/Config/MixedReality/AutoLogonUser` + + +String value +- User with the same email address will have auto logon enabled. + +On a device where this policy is configured, the user specified in the policy will need to logon at least once. Subsequent reboots of the device after the first logon will have the specified user automatically logged on. Only a single auto-logon user is supported. Once enabled, the automatically logged on user will not be able to log out manually. To logon as a different user, the policy must first be disabled. + +> [!NOTE] +> +> - Some events such as major OS updates may require the specified user to logon to the device again to resume auto-logon behavior. +> - Auto-logon is only supported for MSA and AAD users. + + +
    + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -114,15 +161,15 @@ Supported values are 0-60. The default value is 0 (day) and maximum value is 60 HoloLens (1st gen) Development Edition - cross mark + ❌ HoloLens (1st gen) Commercial Suite - cross mark + ❌ HoloLens 2 - check mark9 + ✔️ @@ -167,15 +214,15 @@ The following list shows the supported values: HoloLens (1st gen) Development Edition - cross mark + ❌ HoloLens (1st gen) Commercial Suite - cross mark + ❌ HoloLens 2 - check mark9 + ✔️ @@ -221,15 +268,15 @@ The following list shows the supported values: HoloLens (1st gen) Development Edition - cross mark + ❌ HoloLens (1st gen) Commercial Suite - cross mark + ❌ HoloLens 2 - check mark9 + ✔️ @@ -274,15 +321,15 @@ The following list shows the supported values: HoloLens (1st gen) Development Edition - cross mark + ❌ HoloLens (1st gen) Commercial Suite - cross mark + ❌ HoloLens 2 - check mark9 + ✔️ @@ -317,4 +364,3 @@ The following list shows the supported values:
    - From da790514fab01155f8f9cd957c8cb1da70827c5e Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 11 Oct 2021 13:22:18 -0700 Subject: [PATCH 071/284] 80 --- .../client-management/mdm/policy-csp-mixedreality.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index 2d549c3a18..d08161c676 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -68,13 +68,13 @@ manager: dansimp Steps to use this policy correctly: 1. Create a device configuration profile for kiosk targeting Azure AD groups and assign it to HoloLens device(s). -1. Create a custom OMA URI-based device configuration that sets this policy value to desired number of days (> 0) and assign it to HoloLens device(s). +1. Create a custom OMA URI-based device configuration that sets this policy value to chosen number of days (> 0) and assign it to HoloLens devices. 1. The URI value should be entered in OMA-URI text box as ./Vendor/MSFT/Policy/Config/MixedReality/AADGroupMembershipCacheValidityInDays 1. The value can be between min / max allowed. 1. Enroll HoloLens devices and verify both configurations get applied to the device. 1. Let Azure AD user 1 sign-in when internet is available. Once the user signs-in and Azure AD group membership is confirmed successfully, cache will be created. 1. Now Azure AD user 1 can take HoloLens offline and use it for kiosk mode as long as policy value allows for X number of days. -1. Steps 4 and 5 can be repeated for any other Azure AD user N. The key point here is that any Azure AD user must sign-in to device using Internet at least once. Then we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. +1. Steps 4 and 5 can be repeated for any other Azure AD user N. The key point is that any Azure AD user must sign in to device using Internet at least once. Then we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. > [!NOTE] > Until step 4 is performed for a Azure AD user will experience failure behavior mentioned similar to “disconnected” environments. @@ -106,17 +106,17 @@ Steps to use this policy correctly: -This new AutoLogonUser policy controls whether a user will be automatically logged on. Some customers want to set up devices that are tied to an identity but don't want any sign-in experience. Imagine picking up a device and using remote assist immediately. Or have a benefit of being able to rapidly distribute HoloLens devices and enable their end users to expedite login. +This new AutoLogonUser policy controls whether a user will be automatically logged on. Some customers want to set up devices that are tied to an identity but don't want any sign in experience. Imagine picking up a device and using remote assist immediately. Or have a benefit of being able to rapidly distribute HoloLens devices and enable their end users to speed up login. -When the policy is set to a non-empty value, it specifies the email address of the auto-logon user. The specified user must logon to the device at least once to enable auto-logon. +When the policy is set to a non-empty value, it specifies the email address of the auto log on user. The specified user must logon to the device at least once to enable autologon. The OMA-URI of new policy `./Device/Vendor/MSFT/Policy/Config/MixedReality/AutoLogonUser` String value -- User with the same email address will have auto logon enabled. +- User with the same email address will have autologon enabled. -On a device where this policy is configured, the user specified in the policy will need to logon at least once. Subsequent reboots of the device after the first logon will have the specified user automatically logged on. Only a single auto-logon user is supported. Once enabled, the automatically logged on user will not be able to log out manually. To logon as a different user, the policy must first be disabled. +On a device where this policy is configured, the user specified in the policy will need to log on at least once. Subsequent reboots of the device after the first logon will have the specified user automatically logged on. Only a single autologon user is supported. Once enabled, the automatically logged on user will not be able to log out manually. To log on as a different user, the policy must first be disabled. > [!NOTE] > From cc199092888715b753f46e5849a892a25b2279cd Mon Sep 17 00:00:00 2001 From: qianw211 <41130658+qianw211@users.noreply.github.com> Date: Mon, 11 Oct 2021 14:45:58 -0700 Subject: [PATCH 072/284] updating the note on win11 fod file --- windows/application-management/manage-windows-mixed-reality.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md index e33d30d8b8..ecfbf1a470 100644 --- a/windows/application-management/manage-windows-mixed-reality.md +++ b/windows/application-management/manage-windows-mixed-reality.md @@ -50,8 +50,7 @@ Organizations that use Windows Server Update Services (WSUS) must take action to ``` > [!NOTE] - > * On Windows 10, you must rename the FOD .CAB file to : **Microsoft-Windows-Holographic-Desktop-FOD-Package\~31bf3856ad364e35\~amd64\~\~.cab** - > * On Windows 11, you must rename the FOD .CAB file to: **Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e45~amd_64~~.cab** + > On Windows 10 and 11, you must rename the FOD .CAB file to: **Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab** 1. In **Settings** > **Update & Security** > **Windows Update**, select **Check for updates**. From dd4fca93b1a3a64149dab14802e44d757e1ec500 Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 11 Oct 2021 15:18:42 -0700 Subject: [PATCH 073/284] Add files via upload adding maa flow image --- .../mdm/images/maa-attestation-flow.png | Bin 0 -> 81911 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/client-management/mdm/images/maa-attestation-flow.png diff --git a/windows/client-management/mdm/images/maa-attestation-flow.png b/windows/client-management/mdm/images/maa-attestation-flow.png new file mode 100644 index 0000000000000000000000000000000000000000..5bd288d0aeb9a5ae32344d19f58903e61da0db4f GIT binary patch literal 81911 zcmc$`2UL^W)-D{&wqZft0)l|pP^uzLs=(eBkYb^ih#(LkM1;_rTLBdTw@8r)$dO(W zY9NFJ1OzDoqyn#5@m#yt=5au73Mi z7Fwjxt@cjEBS-h4u9{Ngd-9?*UtllZZoL)!=no<m*R;^uKq#b8Fdc_m%|Ry5C~U>US@So)PLg9x1&^ zO4D1gT@6T1KAD-QZ@g>oN{*HW^&a>x1NSeJRj3D%=f;b_jR<4Ie|KOmcGuEH z!xJd7Q=wmm;rqsnCdZOKmGZsx+&XDyGklYY!@?cPhSl9SCJGGPg_-EWPKl>tvrCoX zWr;dYd>5SWbk!A|A`O##yCi&DYvH1Zt0;{$KhkkKx#*i+m&Vbg;mZ+2yH9UOVkuNX zJ1EHOiGVNpKba#ZO$Hr#V-Ps7P9tCqM;$G;m_Vn(ra{Ig<;p#Igl_;k|1Yyqnv zGs#;QDHBamIMs9b?1tghsg*P!#({}cINbC?gzLmBN^ycJT$OGwFtop|dfZ2%5P7ZS z{Oupg_X{Qq7lr!BuP;VWt7PsPygOx+RX%$ug}L~c`VYYo|6G4MJ({@OhW)!ty9*jo zGVlN{>URPtY|h_qFjBZEy!&-tnT?F(^bUo%`r1zn{0!r&`?hBr&eS~dO+g;#`#!3G zmD~>0C3vlb(aj!`);9b13JOat9&!;-6L!I^*j|zq?%}z(Azy|1Bl5c^bWy6y{jR$0 zEwhTIT?WgQPw2ay+S#+*5NeaL(FYfefk7s9{D z=>Vg0{`HB{v@bA0*9p2Xx!ou5PYB7CveUD8-}wKs&wGF zw6T`|UxVzwn=HG6Wb>W1 z;o^sHCJQIlU6~BQkcNBS(FA=Bxwp z7Iq@>HTl-@uZqhdqJ=L->AruP^sypK+t(HnV34PTdi)XX*iGWr3tC67-dr2!sJ7;Z*(-s!6=B;7KAtM) z`VNf$8*o=Tvx{)3SMDS8>)*R3ijoem4bq&Z??FFandnkD7xvvv6;1-2-8F$Kn7g?F zZPG&jd+h!1+~WTR&~r(Z65VS8byahHlZ?8^!#Yk-&m|D|h!d&^@7py`ZG}lgJ#QM0 zKOUA+OrSIs!cCdV+$BGNOYD}1FBKb!xKIcmq{EndkoUVjJUQ59K$L;0AjZ4gMo>CV zrk+}qBkBwX0X01CHAVKmJ6uIIR@(OB4{zq!Z;>$H{K4B{U`4C6>{O&KfD4ck&>)lt zRg=cfXAi*z)Mjzdmb8q@lK8e<`30NrFrQ|EWiK!Q*mQuElSe}ViZ0;k(H4I8%nuLR zKx$AT9slYoVacla2bz{u(jvMp`^mteaC_Spf-T5QpW^cp+}fwvC_T6gKVJ62)wX=c zcQ@hyxnzQ>GBpfi+UpA!Ws3>-cn`HTWi2^Uh$ihm4adLQNLcd!6HSrZspnW}nrz?| zC`zTLnxE|P&d9{Ib(|Y%4A{u}+=~Jh2_n-OX9mu5EB)ViaP}jokmh532 zFr;}ZHhhU%z^ax>0BPY>Jxld`-i48B$PZG%b*yx+jw5s-KBCJ&T?JLwJWf2|U2((Xs}@A`oDYYH6yVK|P%7L{jztmPMi^Z#{_{Wp`@9kL+X zySMEA@WZFsY%Xw4dq%}8X+s0*CLatiNjslkr!dnjt{z+mDN=fe?$gCyhYxA(mxIW4 z!t1zmQ53#eP7t~Ku(gNaLdel|Fw)$S+FF6FK2WOWLjQ}V_Z{ipMBWrvQ7E+#dZV=t z?VK62y&qOgBZQt5=%ksBGo0dDPaSzz;*V+Xp}xG)6Pb!$2WAc-J1vgSFK@&} ze_m&lL!WO2O?=bWEX?kyHDwny;Pv&TFeY-;+;eJ!bryphak6|pA?$VKF$)eqWN4pm zNbx>iXg`5r{6yKcJl23+YWe*>s{cCorCaZyx^ZMD7JgHC(kmA(G9k1!ligc$k2vWq zlq=pV(l7rj&VF3UJZ@G+Q}a8NWG6jx48PT~^}}hp?=7I}wP84?lTObVcu@bCczd~S z?t2zEm|fu@czADICgBIkJpB5!`othgx{DYE0kx?Q^X*kCpRS4_}?|69sn zuvxRt+F}N4UW_Z>>yB7(0t^k8o0U2SZLM6#9Ny zNukT37hYd(t~DE9dG$Bxs@%5c-ziN=4kuvVcbIi^ue-5R4+>a~9oWbfaN){1zyWj| zO&2=UVlF?wDbm5{@Ro4B{5@>VjXr$i4f=ayE&oj!`+q;k{+r3vGryG> z;3I4<{#s6mmLmQ&_mSNmc(cU{l}b)9z>OsM-fG95B&`CeQA3M5*6XBpz_XU#%M8s} z$ZkSw#gN|h&r0#4be(LUbP6nR@`d>-5a-0i*-s|f&F}b@%eMew?wIqv<;gOZr2!H0Q%;1#fWVb$TBl6vUyb*7O)2} zLJK9+6a9t7sgiurZqIWy%w|X3HH0tUtPm++(qz!G6|&7@M||t%5hsynCqJxasQ?u% zj%*q*V8EY=T@Y{CtX?I;a=|jL#Yt$b6*Y6!#Lk?ZK*V^3?)lw<#3jB!hhO1%7r55P zI@{EuP6HN(+`c|?qTK0_W>Zk-M5<9aTsmB!>h5zMMmbMrL?UuD12zAG(JZ(mNOYJ|4${#oIw zHHFH4SBTw=VsY4eAvfg@Iu>gmC5x^P`}N%VM1QP*Il%M4W}5s5G(szOb%OGi=j)Qq zs2#aOemM5!?&@_Or*&0a6x^A+7Gf{H5Ahr4uS0yhvZhoBm(h_s;lrBvb(8ImTvyBO zi?6xvkk@;Z<$B-0zOBLWF|a|H#u!`nh*PT*=M*OecCaHDvc+CDCoI1D$5Q*hFI8-_ z^JDXUc@fd83%i|@y#9-j$DDlZK?45#u5P18>bLo~f7-AV&yjVp%8zjecQTGDdaiLl zE{k>FIeTK=7j|cTU;Kwh6tGE(?+(z_0H>l-a-8&7(Xn^=> zcD&869BNLD`u@>X4&U{U%zidh)L#Y7?nWXP{(#*6oAb_EtXskoCvtAxe+(%lbHdq>aV@N5b zMIJc@Is3=2>g0M`&|GA3HR3^(>;yYD1B6bjNz5Y!OGJQ3+9D3`T{WhL#Lv@(sF{2< z#U#~U)Izzlv8d!Y{M4oRSf||3-H|kQ=A0o{6oKIG3()?{QOtDT!j8QuJk|bb`cs1kGBvE z?i|?202ev_;WJ_}t?FYY>+o~qA2a8Cw$T_fgSj8M6P#MGjvZR2CSSYs@Z4(2ByTJ` zig1@qbT6PsWqQT+Xy(L-+%G?fWAns#l2c5gLgo3zE=GN zyF4o2;|>xMwT47SQr`m(AV1raXUDKVunvHUpti=C35cAv*Bk$SPP~A%u;g0SfLvVJ zu?D^nAc{~<*u$|!?DrB2GNb!54uB$2a2@LbbROT@;rx69JOCmt^ZXlDK_FaJFd?_> z?;AxBvB#e{6%8r;!JU0)=s%{Z`4x%SgFVq0^Lidvx_f=utmA7c15DxeuVx1ls{X8J z&?fcYm~Z#9Ut${!wrB;y%q)`Lqr!nb zR4yQ;%{X=r)n)pZo56}!eUE3yk5A9a!B!+sZy0GquD!Z2;SJwYwb?@Z3j06zu>Zs< z1lRK=*r(O}PrUd)nuA>^)CkRbpbJdDZ;zJ$B`;ouj$8{);4Z(N`?n;_cA}U)S#MKw zH&Xt^Oa9k0?QitiMuksJH7HC@1Nr*v?F3&B;pBV%%DOY@fX z9NKHYyWo*YW#(k9>9FU>PF+*E_!Ul@EzQS&j^&U)e2y2I2hR4{blq4fuDrKoDV|mH zRt6tGV5!!7@@WBF;m(A^YBx_v_3|RX)i+-J2d-|UWVtM zRzP|;K&)3&tkG*;#2Zp_6oph&Aam5$oHx^u(sRQ7JWo`Zf#r?NQDmA7_hfgF8f9W6 z2cEu*Y&u|K{c)U%B$zc7Ow!u5Pj|tQ(?qjtwBKD@w+CF<@c?477n2@S7^UiP4mB` zYCtp)|48@Sv<67|S#r(lC>uF`Z{)*!&F|&T_IUUh4a7crif9f}ol_r(>5C1)Tpr%S z)#yW*XiZ|_)7qJ;%RS1cd55L1Ovlo2j!LRpgJt_#T=8Kr7VpZD3~mZtxE@DK(S7cA zjZwEaG37SBubqQF+e$wdth%MyHZ`!b@Bka^b_Z3XY!elBvidpSpw96~z{u*QaCD2) zqU^R4iDnOT?kyf_sABGnWDuYeil_Srcz$OoL{~~IyWcW^(FDWWLtI+qEz;(xJ;v&v zJkZ7uyG!Pa6%JdS%f5M5a0R~gV)Q?A>5Q?@bXIG#Bz>Ei+`!o*{j{Txi%1O0;~I{B zR2y2=NFJuv;`4YeLPnnVkI()jO0qzt&S*nxKm% zIx3NM{_4IonHy+t3j{P*vR&!feD>l`q0q#Ocug7{GM1C$JFG%NKk)Fzpz}*S@Tl^f zd$GS=C3Mu^wojB1xSXc;5#w^9VQ6Y1)rKaB*vI^ODMo8Ro-sK2>nk)MYoDK#&#t2N)GqhSgfM3p&1A7V z9Xdi6EG9h0ElWM()EWH*?u>(zO1yK_V&z+M{gX6@!_e)uHyjMZV#qGRkV{5X#Q8&{Y#2CR)T==gm0k*Ejn>2?{b3G~cS)^_cR$uHj9Ckk7VnxrG@$j6WQ;JlD_w|ASwRJY ziU!g%D4{tVKJiA0_G4~*kTQfNJ*ge6#E&^9;P&qaiN6@&`GlamrpwKLDkEN zqy1!Fa@s2pI*ZZ~Zv5E1n2z-8R#d$>Ged~j^B=ij=AtCxHPS2p+?XgaJ*Lovbl$0J zB($#BKh{7_6ZHgf-zMEnPJP&65B|`^+v`gvsmySu+*9(Kp3WY$ahlk$0#T*pg6=d@ zTgHIPrROriBrd{(kY|9OyKLT_+G=Irtt&iyj<)od6Z&tjLX)nN>e-$wwKSWO!=kr@ zX|2~N#m2pgabIWW)$b}-7ehrSnaL5zXUuAccACrKqWXVPY5a>bQ>Yo@Dmq zKBAMVrk^ooh!z-&$8+sQgwD%6$Khl5t|g8-bl3}IcVtV9w`x)rZ4S-t@eh-Ue_P$+oPi0oz_+UXYMERA^nvB>@tBsy zf|gEMv<>s=+nupfPB8C^_GIN7^?Bv{pX$IVa4iwKP zh-91Y0e3xhIHh$q zx0;w}V*G)zS4MCmcs@qKyiANno%c!;>-T(L!;gVQIf%tOM5$y~xj4%7-Z4qNM6fsy z+4jc|mP)ZJg>hx{gmxM9qdZ8}A&3rSUeo-gJCr?jN8u85Yuth{`D$0S8=X>J;Vjn1 z>-N^UTQAqCQ7dYp8m?d*E~XIY?&GI^H|}N;D{u76k{p&J@=q&f4#q$M)&?PJ9w^&=V^Grp#uipEuB>)T%oETm4HqM;2~WrFn_OCOev&K>!_vDt-v5M=cBDM9L5AQ+RX;A(+od5M?Mjn-)LTzf2zyVu2j+)M+e7< zK_6Fza5wdptO0hAN|To%Vh4UE-g|fvv4NWS3(@*M2PNR81$;?M761y#w7LnY)OlXmJN|T)Ik0 zqB8_Uq9I#4g>RjQ4QEA+etFHduYM6(ze8s4fDD#{nJEbEc*>M(1)>{Fs^rbkzwn}T zVJ?U)1KObkrc;=ZMX*I&f=+cPFsK4t&|!=(6&iPC1bsOS9Bhig|1HwQF|Jj%%lq?})-` zKGt^gb_D{Iq;?Y9J13nR3oD4ICtWt}bYvtlbbt}-5V#ivF)G?5R51L|a`!cg_PoKc zkdq>L)Ea91z9xZDQs=ci;O3HTFf8nZ(x-UBg=v#>ruhsVMT{|}ptY8A7tUQ(^KrDa zMnPFF4jV2ryQlqHx6|_u{B>dGj(%*MfMExtNdZ%=oxe~ua2HqIk8`_ko&q}}dMndm zH4L++H{E_5_*17@OUI`*>(ibRu?lT`b#9AO|9d%}VH5fgYB0#AI|YR*fDLTxdDf$& zG-T!=F|5QD-g7OA4?D?da}0f043Dzf1@HHZyCrIj373vL;@)G1e&RMzL$6#?Pss6O zXm=1ojQ2FztqYQZFg}yU)}A^otKYg zyb2$n&+)qb%h@8)oqipvoJ&&H~DunWXiYCB(g^0^BiqRgY{P!HpF7 zX5}K%Z2H|E7W9TH_^MXH6_wFC9c4X}HJGAUEuYsw8t^twhwQluo9M$3jV}e9cmp=y zzkLSAP73YXB?c`{(kVSkW{>%hp-hfLf>ujjT$9d8{0?UYYw(;7G5Q0g>V++%@_A^4 z`PZ&aVg!oB*u}IfOepphjcY8s?jx4HSPj<*geU6e%Y3zVa_$24Hr1X*>-RHWbQNVw zW@ZQysq@d0MXyTsWSCootE`vA_*A<9cjV59#F@#(#iMk(YS`4~l#|>QT2ET*oW_!3 zQY(Yz%Hrz^vNx-lFEr>MXt*B=aD)yLd`9GVJMB*VM?0`w&z>#h&5Or4=fw<8RiWN)vI538^w3^+oQr&WSpwlzVerE1!t zqo{qc@CDLoa-NZ^!So0NC5;#pQ}6Yf&|I9LXZ+r!!ON!y?VPsILia0qWz{hNJw3Uk z{=T1#zYsLPxYOS$1@HocewP;eZljHq9{Z$gPm34uOBQESdh5WbD+`samO9|-68fI` zp+#7m!drwwq}CKYr?sWEvH*aJ#5IaK33i;b=n|8AsCXe9TrX5`5AFBMcD?Ug)o%sskn6piCYIMI?nHJl z9{$J?3QF?!J1o}olrC1mBJ0yN)h4)H|8(rE;whCNy||~$xlx6$Ynl5y(0iz6Q)Ca$ zA!NwKaDzBBpwF1rWoM?IT4{FAMBco7Ywz(~532EE(i3VzBE|R`t?jf*huicvh~SyM zV3&92Y9!&WbB7?h+cP8QZOn`0_m+3JE9J@Pel@xH-DeRof+&O(sQJ5n)$XL4Z z%q_rBpAT5o-`93)NzFCKWB(yjhr>}?cfT8ftApUYq-WgpXKFvox}8+WV{JZgwD)qy zbZ2_C@1r^qx>8|l?WE)*v58!qMZzTSBm3kCY)_+jHWcr2p6v38jTR3}dqZ1>K4~gp zbg0yxEPpGeUe8k4lkoFe2{-`<&L){#QC1dgv3hNzJhzmKv75nX8`zn8^oxx%MY~(f zs!Hx~{>-b)0={QG-D6p_Bt%h-X@U!d)a+FA8Zr4gkKM59;CnZ@=d*#s$4<0)SBb}x z-kObkWoUd8$LmenG3nK#)=L&ptIz@R+&MuY&!L2ntQtX#dA`hEkY>FIjcTRgSuN;S zZY^Qy2z?+4A2e1G;kRVT&c&QMy=&xr!$ZweuMCH{M75>ikq)C?m!`7a)&kU z5}czuRB1$-+>v3gh_mq;!U_anJFEpMOwNL8Q-kAl=+se45Hsny=v0J8PMQ>$1Q)~c zGFME8fv{e_(og5eSqS-RHpKC}n=tjVhoU-E&}XUDy9Vwm_ZD0TJeRkFxdX0|U{J$f z#r%+=;zyv+QzaU*a{=FfJaaioUU@QEy4aB6iN3pA>9>z~ZGb32ll_mnLD z?9;V;mJHf({sP@h+CX&DBv{q<&_t0wwctV!d@{ER4yuWHQiq7c-3#M3v?GhM0+(4v zEtFs~NI2k&nLU1^6-s=}Let>0PF75>_NKcOg``6GNv8yTN;mMfM;U@zF%G_PJYb59 zjEPide;A#TZQPuNNb?XRQG#R~g~wZUD4ywtnFC=(fo^nABad+ly2lnn6-gauZ}}!n z`VGW}Gtjgl7H3hDR9VTrtWe*|gnT=!tTD5u=5V!xaJ<9UgIJl&YAj49i*}2<2^T?x zG{0c?v5m$+I}2&r7i20dcbL|X@{2R*K!qT)XUQW*liD?6EL6`4xM6k&mdf@QKLh77 zy}0fVp=4|iqmzVt%q(ajF|Kn@r0P?h8vTU_w)bS|TLmuD8<2u@P+m#I8{%mhXw;tP?Uf|Weu5$MRFEJBM*C@{sDW((Q9ref0v@z^3}m(LlItDv z$`|jRrwv^~cJPJd7UZfUGstq9ts=A-mPMsOzpr&9RwAxJQe|1pHy>?m#|=uhlYmK@ zZJR8mF!lf{Nz`vACp(*FP7dH6sRp0p6`jEt=F7m{cdOY&bQI~gH)$(6mu2-2q+_6p zleyLxmXAK8I_?1nM?ByA=Iyd_?<(rawN~~gwPDH%a!vI+rayw*;p*k+ypomIm^m4P zf+Lc<*sT?NJu)6OS83L(F{xm!3{?Z=Ph8e@rC~8&MP*y(z-7y_9;0i(ZWP(s-vT_( zV?Dime;k!4e*>V+s`w)p=z;wew_~7MZkl(F-(q66+Qyus{pGA%YQM9BdBkFFb&Vo< zV6280dtgE`(?eNtgim^Q!nMp&n|ID!@c69(6J%cayhnvf-czP*V`8Muu!>{I92F4i z`N@(3#i2{E=?@|e!t~dVb`7NP>ncwAfG^%v=I)8FyhLiWOy@`hZHx znW+=Fkj!tIW>XXW-fXD7v#32+&c53)Evw%uq28MqK~%F^5%Xt0>%z{ znep?_HbH!yO&*(zuI~Pw{aUeSzM7Ags2~H%w#qvaeIk{@M1hKgO>Z!(z3R0+E~DN3 z-%3z?v`|nOi0KpNtRsI)>cGHsJai8yY%zWGx^8w`N!9M z0zW6`_VZ1J`a+^gzInGyT=KD&hlE_(ku`7>PZVF>D{Pi?Zf?;IM9o+pf#|Ggsrac% zh)Dj^W1! z%f_GBYKJ~ozPC)ySb=vXZbVW7l9RStGuRe^-SmXDqay4LEIZyiWRV{mmIr^@!)I@^ zUf$RbEB|?`g}s~gpKU?cbPkO$oFD(sc2WP|?KZLtj(wvX=rzKwtO>`&;=o(l4H-;Xl@C;u}8{LkkIXYZH~aC$2lQpA63jsJ8~ z4FW0uD`rnFINjy^m_NQnXYIrsu(N-|&-+%Z3r_g43BZ2etombv`xi`Lf5`ez!cnza zRu>blF*f;qUmpw*@Y@fhWDm%3N4Bal(yd0w?Z;_IFwOt@F$MOZ8^=omQhJTL-8KdhKYZ?$Y6@$)%aEL1rTvnbWO&;0&Bx82k+DTafy~<(et)-U3T47(IwK zSGt&?zHo>pJK;BLC2-T%QR;X0;1Gz?wa0s;O^U4M4jT?5ygmhWYexq{ynM7qlxf(P z%hPs=Q^9W+>XtvMFJMJ?MVcCL&GxF?==AQ&3}KF!6z5DdhU{XF7r)6_Ax=MKPAC@@ zufz`?WD3gTJw7kHJY@>*zyxA3^%DdnlIWua&%$4Fi9}@8M$cx~8WMf(qGwdArw2)V z*lR1OJ%P&H#J&=Q%9&T7gkrz6wAnE3?bZdr?drkXI|5S^D_cL(rUnyCBSd{=9<@eu z&-yW6^e-zmojFpQON{-IIF?`YN3?IADcSp5SYWhN}9p$cIBx2` zQn2uC{POpx)~S8^O_JkfbA|6;ncBN7yT!~I5oZSYIL>1<_j0TX8({hUB&5;SYD|LP zLTA*7L&xtT{?2#N_q(1}H1uG^1bn{XA}(j>#+F==kr!z5s^}PKAJ*Z|jyG5O)_gaR zP?TM(KZ~i4^tT*{YH5Ev5vOwgg7xa?kRWi_f-8D5eIz>kkigz7!$DE1g+aGJIX@+A z_UrMo?WyrnNEb#{`tf#-5T+AUzth`xet9fceZkktG^I&r{r<)P%ilM^mg9tvJEKx? zyT$Uwb>??Z8QWrSmfo|<`otSw{r+w}mwC|J5c zYOg_jpnGb0^v^%_88oebx;@J5c28F0Yb6uqGLO%_AJs>~kf>DuyGnAtf98Sq4*RwH zxRC4&HHcQWSW&oe-&xvlp&GEnxm{T(!}<8J{8Rf3FF!qBlr8acZ#d!%L0Bm{UhL%B zFDp-NoW>fm)39s`q)iV(cj+E1%K*OmEv^anAX^iYs?DECyfdYT)K9$6v_nr(tEaph zwWGLJhX}Czg)%l1_LyoqkiTe_`5P1O*K3{H>%a0WeIUIrtIi<2%d2#;zqYa+L`~PF z=|Soa|1(F8?blWk^l|OL*YlpBrFcQ(2uc6DcP)oZn-b)g!eMG-N879%4sB)#cZewM zSuXgbAj_OSSR|0(OLxAWpq6%af?N9t+9ICH>?sVKYRokod|^GZdTtfMb17fQ4PBtP zH@EU8fKqB1eZtUF=;vCV^Y#^*;!fIMeXDq(Bcx z%Tr$n1B=Czztk7*TFLTp00s=z53GCFzEG!~XfRmUH*8fX>u;Lbb$NOaubvPIv~FS4 z=}*l(wbuYD3Xj?(Un|{E#(R8A4B=qv6481%;jN9CyS(SJ8>9W1 zb=~pl-%iX2iAQQd%RDDU<;=?F0ujYdL$5HNIOpdLck&tz zG8;Tu+pw-$gLRr}dDXKL=^bAt0bRxc?Z9mh?ekX^zePtX-=$SrGAU3G46?M=2%i7EL(5$z9Uy5kW)S!D7DbhVi7>D^_=%k$L@j0Qw zr?Rv)ER}pHeg_mKNi|^-3eLP*z108$sl4`>bfZY9Xjt4~IvG*s)8G6sJfS9>w3n*P zssM_2dAcvS-SCTOjp1NDUe@u|vK-%iDF0XCXV9|2@(|#~y#*@J_$`McA8mSrWiCLbLrj51s2tF zR7qL;2r*y5XJ$4K_yGtvglU4LV5dBvf#i62<=$zk(dm`1cY*U&Tt+3BcCQeIJHpN% zK~NML3M+UmuBUb1VEWFyYd@H5d!ltMC~kMIA0ZCJ}ma>o?k#J1QEo zUC;+^In;ItS7!)fVWL>U&{HRmc2Y>`kaCnHYkt&hFopcPjg#lcFMXp2y_T+zHN_|y z5R!^lzC_|ibb}^DblukO?km5saYDbmoI{s}CK)>UzWdVWe~sf$e75a1eiTc9)*e_# z%_8Yz9mTq5GOVMuC~UXB%#jQg6n}|OOf6n{kjj{sBjB zXq$>0YWp~P#geL=IX$Q<2=a2mSkPY9=Z=x{HQ1N;`v$6@vYu&+^Dhg>Q!Hei(-dMc zW7OxFW>M@Lc%*i&Y%$fYYh~YDb9UL#)zO12(ZN^0iQDDd<@Oy>2`qV?IPrcus!lqnI?Yu8w`XwUptr5Js7Z)2?*_HClG{H_F=R z*6Zh*Doag@l3(Dnis!JvzFK?a71N`2jw~+&v1dhH25Av}Be|I_k%O7L2E(BSo!&JZ zwi;tIE`JxsDrtm(bd3i3f!$0UbC(6%@gx{-T>FcyuW?|Mj zM;C6GWWH))eN!;Ff)(wBiRx2nEHWR_9@E_9QU>L!P^1x6O%RzS~sCY7Y<5pAUn{k)~bwv3Vx z%VPs%ZV^>~nB`EIZA0G~=CG~+8ekli@*F>sXKe?8M7&5b?TvJafbaGLskyk9C_l;A8~HfJgsFaO%hDgTzo4S#9q@=#Dk zJV%7(CZGs~ofu_bHiR`CxO0&CF1yt>j7!shvj53(sxHT=uJ(i2UNb_{Sr>aGdd8vl zxtLVGzo(Gl0&6;iIiamsV?5d?oKwG@U9A{Mi2?cl5C&^hS{+g8*mn+Q%t?&KmvzuP zSzkW-EO1Do<=@X58DZl+qAAJQ(7tJl=zTije z%R}q+x;a}8eE}80%_eXBE^=#ZMK4u5Xba@_2joFBa{bCYJL7BbQGd+(;P+eSv=cmW zDK|f4`?xO0(XMuvlrRIp_~y`!Ju?##eLTmk0;ialKn>)1CwkND6o`k8Lv>{_ySGEi zIZ;|3^i|(_ll>_*;q7WeN=j0ou*s~}_nBvbpUVij@r;1SQE?APL&+GW8|HD6zV23* zO@p=fb|+4%FVOpr_ay*YK8kEcO8^dcE*`afQR)Z;qG2boYIXKKVn-vs&A5QOFZ4W# z>SLGb!k-MM4k)|cMNdr+bI(yxT=Lk==xYFhM%72Y=^spWWd$?!AeAI{_-aq%qs`S%lLd*#pg88?h?*Oi5Cg`SbW|orbe!OBl~^it zcrUm!>0`*}5{q~u`v$oZDLyIotyck_XzKMIc?+}6W4*-+a)di@q7Ut6k=yd`^l4jF zky4+rjEWVnKc$XneW(^s&NLhraaYBMK$ynBu7$MmuO&<4!zU{@0gU%LybcjD5ueHx zwtl+)pyOZfP1c-zk@%}_L$y-7<=*~{QCf)F$a8CdG;KUH#!lXSg(AQtp z;&hq#;a%V^IY*TW2VE$eb1AoLKjz;&Qmorr7untPwc_hgi#OD~(_PEtO=m{DEYflI z32kyIKG*uRM*}DzBSd$dcUK*HI6~IW-$nH&C_r(vjP9AI)~7-4PF&aluni%)IxhG3 zvQ6oj6B)a;lYf=|fbWAR6ojX4drA`78j2CU z0@V)M1i8IGw&@#XWsDso(<0)pop$FAkn?Vt?9eG$4dbu<-e~rU?F)<+N340|NwGeI zE|RYR(y$6LKokj>7@qdtw*?}mK7AMj+iLbKFV*s`P%xzUQn1fXmOHW8-y&dTPFftC zrtP2JKip^jH^xW$@U|Q9;^j=qBc$kk%C@6+qsX=_0X)Nl(NfXNl;ukCKf0>Se+l*# zuI8Tr;?6`D`{zA>22RxL1f9%FJnPa2*dtaLPPia*(a``z+yP?rd`iu&%y8|Xzf!7q z4U)6#49C4kZ`qPRolgzZ2PjT8G3@p=U^h#)pat167tZF8&4w6Aq3j8QmYS;y8W4jQDl8XMIA3yaF@N*wl6w0C?_g-rzx-q(mY9to=Y&Zq81A5_XRM&J+u6VMb z09A@*#aHwa-OJ8wlTQf4rF|vJP5x}oBXoEhBtT;IsT2VZxVJYEGLi*uBf8CaamSzw z9RoKuSJ)hiZ{ACF@kOHZln!qzk!5GN_f-u&FtSPhYAlZWEOeq&O?`c&uGLfs?{#Fi z&2oK4YRJP{ikGG%o5F_bgJr+e14qm3b^~n3-2w&5>quaQvXbHnbO^_JcMH8vcdF<6 zEpuX$0v?|M@nJTJj^pRr!FNhesk+qP4XlfM8#u-Pc7Z@OF;6>U5rOgX)JD%R*|TBm6`qRb6IIfFHD+InlY%a^ah%$>Vr6o%GpkX2 ze5JQUJel@F=yqerkXC|xW@Y%keS)T{Kx;(n$5CvC@zKa{k)Kv{ZDlmpXQ94uadvRw z)r7^3ZhzYyiIv0z8Dzm?(q2^s)og(>#{3xcn}=6+yfQLr@vkS9?GzOO6F?rbu~a-z z!b%}gZ()!#78-}Lm<*y37m}<&r?qYM5i|i0qPXPeN}}!r5G_PH)r(Of_i&2X@; zwU)E_pw)u%FuE>!!mGb+vW+H@t=_B@D@yg$Ph5Ix9dr3nIICALX88dUHv&CO(%)N# z)x!-&g0NQcpSs5w0U&PcNFpX!bXYks3Mi$32U*KD3xFIW8;j{SRt)R0!j0?;JEWEQ zLIaSTyfwX*$4;c81=GQuhk5lUt&oX%b08bs(7+b#de`MJ;G$!xxi5P5W#=x%%bAaH;Do^*i1;wb?j$UEB=qKV02J5%W4y96G zi}6FiZM3ToHxS$32O}AB&-FxdJ(kJT0)gq+ooA~pwY32c>Z^*WCoEv;@KGr36-e!D z282Hay+AxC$7+-_lbdd^-nj|Fwf1<)@&maF(BXPDP_~YVB_6ElTednGH z&t_=_1rQI5zV!dr-@hCIBi~gWoh2h&0+eyd+Bj1FPZBrS=CUF-$3l`aV(n7D>pGw;m z=?$z;JxrQlHL!ad9>k@^J>&^b2D>Lma~t!!FBKR@=qr&_p3b-f`_wtqk}>Hs5?t-l zYKjIOzWYexeOhuL!9DI~=L#YJRQRogkHO)8_`j>_8_n<;oIM*%E~R}w_~OiF$ZqL1 z)jsE|*Iuc@1#X#3`ppb>NSz2ON$ANQ%XiO)>imzW{C1SC05{a7c)2hFf%Uk#=6Z@w zL5U8a%pMV)_MYY|>MpR<7|)cv>h@7CKhcf&zsUOTxF)af|5$5jU9?rf1yrq~fMB(X z%vh~OML`8*Cn_Q$OIAW4Lu-*L3ND61hzpRF$leKph%yoZA+iz~A&>w8LJ~sO?>>qB zwBOh7AMy2q=RWtIectEX^T@MSNIOOVD5dfMU^=(55yxI;a1{SXvpnXM-*H@RG-{^q z5CAov`&2e>xSs?3x5<}{cqUOMFlV$Jqp6VZnUS9W6U-X^?73^~U0Sq1+_N|G@fk-_ z6-GSHo5oF+@|9MuBgW>SRhc!PrKd%Dyxd~fTb3$`t1bhriETExJ$j5?`?5mtdz6tC zmWk>uY|E^-OQ8T>081?W^tS#43K;_D&1wbuAJ1?l=yUJt@Q zmDkCB6`J86+B(o3ZwQj((U$Vy?Z;IIiUMF)uWeS3N?d!MFU(ZU4c%-2DP~cJ5%$eA zV7u)8)T_^Lg`Ll5kabbB-D!DdIo`}I0B_7U0@#)*yjCRg%rZMxWfBcMP>2VSA|D5m z(|1|G=B>Ki)E6ZW&w+G~nsw5m5}1Ig3uq929nwTeZ@NcY?27TrXM6%mjgXb$-l1&w zqv*BYx{ex?qT4?XUY>WGoGugtu!gn{sA2g0g=;U~pX>!dhIIy8_;k8t&Z2R#_FsvI z9b*J2564tXed;nffVakd%GW#c~54o7mctJ3k?LXiDgi){M+YoW{{U}+`=LF}uw z?pXsWqMBK7%X5r{nRD^Jm(Jj3PIo$x#%C$A+*bE%C2>|A7R?ZS6aK$w?Js?N=^Na33UEvvA72$i1 zJ?a0Oi$`q~fL=;YN=si@z4|u4I#^=QMFItU;Y%FP&MDN(ssAJqrO#d)3ig?;`n!O&-=FJdPzU`04CVjaufqciAW%2 zP;t=y#y7CBF9!2_4`N>b-0k;1IfKq#j%k)>ydUH}d_b-{U*gj=+|6n3Q`Z4N8tBC4 zyYr!Xfa~Zn_=DTaVIR!DFmDxA8`QGGJUzB2oiTg7-^<&3yCSSZ&+QFJc3tvjIg49H zr&o)8%9R4%;YOU{TL4SGe+7f#HfaQV_lB^{JX6zFtkuqk$MU8h`i?z_(7JJ8o_94V zwpJ4Bc;-k9yF9O{D_0ydGU7&!@ZSA1tghzE*&jtp$0yC+FW{I4@@ODMSPAcD$DaFB zb$8c-h_V`3?EwbS^1f0T;xzbv(*Bmr;SR@MZ~}}AN_G9R{bC~|OE{O4=G5@ABEupw zKl(6rmUf?9cXu88boAtFgm?Y^2ipoa z%ENNHOTITMKv;&ptlEb(-8OJ-Q%T`T{OiZq@o?_(jZr^gdk^*s{yZc4tDq@wi}X=U zQ+Nz3WBGTmU1neG$_1aNSYJanTEPRw%ne~lE#MsAd#0GFyrLMSUx1)Xe#?vQ09pmW;jcuYi=;P(#Pf5SoW=eDm7Lf6&P*kz|R`+xc)Rsx?6`(Y|W&p&7*IzJ%P{R_|+D&zm5l1-I&{ zG4)N?vK7IXT+AL>djT<#<3ZYYz)>>|@5VcT63sf5v(ndFHi|mlAL@$qG^%`I{OYg3 zcPD5u7xvZB#jAP8fW2{O9{Nw;YrQ#nv1+dUI4aa{3jRyv{;k-+i>sB-4 z0jlcCwO8#JUpk!%A?SlK`6Qc1laeE~2S3|9X3HL3SPQ#K{=%&{JUQ#o;BZ}MeP%_n zt_1!HSpSd*WLWXr@R;sc!<=HJX%2I1EG`@12C5SvD?i}+MM%&8illNvcRW3<4pwRl z-PRwi`pWt|h{yNp>WJAX;_Bz_HsL%sP>Tth*ekG{{|kC=!k72fRkc-A3@9AvM z?8*g5#Z1n1#xdww7iLoO9i3*hP3iSSZ9+Xz5!Vq3YXe@*r-^$V%a9>PZttI>!hM?-DSfqn~sA&6cW zA8>NzN@#(f75PkCcVQhAUYloz0CRsHek4 z+B^lG^#lzWkNhI1=R`sfX;4g(ZSO^B!QTCkL}8t22v8<)_V{}>)cOE2SR+Du#F9$^ z*2o1=Yu;nniO>EOFb+V1mPlLpy02hQG}*!dQmuc}>ufTpMzH2T&b2g|6DI%6TiQwa z&VXW-K^qrs2=7#(@=rcq+meFE2DY4l*M!=S^X|mXCT$2a_uiMB=M@GeIzEFfj`laA z-?*Jy@CKOo+*yyStC`{368{p^C>y{5wgrS|n%S0%Wm_gC$2@95)o&7gVx0E#z#>?$ z#^twOH}{fc8s6bZ(yh+q-wpxxCtQ&{j`Rk>J?6wyc{xb5Jk1ya#T0*OOo+GpC$wy9 z?4xP`Ak!33hf4B^3BqS6{RUklS5#1HoNgZaIb+!}SqLHW9DC=M*hhT`&-6-P;PmEfeZ4I7iy)_rqp7kNmb?=R>rCB|uY<$^;My8RZqf!8AQL#gx zuQN#2r*UsT7WV8i+&MB{lJN?_d;X;}8GAr-@T~U}ceR+{7`39c+&DZ_HS_1qKw7}T z+FZ~ju%dDtZ3sx@p&?PkCM*^`e@Rd(?YQ$iwxf-*qqV;%|CNf&J+4<^ivbm;@BL1K zF`p3uCP>6O+r6770m5n%$#a{3{3qo<>s>LWM28;irzADy*Se_&--eUW zZFcl^7`|PK;+-d&h@0#~nX+fg5=~`2C(}?nWug;SDY)5^+#pK%caw)`C#sWGV|~H< zWu;8)$Qr+`hq9|6XdXwE^Fh|)nF3NvkYfYLCAASzA8?jTZk>D--T3CIRwuscMHdts z2fa%n{5-xAc2`3PlM0gj(`*VglG_vVXvGWkPLQ{XTk&Vqt0((p4o!}J{$@|YD{$7|#tP!g`C4(orgoGK_ zT*m>F)8+ZyCLm6T9?adDnP^Mk9pMQcRRGK^3KR^n{8&(mTlHWH2FuoryT;8VB-YHX zVNQ4`>3~p#g~#444&8Y2%FBwlL~2!)vLPfdL$b_(Z0jR)b-JF~=v5!^M0elFF;{Q5 zewDQH$O{~?LSB}5XGaG=~shZzgovb*t@kg^8(R}){ygb5W zZI@q&s`%rsEJM+2iYw!#Lipav+?BL1GJhc-7{F;gi_)d5HVunLUSW^wg+Y$@9YXoXtP9WIH+k0`F*Mm7Wu9b{8y<+kyquq*4;+42V`W`ER_6fi=Z zR04}~Ehk8C@I#)4nADi(ym?JFv0J@@H|y=57^l=ovX*^G^({+Qq9#|8jMY{&#r4Kle;*4P!>JP7rqB{e>ZVE}Lz z@ks?Nw=-$?h7$Nf&Jk$4KAy+m8}ZyL(oY#+jP_wcGXU!JKohOW)Ih^I9wWMKIx@Yl$=G|@+Qr@dBfUFE4(nB=ZKr_ zw=JgmB;LpKSl@{vb^`rEsEU72=3|o{Fo+nT!gn0(@4a;(wgu(jDQ;uf2I?AD; z%QG!R*D>9NxX}72fpkvVg;vlpU1l7z>YPufm<8ZN%n;!^JE=g^*b2-)iii>T!LSy;fV+l z=SrvjbY0>%y_j-ZLyZU(EijO7IJSY;NyWG-G+5NTp_AL=zEjo&%rRlVby9}Oy1J8n zZu=KXx?+!wPA}BgQ)vdEoVX3RJAF-#xx0GwhHps4MdmEr*5*|kB7`=R-eZ`@R`o2) ztuzyx=Lfq=d$IMMJpyuD2-(1j>d%~|AgTeYA7n0Gdl^D^vQG@8uRqhY#`Zkc1g=PU zVf?@2c=A#CRz96}DQh5Zo%A@FmU(ckoXW^Rwuz+UykKKhW_+GN)w(2nd0~n|xYyi7 zRr(75{`6PNGb3YX&1$ajj$C%rV+w(yFh`rMKoAZ~)IbC~YlFBJ!^{aUapl~VGMwV0 zA-#Yq(590Vtnre&Q6G%|njG9QGd(lv-;|QMZ_-1Y&BRAYX-AV+pB)2Pm#Poy+Bvc; zZ#Ww2+X6^e`+v5bTWK4lM`c)IQz8Z#oreY+&kXLjovsADXMLJ{@To7*BzW0r1M z`-dyHg^Tp)mk~=|Sr+^e&aq-cExyNrS#H&Y6WQOfyK4Novv7OubDqr7(rAew!?jkK zXqK;YaLnpLX(h@_AgvYVFr9b7A6#BAT%}y5dxou?nTvdP8hB{c zoFhI^YX2Zp%WV#7qfQ4o^IjnRd!>&E`ivC(c3>8FX}+ptJ=(h=**m(8&Y_injfZ3{ zDRAf6&|(mgEhMk~vYB4{%rg1=!(9?N3zNgYmwB0wvkw{|Oct1@hhxHwU^)d|py|^w z4fGj<7eK*c0>|Dq_N#yFn8~@2>cI&nqBx+3z$yvoDetWBG7-@o(>-x2KLcejKhr~? z>R-}@R(4nBfT0b5d-%S+Rw)W*`M|3{m$1t)9b(>Wrb?Nf^E~HVq?bD728~npRbPD} zOx=$WVE3+pRp)vP%_lvSAAn#{P@cu?AVqAZs3a29yJHpP-sl$vPTh}f42liQSX>xi!Nzp1KQ&?rEL9CJ zT-_u#2)34B(t_QT-5$7TvZFhbKR^pd0R4{Xt#XOYZs#tnM%C71^18S{lf+J%uqs>U z?C0B1!#-#o(dww@RnP%^;r)Ojcj#CHJFEG=)s1(F_|Z(q%F!FeO~5!~Wm(=WDmf4t zT8hr!C?_U95F^5oY~XwIUB)usM+ojMo!F4` zlGIdb?DNH$$n0qegGrx?CD(kNQ4#-T99wbT1)W4G@N;9nqWbe~ z*$^Sn(AHT!f&(Ol{r4?wCz-UMn8^k~_;*a7F#oS20s$a4bL5-=07H>pAga=4V-y9D z4bxNtTA%l1BSPGi8-VUx6^-BUEw`3C2S&fz|LxY2DMt=9>Xb-9vLU=aIFS#g55`gY zdPUU%J>*^z;n&KNMGoOEg(VZEvCTWd>K-5#SNVcSHoyx&0|IaXBZ2bXr5ObBW?f3D z4AiV?zhsbDmS<9_7r~}DUD7l}@`Mg-?Phggkg64;d>89T!bMwd{eELfl^ED4w#bU> z!d6u-%d3RfRy7;@1J*pR=6B0@E9WK7J;trMJf&?J3(N}eazKH$Q7@} zH~QzS%ysOyymtnDGn%|Y`1$dM=xVwJ!C3XHYAESR z6M3LizJU2c<+zVZ;&qM?iFDr zwaF?}*!#t;>;IazBxfHV@WPFQE@f~v1oR|qS8<@8As>ONIsCzn#bDZyI$*LvwUIem z9Su}Wexf4aq(aH?0;2$8<8v#4zdO`5M81M(kgi~#QbKyZptkX{JKQX!uFxH1K3ghB z7F}F%K5D>?@fa8`M8B#IK*du~<~=MOZ@<8U)m>G)`vZyIF%7exryHoI#$P`el;se3 z54bLb1&B^u37xd!C44$g*LLG+)%f8q?6KIRh|Aun*>BD#2XloRy=1* z9)Soz)gD{S4&QiLXn=Gc_>t%MS4Xa74LR=$E|#BIdi|R8Z6utgQK5u7A@LX2Jc8Th9&*1RePBPn0{fcnt z6#y8al6Qsk7Y>f6G?h)o1czOM9U!Rz!Y56=vCKi)-<@9_iVPJUB2?xs7_#Thx&-}% z?Kd-G_#_n@?m`P?&jsG~mUrCxXz?e(4!@I^LKR={g3I74oY<#M#z`~u%O%xH{qj^ZEv_%<{yEHK zGcRYH?9NVGTZl0Sqi`|sTQHZAnT!<>SM=zA86&7J+`)%InOzP zhE-gvR_9k-789tv3v?mom&azRK{s;P(XdolowYj9JCInql)_dPhM&G(pXo8^Q$v%t z5yKbUrYo0TlNzo>kSuALh!9o9^!j(Ee=(t^7kVkwC7cL)Q{D>AYw?Gk%AXI%&h|kW zBe>%re+^ZrKp!Bt8MLT@b{-iE+z|rSE^?yeb7hL?PjFXluXJ{@6jQs^!Wnip;|sYx zVwr;Zd5f-o65_>W5kIrsIguse{Cp4*g_O}lT+vuj?#D{gu4pd!YUZ`q!pCSmY`sgG zJvRsxRqLP{T`tzwu^<>usZhmix`YR<2RWPOyo{`8aG+T~C(`qn3ZuR~;j{=AtpQ_g zP?L9BLMp|;(D(!Ax*8F;Ft3!Hp+(Lf_;G`F!XdQMUqqXbwtuuRYmDX^(ofVT`0>91 zz|($kezUbL0!-(^&Q4mDCAf_R^;53=O*~w#@3`W5b%E=NjnP+rMJn^ABcedT_eq>O zOZwnb&+it=?BLF|Tmx#-o5t(hG(+(jc$vT^CmeYhgj70t5O$hZ?ri%5NJ`v6u^bqf z$Ls$*gxl(Pj?Ak4=_P-Kd5S4i^vw0fI!GTevjl1_ZS@d_Q%*Fb-F&6It?aO zVy=XXMkFDQLxZn%GwPIGY51Q-Zpp_0?avhzo@BiOT_mR|2Pf2^i_IsW*wdz<4!X-u z<2imA6pf1vXxPIdfolBsAD5Zwo3j;NABWwIz!`6}H*7+2?2SP@f){@*{CL(fz$Ta% zC91Di%DTBNw1>;JVXfExIUp`t(NzwA^yYOu!(d}yM)Yy}r++c)cJ+aJQ3a@Qhd~Vm zet|X_>mB?G!sBJ&at~5z@cskrK*|@A2Q~1`5G5~oHy)A5N(G#F{MqM5u2uF*SHd`j zl^Pw`00DWQ3i=9Vw?QpJ&H?=sHiQI&t;$@ewzFES3lHYH{1Hl z^pMDqpa{rm+BX5tlzgiYi{Sv=I93=hQ<-8@B0csKGm~{e?_qGu9Kqqn5}4)B8pU6Q zPzB(k7-_m3w09FVl6N4IXHPk5^Y)zS;NDjsZ-YuE4qU{U@;jk-VnufG$5?<8-&u34 z^1>0=lg0m|F0GrSYO}jPkDif@Tx-i|+TRLo;u#1uhM`ux==L{*AFot-+XRF9#I2i; zs+(pz1xG-EboUpP|Bj+6ol?XJer^{GxhkjpPA7(@f+Whs#dS?H#m)02R+$b(=3ntp zqBl9iU7+L0@NHNofdnd>7rq#W?J^Y;(&n|b=J8nbQoTC7=0u4fy zKsXNY*~NLYNHdBLcOs*)%j(d=r#94}g#70^W=Pp=%J83a~~u zadAye5}KLFEv^&@f%b-$6qeO}c8uUbRwz>G}Xl)r7II_%asi1X+Ur5-YBwMye3wGhMR7E66`W4qu7Cb+Z@{|RtSQ`jGwb9HN%DA7F;Ere)%l1ptuJH+u96q@KWk*v^`gjrd*5+k;&im zF}^LYymJb%I08M(TW~?fjAgufF_lcf&cCL=jUYrVSfFjq(^kMvK2a;yjUANo2yzUA z;p+mPmY|h=SJL{{a`qlTvun9!6fCEAK>?5vf}1nCg=tX3Eqvgbs5rfE1MJBG3z3njG|9K2tOk#V^pGvdcolvibXrq8ieyv_(PZ#SKji1vT4{! zu^nw}`p~&kdYonEvjutO@aVVA_gpU&FM{pXoXL$nyKrM?0b`O75ecoeRie!PvN1w7 zd80HjZDqfRd+OA{PKHecfjd$vVmDu01iSDMYLxx3iz7;=Ur(fN$&2peR>k2>`$zZv zfmv~~?Wl26Fh==QR{yNZ)4{EJ*pcCeW1@YFVX%GMq3>QkIj3mmwsMO&fgru6NSW4S0=v56KfF*7!d#(E_u&Pu4MD*^ zU{hVSmqlYwL#(5i+0VecspECtBx@Y|o~vIm>}qB9zpT)Y8kuzO>a%6ma=HIJyOW?w za)kSeKG`7g^VeRzOqi`XB#GRYRcV>F1lDT9fo$xr$1$~;;j%dL`&<^l$fyR(G@Jey zzMw=a*k%@2n4~`rN0wt-u36cBp*DDP*1vDYa~E@=6Q{>;Szkzvqj*@MW?c2E%uI5h zzhF==b3S2uMqs;`8Zy74azIm+2MGYBkMemzB$A9sSOYlzyylyiW_O<9rPr+BYu9w0 zqF&izNG>2ul+>2P;n0?M{<~%2GJ*UWoh?@&eIr9+up*ePPg}TmRX(B5EaTZkE0{vBoA3@5k;_eZDh@Dzj(~xcZt{rYaM7T3?Z5 zKYwP~%+!mL_)vNYb8z1Wi|f2jLw!mI8XhtoN0{B^XnjSz#7`uch@Ng|Psu;_(X9I4 z?z6+J*i|85g}0=n7gZ_k9IfOh-Oi*4Gr88EEc}BMIEVu&UpT<59dFd8O`S-yJVnR0 zV3U|TLTY?m&n#kOIjXuy5%?ih&A$G!GCw{>t%IzWHQ$VJKPv3-Gt#)JWi7nzX2{y% zL}Ybz;4f(#VWSD^uT`$^rqr-v24?#?SrTQ~nI(*5N4z-EiaSuM6WnS2JJ?=&=a~dN zH@UQ0x!EZ9xx9F>K-oW@XQv_shQU&;G^+54&z>8KL#nb)5Vw1BOKMmIg}o(Bs1z0- zi`pj_v2D65dDlow%l!~VlQnIF7_2p*-Z2MvcLF;lU3eBca{nO-8c~UwYwLLd+lAH~ zc^4-#-T5p{Dy0(=H^zFEZ_15lU|xpL@(SUt+m>9d z1R@F22Vm@~xhX7>z=|;Er+q;*Jy#`pULK*Oc_P*YH&`DAC##v`O>-8bl}DY=*hxoA z`{1)gV>`rSNZ`P)A%o|HkkD0@vs;KXRUED5^3b?2g`n^w8mQU?%b7UVvzl+#vT|fo zG2)wfe8NT`{)njQj3x)9&Flh19pirtMHN9~V`kR+;#(&Iqy6jfi&D`RhV|S5 z==|vo610PdMfACSJ7BGAG_p4lg~3f_IjrW0hATNZ+I^SCPVS%8+R*boDCOw1wQYv^ z4$7ij%gD)31k7)Z>==bFkQ^ZWlM=rNU)6bmw`fFAAq?R673W4(VMi&pJ<^*hVeb_p z_ZPs0i|N#`KD1f>fOPyNAf-Xj$iunEp|I3L{~G6BP9?*_y!M&!CPRMe%sR(JiS+{g z3XZ!MdK}ACqH!YQ?rwvGX0?bZ+67)#;uVnOn*WcDrTvP*4aLn-(KRBp%C&+l1e$js z+yP-DZvQpc(kQRR-SP@Eo8eYD`7!V`EOo>G#HwU`kV#5AMgt@MJ@>_J9kd?Jl@ToS zZf7^C1Y_M-yt#Y(=*Vvw!^4=)i(ttWh7^5IRY$n~@)lm$7iL(@8WbH}bT;^l)o$1Q-)QG)(uPmZc#%pMCelQdl_fxf+>uWn@a^+PJUsW*0scK+5)oOOS=%3tpeXk{)u8w00**nS^c&Zq|c_$aHR?jU#5ohlgrY zF!Z__uAkJ!!Hy5coyI7p{==};*{bN3?D<>tY`DbGJ=WTSFrO{?i*GJaZ@|hmkyyg1 zBO2Uk=7nY8>4%69&UCX={?Fc-ppj;Xo_{bST@*)I$qZrvZN5YgU?$Yaw+5iCe}vxK z{)dByx9TLMC|~G!9OG?Pt{BXOUdgnXXE#KqNdUVa3%zBDfta3NJxDmSN1xJn1n?6t z0L|z>snHBNR+tsXz_viV!^p1~TESQSZ6RkWLrEkDUOJc$zYf!$5 zMl)pf@L)wgK8!jx9b;)&P(aw9wi-5iLt{;|YRD-_i`fNmfZLGG;LArsaOjF)AtVps zh+@H53!)0u6!)yCD&5SM`+ClbLV*A0`R?Kx2g(XswEI$NVH$D(GZCWPoOi!TaL;LiquP>c5xZpB7Z!`DKsv+`6@a_k6H;VLx|IuS`fQgoul{lTgZ66J2=!tB`N=yK8-ECzN|j-K8Ic=)EyG; z2Zr%vi@$NX;&c4UeudvDpd@e$`2p^l0KVYef0Segh0iV1_Im8{ei%J)o%TKX0mP4p zx6SQANHnmK5CQ!3sPH>ARMY>QAJC5ku2|8Ej4*Q33jUP}2Vi3_b>!qV;fFL{EG#2t zUP*s%%;)<4hmQ}LqVOJ@kaxKwGqR*Ugu$2BHS-qsGAtuNM3Exgt0kDMIX^j;2wBE| z`QMTi=X6wW6d*dq6p!T7_~B1e(6LF<0>V1-0~2(a_p9$oO*=vW?LUSBA0x3SkKfOn;V)e@yoV`;nHiOClrow?o-IEFNvF)48$tA#lU)#zgTZi20LPI z{_n1za+dewIQPGnekLW*YHVlYT>k>Q^9zU$in;>y6_cjl?0|tq?++3LvFF+X(DcOq55wj2H%7hlq;JA z?~FJz(n&TP?xl;dZkMJ(VOqikaAupDut-I&pQ{|lWLN`DdeP-$2c3B8-xFiqoy8o@ zN>k76AkMOsG29yvJ1hyLcUk4WU>)!D=+AWB^pfa_L&&wOK_tHLp_b@$CQ<1HMYDPu zhZD$`rYSwW#5Nh;DKSA&599PJ_vSrp;+hjA%!bH&nRK$TPJ^)gF0utsuWG*!r;Ldk zeqF6H(NIrxvr}SVvE@JEW0|O?O?Lg6Kxo15XrxaWC%dg%Sv7L9)b$48H393$ebXg^<0qRJ!i(PjpF_(RpX*6EjM3v} zXw!B=dwi=!u<+7#=cPv;W#40Z7CY%*t@D?$MLXGHpA!;q9FDxp)u+mHIB9~x;>t@&qP)fNIQbjwR`$dh(wSSLAHjCqR>WfZZcw97GKQBK4JW_p=ioHySlt!F|Jxs4s zy|YkF)C~}HfMLiWjIriqWOnMmNz;~Blkzt6!KH@J+r0)JVgS%ZL?-EG7krh&Ak(1ul`%bP2`q)!9cIA)HtwLRdZZh5- zg?LtzJl;mPr3s?@q|0Q`vwy1182}t`BkQ=%29b(qi_wHB7vm=J#p3_vu0MRjv=13~ z1f*2^avPVO^WVOEMGxi_mNg2Z;h}(H^)jvriaGO*72Lv?FB0w_n|i=Zz|DX3F1OtS z9c8at3vRzFTegpIQ5L(5xZTS1G@@m08&r?lbGhx;QI27X00ml_}%);66sXbm8}Xs*9*wi%(ve z?Om{fyw$503A2q*M&}!(xaZ^=fqOp|(?emloG@1=Wc8dGWGjnyppiqES{(NQKBhJ6~T$ zq*zA@kbi8AEUy`>8z9AWH3!8(aMd~up+A%@(_!f(UEN`|?>?eE9WN1;TogSH;mbeW z$+kaqRJNy=(RrVk5}2M=+st343+&-O*an9I!WVf)G)Om)wI=B*=Cu3Tq`x0Dvy73wl{}WJw^GtT>yf_kv;FuK<4?;{q>00O+3lgJ z&L~6&S1qe2QI{9D*6ukIB9oYTR}UXL_1l0k_z%B*4@h(!|Ao7@lql}E#rK)@%A1<( zioZEZL+&^F!SEguUQ{j2uwx~;s(P@>q#UGIKeA(tIS2C-8r&g+~E6wCVedHb&P7a(aRX$K>%mryLgj% zJ^8S!S2d~~*yOv+tUt89Udy~=Jo#5%^9HO}#3tt&$dvcKFAz zXXLJA{py(jt?gt|B#2Q!$fIxTBWWi*Zd(Z(JE*3S&nw|jtie+I*Cr2)K(&u5Eb4ve ze`RE`>y0M=kK?YOd+thT49aM6D{;;$7g5=a;>gVJ`309)nG+pJ4g7Hk=ubN z*a2;gYF`i1-H8_g^Nlw*`bPMB=Fm$ZH^D8J!Dh8=Lmi{i{~+qsBG)Mg^+Mcx9}=5k z;hecrA2te#G6`Kz7ihzlzQSH_0-nda7hco@Dx>O<;OudfSIIOjG377sACqo9ry~`U ze#Ky~(-PG*dN6dof5%JyXROJHd}8%Csm9p?c-UKG$gWxd6exZiFRcPbM0~3YLQ%C~ z&Ke`~OAl(Wp0?uFYlffSv1r`<+J-szN?u>R&)(dLil1!_gn`wUIukEs@2cyM>gt^g zptyMx=3BJk-|KWLX8&9)!HXd*BYUb^)YD_K=;~4pv$g><@i9Ay7A1Us>bF!wBVD_7 zSq!%p{^yM*94B}f%iMa4RqP@U!R_mIs_`9QG?JV36=oA{K3%Kfd=)YS4Fdh6Ag_?o z0afm{>A+qd(Qv9{awxX+$xkLfZ(nP-HjA;pg+IR$3t40Njfsy-F4cCPNvs)tm?V}R^QE1BUK~-v z!_V@V&1nPzmlJPzA=~soK<&lJPp-tOun`(g#+x*V0!FFfbk(s8%orq0{KWJ!)tGUy z`(oH$b<}aT73EbkZ!lamee-wU;qCQv>-ygD<7Ejo%ASdbOD+|-PQuF+NdZkPRixGw zNabJTZA)SqlF6!>qX1d+-WLEn3)9F@aY4$?U{>h+Q7yDr(TDFI+-k5dx>vYmWv5{h zv%T=LZKjZXcTzV*Ib9YHW-y|fzbc`R%Mvo8Ks_L2r(Okr6%qwtIbMngvdt zSQa*CRonymJk$VX-PaQ}QNj%<#Qi_qnlRWA{?I#!_p^ZaU4cVFQw9i{@D^4si#&jE zZlT!vbH+}vt57llT=1cmur8@Ra@Hko%AT^6Fn?QNN89W9HJG=fw*JTK%HnkqMZ@>o zXu50SnjSPa{<8YhaZ>0*=AcE2Z&Twk5QI|`hXJ+EW*t^6Yu-q{8DgcD_;(zfW! zs>P=6SSdYT*I?zcH+M$1`nVkcBLx}TTlmAOpPofzB+csfnR;M@p!L%`#nfRb#obDL z-LODErVpLZQog3ZqZmG_`RVKD7TFx3&ZTQv0W6+t=*S|>5vW*MHEqAA3GBo78tQyV zh}R)(+WtN1;T^_bhcB#>rqN`1`MZ7B%N20BcU1c0cj7xQW-Tq7W+y5x49X`yex3TA zTEYDC^{o_Ld3Nk8&AdWSN6S~r*C(_D__?0ADeV^Sx!IaISpl=#zyc#mVEV;t!PaYl z|L=MuS+mPfh@$z*u$%KQRxf>*B}|Zb-|fmeetnC8W@PPf;sr94SR@)cVb5 z(X@-~Q<9^wwVN~t{ghy@ix1;w#uLevKO6sK=CStZN(3&93-?ApKE8i^|L;xNIUCJh zJ{KCdXe)S4X!HV*K>3Qz;j%3 z-j27;sav`9=slyJM|eVX1j1MPv^<@KnQ`Xu zBhDs?yOA}8txyKdMHE&kKlta_As#4_R={qjs(oQr9XM|J;mjfKgF93fzWvW51rrq& z=uqNp5mNr>Rm~4SJZiF5eZUb{F}vX?UUU0(DuvIVA$mx!v;b$BUF~x+nX3ZT8DyyCO zoBNK_tw7=Gg@z364D=sdDIDYNHum@5C3_kBMt=Cg{}6;@HX)ZO?`Taa`+>Jg1R3~TJ>-G5$?|ky zsi!quI9P4Unkxd^l?ORnkM=zJ18Mv!^I-(ycdq>}NQIMYtZ(Aq@A60E>6n+oHE~md zn(5Cri8vvTXyCXd-#kpY0~{R<0Z8UD{u)?nm}b?}R%YJwg)gH_F2=D5J7Ymiw8`4> zmNY>%L#iLL`~8B>?BO^Ap0#j#ag&`3K>-XOC{{6>kW^HY0SQ1YTMQ{=B&wO$UQ7*8 z-P_rN%!Jk521pkeK=ja3c#FeLkL;=UJ+;XFIEV?#mi_UdTs0-tdmKKZO)uaVzz@x&Zo`Ctn8QmIYF_5J;~HWEgX8)`Ey))i>^wU z-=b?Z06bXZtB)J^HS;gt$*p09jvtIdtS;u?YD}7V_!SJ6dQ8KMMSkAYY2)hCi+Z+L znFUkp&LGSKR&yd3YPs#w=@FCkYHqSF;V8-yfD*?wwZ+z}#io5FB|v=HH{;)%r0mo; z+x`5{@DJN5X}^L!`q{bpocXT)z-hgQ%tdJa*Hlp`7o^L z?l7%yeyCz>$V>pF;VdaE3O2@=SHdUvr6zo+-S{`^?-XCTf1QRXR3vmcdhqmLQdI0)+tZ zW6#Kn@{ENNZ&#CkeVwFOfXRp#rk~8`Kd^#Fg+ohd*@gvFkoXt5Z)ff##QXw?bA_Fl zE?L2N=K!Y3Ud_=kcU`gUR^uv071kfeTw_l}^xRuI0jAAE1u5^M?6Cjuk=T6FyP+n)?D4o_rzPMcaThh=^&gYeFbreL zSVwhHl4MT|?unFk%+&8OI+!>5tdD)Si?V$9aSZ;Kews_M;#ur)(;iEDV>*u0@pNJ} zU{C4}jX0dErnoKiysR_XcIWK?NayL@LM_G;KD-+<@2KB;*^M_pmaTje-a~{B^x$S% z>T#Z1$LC#kkkQ_S^Kb`TLylvM1DGdx^$`HT!H;!i+*`T?4glCp|Gw3Fo?aDLSUmY> zELe4)cDf=3XUFZZ!WV`236MR~T06l*+e*b^^9WO#(9bd;g|vE#k$bdJObi?^)#bjshz>0Si(*|5%tU-2P8r(Hs|@_yK?PC1Bx9SkC_ z>vT2}1mYhoggeuGo9`#sN7OV!D6gtNk~6#K|2(%l#x!~+g@o(sP#L8VPp$scnWU!+ zsFjoM?YgtppSzbm=hCxD3$)-YQM;a!55QF*U&(SC!x_}*oKE8nq*G@dkCugOj2mzT z&y63gygYLs$J|-7%jzRIMS-Sxm~6@CoiOXgi8?aRE%G?BF!0{W6g;Q<96rdFAqW@QQ(2?qiMv z4H8Y^LV4g+jk0Zb#6Gdlg4QBGEmlO14y^13wtblSkvS$-yZ0yzY@p+k;{R-Qg5s<m;?p%arzysBMOWFg^ebw3A=x4BG1vSKW3mqHuPud!+?}T-4Y5M z{or8{fQ*SY%&%o8tsT$7rQ|s9%vrLUdsi7&fD$3>n9145(DsFq7wpa&;g3sDzgU?e z#wIGWhW_RUq_E0VRhh0AtHDgnvs0SK413U%$(glGQ{-A5@^2_a)hCNRN#!Arhifq5 ze%!4v}^0CZ-QR|>1l zgC19>OOsC!0b7{I#4>>B!dn2&w+w)&Xg>QQG8GkRkb9gNr|pcmcM6jkQE z3%NwxEi^Y^PhBGX-V;7BtNIkv@EwDJ`URYIiJGcU^2{TspA9Cf@#CsKKqTZ;H6E~K zTw(*DpiL&xeaR(6KVhBR!B-)!f}$%}=>wC>PZ0-?v{$6= zV{_C6QzT4!}C0Q+WE;fjB)J6U^f`~#qn?GLLf&e4G# z4IfP#eiqex|CSiCqJ2M%E^r(Lv~yB8xVy?hCQoh#OK89w*r6VDXR_**;08xa!mh}4 z+8RUl<^|HCo(i9b^#5840a`Q6zwG!1zU&pAcmn%GOJ9*UAXyzu?J4R$(5W+jHR8-o zXl6#JYR-JX8+MI_Ng}{ih}D(h-5_1XF`M}PTeSt%!BXEIa6c7x_JBq(eu$yCTc1g@*kr1#}=`GqUd_ z>CoR;k1knFp>fRi=Oyb(m1bWY12J&>nJJ$>IL|ONNEYqiovB6XDO&PabTI9Eh!X;} zx4>yV>R`_59a`ILf03u|MU?AnFiyA@m`ld~%YzDbLwXHG{TMAGiw?#sSza>7ms!_# z0M%_Dz!>9x9JV*yybRdeJkbBo>|!TiB-;HLO3cY9aI+tX#8EK)$jO~sh^oOac=gE~ z!@ZUUnId!$3kdOfNOi3aUtV-HU7?0W7r3NbPv+OhWDQH1Sdb{UCX21*OtFPYGkve* zx>A6)Vn4%{wm3H1TQp6c?JuM83d=as^&q&N1e2bzGH?#=B$~;HUf&dKotQOeR=Mvu zNyUNc&Dwx|fCFwu9Ym1!(z?IVBpg_3DdV(i4+tIX=(Tc-1IJPpuQ2AJE{oh|jfVx! zD7ey6L_`}6pyYJBE;I!~Sw4Q)t7#h||=Syu)G z`NUZ9jkMg!658Nla9~-f*m));nPQUxMa3;R`SnSAcB5@z1Jv983`et-(s&C#j6)am zrLUvM>%z+!Kz!Brh(pt!GdpRx3>nAbBgdlm*43F5D&#G6(t7*7X>;D%1s6e40S$Pr zpb@i9Mzqp`Hbjd~7$CgOEW^)tDi)T#x6eHfIxBVMW8HZU!gXRqkFN&SB^% z_f+DV0cdb}Ooi3vsl>;2TGfFO8ZMF1=J4NtJ z;<%8$Um0my>W61WsRc`Qpz*$ng=iBZZaiEB9l4^g2))=s0$Gy+S5<$&76n(RNLg3_ zbh!hbAwgFb1F(glON}RREP^Yadx-AfQp^bs7U*{YL{D(_za!LVL9^?^3QI4xzvo9* z4WX)txBG&8txoGIsU)uwaCn77TO5h;*u7OrI5v3p0HC@0N>z|0$CsooU6}flSRu>F zO>)78HB0?)!<+ECai44Nr8tA#N;^qm?`#}RolUQ}d23mR_ z4ONA%&_%n!lNrUh`Y!^6w(r<^p+<~fnZOr1toZ7}gusxvy|rbupHc0|6LoLpOcSRV ze|lcO|2-ucPD;bGgk>;Pot+8ZlL^vaPWKey7Sg6!+Dg{W?zAgO>7;9r;0Sr5YT&*w*t5S zyea_lBA=C#umd${tu*-;!CiU^or$uXQAcHma}LGa#>LhSp4dS1wzz~|2bN=ARo;UP zT8K^7owpavYm;sA#nz{$-y<|c8ND4MC>#%gws3rS!n}8YdC)0G+KHs2?pIu5vG1ou2M4n9diX>W8KXHYH|Knd^-V^l5lC zo_x=f(cPU)X|7~KSVV|YoN$~gJr^Gq!Jp+F);#@4DQ-x+FMPVcW;`vCs^AwR3TWz) zH+U~Lq%g;yS8B+lcETw>#mnSJwu;y7=JnAg2C)VG1zhN8QIcsam+lp_I>sAed;#v_ za=6KoyIL44zNsKQ#QqXrZvgXR`(xK)ZhQA=j>qPe<2ZNT3{Qbavu4H==5)DEUw?0C zp?F+2MKL~7(yJ|DS;?Pv2tPOe3_QW;x%>EHdVOP9#E$Vwro2IKt({r=MDBEPdL5%p z7(cWLRmDx~e+E$c#w?6uy5%e@eN^FB(G*Jc98N;=qDp?dE3o@0fT>*a=-Tys2tjrOl9 zLqqFC9cRtKmUZ*#oZw(^>)BPJAX$aXu|Q|R=96A_6|HGj{^1N^*&|Dx&>bp?>sBH7 zvxICy>*@oNW`v0XhnJ1ev~gk0ILM~4&j%>$V^p-A78EeN_a$-jEd3!fgB8!ITzo;X z0#0oqSBMe%XeBe6IZdPcn>V*%oVr7atz~s>NlCPn_tcA6@+EhiNvnOgLd}))=34ap zUSIB+=Lz$})W`g_p$?3PD`gQ(7rQ>%s%D%ZF}ujD<$8vHIIp1haiFQ)vVWYY04ADL zmNic)74()~^_-VI$HIVD3;2H&0KJW`95_4Sz&RB%Fs$RQc#SOVKGLsld}AuNyt6b@ z0arPGlvog%*O1qzA9nw?P@76yfLaHQ3mu^|r;u8@da%05s=YR$jHo}<>$vw$?~rGd z(C{^aiEg^>CEok=!#I_BmSA~-;{&@os-8xn^L}H^UN7zQE>D1G&B`}FUulu_ouCLU zrcW^a>lU-9%sR$f$8!I;#y0yHe@4r=sSw$IVUkGY!GM?zeO0Ln5{Uf zl*=c^VYSglG@U?(sNcTj&;f zoKqCm+qJzbcBE|7@Whe%6A1*Z#eVP>>djR$;H@yI@-TIOEGL!2OSWIDc>jpL!29)& z1q@@Qg|_&EuIRd!*4JlBEXSYM;T=@q9GzHwCB{0cb<*ETdr3oW$DOXB)0?mNZ7B_^ zvD0-I^e$*}%5>fuQJ6-tsb3$Hoo(xpu=#l(ej=;I-DSr(MZR8b^q8pO@V+co*TC?C zSHUryip#aSdb0b{qtn^uDAddStLq^YUz~b(BP=eiE{=cprkkFU9^sTZG1Z(jeN>C; zxYs`plcu}>eH|+`abjU>g6wK2u`Z6BtBJYR40O|s&{652h2Kv+-SqgmWdUKE?=i=> z_+y&Utr&tFUcEU<)=RAr&ueW|L)VFt<#ZP$+lLYv=CLY;%dHT49qx3I&({!=rm3|w z``ifm#e|Q=p#nj8LM(o>$G-1S+z(Gz6a!C2?)DAkpxNo%(LVlD`YvwYOpok|v&#cE zx}$1`m7NyyvgysENeW&eFTMEMdsiQx9^O7)&#ah;U`{`@UETaV=De>1D}KFE-!sO= zC(_B$dHwg}_Fgs*rR0z1WaefHbUJUNvGSfcP@_UA#hxp3>XKfUBbSZ!Y?Nrtv)!Dk z9Rw2Y81eX(i!?$CzH!c}Bb3B}ve@{(KORui2R+)Or%5K#ZPl7x~FQ>PbQW zjokoOhI!3*RND^!QPk{PvWPx0qVSS%ETNgS`FXi209kaNc^%JXLUpzkWQ#hsPSl)z z*3s*W3!*}Uteoa+T&R6adCus(tq(0{?X~j)d)pQH^eH(@#SV)FLD*V{2a-9O;GQJ5 zGmi+PuaQ}~x`Yzq52p^fi}h!{zq?s?S14(`aHXa>rG4i(!?N}AhV5A<`ZW5&c&#Y} zd>1|%{SJm~^{{Dpdd9XSbUI(2sx%@UkvyZ;HfvmXR6kq>35ArUV)?lsQx{JE&AAww zm#M3_WOCUSLc;PcFNa8%lhV~=l;;DUIwc~xOU1p(C=P!LEhS?+Ftt z!JFlSRrlQ|);G)%(7q1NEn-yjD_`uE@qD$eRgyM;?oL+s1%WBVe~! z%41y_uK(C@UZT8H#1PNR@z@njBW#U6oekEDls}tIsomjcJYRs!RJ?a20W`bXs}5_E zQ=X_}N*2(e!7S$6Wc8@_XOWX4AyJ_>Dd@bhgOeh2x@6a#F2@#T zYg{tH#bjuI{a$O{kbykG-cYnmoyRLNs$SnDeom#Wj`~Q)U}a(dVu3$EQ4-LA=^jyu zMRcGR>(zdx!W#3ujjSq1Kc8z)(ma2QjLNN?Sc0FA`RG(yPE<9;8*KYCDw0wLtFPAOo^pl$HUJ8{N>XL7ShBHk{AZ z-*oGOo}S)gb4jzx)}*ER(|Uq|FYO);pN=_`8f`fwj;l>5Iu5nfNTa7aOac$M@Hzv6 zF5#J8Xbz)DBu85oqPhIJR-YJHIJH3;yZHy>B-ltGI+)Z znN#T!K$R4|l}0cTMg`k5E#2mSC#n@bvf|==cb}zBHzX$Eg|&3AlrV=mv~A1-tCO01 z4=s3_RX1352c0LFmGHPk*SG1*b++U`8ft46t38}1fdk!WerHQ{$C&h`2rV8ktY{k5 zpkgYN@WcAp2#9$yN*o#7)|EGOl?v?2{fsnY?COEHubaQ7$aUBHHtj(92!?xGfjqcs z(4X`7=#PXnh02k4#A#H;20Y)GN)0B~Hs(GULG<#r>emN)nnVjdtYe60GMC)P+sZNp z1-d!QXB(ffxM?}BC|Ui4uuzH>*J9SFOYsOxP``jQ`n*J>QUNDA?{rjPyctW~g$Zd@ zCqzN24u3S*nWaU>X(q7Bsq@k2YI7*V_gfd<*Jn5%i+U@g>J%$T!;upw3WFmO_u>!p^v3YBTLcex{L~;bvMwjXJpz{b?xjd8v z<_^KyeD|3)EW&KGx!QuUXp5vB79=rptE@|Pj1F83Gl^{2g6k$SB11`xBi-2w^C#-- zMM(WhT5Y@0aVw?i%o7aY2ZEQss=06qRhopJBvJF`%UCP{v};21Tz8>e)PPN!x6D(8 z{!8iCT(x`gV+CV*J=6ILEfu5ElX;xLOM*?go?uM*7nsO19a}*k-A323960M4clk0& zXkj7ma?OP-tLgX(L#E%y8Z@IY0F0Y=wvUtL?FJ$-qY6jU-Fw`5Ztx|_@6xAaJi#ss z%Zx~KKF{)vJyN|dLMTp9m~0cX`FV53gx_UTigC>QxhkPMU4??>n{&-Q==t8G$E_aV z_qoK)$nW-39Kwv7z&sxU^E|(`%zUm6p@POiqme19VSW>|-=3QIvqoo!A3|D$`QJUg zF$haj=B3R`CoA+57xVj-QgxnhIT@_Y3v%{M=W86jLwNxsEN$kD;EGY0y*MD4aI~R* zhsUW{hx%YJ6>T7t}jKcLQit)U->D$ai+x=np>*B2+Sj z)M7j~ftk+(??j-U*koOeehf1uj>zJBf72s2owKiPIN`;9k&{9k{&93ezEDb~s$Ey_ ztX9PYCY&=wf%9j(DCR6_H9HrJX*kGJlk;krr_nXi>STkoE469bhHihprn$q6a=J5T zX}+X&fy6cZ@JM56nU{Xj_|Ya(lR{lvXRn`r5=bJ1CQCy-y*Z!vUYWmMSI_Mt2S!d} z9ZOS{VMuw#h*XN3j2`f0dW8+4?|N3$5TvCX!B}-{^(DyH;6DLyi#2lfzq8JO2>oAP zy!c0e*paBV`o503cAz|mh{1d z-1`9-C{dB2W$~IkN%0dqp>ntQp%nukC!QNz_+D;2Fpk(+CjSul4)yZs#pA)yl6%88 zbOUGxH5jUl-Mwi@yC&5hRN)C(Jq3sjC3ZaR;_+RLiSXLcOHLQ?Rn?&Y=A7AHSeh@B ze-wO$dTAF*<^<&}*3Ul$%LzaY?J}hvL{iwQ1uSU;pjJ~SNQY`BKQySJ1d=bF;@knP zEmdu<_bx*87a*?Y4}cXzi)y=94=Uvq3rIL#vjY;0KHLy2LEqhrO8jumNrG*>*d63^v&> zSMu;iIb+9b;hu)S_Wl!UmHRgH$5Cuz*1=xlDrglYGRUC>Nztn#Z{R;Sz3?j{96TNg z5*{y@_AB3e&~T_ZKQP^?P4n>AwmO77d@tpeYe>X9Wiuc)FBD#6vsDWLl6@=O0T6t6 z;B&I5JNhf-?U=v<&=-p!WEIjf)O-izh;_&UyYGd>43*_5@P-1^5OS(0HAA7h+x`XU z1~+miL~6Aya6C#GId`o05IkwJdAm*kBs5+d*97L~slv|){Vu<`m$FwA*K6}BCRS&C_ zg51V96w=ZO6x2X&LvDxw${<}9LQY5!-7vD?cU@!~c-)W=H!k%Ks=(fUj)to@Ajd%S z44v}u3#;H~v3z8YUI_~stf~Q4>{KZtOaj^67`MoS94Uc;yOrAvt7VOB1Y4UF7Xcgj zJVuU_bpcm`qIt+|Yu3SV2j9rU28`rYHUZszV~l*-l2+8@9V7$WqZ4knYFfBb0E%#9 za0@>8r>!0~IQwS0NKINxC#>bCP3sbF*ucn5{Z-Q!YVa$$?*2$Wk(*F8{1Bh9Z&kB+ zUIxoY9yVcd9pJhg`ogC;89vbQS`5+##Xc#GwR6F*u-p)V?0wHcT_SAe2Z+KW$t@kQ zN+?Cd3wfVJqW%T1_67w?^G^`3n>1C;LWI060IXw z;V*o?gMnk=_Nm*S&N0ivW<0eHcAQwGWQqK0v3w2e6z<>PC>dqjk^2$+Fu#fVD%zVuo+kluwO0IV4Fp%eD2^5xP6O0*smyEq`CrP ztrVC5dDy*E1bPQ}#e;LrK5`V%0Gr1gen;8(1Tud`cbmS>(>o zT@rzh3R!d`26l#kV=mF-0HHFOYxgJ|aRI!Id*&1j*0j61f8gR?2M{ z=VG<6z8c1WT~?;`VWTBJQZ__z^vgX6X+GLVKXG9E5x4{fK|(4_9jA05 zU=24Q!1AesTa|pe1S8AG82-5VU|=@Ff)=)LN7w6rVzR0#q{IstOKesi1=P-pJFE*c zHEIuhq96J2^5S>DQ;#G?zSim%5C9z$w{1OCS+X3GqzTE7(p)nXrNu zKf|>TeU^3!{)}K1*#okuK-{bWpGT_l1Qcw~J%aSo8s^$~GsFVcaLC6i>Nv%$KCyw} zAf^j9KK=^=hbj#?JQ}2t>c;Sa9I?{R#1&}-x87w1S4Ozor|XeFW67qN?KuND+!}%q zazz=#PdN}_)dC(v9sct*A`W5ZszKlY zctl271i)=0B!p~cTEvEZ8a9xfX&=HB7$a3&Frrwgvfc8_V5<&fp75y9umkBAa^Bhk zix4h*gBOQ@lTFB1J<3OG!E4OyF@JTb0o#XgH%->!Y~#ull|oB2ee||bKXiI z&-iPD^!HR-YctP$^HD(}JR^wIrg11Hf-{DvLfDZ2RZ^&VMBtk021#_hAf5l+F7Kcz zXp;`)^8r@V5D0dBY4M7(+(P$JFkOk?fVjEgrgjkY0&i~R`Qe@LpoTJb;7TM1-T@Ns zXd~f)a<%|p0gJDHNK|5*SFZE@h&^Wn;Gxr>gQRNT)$4GJW{B_)1WZ81?1K#`RBGZ9 zryZP+qT(O6KyjeYwmK?KreVY$%K3eSTG3BtVCSLS_gKS%(4Q&rl%a1xg|rUXR352? zU5dKOa~UopLyHqfd=md$9%vp3q?aICqVDL}z-5dU9=|}`YI`oMg~E3Vbmj`8 zxNrW542whVffcj+!C}HzKtqQ-D6>Tcj!G?nXxPt|`ts*JUhtIZ7clk=gHvE&Vj#4~ z3k?4aGKdW$e@p~N5PVFhhJE2_D$3%TKh%oPJdyyTG;U8nsH+BLBDIhhs%ro6D`<2m z7#?IHks6_2F7-a;0DWR7 zD$u2d24MY&PBxu_FT@OJpY^YL3)Doc4}Pio<1>z-npOyRL6b30W`NUPA)8TzvtM7SPYYJ`4~B91^Gd@H7%RwNB)82iF|5n21SvVvcM8cEnqX5s%uY_g4`OTW|HT!52mG4g z4pF=M#Tb{qXrA!p^3vzg8MNV(gQTV4^1o0yb-P3#BO@cqLhU{0HP(Ahhx68g^d8KW>b&4b&gJ@AM2)ZuRY#K-uTS+! zjC%*e%H-)xbwvJ*tIyjRn_c)W@sIUU24ylNZ!uWcsz};F^!?-q7fdAR+g-8?hphAt ziDfd&yU;;UKC!US8MxH0+;7?k7q7=dg8CjOnXN6)uSoJx#DB0hoWgKV zfb%A(Q|4(!EA62C&*v|f&1VEYDc|0mR>!!%+@xY{Cf}U#gpsJ!Z06XQ=C09ZgQ{!w zlJ0fv6^8mzw=%EXSNd>Z-G%LsHI#}TdgpHMJ|f>&;})qNttWU=MbH>4o?W;g;H7c1 zOSjDNBga{&xx-r23o-pp%f*2T$9~Qa$&ML`@_$6+xKSc)7d-t;TE3IOWtXR2`P^CW z@Er!uMF0l$Xllj(fzU&{kK4+RN|ovd5+d4;|T`R}UgL52IAyZz^>flGDDvBlft<>>r3 zm*xVK?2nbq>hSg6ZJ~^}WQ=L2v{;ubpAJqRabXMD>%Z#uY8i+?rHlV2M5J$DSb>y?SjPiDS?m3iB{56D*#;>QzMO3g>l)xSO~;eS|PuFCWCY{0^z zoKGR8zkX9dAE)D?lJ&Y1eLs$GT?_f0lRqG=akkX^ zV2xj3&69%d7Sk182V0~fnZF0V+1fIN(M}QP3kL12lq`RBNH>gG;uT5}^9I~GkUxp6PJpexJ@>V-)oy}hs;GPcxUuRnO)nV{9Pycb zl@mV3=YXf!21GDRmVrp{Y#Ad>{W``hsJV0$JBes}P#-7&?gx0OPUt1J9}iCwSp+g{TyLQW*yy?_T&?t}g?jjiSMff8UUIF3wss?KroOYTZ6 z+hr#J{qU7`dAdSr_bG+Q7-@yHY@GBM(!FxzZ3=j%N;td2ZP>+)lHUqJB%Xkz2^uj2zArCD9V55-ZhI(wM1GR> zsXs~1sp+;0;D%A3k_6}DTKeS^VTs#Bj$Clp}g%N@tTt{YyY(*gL4h5qR>Kik z1KeKn-)VgPFpSBnhNDWh$G~i^Luv|T&NjMpTtJGJ6ZuLg+MKQ(5E z@U#~N3yN_g!>zU2)M+d6I{Vb@dmJATY^lX8UY7Lo_YgrWe|12~NG0z{=xK78Ef)7W z{w3f=cVtwy*7=`QW>4X*4gSN*Tog5DsL`wbloSteP8B8Q{GXb;$RJ7rSem^ga7q}7 zkUOJMZa!oL`0d47%59_~$_cd=xd>9az(ffCT)nDOmZVKjE!RjBvS8KupIUgp*sci} z_tPRn7DO=tOn3KWKRrSEJH75oLdp250-YtOd`Xf_UD5g!B&x$&`T%P9q3`hLhfQPC zql&aTw*y8*;Qr_9*172#M$_C!(0Qm6Zd{3Fv3&H?dfmb0d_QqMlB_IyV=enN_C_1l zjrungE9gr(#bq8e*7UbemK#(`soK#xH#t8u1Wk)kd5HTNuj@83Y~zB2{KtO(Clr0^ zV|(0o&q-*PDNhr2Bx5T2oMo>F->r_eKh}8y8arPro!sPgB1);IJY4%5ih#{#_67vX zHW>=QP|BbLCK)eBKk%5tYWY9ZqXEfKeTsDuTTiDH=N+#-`@HWz^zo4P0^z9}xFJ6o zGA?5${~cglzN`WJRck@Dv5Px6KZH@nck@z1<>y`lKAJOD7L*@m>Pbx`NPIS_n4>>h zw8#|-W#>eg0B39)T5TCv?MrB*ekJ*#~5qH5(y9hram4tTv^w86P*D zsr};{zIN`{#KJ~8EB;gV?o*6_uSCu_sGy1e;ud3fLrm0ae7%z=KZWtpfKB}E#X$*l zUDNx24*&AzTNRjs*Ob)ik<~u4Ic4E5|3V1HnF95L)%qC4CH>)$X9P9`dwM zn1}GghI%$8tv18jU;Bo$?BCOMNT@fur+u!3?lCbSB}wjw?vq3*oL{L*+DDuDb2PNP z7rTku3!L{gzu%@D_c}y9F1P}#nbaiRI9OfyHLtVW$X7i79XD&}Of5~!E_>+LOlGv< zCC8RPLn!0qkNZ=&X)_k-;brBs>Xn3Zpp|;vPKKp(ofsqBrjPH%OgHJ%$X}ja{Cw^B z_l*%iLv4Ps-*Tl%1S?}#0ksgy#s3Guel~gZ)ex35Jw3Gg;fOP#Ecf(esnr; zG4jQs>4n%r%G?Y%EBkQ~EMB4Fg9p|{0uGs(cK3-U^{>k&-u{(LPi!8hr+}yV^Oh3Z zNU|#(?92$C9RkclDDI35fYO;y!!tXILbk>9*Gw_lV64Z=Vk`Q$~ z2#M!5o_eP)4ju#@CFGb$_op9;63{}I^C=n15%p(JQ~BS{bo+gBE|QnvDk&$7)>@xE zXuV9Un=2&L^)q&p1BKAg)+*|kUpznP1TagYY@_d|F{{%1t8;`{cT?)yw1mPF=}gI- zEjTpiTJ4npCv+17#lJ1Tf3AR*G)V%liQ5bB35xj)tP2O0UzXCAKhly%h>BF%SAZx)jkx&a;~8=)7@ZP#+4UDZvB?2Eh7iyk>|3DC5=2) z_h*)rruZ|6th9rWNK9bG#EjU<f$+0 zQ=L#suav(0T$EPFzZ7;i9@OG3=Q~G{3vZbwbh~Lveop!92D+~f;%mMs^y+d&EqM=g zn+D3~09)pH>SK~7eIF*yMu&#iO(ZWWF4hJH;{e4!HG%8Zmn#Jp#8}qzlx)wOvr~y*m^_$|jPxk|BphD<^)jXBwPBYrhgly6?0* z2IT&q6a_b2uZTG{L!JLD5zAT7N=YA;iaR}LC`nfE9ho`RolzZ^PPy@Atlb60m5ZXd z*IMdlCsYAyE?Z?D%cGA#dN!1gdl zEl71CkODUTrra~+$@*xG=ssD9gvE4Ps>8t3`$J|tp6RQQ{mOln-XfCKhD&N)xTq&_ zYl$EQC=6~y`$gqj?z-F5ul+|k#4zy*Bk$CJy04@5iSRZaY>rPL(0KHK74XyUMZMvy z#5I!(#{MX!WD&|wZEzm-*H}H%rmQ$BZ+1}7PEHxV-&K!G(H77E+K9}Nhv!q4l1nH) z8f6}P8nY;^6@pz%ho;MLo{8UviE9nFzek5>i|jcId*<-euBG_oh1UEBk0RRf6a zhD#Ia{SWz%pkc`3`veXNLGTd%Bo5t{g5>tz3L_zMv?&G4Sw#KtCz&#<|2gvtJ_jKC z4iLdNlH)f?BV`!XVZ7P`*6=iR@Ivgnmb1~oaXX@pIe9eNNBUW{EHO7TUDUk5(!XMg7ll?gM+{S|ecgPVQ)7oOX<^XJA?BrJN*f z@}MzT{(#mlbcWsiQ?%^BP)6SgO~n6dS||d1OheYdrF;s6WCJPR7HdQjd2$U11}L9xoHKUv;m{^Byi}V4L8)ygTUt{ z34|nB6+Y6ZdE0s@mVV_GFGpf&#mxA8-V?URzgEkLM+t{kN!MXd%}v)q@lq5NiT#E{ zAtfT$wXCa!jGZw4$XbH2HX@+u;-T#aPxH^+()_Tp_>?;s`do=^9XR(#- zjJpNuQH_~jr$Px2tdN=f;BomxS`s@=fhvABSIZ66+{b@gf8e@~B=%Q(&f9$3ItRLs z+ezpCZT5dA2$`}WIX0W3pa#V_5;%e&d{4W}3RjcHhc7@2TVP2_Eyf;->@Ae-ZNh7l zHuf43RQI!WLO5*_3GaE7B`X!G?+!(fvTgYUn;zDFPR{-ck`V6*gD3e*}938N2mb~2LY?~*sUcEw?nRX9KKX-D_o2b(9Qj4@#H=#wRbmN>^F}LoO=6in51e{>V(%~de;=iOfCLVm znywND&)H|pjebZ^zE(Nk?uB;)V8sJBxW_7+9a#&1XqojNY0j0xu*9k9mk;T>R-R|Q z(p4e17B|__K?;Z;k`P|Y?|nerXrDxU(0>izl2T$~N``}TNFo{Zuzfowj&zmYdtt{#~NK)@~k*nJVezt5ZGpO88kbNw3)Sg|H_51}mqSFJ7=4FeXcIrv3x7PGt3` z(nE!!_IUAv*;2Y~w}QU(<}VSZ8R`bPKhL@b5ZnXe?Rv1xY;`EArkTrX^SD{9Dz#yev&<#&+@3GN#~6J zg%_bk%<~6okHQ4|(#%Eq^9nK4Q8oqP70dbl9HJWz%touQ*B#8KdK|qLF>wPQ4L_$X znt-i`XvS72{=sbS>19d^$%Y3^uke983GmZh3J-e=Lb|0-1z z+_&>>%P=!k->BJ=BA#s0(x?32#sp`|)f{TZJ}|G9J={%#q|HRHg7qg7MWH*DLj1I# zeJ`8t08Jgfy#x(e?GtHm80J@L(hZo(aUufalz~@6BNBw``YLx+(lw(`IM(35p5N`jGY*b8WI;8||+Fh0O0BQ#?cl|ABBh$(lD~bdD1< zH2Wu=@k6?L_!0#geOPtvFa<3Qe{-t}>guO#r7@LNGOkebQ<1|>1zZ1m4Mq>+rc0>p zAF~Q}UoU-4f_3J9h;;`8GDlhOqm4AZjlm^VO%W2W(u}9z9sr9$^lD?4hW=)g{>bL3DYju+BE-76z%zShA4w=EP9c2{3LziPae>%yF zPR4tG9S{FznH_4Loq4;TNJ;)fvle4#_P1>R(_X<}=eTPVsn|@_fR~!JYL<$T{{zJp znLn3O&JLV@G!&8Wj1T)29=~jUvKN29;WBzy-O#0{F(m3rGk8EsioSu&KkrHnulD!F zR2g0GoO$8>q9S!Het*XEqKf?$*+=73DLZ#3P{x1zar?cqC)%9THJiWRlYMvpal`H3 z8-{0G>Y3T|#_*o0*s;eAE`}ZS#~MGK`RUC5F_Q}yPOy};Vn#1pmnnvmMn$E2&#OdmgK%@dp01|6opzcw2Q!&f4Hd|j>H3w!R~LrPVv;5aFWLZ1S#ih(&%W^gs!o?X~*a zVN#S2m-WrB|3Ojf-VY~@sAXFCk{9m_@X0@6wSwSRn4=<#Ah8?BVNn`^YHsDM4dloA zqCp+fle)=qF!Phm3)grjrg|2 zEt|-?tQM&R<+6m;kP_JOP6S0#K03uZ`BLmw8Va{9P30`Rh(=Cupq7u!Hs zuXPrzpt?_%^;6Bcli6Aw1zXZmq{@ic%xJ5al5+ZFNlwbczZ%%mc>`JXU0=M|g|u-4 zJ0-^(w&e*p4;_q^+w!`c?7)tK@-!tr22V~(;NR=XX>VN8^VqVn!Qe%!ssYvAARR~8 z`9e3UTMaiDc6CoRV>Kb?xe1P>Y7Si-8$r(yP ztX>=UZ`Vr;#MPw&2XAO+LbX~wo{_%MsHNl!d*v2s>$DW7p5s9s1zATrA6|3~kiz^G z4qKwZyWSJGV%mXHO$x$zz7Sk@q z`9poK*v2sWW}m+_kMAK$8Bk|a-1Rf<4*kt@_S}IVqQJvejMDA+3iz_uHnhA=}$p26`C3FaGYAa~q2{`MHanz(JO7!R)Y26W;9JjJ4Y*0N76nNz>x zngP}GLKrdpw?}rVmee%s-0q=jwco9IBzL#X*gw+o#xYdG3ViALk6D*@mCG7Xb1<|X zL`28z%|12pQc(VekhLMz^P=FVhPX=u_i|xLanOn^N;h?UU3u808(S7md7b3S&A=&T za$Va60K+YLBklW4hRo3-O({AH+WSI9K4@I>i5a&#=|@o-i!<|mvGD+3w5nTUYWK_W zKbR+Rp4GoG^q_)Op?jvkE9ES=p*$=7J*7C(%=cfLzS{;DRo-CSb|TxdI@#IsO>v=4 z&|#>&Mvmoy!@2gMob9A6&;5$j?x8=_9`DV4iW?(k=@d!RubMRH?X;&Jw<^*_>~|f< zKb93*WmABQK%MmZfTox7bYbr_>RX?szRjQ??UWw7f9vXXT0dO+*_O?vgDO6lsC8)u z6U^uo=4r|5-|Q*Rx>}@HuFCuWe#fk~{bl_mJc_;*P%a*<5HW*0TQ|%@=JE74Xw^kwas6fn0n_B6pz5U9AEI=mFa(R6$Mw z=W@5u?bAv>eqV5=WHx|#B|7X8%JbKQ_Lx?b!FZ+ixKGX+5$2xhsKsPo zEuGyg{CmxqT{H(!ZAO)nqsJ)U+N2iqaq-1&=s}1m3l1kzu+G&Zp?^YK8_?%%7Q)E| z&KuzSlTfG|+rBH%xq33Zwg&DHYV4OY*OJ?Bq)x}ei5m2|LRopTS>4 zJl7?X+D&bf2T7qiq}p7)VLL*E(uxMqms9-&BQe!wMsXt-<&V8AbPuTNb-E?I(EP(b(`V9~P%` zH5?2KP@(^;|28|VOr5+_tj@>BtPXw~E>-yP)iaW(?ZwoI)-i4KZnBpj-%mq93eWR< zZ=^1l`}y4-bhVv@9$W$bEI8D^b2K1IzOTU?5Jgumrjk*+4*Ii@o~~vz-;Q?7TbjQ8GMvD@1_`Y7#Wa3Ncn$om;dbX z2CjEAF5yTf14vWw1%rMJ$xA^_pnHqbX7pK?lpo2Y+)v|lmB#k}%?7VkG`$nu>QU#n zHFNhqw~HgD%s+qaym?Y43+@jp@<&8VX>)^>>m%Wm8t2J%Q_c3>8AZoe2u_jYiV{1R z$-oU?h?2RZ0ndJY7ZbJGXkDM-AUnx)GrLC#bivtWOta=`_SF@mQyAg5^FjQ-CN@A!lAl0;D`G*$K7 zX}wzxQ|3-RoHYy0A6+Z?hVGLc!!Jo(zS3El@&}7NUZxR7j3wDOB_A<&wjf0@6ctwX zz6+cx(R=A^k&{OIIO#Vmt^P#GIRY(~&G4=fT40D=3M&^gFV8cA8PSIq@?Cz%yO|gH zb9ZYUk6)&(6!9*uH=Ig%BSr8GN2>1|GL?N=UT|3w$8x8BokvZ4kH&dDV-n*k-8K607rEy}N@ z(_D8m7am_Uyu~_xa=v>yVXl^S087z~U^Q1-m92O=Do~Ewnax$u(8204E#};?iDJ$o zTH=Re%=ZPq^QeBIUt7J2%x!A-m=#nZdh8fF#m>w9n5kQ#tk(U91@!ZVDGvry-iQ$6 z?GyU{g=79V{Wujp@i6QxE=gJlxxWL&C1iWcc@Y7gZdBhDS`> z{M%IBws?8elYcatx$|uD!wx=a7*KEW=ndE$q&=6td70W z$#7h})rRog_TlXZhsnb;i(b@%$v@J4Da?zn{3q>g;72U zD95VT3ZgozWqBo8MKzB;sq8QB&I_BF<@o`mD$F4Et+)UT#a=3#SwrS%RpuT-q& zhD(zSygV}urL*MBZc!T2CEBb??n?~jkMcSN@ta7FOOS`XlD&GOX1l@zi|+mXd1KKg zo|k(H7|KeMI;hy)lk!>STTi()j=lA2>8#OueRe7g&W+o}sme6^g}dur!>Ie#=FSiGNq9A01Vea+apn4TO z<4<#^-@Xx#E;2MDR{VE^Uz(z|Hv>ZWcz6t ztSZ=G)ZM(WllEr{%X090wbF~qS@rbe!@FffjtGmESgy8MjWhUuv0KU=5CQhdEp#{N zp_p*od6G67pF7w5?)C0IDEKo!F8|s`8z0xqaz}^9QuE%sY{%yASibHQCtJAcQ5IAo z-t^9%VQ*K0bN*ycHGzTwhTO7>4 zE_dAZZ21Jyw!DPw#2(3>`ECHCQ_A5oP3Az@a(u#-lUkWBnXL4U&gFi`J{CZ-qB4u!awLVd+MaT{1QA<^L(G@8~Q;w!(P z1LUUm1>oAeC&~RX*jr_Dw^Du}g?xyLc|Z1X(W*b0|2`$c%1Kj80HDh9-Ar!(e9csp z+4MS=D%k`{tDb=c1)!Q>S(7`uYv1ti9i0A-KgJ}#u9z#)U9uf>U4EysQHwcx9^<&T z@MKedS&8+Ccvr-Wr9O{p&#Cy7E2R#T(Ps;n7K?)8?&5VbO-5DnhdcZ(p}o0EY7(Ok z%k|!(j2!~6{6aT%1jmKkz86Ie2;qF zD3brctqZ}eeI{d9jWv~R=vpcpnRg-jE1UJ|~Z$8l1O7oBucnY|Rq@oE4FJXu$-9ea$z`H}^72h><ZPRQTRpn<>>P zS;NLehy z%lTF7?B*Y5bY=<{Hvx{=f~gOrhYtTC&d0nvaex|{zIC4m`6|#PmlG|^=hrfExglfj z4#-ch8b9X++@fk+&5$i@o2+r?BZJm(L16cFN~z#+rL+Uu)Y7-jf91!e7+{8>Zxg{11CN7L}up(7oOeI&j9>{f}!W zx#c^e*9Th?j=9{|s-5ZWSz)E<@Egqsy=Cw$H&N0|6hwmRMb55cag8-ZtmfL)+&BQN zBPU*_nZNp6*3UzxhB0*WqUeTRb^eZHAP12@wesiXYDUontFzHy4r6#t89d9htSQS>Mu7lqJRRs1+Y=H-I#8{X%p z-lgO%&h_Th=?W#I8T*-ouc)0)I$>!Qg+Lwg@pt$V2|VR@j$6IEdu48IC^w948(BJe z$H6I1Y;Hp3j$+N=8RE!xd}?WnXiI?5Z3?SAc#i)&te#Wfistgdt=#_H*~u`~JCxq^ z)Wz3z!UL0o=m1Ky&8?<)95U*e0!VIs%1tp@D)1e?U|QlJZ*!goR^)bhM})Kpg`}$_ zHCuS&7gKapsViP_)(CH5@hmpT#-MLcA>9Zw$p|rYW$NL(Cuf5%<~DgvCcY5eJ!iLP%WQ-2WM{XENtQx-A!ebgk12eH_|fky$<3}O zuJT^(WbXmt<6A&Hd~`LesXV!@ImbK5doE+D(tH0{>GS~%qcNW`vhGFS*?zvl$%wNR z)7`TC$M3E#S}ZvWI+$!SqTfV23ik5gVJmvCR z%X(+L`QPMqNA?=_D=Mr$@+-`?Np4+e3Z%>g?xF2_e4n9a9?Mgky=lUjqdjJnG${Ae zu<`t?8!?H|rZTX);FH5^&0wkPO-`S8SB~rvthQ(+pCDI5{nZio z)IrLlAHY)%PZ%&S#GNtjnHLhyhXZjI>xCh(P=ryc)>W$!PL5Wz$(h1 z(1Ur~HQje4^W%NlPD8(CmEexBzLT*NvSj<>w2zf-{Szvw0CAv z%yaQ6vbsXnW{nmbn~@tDGlIm5>ei0uAJZP6{S9nt#>*(E#g)@s1}hk010{FGx+cA2 zX#}S-?g=(RdKW>AgEhc{Ls(m+Ox(uqT8(r4NOg$rVoUi!!3z!FSx36lGpTn=JAY9g zW-W<=Gn>X|&ioj}nVd)PMmgR#{LVgZ7-y2$M=hUNB0KHc0wd*qnlq;qzl}KNuwyMd z{YveC5?~+Mu6jO(i`x)i&Tc)G%a6TQm!W(r4FEF;un328d#~tOiw1%Nm$I;!kgVYP zK(I-(=o5g?#miMaa|LKbGY zh7^(&UAK|94d-2oM4j53on)`+fXwIXs#2MGwLY;zH^sJcx&b{Eh z(y@NT#*5lj&b1dmva>SiJ+HW6h>*5tkds6>)VE)}OXMGDRf}O6IBgm#!8hX5 zoDTJ0ZJ&X>^RGe&kS*EUVeef6$wc^eRGb>53boGXkAb+${%P$k6SRP)?v;C;RA$@W zjuX0Q_5FRc!N&TKfozQJ@9{!SyMINjBt+_pfeyzf%KboJbqHQO#T-@iC@aCZ2XRi} z?MpfZ)_4Ovq%vm6vi;?1WiTv+`HYBjpNUOAobAJgtRtv_uuc3o{$LQYbI@L&HCq(M zn&Nd%scZZXCU3|y;hGA@YQ>0i6pBu|Ekz4N1=AjzHfw4y#{(_#{OF6+ApeLj_H|kQ% zl{zg`t$x>45U%596E~qG>jP_9Lpz(~m2#dlCf*WW9^NgAhUrl)MfKKyX6@4fe-s%f za=8S9EOj8(UVYd;4|{Ct{g5uH>UL#62=TUQ5QKxTCkkmW94c{Dn?S3uA7m2WHI1e- zh*!j#@te~tmS+tlkog2#GPSp;w`U!)D+!TNW{-*D?DF!*U{xD;m|P8hl ze;M}UVreaN>XNN?;cd5beNa*PPj{>&RN0E8-FpNoREF*%oBioTy*{uyleXrtRa=xB zB2cVF)xUb)%4YU;th5C(r0MzWcanmnc@GHgl%X9PwwPD9($gQQ;zT3Q4G177?V*JuYbX&??)f8U_foGdMb;9k>5CQE!_K<&d?6;w0z~J zGFh9{wNJkbgS-@i7{#u%NQ+YuWUI-suGjvF-;skf|0<+y#|IepzfIH;8${q&hP$ac z+UUiBF|!6Tvb013LYG&|ZAp{ngPu5@gc3A`^lG=)5hHEiy?$lq3sm($vGk!s!^fCX z$(lhtM&a~tT~DG)K=U#c@%5I%4aljt1YI%lCsRG`hvwx2TNRm1u{JKZ@^~+wLDKvFUtaJUB z{X~5~L7|WSC{A}zia;gY^U(fQrO0UJ zWe;!`=5<^MW!dAM(yUvZCUw+NO<|t|hx6sD6Kz+oIJO}Dl(@;3nH+g5NjcQ9wB~u+ z=hP+TbhR%83m^Ws1IfyauAP1QwBGp8D}46CGebw5Q}NO^d4+Yd*Ll#!w6(OZIH%E~ z95&*o?i2HjhY3Do?S+x-vZ_>%A;LEI08~phU%1EHqd;8WM6{+;D~D2lLB6W?h!gv3 z_I>QUdEzlqagCi>3$Mrb<@{6Z_~m2gH-3hVUx19|(;Y6*kp`$f%W$u4DHYl`|AGNM zTkmjm!3cT4(5#VckBJqJRo#sQzZcFxV&ewXo!2Gx8`bu)YL@Ce=!#dTKOef&W7147#LdS~I z?O$XPZ}1zp;aS{%8qRlOaN}8`ACKt5X+H`Dk}5;M%Iw{kx7G>jR%~i^Uih_Qr}qhW zmj8#zdg@nfRG?PglVO>WHnCs;q!=<1q3wo>_GMD=m<0(l187`_-D@2!Z17%PhUZ_C|14OdMrw5PNsNuPJVw#gZ+R5R93 z=a)eEFNX=6Ur85gf;GikwgP9^pfCFhKmPmvN5t7<?qG6bQ4FZ!My==V4ZmVRw*;(+JiubwvR8RxO zZ=yqTlVLbMp~n|ks;m4H``42^)`BeY2h9chm%mSB%jmrQE4kq`)8=0I)|rOx*i{)R zxi)=12;VXIikqKk%(lJ+g(rmSjOS$21CRzt?!7*!+BzmcQ&@w~lrjTrrRP`)XAS&B zq&uyJCu#zPdarha6G_{%lHP%#y1t@x%fVN*IWVZGMxf#Lb05QZ6wp!ZU1ecHhD8J* zSgC0F;|L6Rue;vu5pkb?=9zE7HrgORgiT>E*?)adGxm*yLo=m>s1A zg+;mdioYXatBtRW|1-O=#`m52_;{>SeNN`HZYxt6Pjsc?th=``sNb2xgYr*xwzYBm zSyM>F%NJAZNs-ighuO@#3ihotRP^ED_)b7AP}+m=iCoiVf=MFUe2*A|vly>EY}^>~ z^nM|2vejzu7n}&U?=E;&h<IXLF|)dPL$`_7Lm>O4 z>k+kAqd|tHL$%~C>jJKclh>^(C?)0eQ@9ce12LyqcwMj{v|}q%VlCg#Ni7RCoXTx{ z;4Xez#t+YmCNEIj(-}-U3aqa++XZOHtCIE8BLBbnz=|rMREP9hMhCo-J_|8ynZbKD zynjFi+KU`AIzg)ntsTF3wV2d!eSC5whvz+D6-Xd!Z**c@jE%O^DGWC|oM*v!Bi*i= z{yi>cn0L;0P67!tnP@2N9uvHJJDFLwkQFF7Wo3GbbtM{g=pKmwc61m(VXBo!w$h?# zn=>p_L&N-V%x)|BGB&sl+o^3(1MhtwI)G9Y9pi4F7-ByT&25_|W~Ui*x`k)bGYclb z=U9gA2e?5EsXb!-gATA;q#^b74A53-u!q98$&YL7PW(Pz->}{7X%OAj4#sJPC1O>X zyh}vOEN@nYBv$;yrNE1I*Jq?V?!vbd5JfaIKg`kV)-Fz;_iWtPx_ySIDQ%HkahOA% zX1jp@d*UrHqt@YCkYsH!gwGHub>M0h>AyOsO1kKBzF)R(I_x6D-}*fIc`Ev$^agPC z7yeO?n;c5=IB8Dc+e=_&UzYWn7|Z(>J(5G-5DE`jepB!d2VBC3=xZA54@1RB=PJ5% zW?H;9=j7ud_h!+Pz}jar*jUvv7E)vUJ7Z(9*@OEzi(R0f%0Olf77m@TJB2vsbWKR* zzTLGA#<5ZRwU`eI%eO3>oG-&4i&7VKex3%&c&im$_eHs=Z0EdRP3y#?DMY!|8E?os zgDjNYoT^we7mRmYtJcW$DT71NB_lQgl4NH7gR4w=XSwMvWZsi1)&*Jfk0X{s8%S|S zgvw+mZt5RVI9Uc~TRH)W*@K>!EG+ENO}MMKBxLtc!$^9GlRXZa0$$BQ*;QyYja?a zhnOw03E=;?yOSGe>u#5yYSiAVQmk|VlZ2)#HI!QoF)U03XV)p60vTeota1Pn{L?VPJJx$CKxKQB*k~>MY0h^Yv_jZmOl8! z$c7Pnu46h#eMVMt82cK9UW@9;%FLt*i;q(rMpy%cP)JxjLD5iym;T^Rkrc=!ch~r? zEOlMcz6mKdvk{w;wxf-Hxsm{bxr{szSAT-3J{v8XAuz4XXCI2dJf)x*l2FUFkIIT4 zcv{l{+fa{fj(eMg6?*u6@IG00)6xZ>u=}xkEL!u)FsBf zQxtpyi|uoG&OZ>jj;L%f$;?kqj7&PETha2o9?S=;d55G$RnzhEzF=dc&BIK&NTx;@ zJ-FBXaY~v2XOAUg)~2btrJe?P8}awsGa-`j(eX_5F#mLBZ3}<@jp(L+)LU8t+HDSS ze}PkA3|TJuQokCe9eya)3#(YmpYW&8+A9aAk~g8;JWB%(`ocDun7dCiO|ovLfKRJ` z8XeB`8UA+^TA2!=X3l@GgMjyGkIpVpAH=ct+F=_(=(eS%6NnUO5n`KHLH#C@=8W9Q z+QU&BG<&9NnuIrlJdeB7d3o|4~T$xxtQ_|~RW(>X}Ub3Cs@;zdz@XJcf-exrSF~%|CT3#um|IMuzOM(GMLye<pKNw?^M3}@-Ci?_3EuHD$*L{m&6mUA+h@=wCb5>Zv=%>191ZZ0fFv>UN0P|S z7G?<$Ll~ycr^5ovPTXMLEIOS52qp26?TkDZWAfc@<9ju@jU1&7(_zGL6e{h-sq)}`rY>R<>fz=(1w9NYHMSe%l(&W35%ONlwlDe0T{5rTLNtKDn z7&qHjcM^QP(>p!i#yKAoS0nLTi4kdgM5qYZX7^mscx!l~ zcR_52^8K?k?KRO_Rce7L5NAMVAdJcU>d(owvGOuS!|+9_TCBYq+%O-goOnYFowtnp z_T%)+gF{cY;v#03(SSrWJ|37^*&PfBI>)%r+yKv8mt~7Fd(mT|=gB-a5kj%n{ zYd8};WOiNWV+8db=C=-TBy~JXj{ddPK-E!<4jXY(%j@Aof%QbgNNwl7UvlX9-*gq+eX#v(E( zt8@x%>F|c0swUCtDs9&6UM}hV17SK$^48j}A>L=A&5l!6R!HNtM%E8!rh-pL?wk{Y z@Fv+_ehb{zZFL}LO6-TrmB1^Ct2!q_iUHrx4(D3FgSaCj>ERm^l!}R}cvnP~yU&NH zD1o)Nj!4`Vir7Xf-oaC`7WoIK6z?TZ;H3csV=pU(z7S-r!Fx8xxw)x^T6pdw=&fnA zp=Bc@Qf=5KFPjsU!25>~#gMxMf+6|?weI9t0idx~vEmVr!uJ|kl$g5Cu>5@5wf2Fv zmm{8Z=$qfwc#Gz>=d|*YlJAE%n_|%)QjfxAFJEyJRu3@7E2VolqexR+$u6=~S6x%suEZDdG-8PFdL4j2YY?I8Dv-3Z%x{} zA+}?Vx#|HmpI!7oh*S4EY_t1rFw?Z?^vI&zLA%Jq0`eQ%Nhe4lVe=T{FGaN3iJPY(G-e&?k&^nJaFF zRQk2BtuG@IJV(~@I}N;(-Vwh4X|GpZYejG0Jb;vkIhdQfR;daJ#7${_fP8@H20AWZ z2yA~N-u(w#W@6;cU4R!`A@2hHOhvGwOG2&_fE$~OPMlAwHGNeSoEUj4wiaNgVKYZM z?a5ZHAfc<#dXl`)rVq6!z2nnDR*$O})JIBAW|VCan3%Zn-DR>7R|5{19Z-Om%OA~( z|Db>9FZXnCShrEY1@!Gm>e5n$AY@EXmw^C|K`$vW=~xcIi-%rHS|v24x<0{*;TR^9 z^`1$(<@W-a@7Je;Yu*~-g3ib6zjVDclxvEgZrh=y43VvPF9xhBAvD0rC4ZQxi0B>J z{GXh(3Y(1El7sN;lg4vH>^O*fp}-~Q?A398_sdZl^f_uuH-C1o_pWvi_kHV*$i3|v zj06^4$l)5vs#`6^C+7aW8Kt_i5AOLW&Z)fY8<->zNr&t(A+_{LHY&PXa!=)};Xh>b z#-VVFKlh0FvCp5VO?-RBdN*vytXXh^dC=r)Yk)Wf2HM9Dohu~u+xdi-CSLzoQ09I) zSf5TA$dp925Geu7Jb|XZ7N3mS;|*f=fi4!2qdKxwV{GYY5|uDnZD?7Y+V|+vF*n&` z2FJtl>6cej`-G_)4y;tNL(BPBdpB0*E7@pm2aJiQmfxH=f_`%4pBDWQ23PA7WuuFo zw@@nTN~{LBndbR*>IYSv|{jd!hhP0D3)kcj&fc0`_ z4=^+jn74o0`}oy<)kYPqg^uqe2O*1RrW0~=5Q^}^wZZ70ksF@NYAm)v9%AJ(MPR=4 zV}K#;f@|r5dN7aRVy|A_tCzjGthj7n#%bL~1Rhhk@V<_Wnr)lS4toeTgbl|x%VfCc zW8oQPlT+n{_v;2{sM9~+0 zS9vQ|7brnXcp=w0puA2~u3_Qzumsq{`In3Xdw{OG>JWU4P^a#8A_eGF=vHj&3VP0c z<=4^W=_Wk>nywe-u+L}S;~SFiw8ke^wWHYSqS1d(dTsSR;z!U@*3G`L(A=Xe#cInJ zSo_tCF&6RSm8;>)YuUCduNi5@X8ijSjNcqT=gOHRu!Vts*GI9(YZ>)s;xUsD+^ zCK;#M<6o8kHaLW&>r@kq(UCN{8r0h(^>DHuueA9lJrlHJ6z*m63VbngA}LuCmypEJ zrytFabqQ!F3fo$@{lYSyU)@taO?M1X4k)aw*h;17`MWuLnthx~AYW2B`@j!rAm{@^^DxA3k<>wp>cq>?HHsE7LsTSw1Zv z<2j@3DdQ-Ef@O2cqY(pSc2qS+`A6 zLf4vZpm+&U@=pZn=!sR-WZn!`t@K7Rkej?F6=m5rWTLa3{`~0|gqaw~7KNskZRcQ! zKRr4E9_h%T1O$@^M7#2B%p1X*JZ(fCdl=w)0^DIr@v?b(>ALtCQc>j({LEyfx@q9< zh%L-*Q73*pq|VJ|+dj7dI1GQr!(+Z@sw?1*lxw0!sPg(g@E9M3z@X# z#L&sFnkU(g0l|X+ijoR#9yMh0O2N)cTJJW|bY@s?kmPM3es#CzPg!X-;U#t~y1!&_ z&CTDv!`n1WnqiZqWq1R zQo$@DMmW%5J>t9eCr$FfH1vg(!iG@WkLBr|%8wf*rh-=`xjBPzVBpasp5SJ&4{HR- zxB3Rbkr(-4n>fUiiv3X{M?jqp!@?&F%h(eNQdGw^3ah2qEY-vKc~cZWe?1}vM)`L{ zGiOp1z_)O3oUsVNoD10chsqRpXHe4y(s6M<&-)O^GP@pDA4so_1we^MU;}-{vSfj} z0Eu<-O8k>F|Ln6r%tw~Vuk8^TQJApVqK?)Drav%yL-IV#p3h@BtHAbklQ-olfy^+p7K)h!^fPaJcb6Uz+5{G-? zcEz##;9m=#Zt-OkvEH6!J+*W0Lz;D{`>qJY^waJFwzv+M#V~MBZN`XPmD3p<93N?1 z^v{p2hBeIU2S8u1E~`33c3#5nZI64hhOC$DNXisF`&MDeP58UicJ4I;p93`gY=$@Z zi^e`#v1XDsuEC8k%9BXsg>oJJtN|B4F>AN}A#$Y$3f@{#Z0;TPul*Zjq=^4N~`yLLj+hduYMnTZaG z;{a^elRm%xCf&zh__xDcaxfH0GB9?XQm|6JaaCYYn|~ZXTbo{0TXh{Ko{%B zi-M6kf<8QpkyNB+c(F9>iK@-D<3FogH+-( zRID~#gAS{iB+4WukOxAuSffqb#12A z#2}2~E1FrP=kd5DoL7I$*MPEJPv9Ko$f|kz$*%a4pnCOaQCRli_a;e^NmhTUa+a&o z`kF6}vG)evxsr3K6erQ%HqeCpCqHBZv{8J_iVPg2XS z;tR$zgm0b{?zWT!spNr-x91q#Z|Lby37$i#a|+OWIU)Fl;{Hg?@bUnGHoD|KdSAfZ zzc73#VGzHhL?OQO)BrrTdjPF_rYV@Vxml*IVhDKueUoV4JAGhuLnX@bQdeEU*7=gj6!r;cGxAW-uo*A z<98Zq+Po@(Vl#|1VsEvD@B}-%TrE-}QTIGnSb<`Ns<6*5r!M^FICw5#qt0LBb|QnL z8SK%q4g7X07^=?Xam=!$?Ec?Ra!`G8K zcnc|i`5L2o#ekyjVWmVSt#m2{d?$sb#>V=KV28%1@N@LjJ&J`4`+-0nuF2I!^7vuy#QGP<#wRu`P8uk%2*tMsYggo}m7E6OBlB zlT>4O)^xYkfWFcv4D-*uCO9M;z3qRjPNhws`+Ua~qPtEjv6gTE%@?wp!gjNpv>3c4 z(7ImkOMs)Z(lNQR>tcTvv7{G>b%~ePvMzfB3kk*C9HMGNGM+t?_OQOA?4Y)!!zS99 zbg}9>GAb-AS3c6zaE_W4KNq`5Re<`q`T~LbuX_Ng(76~`rlIQ_BIU|ZG}_0i!!}!) z2qrPPyt1jfHOM5iMW7Wa&Vj5ApEYGjw}EZu+%6erZ1_izBeBz4bn_S9Qwv4Rru<^a z|0uD7MKoL*ojRTz#~~fJy9K5G=HeA}7#*x={5|7z<*zMd>s1NNE9vH97e`(T*cqvB z!vzca0DN{`7IL(Eh1+wVz7{;`rpuB59!!?&I~pJTqRG8Y{fu`3*tW<<=F!!}ejq*r zg{iZd{3c*`gDi|ow7p&i)lQAh)FW0nxbJY8TpI|EJW~Se@6h~P)34I#^;ro*a47g_ z();q!T~S#4oe*%%h5277EbQPTtrLGOIM7`7R(doXn|}I{Q=N=A(nta{fBMVOD4G&|i@qLz z>~YkFl41VuHU~2(?Lm^)85a+4JQG%97@cPVlF`0&h9LJzZ}2981@`Arq|jI7aakFq zUg>0Z^9~rcckpx2s&*`J1NHzb2sVIdek)DT8$HmCLHvRam>5a$h3L{=ywXVl^ijJQ z;)DHoL`tJM=#^={9V@!q4)%S{sknaB63UXN_Y3coO#;>^eft?|maeOzNx1DiYbqs) z47phgU9dDyYKN3w6?&;TK=V_6I4qalF)wIBFT4glae`HQen9nR=PZfhD&pwqUW71Z$g|C#> zoG-?x$-On8OIF4jV?a1eJz%z%4E;soVwJ_787uspMpjk>^tBBc2JPx~ra-ginna4L zeeS0`v-ZH&cyAVug%b2mU%7B`O!)y=2a$ zBn$I@w}%$zM@au!RsHf+o@6~oHXNNC20q#4Jy&bR{o^A~$@(ODi6l$&^NFqMgA>GD zva)$a@Ud5X4(O&UpxWbxNRJt9$nb7hZ{_i)cqcF0i)q?kxBAJCvAVTOWq)##=CeO%~?cysw(`h)oFDZuao9-!+bw)7|9#IGd40Fd1{NSvZZ$+ ze_^uD+KP5SY`C~ehH`(&p!~yQ$tl$<`MTf;4wo}<^^P5k5vFD^lzkZWw7aQil=_Sy z=7G-m2HgoSIMMzr&DQI06;KN1WAq59g#%Dw)2v#te4i!zj9}y!M33idLXn!zcO>(1 zUjOqc1ZJS^gC6Rp#zj4UDm&~Z#37F{2*Ms7?iIeJe7vC`quy%9I;P%5cJ3}XBI!yQ ztjGkOs(*sFrdNB1(VI_7f=m2$B7~6n7HHrDu$?rx@3Ou9kGOLHa|hTHzN5JJZHm-* zXjoJ#Chp=er*cOj09$)@z(LJCk^58NerH(zawZJ=Xq#bg)c6pG>Ol6?NtoA?P~XDj zFwF*p+f)gSjwC@b%N&pw*v7AGIr;^Uw4_jxm1yTBE z73_J!^JtKbWVH zmEMV`D)Tp++z568R#IGDuzSz3(xAXeiy*PtL5iJC)8`~Nk0P~~^L_+ImXYog!ol|# zmdh%gC7;agPeZR@D`PH)DH8!pOX;P|*DMbE(ot0J$sOHL)z9)iK5v`eXHFj4r2o;X z8UU(@;@nY%DlOVVAohV+++=ssHfZuxZ|rF{}=LvIYmPMz63{LG4*T->Yf7vsMD*0F z%v@bQzK&-4*0$V|ZkNwzfvU6i>m$l{(8U7ZYNh2FWkv2aK^WZ83BUG_pP2vk@pu21 ztt|f$w*Ln^(v`-fOrnuI7oVGytYJ}2gOnrdNDSC0E*()ae@w{uJL_TKh6xJhjUF?$bkK_OIVgCQ$|9=Ai&!51r^LwuuKq_lx Wz5izpeyhiE Date: Mon, 11 Oct 2021 20:50:51 -0700 Subject: [PATCH 074/284] Update healthattestation-csp.md --- windows/client-management/mdm/healthattestation-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index dd83b691f5..5893a45e9a 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -51,7 +51,7 @@ The attestation report provides a health assessment of the boot-time properties ### Attestation Flow with Microsoft Azure Attestation Service -#add image +![Attestation Flow with Microsoft Azure Attestation Service](./media/maa-attestation-flow.png)

    Attestation flow can be broadly in three main steps:

    • An instancne of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
      • From d37e40168e91c6923ea297c6b0712d60e9b51299 Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 11 Oct 2021 21:50:17 -0700 Subject: [PATCH 075/284] Update healthattestation-csp.md --- .../mdm/healthattestation-csp.md | 31 +++++++++++++++++-- 1 file changed, 28 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 5893a45e9a..f84f0fae96 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -49,9 +49,17 @@ The attestation report provides a health assessment of the boot-time properties
    • Receives a signed report from the Azure Attestation Service instance and stores it in a local cache on the device.
    +**MAA endpoint** +Microsoft Azure attestation service is an azure resource, and every intance of the service gets admin configured URL. The URI generated is unique in nature and for the puposes of device health attestation is known as the MAA endpoint. + +**JWT (JSON Web Token)** +JSON Web Token (JWT) is an open standard RFC7519 method for securely transmitting information between parties as a JavaScript Object Notation (JSON) object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret or a public/private key pair. + ### Attestation Flow with Microsoft Azure Attestation Service -![Attestation Flow with Microsoft Azure Attestation Service](./media/maa-attestation-flow.png) +![Attestation Flow with Microsoft Azure Attestation Service](./images/maa-attestation-flow.png) + +

    Attestation flow can be broadly in three main steps:

    • An instancne of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
      • @@ -67,12 +75,24 @@ Windows 11 introduces additions to the HealthAttestation CSP node to integrate w ./Vendor/MSFT HealthAttestation ----... -----TriggerAttestation +----TriggerAttestation | +----AttestStatus | Added in Windows 11 +----GetAttestReport | +----GetServiceCorrelationIDs | +----VerifyHealth +----Status +----ForceRetrieve +----Certificate +----Nonce +----CorrelationID +----HASEndpoint +----TpmReadyStatus ----CurrentProtocolVersion ----PreferredMaxProtocolVersion ----MaxSupportedProtocolVersion ``` + **./Vendor/MSFT/HealthAttestation**

      The root node for the device HealthAttestation configuration service provider.

      @@ -360,7 +380,7 @@ c:[type=="events", issuer=="AttestationService"] => issue(type="bootRevListInfo"
    • Call TriggerAttestation with your rpid, AAD token and the attestURI:
      Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Azure Attestation) | Microsoft Docs

    • Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties:
      -The decoded JWT token contains information per the attestation policy. +GetAttestReport return the signed attestation token as a JWT.The JWT can be decoded to parse the information per the attestation policy.
      @@ -422,6 +442,11 @@ The decoded JWT token contains information per the attestation policy.
+### Learn More +

+More information about TPM attestation can be found here. Microsoft Azure Attestation +

+ ## Windhows 10 Device HealthAttestation ### Terms From f6321598c11184393b90ee8f57c0551ef1d4e8dc Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 11 Oct 2021 21:52:09 -0700 Subject: [PATCH 076/284] Update healthattestation-ddf.md --- .../mdm/healthattestation-ddf.md | 571 +++++++++++++----- 1 file changed, 404 insertions(+), 167 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index d7209b1cf2..651900e2d8 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -22,193 +22,430 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. ```xml - -]> - - 1.2 - + + + + + 1.2 + $(runtime.windows)\system32\hascsp.dll + + {9DCCCE22-C057-424E-B8D1-67935988B174} + HealthAttestation ./Vendor/MSFT - - - - - - - - - - - - - - com.microsoft/1.2/MDM/HealthAttestation - + + + + The root node for the device HealthAttestation configuration service provider. + + + + + + + + + + + com.microsoft/1.4/MDM/HealthAttestation + + + 10.0.10586 + 1.0 + + + + + - VerifyHealth - - - - - - - - - - - - - - + VerifyHealth + + + + + Notifies the device to prepare a device health verification request. + + + + + + + + + + + text/plain + + + - Status - - - - - - - - - - - - - - - text/plain - - + Status + + + + + Provides the current status of the device health request. For the complete list of status see https://docs.microsoft.com/en-us/windows/client-management/mdm/healthattestation-csp#device-healthattestation-csp-status-and-error-codes + + + + + + + + + + + text/plain + + - ForceRetrieve - - - - - - False - - - - - - - - - - - text/plain - - + ForceRetrieve + + + + + + False + Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service. + + + + + + + + + + + text/plain + + + + false + False + + + true + True + + + - Certificate - - - - - - - - - - - - - - - - - + Certificate + + + + + Instructs the DHA-CSP to forward DHA-Data to the MDM server. + + + + + + + + + + + text/plain + + - Nonce - - - - - - \0 - - - - - - - - - - - text/plain - - + Nonce + + + + + + \0 + Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server. The nonce is in hex format, with a minimum size of 8 bytes, and a maximum size of 32 bytes. + + + + + + + + + + + text/plain + + + + - CorrelationID - - - - - - - - - - - - - - - text/plain - - + CorrelationID + + + + + Identifies a unique device health attestation session. CorrelationId is used to correlate DHA-Service logs with the MDM server events and Client event logs for debug and troubleshooting. + + + + + + + + + + + text/plain + + + + - HASEndpoint - - - - - - - - - - - - - text/plain - - + HASEndpoint + + + + + + has.spserv.microsoft.com. + Identifies the fully qualified domain name (FQDN) of the DHA-Service that is assigned to perform attestation. If an FQDN is not assigned, DHA-Cloud (Microsoft owned and operated cloud service) will be used as the default attestation service. + + + + + + + + + + + text/plain + + + + - TpmReadyStatus - - - - - - - - - - - - - - - text/plain - - + TpmReadyStatus + + + + + Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state. + + + + + + + + + + + text/plain + + + 10.0.14393 + 1.1 + + - - + + CurrentProtocolVersion + + + + + Provides the current protocol version that the client is using to communicate with the Health Attestation Service. + + + + + + + + + + + text/plain + + + 10.0.16299 + 1.3 + + + + + PreferredMaxProtocolVersion + + + + + + 3 + Provides the maximum preferred protocol version that the client is configured to communicate over. If this is higher than the protocol versions supported by the client it will use the highest protocol version available to it. + + + + + + + + + + + text/plain + + + 10.0.16299 + 1.3 + + + + + + + MaxSupportedProtocolVersion + + + + + Returns the maximum protocol version that this client can support. + + + + + + + + + + + text/plain + + + 10.0.16299 + 1.3 + + + + + TriggerAttestation + + + + + Notifies the device to trigger an attestation session asynchronously. + + + + + + + + + + + text/plain + + + 99.9.99999 + 1.4 + + + + + + + GetAttestReport + + + + + Retrieve attestation session report if exists. + + + + + + + + + + + + + + 99.9.99999 + 1.4 + + + + + AttestStatus + + + + + AttestStatus maintains the success or failure status code for the last attestation session. + + + + + + + + + + + text/plain + + + 99.9.99999 + 1.4 + + + + + GetServiceCorrelationIDs + + + + + Retrieve service correlation IDs if exist. + + + + + + + + + + + + + + 99.9.99999 + 1.4 + + + + + + + + ``` From 99fe9c6f5e2856d84c52a0925a5522df3146ad49 Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 11 Oct 2021 22:06:23 -0700 Subject: [PATCH 077/284] Update healthattestation-csp.md --- windows/client-management/mdm/healthattestation-csp.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index f84f0fae96..d8b7e7ed5a 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -233,6 +233,9 @@ This node will retrieve the service generated correlation IDs for the given MDM If Trigger Attestation call failed and no previous data is present. The field remains empty. Otherwise, the last service correlation id will be returned. +> **_Note:_** MAA CSP nodes are available on arm64 but is not currently supported. + + ### MAA CSP Intergation Steps
  1. Setup a MAA provider instance:
    From 4988c8cf4f59a11fac5eca1f9e698ff78d5eb486 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Tue, 12 Oct 2021 11:30:07 +0530 Subject: [PATCH 078/284] 5488965- EICC Updates-Reimplement Re-implemented EICC CSP updates as per task : 5488965 (Need to go through and re-implement these text changes if they are not already present: CSP changes - https://github.com/MicrosoftDocs/windows-itpro-docs/pull/9138 DDF changes - https://github.com/MicrosoftDocs/windows-itpro-docs/pull/9137) --- windows/client-management/mdm/euiccs-csp.md | 30 +++ .../client-management/mdm/euiccs-ddf-file.md | 206 +++++++++++++++++- 2 files changed, 233 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index 97ae6b939f..c9219f4340 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -62,6 +62,36 @@ Required. Indicates whether this eUICC is physically present and active. Updated Supported operation is Get. Value type is boolean. +**_eUICC_/PPR1Allowed** +Profile Policy Rule 1 (PPR1) is required. Indicates whether the download of a profile with PPR1 is allowed. If the eUICC already has a profile (regardless of its origin and policy rules associated with it), the download of a profile with PPR1 is not allowed. + +Supported operation is Get. Value type is boolean. + +**_eUICC_/PPR1AlreadySet** +Required. Indicates whether the eUICC already has a profile with PPR1. + +Supported operation is Get. Value type is boolean. + +**_eUICC_/DownloadServers** +Interior node. Represents default SM-DP+ discovery requests. + +Supported operation is Get. + +**_eUICC_/DownloadServers/_ServerName_** +Interior node. Optional. Node specifying the server name for a discovery operation. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request. + +Supported operations are Add, Get, and Delete. + +**_eUICC_/DownloadServers/_ServerName_/DiscoveryState** +Required. Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA. + +Supported operation is Get. Value type is integer. Default value is 1. + +**_eUICC_/DownloadServers/_ServerName_/AutoEnable** +Required. Indicates whether the discovered profile must be enabled automatically after install. This must be set by the MDM when the ServerName subtree is created. + +Supported operations are Add, Get, and Replace. Value type is bool. + **_eUICC_/Profiles** Interior node. Required. Represents all enterprise-owned profiles. diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 38bb8e5f6f..f7d0851746 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -49,7 +49,7 @@ The XML below if for Windows 10, version 1803. - com.microsoft/1.1/MDM/eUICCs + com.microsoft/1.2/MDM/eUICCs @@ -58,7 +58,7 @@ The XML below if for Windows 10, version 1803. - Represents information associated with an eUICC. There is one subtree for each known eUICC, created by the Local Profile Assistant (LPA) when the eUICC is first seen. The node name is meaningful only to the LPA (which associates it with an eUICC ID (EID) in an implementation-specific manner, e.g., this could be a SHA-256 hash of the EID). The node name "Default" represents the currently active eUICC. + Represents information associated with an eUICC. There is one subtree for each known eUICC, created by the Local Profile Assistant (LPA) when the eUICC is first seen. The node name is the eUICC ID (EID). The node name "Default" represents the currently active eUICC. @@ -79,7 +79,7 @@ The XML below if for Windows 10, version 1803. - Identifies an eUICC in an implementation-specific manner, e.g., this could be a SHA-256 hash of the EID. + The EID. @@ -118,6 +118,139 @@ The XML below if for Windows 10, version 1803. + + PPR1Allowed + + + + + Indicates whether the download of a profile with PPR1 is allowed. If the eUICC already has a profile (regardless of its origin and policy rules associated with it), the download of a profile with PPR1 is not allowed. + + + + + + + + + + + text/plain + + + + + PPR1AlreadySet + + + + + Indicates whether the eUICC already has a profile with PPR1. + + + + + + + + + + + text/plain + + + + + DownloadServers + + + + + Represents default SM-DP+ discovery requests. + + + + + + + + + + + + + + + + + + + + + + + Node specifying the server name for a discovery operation. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request. + + + + + + + + + + ServerName + + + + + + DiscoveryState + + + + + 1 + Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA. + + + + + + + + + + + text/plain + + + + + AutoEnable + + + + + + + Indicates whether the discovered profile must be enabled automatically after install. This must be set by the MDM when the ServerName subtree is created. + + + + + + + + + + + text/plain + + + + + Profiles @@ -145,6 +278,7 @@ The XML below if for Windows 10, version 1803. + Node representing an enterprise-owned eUICC profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC). @@ -167,6 +301,7 @@ The XML below if for Windows 10, version 1803. + Fully qualified domain name of the SM-DP+ that can download this profile. Must be set by the MDM when the ICCID subtree is created. @@ -192,6 +327,7 @@ The XML below if for Windows 10, version 1803. + Matching ID (activation code token) for profile download. Must be set by the MDM when the ICCID subtree is created. @@ -256,6 +392,70 @@ The XML below if for Windows 10, version 1803. + + PPR1Set + + + + + This profile policy rule indicates whether disabling of this profile is not allowed (true if not allowed, false otherwise). + + + + + + + + + + + text/plain + + + + + PPR2Set + + + + + This profile policy rule indicates whether deletion of this profile is not allowed (true if not allowed, false otherwise). + + + + + + + + + + + text/plain + + + + + ErrorDetail + + + + + 0 + Detailed error if the profile download and install procedure failed (None = 0, CardGeneralFailure = 1, ConfirmationCodeMissing = 3, ForbiddenByPolicy = 5, InvalidMatchingId = 6, NoEligibleProfileForThisDevice = 7, NotEnoughSpaceOnCard = 8, ProfileEidMismatch = 10, ProfileNotAvailableForNewBinding = 11, ProfileNotReleasedByOperator = 12, RemoteServerGeneralFailure = 13, RemoteServerUnreachable = 14). + + + + + + + + + + + text/plain + + + From e998fa0bf2b958635a284c5751959d96cb3733fa Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Oct 2021 12:02:50 -0700 Subject: [PATCH 079/284] Update special-identities.md --- .../identity-protection/access-control/special-identities.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index 6bf47c2e9e..fbc28f98f2 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -12,7 +12,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 04/19/2017 +ms.date: 10/12/2021 ms.reviewer: --- From e89052838304eb882827c85618c5cdf4042b1f5a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Oct 2021 12:04:36 -0700 Subject: [PATCH 080/284] Update special-identities.md --- .../identity-protection/access-control/special-identities.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index d97d4fecb9..1ae787f9f7 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -12,7 +12,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 04/19/2017 +ms.date: 10/12/2021 ms.reviewer: --- From d1e565330de212cbd25d5171ac03b0e3f5df3cb4 Mon Sep 17 00:00:00 2001 From: gkomatsu Date: Tue, 12 Oct 2021 12:51:10 -0700 Subject: [PATCH 081/284] Clarified Web Sign-in feature is in Preview --- windows/client-management/mdm/policy-csp-authentication.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 83bbd6d38f..b30980d636 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -517,7 +517,7 @@ Specifies the list of domains that are allowed to be navigated to in AAD PIN res > [!Warning] -> This policy is in preview mode only and therefore not meant or recommended for production purposes. +> The Web Sign-in feature is in preview mode only and therefore not meant or recommended for production purposes. This policy is intended for use on Shared PCs to enable a quick first sign-in experience for a user. It works by automatically connecting new non-admin Azure Active Directory (Azure AD) accounts to the pre-configured candidate local accounts. @@ -596,7 +596,7 @@ Value type is integer. Supported values: > [!Warning] -> This policy is in preview mode only and therefore not meant or recommended for production purposes. +> The Web Sign-in feature is in preview mode only and therefore not meant or recommended for production purposes. "Web Sign-in" is a new way of signing into a Windows PC. It enables Windows logon support for new Azure AD credentials, like Temporary Access Pass. From 05da7d5caea72cf7c2f6b6b1a85ac5bf485bcf2e Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Tue, 12 Oct 2021 13:32:47 -0700 Subject: [PATCH 082/284] update PIN reset note about DC connectivity requirement --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 25b4269de7..29bce3f5dc 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -38,7 +38,7 @@ There are two forms of PIN reset called destructive and non-destructive. Destruc Destructive and non-destructive PIN reset use the same entry points for initiating a PIN reset. If a user has forgotten their PIN, but has an alternate logon method, they can navigate to Sign-in options in Settings and initiate a PIN reset from the PIN options. If they do not have an alternate way to sign into their device, PIN reset can also be initiated from above the lock screen in the PIN credential provider. >[!IMPORTANT] ->For hybrid Azure AD joined devices, users must have corporate network connectivity to domain controllers to reset their PIN. If AD FS is being used for certificate trust or for on-premises only deployments, users must also have corporate network connectivity to federation services to reset their PIN. +>For hybrid Azure AD joined devices, users must have corporate network connectivity to domain controllers to complete destructive PIN reset. If AD FS is being used for certificate trust or for on-premises only deployments, users must also have corporate network connectivity to federation services to reset their PIN. ### Reset PIN from Settings From 71ba07e4aa799459999be782674aa4175c8e9a76 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 12 Oct 2021 13:42:00 -0700 Subject: [PATCH 083/284] Deleted spaces from table that might've caused [Suggestion-column-header-missing] --- .../identity-protection/access-control/special-identities.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index f0c84a4b48..ffe15e807d 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -157,7 +157,7 @@ Any user who accesses the system through a dial-up connection has the Dial-Up id | Well-Known SID/RID | S-1-5-1 | |Object Class| Foreign Security Principal| |Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| -|Default User Rights| none|  +|Default User Rights| none| ## Digest Authentication @@ -167,7 +167,7 @@ Any user who accesses the system through a dial-up connection has the Dial-Up id | Well-Known SID/RID | S-1-5-64-21 | |Object Class| Foreign Security Principal| |Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| -|Default User Rights| none|  +|Default User Rights| none| ## Enterprise Domain Controllers From f1aa97ff937b086be9fb8014a6de986129d7dbb4 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 12 Oct 2021 13:54:52 -0700 Subject: [PATCH 084/284] Correct font weight of table headings Table headings are bold by default. Adding formatting for bold results in a lighter weight font than is standard on docs.microsoft.com. --- .../access-control/special-identities.md | 48 +++++++++---------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index ffe15e807d..4476afbc90 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -90,7 +90,7 @@ The special identity groups are described in the following tables: Any user who accesses the system through an anonymous logon has the Anonymous Logon identity. This identity allows anonymous access to resources, such as a web page that is published on corporate servers. The Anonymous Logon group is not a member of the Everyone group by default. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-7 | |Object Class| Foreign Security Principal| @@ -102,7 +102,7 @@ Any user who accesses the system through an anonymous logon has the Anonymous Lo Any user who accesses the system through a sign-in process has the Authenticated Users identity. This identity allows access to shared resources within the domain, such as files in a shared folder that should be accessible to all the workers in the organization. Membership is controlled by the operating system. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-11 | |Object Class| Foreign Security Principal| @@ -114,7 +114,7 @@ Any user who accesses the system through a sign-in process has the Authenticated Any user or process that accesses the system as a batch job (or through the batch queue) has the Batch identity. This identity allows batch jobs to run scheduled tasks, such as a nightly cleanup job that deletes temporary files. Membership is controlled by the operating system. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-3 | |Object Class| Foreign Security Principal| @@ -128,7 +128,7 @@ The person who created the file or the directory is a member of this special ide A placeholder security identifier (SID) is created in an inheritable access control entry (ACE). When the ACE is inherited, the system replaces this SID with the SID for the primary group of the object’s current owner. The primary group is used only by the Portable Operating System Interface for UNIX (POSIX) subsystem. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-3-1 | |Object Class| Foreign Security Principal| @@ -140,7 +140,7 @@ A placeholder security identifier (SID) is created in an inheritable access cont The person who created the file or the directory is a member of this special identity group. Windows Server operating systems use this identity to automatically grant access permissions to the creator of a file or directory. A placeholder SID is created in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the object’s current owner. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-3-0 | |Object Class| Foreign Security Principal| @@ -152,7 +152,7 @@ The person who created the file or the directory is a member of this special ide Any user who accesses the system through a dial-up connection has the Dial-Up identity. This identity distinguishes dial-up users from other types of authenticated users. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-1 | |Object Class| Foreign Security Principal| @@ -162,7 +162,7 @@ Any user who accesses the system through a dial-up connection has the Dial-Up id ## Digest Authentication -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-64-21 | |Object Class| Foreign Security Principal| @@ -174,7 +174,7 @@ Any user who accesses the system through a dial-up connection has the Dial-Up id This group includes all domain controllers in an Active Directory forest. Domain controllers with enterprise-wide roles and responsibilities have the Enterprise Domain Controllers identity. This identity allows them to perform certain tasks in the enterprise by using transitive trusts. Membership is controlled by the operating system. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-9 | |Object Class| Foreign Security Principal| @@ -190,7 +190,7 @@ On computers running Windows 2000 and earlier, the Everyone group included the Membership is controlled by the operating system. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-1-0 | |Object Class| Foreign Security Principal| @@ -202,7 +202,7 @@ Membership is controlled by the operating system. Any user who is logged on to the local system has the Interactive identity. This identity allows only local users to access a resource. Whenever a user accesses a given resource on the computer to which they are currently logged on, the user is automatically added to the Interactive group. Membership is controlled by the operating system. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-4 | |Object Class| Foreign Security Principal| @@ -214,7 +214,7 @@ Any user who is logged on to the local system has the Interactive identity. This The Local Service account is similar to an Authenticated User account. The Local Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session with anonymous credentials. The name of the account is NT AUTHORITY\\LocalService. This account does not have a password. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-19 | |Object Class| Foreign Security Principal| @@ -227,7 +227,7 @@ The Local Service account is similar to an Authenticated User account. The Local This is a service account that is used by the operating system. The LocalSystem account is a powerful account that has full access to the system and acts as the computer on the network. If a service logs on to the LocalSystem account on a domain controller, that service has access to the entire domain. Some services are configured by default to log on to the LocalSystem account. Do not change the default service setting. The name of the account is LocalSystem. This account does not have a password. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-18 | |Object Class| Foreign Security Principal| @@ -238,7 +238,7 @@ This is a service account that is used by the operating system. The LocalSystem This group implicitly includes all users who are logged on through a network connection. Any user who accesses the system through a network has the Network identity. This identity allows only remote users to access a resource. Whenever a user accesses a given resource over the network, the user is automatically added to the Network group. Membership is controlled by the operating system. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-2 | |Object Class| Foreign Security Principal| @@ -250,7 +250,7 @@ This group implicitly includes all users who are logged on through a network con The Network Service account is similar to an Authenticated User account. The Network Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Network Service account access network resources by using the credentials of the computer account. The name of the account is NT AUTHORITY\\NetworkService. This account does not have a password. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-20 | |Object Class| Foreign Security Principal| @@ -260,7 +260,7 @@ The Network Service account is similar to an Authenticated User account. The Net ## NTLM Authentication -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-64-10 | |Object Class| Foreign Security Principal| @@ -272,7 +272,7 @@ The Network Service account is similar to an Authenticated User account. The Net This group implicitly includes all users who are logged on to the system through a dial-up connection. Membership is controlled by the operating system. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-1000 | |Object Class| Foreign Security Principal| @@ -284,7 +284,7 @@ This group implicitly includes all users who are logged on to the system through This identity is a placeholder in an ACE on a user, group, or computer object in Active Directory. When you grant permissions to Principal Self, you grant them to the security principal that is represented by the object. During an access check, the operating system replaces the SID for Principal Self with the SID for the security principal that is represented by the object. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-10 | |Object Class| Foreign Security Principal| @@ -296,7 +296,7 @@ This identity is a placeholder in an ACE on a user, group, or computer object in This identity represents all users who are currently logged on to a computer by using a Remote Desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-14| |Object Class| Foreign Security Principal| @@ -308,7 +308,7 @@ This identity represents all users who are currently logged on to a computer by Users and computers with restricted capabilities have the Restricted identity. This identity group is used by a process that is running in a restricted security context, such as running an application with the RunAs service. When code runs at the Restricted security level, the Restricted SID is added to the user’s access token. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-12 | |Object Class| Foreign Security Principal| @@ -318,7 +318,7 @@ Users and computers with restricted capabilities have the Restricted identity. T ## SChannel Authentication -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-64-14 | |Object Class| Foreign Security Principal| @@ -331,7 +331,7 @@ Users and computers with restricted capabilities have the Restricted identity. T Any service that accesses the system has the Service identity. This identity group includes all security principals that are signed in as a service. This identity grants access to processes that are being run by Windows Server services. Membership is controlled by the operating system. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-6 | |Object Class| Foreign Security Principal| @@ -343,7 +343,7 @@ Any service that accesses the system has the Service identity. This identity gro Any user accessing the system through Terminal Services has the Terminal Server User identity. This identity allows users to access Terminal Server applications and to perform other necessary tasks with Terminal Server services. Membership is controlled by the operating system. -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-13 | |Object Class| Foreign Security Principal| @@ -353,7 +353,7 @@ Any user accessing the system through Terminal Services has the Terminal Server ## This Organization -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | S-1-5-15 | |Object Class| Foreign Security Principal| @@ -362,7 +362,7 @@ Any user accessing the system through Terminal Services has the Terminal Server ## Window Manager\\Window Manager Group -| **Attribute** | **Value** | +| Attribute | Value | | :--: | :--: | | Well-Known SID/RID | | |Object Class| | From 8b32493ec8e4dc5f12078588a2c2729ff3fcd347 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Tue, 12 Oct 2021 18:50:53 -0400 Subject: [PATCH 085/284] Android apps --- .../android-apps-subsystem-windows.md | 122 ++++++++++++++++++ .../apps-in-windows-10.md | 6 + windows/application-management/toc.yml | 6 +- windows/whats-new/windows-11-whats-new.md | 8 +- 4 files changed, 139 insertions(+), 3 deletions(-) create mode 100644 windows/application-management/android-apps-subsystem-windows.md diff --git a/windows/application-management/android-apps-subsystem-windows.md b/windows/application-management/android-apps-subsystem-windows.md new file mode 100644 index 0000000000..09578ea8f1 --- /dev/null +++ b/windows/application-management/android-apps-subsystem-windows.md @@ -0,0 +1,122 @@ +--- +title: Use Android apps and the Windows Subsystem for Android on Windows 11 devices +description: Learn more information about the Windows Subsystem for Android, including prerequisites on Windows 11 devices. Get more information administrators want to know about downloading, installing, and using Android apps. Also see what gets installed with the Windows Subsystem for Android. +ms.reviewer: mousma +manager: dougeby +ms.audience: itpro +author: MandiOhlinger +ms.author: mandia +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +audience: itpro +ms.topic: article +ms.custom: +--- + +# Android apps on Windows 11 + +**Applies to**: + +- Windows 11 + +On Windows 11 devices, users can open the Microsoft Store app, and install and use Android apps. This feature is called the **Windows Subsystem for Android**. After the Android apps are installed, they're shown on the Start menu and in the All Apps list, just like Windows apps. + +The Windows Subsystem for Android includes some apps and a service that are installed on the Windows device. The subsystem connects to the Amazon Appstore for Android using the user's Amazon account. When they sign in, users can search, download, install, and use Android apps. + +??Why would someone want Android apps on Windows devices?? + +If your organization creates Android apps, then the app developers can develop and test their Android apps on a Windows device. They can also optimize the Android apps for Windows devices. For more information, see [Windows Subsystem for Android developer information](/windows/android/wsa). + +This article describes the Windows Subsystem for Android, lists any prerequisites, and includes information admins want to know. + +For more specific end-user information, see [Windows Subsystem for Android consumer information](https://support.microsoft.com/windows/abed2335-81bf-490a-92e5-fe01b66e5c48). + +## Before you begin + +- To use the Windows Subsystem for Android, the following features should be enabled. The Windows Subsystem for Android installation checks for these prerequisites: + + - The device should be VM-capable. + - The device should have virtualization enabled in the BIOS.  + - The Virtual Machine Platform Windows feature should be installed: **Turn Windows Features on or off** > **Virtual Machine Platform** + - The device must have at least 8 GB available. + +- S-mode can't be enabled. For more information, see [Switch to Windows Pro or Enterprise from S mode](/windows/deployment/windows-10-pro-in-s-mode) and [Switching out of S mode in Windows](/windows/switching-out-of-s-mode-in-windows-4f56d9be-99ec-6983-119f-031bfb28a307#WindowsVersion=Windows_11). +- To download and install Android apps, users need to sign in with their Amazon account. + +- What is "10X v1 does not support Centennial apps at all."?? +- Mention sideloading not being supported?? + +## Install the Windows Subsystem for Android + +1. Open the Microsoft Store app. There are two options to install the Windows Subsystem for Android: + + - Search for and install the **Amazon Appstore** app. This app installs the Windows Subsystem for Android. + - Search for and install any Amazon Appstore app. When any Amazon Appstore app is installed the first time, the Windows Subsystem for Android is automatically installed. + + When the Windows Subsystem for Android installs, it also checks for the prerequisites. If a prerequisite isn't met, such as virtualization not being enabled in the BIOS, then the install tries to enable these features. So, it's normal if the installation requires a reboot. + +2. Once installed, the Amazon Appstore app is shown on the Start menu, and in the All Apps list. +3. Open the Amazon Appstore app. Users sign in with their Amazon account, and can install & use Android apps on their Windows device. Typically, users only need to sign in the first time. + +After the Android apps are installed, users can: + +- Pin and unpin the apps to the taskbar and Start menu. +- Snap the apps and use the snaps in a snap group. +- Copy & paste text, files, and images between Android and Windows apps. + +## What's in the installation + +The Windows Subsystem for Android is a [MSIX package](/windows/msix/overview), and includes the following items: + +- **A virtual machine**: This VM hosts the Windows Subsystem for Android, and runs the apps. Users can't tell they're using a VM. When the Windows Subsystem for Android installs, it starts the VM, and connects the Amazon Appstore to the Windows device. If the VM stops, then the first Android app the user opens starts the VM. This VM is installed per user. +- **Amazon Appstore App**: This app is the Windows Subsystem for Android. ??Not shown in Apps List.?? Users can see this app in **Settings** > **Apps** > **Apps & features**. They can also uninstall it. +- **Amazon Appstore App settings**: This app includes settings that users can change. This app isn't shown in the All Apps list, and isn't shown in **Settings** > **Apps** > **Apps & features**. It can't be uninstalled separately. +- **A Windows service** ??Need the service name**: This service ??does something?? + +## Update or repair the subsystem + +The Windows Subsystem for Android is an app in the Microsoft Store. Users can update or repair the apps just like any other app in the Microsoft Store. So, users can see available updates, and search for updates at any time. + +The **Amazon Appstore App** is listed in **Settings** > **Apps** > **Apps & features**. They can use the Repair and Uninstall features, just like any other app. When users select **Repair**, they also get the latest version of the app. + +### Repair prerequisites + +If the prerequisites need repaired, users can: + +1. Open the Microsoft Store app. +2. Search for and select the Amazon Appstore > **Install**. + + The installation automatically checks for the prerequisites. Users can choose to reinstall the app, which tries enabling any missing prerequisites. + +## Block Android apps + +If you want to prevent users from installing Android apps, you have the following options: + +- **Option 1: Use Windows Defender Application Control (WDAC) PowerShell cmdlets**. For more information, see [Manage Packaged Apps with Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control). + +- **Option 2: Block the Microsoft Store app**. This option uses group policy or an MDM provider to block access to the Microsoft Store app. It prevents users from using the entire Microsoft Store app, not just Android apps. + + - **Group policy**: + + - `Computer configuration\Administrative templates\Windows Components\Store` + - `User configuration\Administrative templates\Windows Components\Store` + + - **Microsoft Endpoint Manager, which is an MDM provider**: Use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) to turn off the Microsoft Store app. + + For more possible options, see [Configure access to Microsoft Store](/windows/configuration/stop-employees-from-using-microsoft-store). + +## Uninstall the subsystem + +Users can uninstall Android apps the same way as other Microsoft Store apps: + +- Right-click the **Amazon Appstore** app icon > **Uninstall**. +- Go to **Settings** > **Apps** > **Apps & features**. Select the **Amazon Appstore** app > **Uninstall**. + +When the **Amazon Appstore** app is uninstalled, it removes the entire Windows Subsystem for Android, including the VM and any installed Android apps. + +## Next steps + +- [Windows Subsystem for Android consumer information](https://support.microsoft.com/windows/abed2335-81bf-490a-92e5-fe01b66e5c48) +- [Windows Subsystem for Android developer information](/windows/android/wsa) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 43bc4bec68..941e6e7f2b 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -71,6 +71,12 @@ There are different types of apps that can run on your Windows client devices. T Using an MDM provider, you can create shortcuts to your web apps and progressive web apps on devices. +## Android apps + +Starting with Windows 11, users can use the Microsoft Store to search, download, and install Android apps. This feature uses the Windows Subsystem for Android, and allows users to interact with Android apps, just like others apps installed from the Microsoft Store. + +For more information on Android apps and the Windows Subsystem for Android, see [Android apps on Windows 11](/windows/application-management/android-apps-subsystem-windows). + ## Add or deploy apps to devices When your apps are ready, you can add or deploy these apps to your Windows devices. This section lists some common options. diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index 3655fed6e5..f512b9c3ad 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -15,6 +15,8 @@ items: href: add-apps-and-features.md - name: Sideload apps href: sideload-apps-in-windows-10.md + - name: Android apps on Windows 11 + href: android-apps-subsystem-windows.md - name: Private app repo on Windows 11 href: private-app-repository-mdm-company-portal-windows-11.md - name: Remove background task resource restrictions @@ -23,7 +25,7 @@ items: href: manage-windows-mixed-reality.md - name: Application Virtualization (App-V) items: - - name: App-V for Windows 10 overview + - name: App-V for Windows overview href: app-v/appv-for-windows.md - name: Getting Started items: @@ -266,5 +268,5 @@ items: href: per-user-services-in-windows.md - name: Disabling System Services in Windows Server href: /windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server - - name: How to keep apps removed from Windows 10 from returning during an update + - name: How to keep apps removed from Windows from returning during an update href: remove-provisioned-apps-during-update.md \ No newline at end of file diff --git a/windows/whats-new/windows-11-whats-new.md b/windows/whats-new/windows-11-whats-new.md index e48159d8fd..5bbbab1b54 100644 --- a/windows/whats-new/windows-11-whats-new.md +++ b/windows/whats-new/windows-11-whats-new.md @@ -1,6 +1,6 @@ --- title: Windows 11, what's new and overview for administrators -description: Learn more about what's new in Windows 11. Read about see the features IT professionals and administrators should know about Windows 11, including security, using apps, the new desktop, and deploying and servicing PCs. +description: Learn more about what's new in Windows 11. Read about see the features IT professionals and administrators should know about Windows 11, including security, using apps, using Android apps, the new desktop, and deploying and servicing PCs. ms.reviewer: manager: dougeby ms.audience: itpro @@ -138,6 +138,12 @@ For more information on the security features you can configure, manage, and enf ## Use your same apps, improved +- Starting with Windows 11, users can download and install Android apps from the Microsoft Store. This feature is called the **Windows Subsystem for Android**, and allows users to use Android apps on their Windows devices, just like other apps installed from the Microsoft Store. + + Users open the Microsoft Store, install the **Amazon Appstore** app, and sign in with their Amazon account. When they sign in, they can search, download, and install Android apps. + + For more information, see [Android apps on Windows 11](/windows/application-management/android-apps-subsystem-windows). + - Your Windows 10 apps will also work on Windows 11. **[App Assure](https://www.microsoft.com/fasttrack/microsoft-365/app-assure)** is also available if there are some issues. You can continue to use **MSIX packages** for your UWP, Win32, WPF, and WinForm desktop application files. Continue to use **Windows Package Manager** to install Windows apps. Use **Azure Virtual desktop with MSIX app attach** to virtualize desktops and apps. For more information on these features, see [Overview of apps on Windows client devices](/windows/application-management/apps-in-windows-10). From e0c9fd32f9b2185a5045d67c3b1488aed10ed3d2 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Tue, 12 Oct 2021 19:29:01 -0400 Subject: [PATCH 086/284] PM changes --- .../android-apps-subsystem-windows.md | 122 ------------------ .../apps-in-windows-10.md | 2 +- windows/application-management/toc.yml | 2 - windows/whats-new/windows-11-whats-new.md | 6 +- 4 files changed, 4 insertions(+), 128 deletions(-) delete mode 100644 windows/application-management/android-apps-subsystem-windows.md diff --git a/windows/application-management/android-apps-subsystem-windows.md b/windows/application-management/android-apps-subsystem-windows.md deleted file mode 100644 index 09578ea8f1..0000000000 --- a/windows/application-management/android-apps-subsystem-windows.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: Use Android apps and the Windows Subsystem for Android on Windows 11 devices -description: Learn more information about the Windows Subsystem for Android, including prerequisites on Windows 11 devices. Get more information administrators want to know about downloading, installing, and using Android apps. Also see what gets installed with the Windows Subsystem for Android. -ms.reviewer: mousma -manager: dougeby -ms.audience: itpro -author: MandiOhlinger -ms.author: mandia -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -audience: itpro -ms.topic: article -ms.custom: ---- - -# Android apps on Windows 11 - -**Applies to**: - -- Windows 11 - -On Windows 11 devices, users can open the Microsoft Store app, and install and use Android apps. This feature is called the **Windows Subsystem for Android**. After the Android apps are installed, they're shown on the Start menu and in the All Apps list, just like Windows apps. - -The Windows Subsystem for Android includes some apps and a service that are installed on the Windows device. The subsystem connects to the Amazon Appstore for Android using the user's Amazon account. When they sign in, users can search, download, install, and use Android apps. - -??Why would someone want Android apps on Windows devices?? - -If your organization creates Android apps, then the app developers can develop and test their Android apps on a Windows device. They can also optimize the Android apps for Windows devices. For more information, see [Windows Subsystem for Android developer information](/windows/android/wsa). - -This article describes the Windows Subsystem for Android, lists any prerequisites, and includes information admins want to know. - -For more specific end-user information, see [Windows Subsystem for Android consumer information](https://support.microsoft.com/windows/abed2335-81bf-490a-92e5-fe01b66e5c48). - -## Before you begin - -- To use the Windows Subsystem for Android, the following features should be enabled. The Windows Subsystem for Android installation checks for these prerequisites: - - - The device should be VM-capable. - - The device should have virtualization enabled in the BIOS.  - - The Virtual Machine Platform Windows feature should be installed: **Turn Windows Features on or off** > **Virtual Machine Platform** - - The device must have at least 8 GB available. - -- S-mode can't be enabled. For more information, see [Switch to Windows Pro or Enterprise from S mode](/windows/deployment/windows-10-pro-in-s-mode) and [Switching out of S mode in Windows](/windows/switching-out-of-s-mode-in-windows-4f56d9be-99ec-6983-119f-031bfb28a307#WindowsVersion=Windows_11). -- To download and install Android apps, users need to sign in with their Amazon account. - -- What is "10X v1 does not support Centennial apps at all."?? -- Mention sideloading not being supported?? - -## Install the Windows Subsystem for Android - -1. Open the Microsoft Store app. There are two options to install the Windows Subsystem for Android: - - - Search for and install the **Amazon Appstore** app. This app installs the Windows Subsystem for Android. - - Search for and install any Amazon Appstore app. When any Amazon Appstore app is installed the first time, the Windows Subsystem for Android is automatically installed. - - When the Windows Subsystem for Android installs, it also checks for the prerequisites. If a prerequisite isn't met, such as virtualization not being enabled in the BIOS, then the install tries to enable these features. So, it's normal if the installation requires a reboot. - -2. Once installed, the Amazon Appstore app is shown on the Start menu, and in the All Apps list. -3. Open the Amazon Appstore app. Users sign in with their Amazon account, and can install & use Android apps on their Windows device. Typically, users only need to sign in the first time. - -After the Android apps are installed, users can: - -- Pin and unpin the apps to the taskbar and Start menu. -- Snap the apps and use the snaps in a snap group. -- Copy & paste text, files, and images between Android and Windows apps. - -## What's in the installation - -The Windows Subsystem for Android is a [MSIX package](/windows/msix/overview), and includes the following items: - -- **A virtual machine**: This VM hosts the Windows Subsystem for Android, and runs the apps. Users can't tell they're using a VM. When the Windows Subsystem for Android installs, it starts the VM, and connects the Amazon Appstore to the Windows device. If the VM stops, then the first Android app the user opens starts the VM. This VM is installed per user. -- **Amazon Appstore App**: This app is the Windows Subsystem for Android. ??Not shown in Apps List.?? Users can see this app in **Settings** > **Apps** > **Apps & features**. They can also uninstall it. -- **Amazon Appstore App settings**: This app includes settings that users can change. This app isn't shown in the All Apps list, and isn't shown in **Settings** > **Apps** > **Apps & features**. It can't be uninstalled separately. -- **A Windows service** ??Need the service name**: This service ??does something?? - -## Update or repair the subsystem - -The Windows Subsystem for Android is an app in the Microsoft Store. Users can update or repair the apps just like any other app in the Microsoft Store. So, users can see available updates, and search for updates at any time. - -The **Amazon Appstore App** is listed in **Settings** > **Apps** > **Apps & features**. They can use the Repair and Uninstall features, just like any other app. When users select **Repair**, they also get the latest version of the app. - -### Repair prerequisites - -If the prerequisites need repaired, users can: - -1. Open the Microsoft Store app. -2. Search for and select the Amazon Appstore > **Install**. - - The installation automatically checks for the prerequisites. Users can choose to reinstall the app, which tries enabling any missing prerequisites. - -## Block Android apps - -If you want to prevent users from installing Android apps, you have the following options: - -- **Option 1: Use Windows Defender Application Control (WDAC) PowerShell cmdlets**. For more information, see [Manage Packaged Apps with Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control). - -- **Option 2: Block the Microsoft Store app**. This option uses group policy or an MDM provider to block access to the Microsoft Store app. It prevents users from using the entire Microsoft Store app, not just Android apps. - - - **Group policy**: - - - `Computer configuration\Administrative templates\Windows Components\Store` - - `User configuration\Administrative templates\Windows Components\Store` - - - **Microsoft Endpoint Manager, which is an MDM provider**: Use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) to turn off the Microsoft Store app. - - For more possible options, see [Configure access to Microsoft Store](/windows/configuration/stop-employees-from-using-microsoft-store). - -## Uninstall the subsystem - -Users can uninstall Android apps the same way as other Microsoft Store apps: - -- Right-click the **Amazon Appstore** app icon > **Uninstall**. -- Go to **Settings** > **Apps** > **Apps & features**. Select the **Amazon Appstore** app > **Uninstall**. - -When the **Amazon Appstore** app is uninstalled, it removes the entire Windows Subsystem for Android, including the VM and any installed Android apps. - -## Next steps - -- [Windows Subsystem for Android consumer information](https://support.microsoft.com/windows/abed2335-81bf-490a-92e5-fe01b66e5c48) -- [Windows Subsystem for Android developer information](/windows/android/wsa) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 941e6e7f2b..1af4b54568 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -75,7 +75,7 @@ There are different types of apps that can run on your Windows client devices. T Starting with Windows 11, users can use the Microsoft Store to search, download, and install Android apps. This feature uses the Windows Subsystem for Android, and allows users to interact with Android apps, just like others apps installed from the Microsoft Store. -For more information on Android apps and the Windows Subsystem for Android, see [Android apps on Windows 11](/windows/application-management/android-apps-subsystem-windows). +For more information on Android apps and the Windows Subsystem for Android, see [Windows Subsystem for Android developer information](/windows/android/wsa). ## Add or deploy apps to devices diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index f512b9c3ad..4be6d524af 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -15,8 +15,6 @@ items: href: add-apps-and-features.md - name: Sideload apps href: sideload-apps-in-windows-10.md - - name: Android apps on Windows 11 - href: android-apps-subsystem-windows.md - name: Private app repo on Windows 11 href: private-app-repository-mdm-company-portal-windows-11.md - name: Remove background task resource restrictions diff --git a/windows/whats-new/windows-11-whats-new.md b/windows/whats-new/windows-11-whats-new.md index 5bbbab1b54..81f1509081 100644 --- a/windows/whats-new/windows-11-whats-new.md +++ b/windows/whats-new/windows-11-whats-new.md @@ -136,13 +136,13 @@ For more information on the security features you can configure, manage, and enf Users can manage some desktop features using **Settings** app > **System** > **Multitasking**. For more information on the end-user experience, see [Multiple desktops in Windows](https://support.microsoft.com/windows/multiple-desktops-in-windows-11-36f52e38-5b4a-557b-2ff9-e1a60c976434). -## Use your same apps, improved +## Use your same apps, and new apps, improved -- Starting with Windows 11, users can download and install Android apps from the Microsoft Store. This feature is called the **Windows Subsystem for Android**, and allows users to use Android apps on their Windows devices, just like other apps installed from the Microsoft Store. +- Starting with Windows 11, users can download and install **Android apps** from the Microsoft Store. This feature is called the **Windows Subsystem for Android**, and allows users to use Android apps on their Windows devices, similar to other apps installed from the Microsoft Store. Users open the Microsoft Store, install the **Amazon Appstore** app, and sign in with their Amazon account. When they sign in, they can search, download, and install Android apps. - For more information, see [Android apps on Windows 11](/windows/application-management/android-apps-subsystem-windows). + For more information, see [Windows Subsystem for Android developer information](/windows/android/wsa). - Your Windows 10 apps will also work on Windows 11. **[App Assure](https://www.microsoft.com/fasttrack/microsoft-365/app-assure)** is also available if there are some issues. From e3c58d28aa8dac13e3b74da19a1f991ba988d269 Mon Sep 17 00:00:00 2001 From: Alice-at-Microsoft <79878795+Alice-at-Microsoft@users.noreply.github.com> Date: Tue, 12 Oct 2021 16:50:09 -0700 Subject: [PATCH 087/284] Diagnostic data requirement (safeguard hold queries) --- .../update/update-compliance-feature-update-status.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/update-compliance-feature-update-status.md b/windows/deployment/update/update-compliance-feature-update-status.md index 9b3662595f..f1909128aa 100644 --- a/windows/deployment/update/update-compliance-feature-update-status.md +++ b/windows/deployment/update/update-compliance-feature-update-status.md @@ -45,9 +45,11 @@ Refer to the following list for what each state means: Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows client release information pages for any given release. -## Queries for safeguard holds +### Queries for safeguard holds -Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. The first query shows the device data for all devices that are affected by safeguard holds. The second query shows data specific to devices running the target build. +Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. These queries show data for devices that are configured to send diagnostic data at *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included. + +The first query shows the device data for all devices that are affected by safeguard holds. The second query shows data specific to devices running the target build. ![Left pane showing Need Attention, Security update status, feature update status, and Windows Defender AV status, with Need Attention selected. Right pane shows the list of queries relevant to the Need Attention status, with "Devices with a safeguard hold" and "Target build distribution of devices with a safeguard hold" queries highlighted](images/UC_workspace_safeguard_queries.png) From ad7c23fb423ad6dd25f8a3a9b3c5ebbad27df06c Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Tue, 12 Oct 2021 18:01:36 -0700 Subject: [PATCH 088/284] adding new message around WHFB cloud trust --- .../hello-for-business/hello-deployment-guide.md | 5 ++++- .../identity-protection/hello-for-business/hello-faq.yml | 4 ++++ .../hello-for-business/hello-identity-verification.md | 5 ++++- .../identity-protection/hello-for-business/hello-overview.md | 3 +++ .../hello-for-business/hello-planning-guide.md | 3 +++ 5 files changed, 18 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index 80a1ca91b3..4e7d1f7942 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -50,7 +50,10 @@ Do not begin your deployment until the hosting servers and infrastructure (not r ## Deployment and trust models -Windows Hello for Business has three deployment models: Cloud, hybrid, and on-premises. Hybrid and on-premises deployment models have two trust models: *Key trust* and *certificate trust*. +Windows Hello for Business has three deployment models: Azure AD cloud only, hybrid, and on-premises. Hybrid and on-premises deployment models have two trust models: *Key trust* and *certificate trust*. + +> [!NOTE] +> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available. Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest. diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 735e563fb8..a11d68959d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -25,6 +25,10 @@ summary: | sections: - name: Ignored questions: + - question: What is Windows Hello for Business cloud trust? + answer: | + Windows Hello for Business cloud trust is a new trust model that is planned to be introduced in early 2022. This trust model will enable Windows Hello for Business deployment using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available. + - question: What about virtual smart cards? answer: | Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends that new Windows 10 deployments use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 3660d85201..26a25c7342 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -22,7 +22,7 @@ ms.date: 1/22/2021 This article lists the infrastructure requirements for the different deployment models for Windows Hello for Business. -## Cloud Only Deployment +## Azure AD Cloud Only Deployment * Windows 10, version 1511 or later, or Windows 11 * Microsoft Azure Account @@ -35,6 +35,9 @@ This article lists the infrastructure requirements for the different deployment The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process. +> [!NOTE] +> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available. + | Key trust
    Group Policy managed | Certificate trust
    Mixed managed | Key trust
    Modern managed | Certificate trust
    Modern managed | | --- | --- | --- | --- | | Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**
    *Minimum:* Windows 10, version 1703
    *Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).
    **Azure AD Joined:**
    Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later | diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index cd38c11105..b191dbc916 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -97,6 +97,9 @@ Windows Hello for Business can use either keys (hardware or software) or certifi Windows Hello for Business with a key does not support supplied credentials for RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments as a supplied credential. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). +> [!NOTE] +> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available. + ## Learn more [Implementing strong user authentication with Windows Hello for Business](https://www.microsoft.com/en-us/itshowcase/implementing-strong-user-authentication-with-windows-hello-for-business) diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 617be85699..d0de57c65c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -95,6 +95,9 @@ It's fundamentally important to understand which deployment model to use for a s A deployment's trust type defines how each Windows Hello for Business client authenticates to the on-premises Active Directory. There are two trust types: key trust and certificate trust. +> [!NOTE] +> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available. + The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 or later domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 or later Active Directory schema](./hello-hybrid-cert-trust-prereqs.md#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller. From 983e42ac90688abaa1d375d0122da7796af33557 Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Tue, 12 Oct 2021 18:21:44 -0700 Subject: [PATCH 089/284] fixing reference to Azure AD cloud only deployment --- .../hello-for-business/hello-aad-join-cloud-only-deploy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md index aa4d0faa2f..8e5fd2f049 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md @@ -31,7 +31,7 @@ You may wish to disable the automatic Windows Hello for Business enrollment prom Cloud only deployments will use Azure AD multi-factor authentication (MFA) during Windows Hello for Business (WHfB) enrollment and there's no additional MFA configuration needed. If you aren't already registered in Azure AD MFA, you will be guided though the MFA registration as part of the Windows Hello for Business enrollment process. -The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#cloud-only-deployment). +The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#azure-ad-cloud-only-deployment). Also note that it's possible for federated domains to enable the “Supports MFA” flag in your federated domain settings. This flag tells Azure AD that the federated IDP will perform the MFA challenge. From 51e312687b8637ba77be08971b6afbe83159201c Mon Sep 17 00:00:00 2001 From: Alice-at-Microsoft <79878795+Alice-at-Microsoft@users.noreply.github.com> Date: Wed, 13 Oct 2021 14:17:33 -0700 Subject: [PATCH 090/284] Add more detailed diagnostic data info --- windows/deployment/update/update-compliance-get-started.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index c01d76b407..2adebe9449 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -23,9 +23,7 @@ ms.topic: article - Windows 11 > [!IMPORTANT] -> **A new policy is required to use Update Compliance: "AllowUpdateComplianceProcessing"**. If you're already using Update Compliance and have configured your devices prior to May 10, 2021, you must configure devices with this additional policy. You can do this by rerunning the [Update Compliance Configuration Script](update-compliance-configuration-script.md) if you configure your devices through Group Policy, or refer to [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md) for details on manually configuring the new policy for both Group Policy and MDM. -> -> Devices must have this policy configured by January 31, 2022, to remain enrolled in Update Compliance. Devices without this policy configured, including Windows 10 releases prior to version 1809 which do not support this policy, will stop appearing in Update Compliance reports after this date. +> **A new policy is required to use Update Compliance: "AllowUpdateComplianceProcessing"**. If you're already using Update Compliance and have configured your devices prior to May 10, 2021, you must configure devices with this additional policy. You can do this by rerunning the [Update Compliance Configuration Script](update-compliance-configuration-script.md) if you configure your devices through Group Policy, or refer to [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md) for details on manually configuring the new policy for both Group Policy and MDM. This topic introduces the high-level steps required to enroll to the Update Compliance solution and configure devices to send data to it. The following steps cover the enrollment and device configuration workflow. @@ -44,7 +42,7 @@ Before you begin the process to add Update Compliance to your Azure subscription - **Compatible operating systems and editions**: Update Compliance works only with Windows 10 or Windows 11 Professional, Education, and Enterprise editions. Update Compliance supports both the typical Windows 10 or Windows 11 Enterprise edition, as well as [Windows 10 Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq). Update Compliance only provides data for the standard Desktop Windows client version and is not currently compatible with Windows Server, Surface Hub, IoT, or other versions. - **Compatible Windows client servicing channels**: Update Compliance supports Windows client devices on the General Availability Channel and the Long-term Servicing Channel (LTSC). Update Compliance *counts* Windows Insider Preview devices, but does not currently provide detailed deployment insights for them. -- **Diagnostic data requirements**: Update Compliance requires devices be configured to send diagnostic data at *Required* level (previously *Basic*). To learn more about what's included in different diagnostic levels, see [Diagnostics, feedback, and privacy in Windows 10](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy). +- **Diagnostic data requirements**: Update Compliance requires devices be configured to send diagnostic data at *Required* level (previously *Basic*). Select queries within Update Compliance require devices to be configured to send diagnostic data at *Optional* level (previously *Full*) for Windows 11 devices or *Enhanced* level for Windows 10 devices. To learn more about what's included in different diagnostic levels, see [Diagnostics, feedback, and privacy in Windows](https://support.microsoft.com/windows/diagnostics-feedback-and-privacy-in-windows-28808a2b-a31b-dd73-dcd3-4559a5199319). - **Data transmission requirements**: Devices must be able to contact specific endpoints required to authenticate and send diagnostic data. These are enumerated in detail at [Configuring Devices for Update Compliance manually](update-compliance-configuration-manual.md). - **Showing device names in Update Compliance**: For Windows 10, version 1803 or later, device names will not appear in Update Compliance unless you individually opt-in devices by using policy. The steps to accomplish this is outlined in [Configuring Devices for Update Compliance](update-compliance-configuration-manual.md). From 455141abcdb791cb9b8de9777488d74048ebe958 Mon Sep 17 00:00:00 2001 From: Alice-at-Microsoft <79878795+Alice-at-Microsoft@users.noreply.github.com> Date: Wed, 13 Oct 2021 14:18:51 -0700 Subject: [PATCH 091/284] revert changes --- windows/deployment/update/update-compliance-get-started.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index 2adebe9449..ac348a38ed 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -23,7 +23,9 @@ ms.topic: article - Windows 11 > [!IMPORTANT] -> **A new policy is required to use Update Compliance: "AllowUpdateComplianceProcessing"**. If you're already using Update Compliance and have configured your devices prior to May 10, 2021, you must configure devices with this additional policy. You can do this by rerunning the [Update Compliance Configuration Script](update-compliance-configuration-script.md) if you configure your devices through Group Policy, or refer to [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md) for details on manually configuring the new policy for both Group Policy and MDM. +> **A new policy is required to use Update Compliance: "AllowUpdateComplianceProcessing"**. If you're already using Update Compliance and have configured your devices prior to May 10, 2021, you must configure devices with this additional policy. You can do this by rerunning the [Update Compliance Configuration Script](update-compliance-configuration-script.md) if you configure your devices through Group Policy, or refer to [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md) for details on manually configuring the new policy for both Group Policy and MDM. +> +> Devices must have this policy configured by January 31, 2022, to remain enrolled in Update Compliance. Devices without this policy configured, including Windows 10 releases prior to version 1809 which do not support this policy, will stop appearing in Update Compliance reports after this date. This topic introduces the high-level steps required to enroll to the Update Compliance solution and configure devices to send data to it. The following steps cover the enrollment and device configuration workflow. From 8c301bbc8d1fbfd469239a6b9abb43605641d82b Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 13 Oct 2021 15:43:14 -0700 Subject: [PATCH 092/284] Update index.md --- windows/client-management/mdm/index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/index.md b/windows/client-management/mdm/index.md index a7236eea80..792bdcb30c 100644 --- a/windows/client-management/mdm/index.md +++ b/windows/client-management/mdm/index.md @@ -1,6 +1,6 @@ --- title: Mobile device management -description: Windows 10 provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy +description: Windows 10 and Windows 11 provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy MS-HAID: - 'p\_phDeviceMgmt.provisioning\_and\_device\_management' - 'p\_phDeviceMgmt.mobile\_device\_management\_windows\_mdm' @@ -15,9 +15,9 @@ author: dansimp # Mobile device management -Windows 10 provides an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users’ privacy on their personal devices. A built-in management component can communicate with the management server. +Windows 10 and Windows 11 provides an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users’ privacy on their personal devices. A built-in management component can communicate with the management server. -There are two parts to the Windows 10 management component: +There are two parts to the Windows management component: - The enrollment client, which enrolls and configures the device to communicate with the enterprise management server. - The management client, which periodically synchronizes with the management server to check for updates and apply the latest policies set by IT. From 5d111d7f0f0de24bfa1b9eb66668c46e5bb168b4 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 14 Oct 2021 11:35:22 +0100 Subject: [PATCH 093/284] final_updates --- windows/privacy/toc.yml | 2 +- windows/privacy/windows-10-and-privacy-compliance.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml index af35fd6f4f..25fc676681 100644 --- a/windows/privacy/toc.yml +++ b/windows/privacy/toc.yml @@ -37,7 +37,7 @@ href: windows-diagnostic-data-1703.md - name: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy href: enhanced-diagnostic-data-windows-analytics-events-and-fields.md - - name: Manage Windows connection endpoints + - name: Manage Windows connected experiences items: - name: Manage connections from Windows operating system components to Microsoft services href: manage-connections-from-windows-operating-system-components-to-microsoft-services.md diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index a9a8a0ecca..0930e7356b 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -46,7 +46,7 @@ The following table provides an overview of the Windows 10 and Windows 11 privac > [!NOTE] > This table is limited to the privacy settings that are most commonly available when setting up a current version of Windows 10 or newer. For the full list of settings that involve data collection, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -| Feature/Setting | Description | Supporting Content | Privacy Statement | +| Feature/Setting | Description | Supporting content | Privacy statement | | --- | --- | --- | --- | | Diagnostic Data |

    Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft to quickly identify and address issues affecting its customers.

    Diagnostic data is categorized into the following:

    • **Required diagnostic data**
      Required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](./required-windows-diagnostic-data-events-and-fields-2004.md).
    • **Optional diagnostic data**
      Optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](./windows-diagnostic-data.md).

    | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

    [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | | Inking & typing | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | @@ -82,7 +82,7 @@ The following table provides an overview of the privacy settings discussed earli > [!NOTE] > This is not a complete list of settings that involve managing data collection or connecting to connected experiences in Windows. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -| Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | +| Connected experience /setting | GP/MDM documentation | Default state if the setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
    **Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

    MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
    **Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

    MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later and Windows 11) | Off | From b9601479b32f556843bc249f70b074af20fd3444 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 14 Oct 2021 16:30:06 +0500 Subject: [PATCH 094/284] Update enroll-a-windows-10-device-automatically-using-group-policy.md --- ...roll-a-windows-10-device-automatically-using-group-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index c9f13235e0..8c53bccf46 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -214,7 +214,7 @@ Requirements: If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain. -6. Wait for the SYSVOL DFSR replication to be completed and then restart the Domain Controller for the policy to be available. +6. Wait for the SYSVOL DFSR replication to be completed for the policy to be available. This procedure will work for any future version as well. From 3a1a328871814a1eba09911934a532369292e7c3 Mon Sep 17 00:00:00 2001 From: Jaime Ondrusek Date: Thu, 14 Oct 2021 08:51:26 -0700 Subject: [PATCH 095/284] Update deployment-service-overview.md Small updates for style; corrected article cross-link. --- windows/deployment/update/deployment-service-overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/deployment-service-overview.md b/windows/deployment/update/deployment-service-overview.md index 28854e1093..6064c7ae15 100644 --- a/windows/deployment/update/deployment-service-overview.md +++ b/windows/deployment/update/deployment-service-overview.md @@ -29,7 +29,7 @@ The deployment service is designed for IT Pros who are looking for more control - You can stage deployments over a period of days or weeks by using rich expressions (for example, deploy 20H2 to 500 devices per day, beginning on March 14, 2021). - You can bypass pre-configured Windows Update for Business policies to immediately deploy a security update across your organization when emergencies arise. - You can benefit from deployments with automatic piloting tailored to your unique device population to ensure coverage of hardware and software in your organization. -- You can leverage safeguards against likely update issues, as identified by Microsoft machine learning algorithms, and automatically put the deployment on hold for any affected devices. +- You can use safeguards against likely update issues that have been identified by Microsoft machine-learning algorithms and automatically hold the deployment for any affected devices. The service is privacy focused and backed by leading industry compliance certifications. @@ -113,7 +113,7 @@ You should continue to use deployment rings as part of the servicing strategy fo ### Safeguard holds against likely and known issues -[Safeguard holds](https://docs.microsoft.com/windows/deployment/update/safeguard-holds) are a key technology Microsoft uses to protect devices from encountering known quality or compatibility issues, by preventing them from installing the update or upgrade. For Windows 11 deployments, the deployment service extends these safeguard holds to also protect devices that Microsoft identifies as being at a higher risk of experiencing post-update issues (such as OS rollbacks, app crashes, or graphics issues) and temporarily puts the deployment on hold for these devices while Microsoft investigates the likely issue. Safeguard holds apply to deployments by default, but you may opt out if desired. +Microsoft uses [safeguard holds](/windows/deployment/update/safeguard-holds) to protect devices from encountering known quality or compatibility issues by preventing them from installing the update or upgrade. For Windows 11 deployments, the deployment service extends these safeguard holds to also protect devices that Microsoft identifies as being at a higher risk of experiencing problems after an update (such as operating system rollbacks, app crashes, or graphics issues). The service temporarily holds the deployment for these devices while Microsoft investigates the likely issue. Safeguard holds apply to deployments by default, but you can opt out. ### Monitoring deployments to detect rollback issues From 96aeda368ae8bee88a87da963fbe2db7f5995cf0 Mon Sep 17 00:00:00 2001 From: Jaime Ondrusek Date: Thu, 14 Oct 2021 08:53:46 -0700 Subject: [PATCH 096/284] Update update-compliance-feature-update-status.md --- .../update/update-compliance-feature-update-status.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-feature-update-status.md b/windows/deployment/update/update-compliance-feature-update-status.md index f1909128aa..8fa81c9860 100644 --- a/windows/deployment/update/update-compliance-feature-update-status.md +++ b/windows/deployment/update/update-compliance-feature-update-status.md @@ -47,7 +47,7 @@ Microsoft uses diagnostic data to determine whether devices that use Windows Upd ### Queries for safeguard holds -Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. These queries show data for devices that are configured to send diagnostic data at *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included. +Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. These queries show data for devices that are configured to send diagnostic data at the *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included. The first query shows the device data for all devices that are affected by safeguard holds. The second query shows data specific to devices running the target build. From e8f82db2d96784d46d0ca4f27f199b9880c51086 Mon Sep 17 00:00:00 2001 From: Jaime Ondrusek Date: Thu, 14 Oct 2021 08:54:56 -0700 Subject: [PATCH 097/284] Update update-compliance-get-started.md Small adjustments. --- windows/deployment/update/update-compliance-get-started.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index ac348a38ed..db61a26720 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -44,7 +44,7 @@ Before you begin the process to add Update Compliance to your Azure subscription - **Compatible operating systems and editions**: Update Compliance works only with Windows 10 or Windows 11 Professional, Education, and Enterprise editions. Update Compliance supports both the typical Windows 10 or Windows 11 Enterprise edition, as well as [Windows 10 Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq). Update Compliance only provides data for the standard Desktop Windows client version and is not currently compatible with Windows Server, Surface Hub, IoT, or other versions. - **Compatible Windows client servicing channels**: Update Compliance supports Windows client devices on the General Availability Channel and the Long-term Servicing Channel (LTSC). Update Compliance *counts* Windows Insider Preview devices, but does not currently provide detailed deployment insights for them. -- **Diagnostic data requirements**: Update Compliance requires devices be configured to send diagnostic data at *Required* level (previously *Basic*). Select queries within Update Compliance require devices to be configured to send diagnostic data at *Optional* level (previously *Full*) for Windows 11 devices or *Enhanced* level for Windows 10 devices. To learn more about what's included in different diagnostic levels, see [Diagnostics, feedback, and privacy in Windows](https://support.microsoft.com/windows/diagnostics-feedback-and-privacy-in-windows-28808a2b-a31b-dd73-dcd3-4559a5199319). +- **Diagnostic data requirements**: Update Compliance requires devices to send diagnostic data at *Required* level (previously *Basic*). Some queries in Update Compliance require devices to send diagnostic data at *Optional* level (previously *Full*) for Windows 11 devices or *Enhanced* level for Windows 10 devices. To learn more about what's included in different diagnostic levels, see [Diagnostics, feedback, and privacy in Windows](https://support.microsoft.com/windows/diagnostics-feedback-and-privacy-in-windows-28808a2b-a31b-dd73-dcd3-4559a5199319). - **Data transmission requirements**: Devices must be able to contact specific endpoints required to authenticate and send diagnostic data. These are enumerated in detail at [Configuring Devices for Update Compliance manually](update-compliance-configuration-manual.md). - **Showing device names in Update Compliance**: For Windows 10, version 1803 or later, device names will not appear in Update Compliance unless you individually opt-in devices by using policy. The steps to accomplish this is outlined in [Configuring Devices for Update Compliance](update-compliance-configuration-manual.md). From 63609d921a0b0c0092ea8863049c7e23270b9faa Mon Sep 17 00:00:00 2001 From: Jaime Ondrusek Date: Thu, 14 Oct 2021 09:19:34 -0700 Subject: [PATCH 098/284] Revert "Add content on safeguards" --- .../deployment/update/deployment-service-overview.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/deployment/update/deployment-service-overview.md b/windows/deployment/update/deployment-service-overview.md index 6064c7ae15..546749d1dd 100644 --- a/windows/deployment/update/deployment-service-overview.md +++ b/windows/deployment/update/deployment-service-overview.md @@ -29,7 +29,6 @@ The deployment service is designed for IT Pros who are looking for more control - You can stage deployments over a period of days or weeks by using rich expressions (for example, deploy 20H2 to 500 devices per day, beginning on March 14, 2021). - You can bypass pre-configured Windows Update for Business policies to immediately deploy a security update across your organization when emergencies arise. - You can benefit from deployments with automatic piloting tailored to your unique device population to ensure coverage of hardware and software in your organization. -- You can use safeguards against likely update issues that have been identified by Microsoft machine-learning algorithms and automatically hold the deployment for any affected devices. The service is privacy focused and backed by leading industry compliance certifications. @@ -53,6 +52,7 @@ Using the deployment service typically follows a common pattern: 2. The chosen tool conveys your approval, scheduling, and device selection information to the deployment service. 3. The deployment service processes the content approval and compares it with previously approved content. Final update applicability is determined and conveyed to Windows Update, which then offers approved content to devices on their next check for updates. + The deployment service exposes these capabilities through Microsoft [Graph REST APIs](/graph/overview). You can call the APIs directly, through a Graph SDK, or integrate them with a management tool such as Microsoft Endpoint Manager. ## Prerequisites @@ -74,6 +74,7 @@ Additionally, your organization must have one of the following subscriptions: - Windows Virtual Desktop Access E3 or E5 - Microsoft 365 Business Premium + ## Getting started To use the deployment service, you use a management tool built on the platform, script common actions using PowerShell, or build your own application. @@ -86,6 +87,7 @@ Microsoft Endpoint Manager integrates with the deployment service to provide Win The Microsoft Graph SDK includes a PowerShell extension that you can use to script and automate common update actions. For more information, see [Get started with the Microsoft Graph PowerShell SDK](/graph/powershell/get-started). + ### Building your own application Microsoft Graph makes deployment service APIs available through. Get started with these learning paths: @@ -111,17 +113,14 @@ This built-in piloting capability complements your existing ring structure and p You should continue to use deployment rings as part of the servicing strategy for your organization, but use gradual rollouts to add scheduling convenience and additional protections within each ring. -### Safeguard holds against likely and known issues - -Microsoft uses [safeguard holds](/windows/deployment/update/safeguard-holds) to protect devices from encountering known quality or compatibility issues by preventing them from installing the update or upgrade. For Windows 11 deployments, the deployment service extends these safeguard holds to also protect devices that Microsoft identifies as being at a higher risk of experiencing problems after an update (such as operating system rollbacks, app crashes, or graphics issues). The service temporarily holds the deployment for these devices while Microsoft investigates the likely issue. Safeguard holds apply to deployments by default, but you can opt out. - ### Monitoring deployments to detect rollback issues During deployments of Windows 11 or Windows 10 feature updates, driver combinations can sometimes result in an unexpected update failure that makes the device revert to the previously installed operating system version. The deployment service can monitor devices for such issues and automatically pause deployments when this happens, giving you time to detect and mitigate issues. + ### How to enable deployment protections -Deployment scheduling controls are always available, but to take advantage of the unique deployment protections tailored to your population, devices must share diagnostic data with Microsoft. +Deployment scheduling controls are always available, but to take advantage of the unique deployment protections tailored to your organization, devices must share diagnostic data with Microsoft. #### Device prerequisites @@ -175,6 +174,7 @@ Follow these suggestions for the best results with the service. Avoid using different channels to manage the same resources. If you use Microsoft Endpoint Manager along with Microsoft Graph APIs or PowerShell, aspects of resources (such as devices, deployments, updatable asset groups) might be overwritten if you use both channels to manage the same resources. Instead, only manage each resource through the channel that created it. + ## Next steps To learn more about the deployment service, try the following: From 2515c5784a919ec7fdca66ebd90c4687ffd9bdf8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 14 Oct 2021 09:36:36 -0700 Subject: [PATCH 099/284] Update enroll-a-windows-10-device-automatically-using-group-policy.md --- ...ll-a-windows-10-device-automatically-using-group-policy.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 8c53bccf46..58d590e4b2 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -5,8 +5,8 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman -ms.date: 06/02/2021 +author: dansimp +ms.date: 10/14/2021 ms.reviewer: manager: dansimp --- From b1619045ffbec8088992768de3d22a1f2ebb2b4a Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 11:48:52 -0700 Subject: [PATCH 100/284] Applied valid slugs for labeling code blocks The complete list is here: https://review.docs.microsoft.com/en-us/help/contribute/metadata-taxonomies?branch=master#dev-lang --- .../troubleshoot-tcpip-port-exhaust.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index d3a3ceb2db..10fbfe6f45 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -39,7 +39,7 @@ You can view the dynamic port range on a computer by using the following netsh c The range is set separately for each transport (TCP or UDP). The port range is now a range that has a starting point and an ending point. Microsoft customers who deploy servers that are running Windows Server may have problems that affect RPC communication between servers if firewalls are used on the internal network. In these situations, we recommend that you reconfigure the firewalls to allow traffic between servers in the dynamic port range of **49152** through **65535**. This range is in addition to well-known ports that are used by services and applications. Or, the port range that is used by the servers can be modified on each server. You adjust this range by using the netsh command, as follows. The above command sets the dynamic port range for TCP. -```cmd +```console netsh int set dynamic start=number num=range ``` @@ -107,7 +107,7 @@ You may also see CLOSE_WAIT state connections in the same output, however CLOSE_ 4. Open a command prompt in admin mode and run the below command - ```cmd + ```console Netsh trace start scenario=netconnection capture=yes tracefile=c:\Server.etl ``` @@ -121,7 +121,7 @@ The key is to identify which process or application is using all the ports. Belo Start by looking at the netstat output. If you are using Windows 10 or Windows Server 2016, then you can run the command `netstat -anobq` and check for the process ID which has maximum entries as BOUND. Alternately, you can also run the below Powershell command to identify the process: -```Powershell +```powershell Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending ``` @@ -165,7 +165,7 @@ Finally, if the above methods did not help you isolate the process, we suggest y As a workaround, rebooting the computer will get the it back in normal state and would help you resolve the issue for the time being. However, when a reboot is impractical, you can also consider increasing the number of ports on the machine using the below commands: -```cmd +```console netsh int ipv4 set dynamicport tcp start=10000 num=1000 ``` @@ -176,7 +176,7 @@ This will set the dynamic port range to start at port 10000 and to end at port 1 For Windows 7 and Windows Server 2008 R2, you can use the below script to collect the netstat output at defined frequency. From the outputs, you can see the port usage trend. -``` +```console @ECHO ON set v=%1 :loop From 05d50c14123517ecb7105d86d7fdd53b3ed691a9 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 11:52:51 -0700 Subject: [PATCH 101/284] Corrected indentation of images & second-level list items These images should have been indented as part of their respective second-level list items. For this to work correctly, though, the second-level list items also needed to be laid out correctly, and that often doesn't happen unless the list items rely on automatic numbering (1, 1, 1) instead of specifying the enumeration (a, b, c). --- .../client-management/troubleshoot-tcpip-port-exhaust.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index 10fbfe6f45..a09a0c7ea4 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -82,13 +82,13 @@ If you suspect that the machine is in a state of port exhaustion: 2. Open event viewer and under the system logs, look for the events which clearly indicate the current state: - a. **Event ID 4227** + 1. **Event ID 4227** - ![Screenshot of event id 4227 in Event Viewer.](images/tcp-ts-18.png) + ![Screenshot of event id 4227 in Event Viewer.](images/tcp-ts-18.png) - b. **Event ID 4231** + 1. **Event ID 4231** - ![Screenshot of event id 4231 in Event Viewer.](images/tcp-ts-19.png) + ![Screenshot of event id 4231 in Event Viewer.](images/tcp-ts-19.png) 3. Collect a `netstat -anob` output from the server. The netstat output will show you a huge number of entries for TIME_WAIT state for a single PID. From 2503158cabfdfc6ba9ee37c1d035161ecde678ce Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 11:59:13 -0700 Subject: [PATCH 102/284] Added lightbox functionality to some images These images aren't easy to read. Lightbox allows the images to be viewed in an expanded window. --- .../client-management/troubleshoot-tcpip-port-exhaust.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index a09a0c7ea4..b7b25c7d2d 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -58,7 +58,7 @@ Since outbound connections start to fail, you will see a lot of the below behavi - Unable to sign in to the machine with domain credentials, however sign-in with local account works. Domain sign-in will require you to contact the DC for authentication which is again an outbound connection. If you have cache credentials set, then domain sign-in might still work. - ![Screenshot of error for NETLOGON in Event Viewer.](images/tcp-ts-14.png) + :::image type="content" alt-text="Screenshot of error for NETLOGON in Event Viewer." source="images/tcp-ts-14.png" lightbox="images/tcp-ts-14.png"::: - Group Policy update failures: @@ -84,11 +84,11 @@ If you suspect that the machine is in a state of port exhaustion: 1. **Event ID 4227** - ![Screenshot of event id 4227 in Event Viewer.](images/tcp-ts-18.png) + :::image type="content" alt-text="Screenshot of event ID 4227 in Event Viewer." source="images/tcp-ts-18.png" lightbox="images/tcp-ts-18.png"::: 1. **Event ID 4231** - ![Screenshot of event id 4231 in Event Viewer.](images/tcp-ts-19.png) + :::image type="content" alt-text="Screenshot of event ID 4231 in Event Viewer." source="images/tcp-ts-19.png" lightbox="images/tcp-ts-19.png"::: 3. Collect a `netstat -anob` output from the server. The netstat output will show you a huge number of entries for TIME_WAIT state for a single PID. @@ -157,7 +157,7 @@ Steps to use Process explorer: File \Device\AFD - ![Screenshot of Process Explorer.](images/tcp-ts-22.png) + :::image type="content" alt-text="Screenshot of Process Explorer." source="images/tcp-ts-22.png" lightbox="images/tcp-ts-22.png"::: 10. Some are normal, but large numbers of them are not (hundreds to thousands). Close the process in question. If that restores outbound connectivity, then you have further proven that the app is the cause. Contact the vendor of that app. From eacfe32e51fd32f391a9f3f6945be9871c4af381 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 12:02:03 -0700 Subject: [PATCH 103/284] Updated code block label to a valid value The complete list is here: https://review.docs.microsoft.com/en-us/help/contribute/metadata-taxonomies?branch=master#dev-lang --- windows/client-management/mandatory-user-profile.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 8b2e2bc3e9..5a566f1410 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -68,7 +68,7 @@ First, you create a default user profile with the customizations that you want, 1. At a command prompt, type the following command and press **ENTER**. - ```dos + ```console sysprep /oobe /reboot /generalize /unattend:unattend.xml ``` From e89a0f19ffc81e4d9846b4d3c3a80fbbbfaccddf Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 12:04:21 -0700 Subject: [PATCH 104/284] Indented images in second-level list items --- windows/client-management/mandatory-user-profile.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 5a566f1410..25245fa812 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -100,11 +100,11 @@ First, you create a default user profile with the customizations that you want, - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. - ![Example of Copy profile to.](images/copy-to-path.png) + ![Example of Copy profile to.](images/copy-to-path.png) - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. - ![Example of Copy To UI with UNC path.](images/copy-to-path.png) + ![Example of Copy To UI with UNC path.](images/copy-to-path.png) 1. Click **OK** to copy the default user profile. From 8ffec9b20f1f0249aa9b83b7f6f4370163cb069d Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 12:19:57 -0700 Subject: [PATCH 105/284] Indented note in a list item --- .../manage-device-installation-with-group-policy.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/manage-device-installation-with-group-policy.md b/windows/client-management/manage-device-installation-with-group-policy.md index cadcf9664a..8e177ae184 100644 --- a/windows/client-management/manage-device-installation-with-group-policy.md +++ b/windows/client-management/manage-device-installation-with-group-policy.md @@ -342,8 +342,8 @@ Getting the right device identifier to prevent it from being installed: > ClassGuid = {4d36e979-e325-11ce-bfc1-08002be10318}\ > This class includes printers. -> [!NOTE] -> As mentioned before, preventing an entire Class could block you from using your system completely. Please make sure you understand which devices are going to be blocked when specifying a Class. For our scenario, there are other classes that relate to printers but before you apply them, make sure they are not blocking any other existing device that is crucial to your system. + > [!NOTE] + > As mentioned before, preventing an entire Class could block you from using your system completely. Please make sure you understand which devices are going to be blocked when specifying a Class. For our scenario, there are other classes that relate to printers but before you apply them, make sure they are not blocking any other existing device that is crucial to your system. Creating the policy to prevent all printers from being installed: From 746eb537749f49d492fbbc48a267a8f355fb26fc Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:01:19 -0700 Subject: [PATCH 106/284] Applied ordered list to sequential steps --- .../manage-device-installation-with-group-policy.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/manage-device-installation-with-group-policy.md b/windows/client-management/manage-device-installation-with-group-policy.md index 8e177ae184..4088d331ab 100644 --- a/windows/client-management/manage-device-installation-with-group-policy.md +++ b/windows/client-management/manage-device-installation-with-group-policy.md @@ -376,9 +376,9 @@ Creating the policy to prevent all printers from being installed: 1. If you have not completed step #9 – follow these steps: - - Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click “Uninstall device”. - - For USB printer – unplug and plug back the cable; for network device – make a search for the printer in the Windows Settings app. - - You should not be able to reinstall the printer. + 1. Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click “Uninstall device”. + 1. For USB printer – unplug and plug back the cable; for network device – make a search for the printer in the Windows Settings app. + 1. You should not be able to reinstall the printer. 2. If you completed step #9 above and restarted the machine, simply look for your printer under Device Manager or the Windows Settings app and see that it is no-longer available for you to use. From 3658e39021c2595afe94caf999f887a732128632 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:07:36 -0700 Subject: [PATCH 107/284] Correct slash location in self-closing BR tags --- .../hello-identity-verification.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 26a25c7342..1a9e16072a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -38,37 +38,37 @@ The table shows the minimum requirements for each deployment. For key trust in a > [!NOTE] > Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available. -| Key trust
    Group Policy managed | Certificate trust
    Mixed managed | Key trust
    Modern managed | Certificate trust
    Modern managed | +| Key trust
    Group Policy managed | Certificate trust
    Mixed managed | Key trust
    Modern managed | Certificate trust
    Modern managed | | --- | --- | --- | --- | -| Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**
    *Minimum:* Windows 10, version 1703
    *Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).
    **Azure AD Joined:**
    Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later | +| Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**
    *Minimum:* Windows 10, version 1703
    *Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).
    **Azure AD Joined:**
    Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later | | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level| Windows Server 2008 R2 Domain/Forest functional level |Windows Server 2008 R2 Domain/Forest functional level | | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | -| N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),
    and
    Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service | -| Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | +| N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),
    and
    Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service | +| Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | | Azure Account | Azure Account | Azure Account | Azure Account | | Azure Active Directory | Azure Active Directory | Azure Active Directory | Azure Active Directory | | Azure AD Connect | Azure AD Connect | Azure AD Connect | Azure AD Connect | | Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional for automatic MDM enrollment | Azure AD Premium, optional for automatic MDM enrollment | > [!Important] -> 1. Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
    -> **Requirements:**
    -> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
    +> 1. Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
    +> **Requirements:**
    +> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
    > Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 > -> 2. On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
    -> **Requirements:**
    -> Reset from settings - Windows 10, version 1703, Professional
    -> Reset above lock screen - Windows 10, version 1709, Professional
    +> 2. On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
    +> **Requirements:**
    +> Reset from settings - Windows 10, version 1703, Professional
    +> Reset above lock screen - Windows 10, version 1709, Professional
    > Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 ## On-premises Deployments The table shows the minimum requirements for each deployment. -| Key trust
    Group Policy managed | Certificate trust
    Group Policy managed| +| Key trust
    Group Policy managed | Certificate trust
    Group Policy managed| | --- | --- | | Windows 10, version 1703 or later | Windows 10, version 1703 or later | | Windows Server 2016 Schema | Windows Server 2016 Schema| From f57263c1a54e3e1826d6b43db7f435bd36d4eb63 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:09:31 -0700 Subject: [PATCH 108/284] Add bullets to vertical lists --- .../hello-identity-verification.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 1a9e16072a..065df8dd49 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -54,15 +54,15 @@ The table shows the minimum requirements for each deployment. For key trust in a > [!Important] > 1. Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
    -> **Requirements:**
    -> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
    -> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 +> **Requirements:** +> - Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903 +> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 > > 2. On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
    -> **Requirements:**
    -> Reset from settings - Windows 10, version 1703, Professional
    -> Reset above lock screen - Windows 10, version 1709, Professional
    -> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 +> **Requirements:** +> - Reset from settings - Windows 10, version 1703, Professional +> - Reset above lock screen - Windows 10, version 1709, Professional +> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 ## On-premises Deployments From 2a14c0b54de61760c79f38009ff9e24409be42d1 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:11:41 -0700 Subject: [PATCH 109/284] Replace numbers with bullets in unordered list --- .../hello-identity-verification.md | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 065df8dd49..641d92045a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -53,16 +53,18 @@ The table shows the minimum requirements for each deployment. For key trust in a | Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional for automatic MDM enrollment | Azure AD Premium, optional for automatic MDM enrollment | > [!Important] -> 1. Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
    -> **Requirements:** -> - Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903 -> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 +> - Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models. > -> 2. On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
    -> **Requirements:** -> - Reset from settings - Windows 10, version 1703, Professional -> - Reset above lock screen - Windows 10, version 1709, Professional -> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 +> **Requirements:** +> - Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903 +> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 +> +> - On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models. + +> **Requirements:** +> - Reset from settings - Windows 10, version 1703, Professional +> - Reset above lock screen - Windows 10, version 1709, Professional +> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 ## On-premises Deployments From 86f28739efab1a49050d1e284e437c25fae93787 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:14:09 -0700 Subject: [PATCH 110/284] Add lightbox functionality for legibility --- .../identity-protection/hello-for-business/hello-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index b191dbc916..72fda09ca8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -70,7 +70,7 @@ In Windows 10, Windows Hello replaces passwords. When the identity provider sup >[!NOTE] >Windows Hello as a convenience sign-in uses regular user name and password authentication, without the user entering the password. -![How authentication works in Windows Hello.](images/authflow.png) +:::image type="content" alt-text="How authentication works in Windows Hello." source="images/authflow.png" lightbox="images/authflow.png"::: Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. From cae6cc2ccd6124169492945c64cfa242e890eaea Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:15:05 -0700 Subject: [PATCH 111/284] Add blank lines for readability --- .../hello-for-business/hello-overview.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 72fda09ca8..33d820a1a7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -81,12 +81,19 @@ Windows Hello helps protect user identities and user credentials. Because the us ## How Windows Hello for Business works: key points - Windows Hello credentials are based on certificate or asymmetrical key pair. Windows Hello credentials can be bound to the device, and the token that is obtained using the credential is also bound to the device. + - Identity provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps the Windows Hello public key to a user account during the registration step. + - Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. + - Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (biometrics). The Windows Hello gesture does not roam between devices and is not shared with the server. Biometrics templates are stored locally on a device. The PIN is never stored or shared. + - The private key never leaves a device when using TPM. The authenticating server has a public key that is mapped to the user account during the registration process. + - PIN entry and biometric gesture both trigger Windows 10 to use the private key to cryptographically sign data that is sent to the identity provider. The identity provider verifies the user's identity and authenticates the user. + - Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. + - Certificate private keys can be protected by the Windows Hello container and the Windows Hello gesture. For details, see [How Windows Hello for Business works](hello-how-it-works.md). From c58fe7af5e8cb4d4d6e79e8517d7a00f4fa76404 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:16:27 -0700 Subject: [PATCH 112/284] Correct slash location in self-closing BR tags --- .../hello-for-business/hello-planning-guide.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index d0de57c65c..611f55ea0d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -74,19 +74,19 @@ The hybrid deployment model is for organizations that: - Use applications hosted in Azure Active Directory, and want a single sign-in user experience for both on-premises and Azure Active Directory resources > [!Important] -> Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
    -> **Requirements:**
    -> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
    +> Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
    +> **Requirements:**
    +> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
    > Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 ##### On-premises The on-premises deployment model is for organizations that do not have cloud identities or use applications hosted in Azure Active Directory. > [!Important] -> On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
    -> **Requirements:**
    -> Reset from settings - Windows 10, version 1703, Professional
    -> Reset above lock screen - Windows 10, version 1709, Professional
    +> On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
    +> **Requirements:**
    +> Reset from settings - Windows 10, version 1703, Professional
    +> Reset above lock screen - Windows 10, version 1709, Professional
    > Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 It's fundamentally important to understand which deployment model to use for a successful deployment. Some aspects of the deployment may have already been decided for you based on your current infrastructure. From ab5f819050520acff45c400cab109a4e06695328 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:17:54 -0700 Subject: [PATCH 113/284] Add bullets to vertical lists --- .../hello-for-business/hello-planning-guide.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 611f55ea0d..c8d18101d8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -75,19 +75,19 @@ The hybrid deployment model is for organizations that: > [!Important] > Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
    -> **Requirements:**
    -> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
    -> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 +> **Requirements:** +> - Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903 +> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 ##### On-premises The on-premises deployment model is for organizations that do not have cloud identities or use applications hosted in Azure Active Directory. > [!Important] > On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
    -> **Requirements:**
    -> Reset from settings - Windows 10, version 1703, Professional
    -> Reset above lock screen - Windows 10, version 1709, Professional
    -> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 +> **Requirements:** +> - Reset from settings - Windows 10, version 1703, Professional +> - Reset above lock screen - Windows 10, version 1709, Professional +> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 It's fundamentally important to understand which deployment model to use for a successful deployment. Some aspects of the deployment may have already been decided for you based on your current infrastructure. From 15e39694808a7d8ac40737f67c7129d36419e696 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:19:13 -0700 Subject: [PATCH 114/284] Removed unnecessary BR tags --- .../hello-for-business/hello-planning-guide.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index c8d18101d8..8aada054b6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -74,7 +74,8 @@ The hybrid deployment model is for organizations that: - Use applications hosted in Azure Active Directory, and want a single sign-in user experience for both on-premises and Azure Active Directory resources > [!Important] -> Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
    +> Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models. +> > **Requirements:** > - Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903 > - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 @@ -83,7 +84,8 @@ The hybrid deployment model is for organizations that: The on-premises deployment model is for organizations that do not have cloud identities or use applications hosted in Azure Active Directory. > [!Important] -> On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
    +> On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models. +> > **Requirements:** > - Reset from settings - Windows 10, version 1703, Professional > - Reset above lock screen - Windows 10, version 1709, Professional From 88129581d474fce062c5e20061069da4b290f681 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 14:26:24 -0700 Subject: [PATCH 115/284] Added missing angle bracket --- .../hello-for-business/hello-identity-verification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 641d92045a..92c2b72d61 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -60,7 +60,7 @@ The table shows the minimum requirements for each deployment. For key trust in a > - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 > > - On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models. - +> > **Requirements:** > - Reset from settings - Windows 10, version 1703, Professional > - Reset above lock screen - Windows 10, version 1709, Professional From 438a77ac54ba0fe6b72d1a469d1922f092089035 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 18:15:28 -0700 Subject: [PATCH 116/284] Corrected labels on code blocks to valid type Here's the list of valid types: https://review.docs.microsoft.com/en-us/help/contribute/metadata-taxonomies?branch=master#dev-lang --- ...tion-based-protection-of-code-integrity.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index 5d7ffa6cd9..d4507b1ee4 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -78,7 +78,7 @@ Set the following registry keys to enable HVCI. This provides exactly the same s Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock): -``` commands +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f @@ -94,49 +94,49 @@ If you want to customize the preceding recommended settings, use the following s **To enable VBS** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f ``` **To enable VBS and require Secure boot only (value 1)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f ``` **To enable VBS with Secure Boot and DMA (value 3)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 3 /f ``` **To enable VBS without UEFI lock (value 0)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f ``` **To enable VBS with UEFI lock (value 1)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 1 /f ``` **To enable virtualization-based protection of Code Integrity policies** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f ``` **To enable virtualization-based protection of Code Integrity policies without UEFI lock (value 0)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f ``` **To enable virtualization-based protection of Code Integrity policies with UEFI lock (value 1)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 1 /f ``` @@ -144,7 +144,7 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorE Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock): -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f @@ -158,31 +158,31 @@ If you want to customize the preceding recommended settings, use the following s **To enable VBS (it is always locked to UEFI)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f ``` **To enable VBS and require Secure boot only (value 1)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f ``` **To enable VBS with Secure Boot and DMA (value 3)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 3 /f ``` **To enable virtualization-based protection of Code Integrity policies (with the default, UEFI lock)** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f ``` **To enable virtualization-based protection of Code Integrity policies without UEFI lock** -``` command +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG_DWORD /d 1 /f ``` From 170846294085a37742491866ef21020c73bffa8b Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 18:21:44 -0700 Subject: [PATCH 117/284] Replace single BR tags with proper paragraph breaks --- ...able-virtualization-based-protection-of-code-integrity.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index d4507b1ee4..3bedae6d12 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -71,7 +71,10 @@ Set the following registry keys to enable HVCI. This provides exactly the same s > [!IMPORTANT] -> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled.
    In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled.
    +> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled. +> +> In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled. +> > - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers. #### For Windows 10 version 1607 and later From 0a7cdbac239f968c21cc84aa97b33cfd7a30c374 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 18:22:37 -0700 Subject: [PATCH 118/284] Corrected type label on code block --- ...irtualization-based-protection-of-code-integrity.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index 3bedae6d12..d75271bcad 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -294,12 +294,14 @@ C. If you experience a critical error during boot or your system is unstable aft ## How to turn off HVCI -1. Run the following command from an elevated prompt to set the HVCI registry key to off -```ini +1. Run the following command from an elevated prompt to set the HVCI registry key to off: + +```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f ``` -2. Restart the device. -3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. + +1. Restart the device. +1. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. ## HVCI deployment in virtual machines From dc63e23408a55038ee5a223fc6fd5ba9db6d2eb2 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 18:24:39 -0700 Subject: [PATCH 119/284] Add blank lines for consistent layout --- ...nable-virtualization-based-protection-of-code-integrity.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index d75271bcad..a19ca85753 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -54,8 +54,11 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP] ### Enable HVCI using Group Policy 1. Use Group Policy Editor (gpedit.msc) to either edit an existing GPO or create a new one. + 2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**. + 3. Double-click **Turn on Virtualization Based Security**. + 4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**. ![Enable HVCI using Group Policy.](../images/enable-hvci-gp.png) @@ -301,6 +304,7 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorE ``` 1. Restart the device. + 1. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. ## HVCI deployment in virtual machines From 7577992ae124c1ce3b7bc258382affcb04639a0b Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 18:25:18 -0700 Subject: [PATCH 120/284] Indent a code block in a list item --- ...ble-virtualization-based-protection-of-code-integrity.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index a19ca85753..e331616635 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -299,9 +299,9 @@ C. If you experience a critical error during boot or your system is unstable aft 1. Run the following command from an elevated prompt to set the HVCI registry key to off: -```console -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f -``` + ```console + reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f + ``` 1. Restart the device. From 5416ecd0192eb107b0ea6d06951c74b771daaf5a Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 18:33:44 -0700 Subject: [PATCH 121/284] Add lightbox functionality to image --- .../enable-virtualization-based-protection-of-code-integrity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index e331616635..a4fc2cfbe2 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -285,7 +285,7 @@ This field lists the computer name. All valid values for computer name. Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section. -![Windows Defender Device Guard properties in the System Summary.](../images/dg-fig11-dgproperties.png) +:::image type="content" alt-text="Windows Defender Device Guard properties in the System Summary." source="../images/dg-fig11-dgproperties.png" lightbox="../images/dg-fig11-dgproperties.png"::: ## Troubleshooting From ef9db012f5d9aa8d6e4699c39d8388f625e1ec35 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 19:29:41 -0700 Subject: [PATCH 122/284] Replaced single backticks with tripe to create labeled code block --- ...nable-virtualization-based-protection-of-code-integrity.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index a4fc2cfbe2..a7cdb8f8e9 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -196,7 +196,9 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG Windows 10 and Windows Server 2016 have a WMI class for related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: -`Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` +```powershell +Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard +``` > [!NOTE] > The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. From a8c5f1480a6c6d5cb67bcc4525172b56b03897b3 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 20:23:08 -0700 Subject: [PATCH 123/284] Acrolinx: "Powershell" --- windows/client-management/troubleshoot-tcpip-port-exhaust.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index b7b25c7d2d..772f2ec791 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -119,7 +119,7 @@ The key is to identify which process or application is using all the ports. Belo ### Method 1 -Start by looking at the netstat output. If you are using Windows 10 or Windows Server 2016, then you can run the command `netstat -anobq` and check for the process ID which has maximum entries as BOUND. Alternately, you can also run the below Powershell command to identify the process: +Start by looking at the netstat output. If you are using Windows 10 or Windows Server 2016, then you can run the command `netstat -anobq` and check for the process ID which has maximum entries as BOUND. Alternately, you can also run the below PowerShell command to identify the process: ```powershell Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending @@ -127,7 +127,7 @@ Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Pro Most port leaks are caused by user-mode processes not correctly closing the ports when an error was encountered. At the user-mode level ports (actually sockets) are handles. Both **TaskManager** and **ProcessExplorer** are able to display handle counts which allows you to identify which process is consuming all of the ports. -For Windows 7 and Windows Server 2008 R2, you can update your Powershell version to include the above cmdlet. +For Windows 7 and Windows Server 2008 R2, you can update your PowerShell version to include the above cmdlet. ### Method 2 From d97fae2a49c0fe1a2453a7011c6c85107f96e991 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 20:31:37 -0700 Subject: [PATCH 124/284] Indent multiple types of content in Step 3 --- .../troubleshoot-tcpip-port-exhaust.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index 772f2ec791..1267dad41f 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -94,16 +94,16 @@ If you suspect that the machine is in a state of port exhaustion: ![Screenshot of netstate command output.](images/tcp-ts-20.png) -After a graceful closure or an abrupt closure of a session, after a period of 4 minutes (default), the port used the process or application would be released back to the available pool. During this 4 minutes, the TCP connection state will be TIME_WAIT state. In a situation where you suspect port exhaustion, an application or process will not be able to release all the ports that it has consumed and will remain in the TIME_WAIT state. - -You may also see CLOSE_WAIT state connections in the same output, however CLOSE_WAIT state is a state when one side of the TCP peer has no more data to send (FIN sent) but is able to receive data from the other end. This state does not necessarily indicate port exhaustion. - ->[!Note] ->Having huge connections in TIME_WAIT state does not always indicate that the server is currently out of ports unless the first two points are verified. Having lot of TIME_WAIT connections does indicate that the process is creating lot of TCP connections and may eventually lead to port exhaustion. -> ->Netstat has been updated in Windows 10 with the addition of the **-Q** switch to show ports that have transitioned out of time wait as in the BOUND state. An update for Windows 8.1 and Windows Server 2012 R2 has been released that contains this functionality. The PowerShell cmdlet `Get-NetTCPConnection` in Windows 10 also shows these BOUND ports. -> ->Until 10/2016, netstat was inaccurate. Fixes for netstat, back-ported to 2012 R2, allowed Netstat.exe and Get-NetTcpConnection to correctly report TCP or UDP port usage in Windows Server 2012 R2. See [Windows Server 2012 R2: Ephemeral ports hotfixes](https://support.microsoft.com/help/3123245/update-improves-port-exhaustion-identification-in-windows-server-2012) to learn more. + After a graceful closure or an abrupt closure of a session, after a period of 4 minutes (default), the port used the process or application would be released back to the available pool. During this 4 minutes, the TCP connection state will be TIME_WAIT state. In a situation where you suspect port exhaustion, an application or process will not be able to release all the ports that it has consumed and will remain in the TIME_WAIT state. + + You may also see CLOSE_WAIT state connections in the same output, however CLOSE_WAIT state is a state when one side of the TCP peer has no more data to send (FIN sent) but is able to receive data from the other end. This state does not necessarily indicate port exhaustion. + + >[!Note] + >Having huge connections in TIME_WAIT state does not always indicate that the server is currently out of ports unless the first two points are verified. Having lot of TIME_WAIT connections does indicate that the process is creating lot of TCP connections and may eventually lead to port exhaustion. + > + >Netstat has been updated in Windows 10 with the addition of the **-Q** switch to show ports that have transitioned out of time wait as in the BOUND state. An update for Windows 8.1 and Windows Server 2012 R2 has been released that contains this functionality. The PowerShell cmdlet `Get-NetTCPConnection` in Windows 10 also shows these BOUND ports. + > + >Until 10/2016, netstat was inaccurate. Fixes for netstat, back-ported to 2012 R2, allowed Netstat.exe and Get-NetTcpConnection to correctly report TCP or UDP port usage in Windows Server 2012 R2. See [Windows Server 2012 R2: Ephemeral ports hotfixes](https://support.microsoft.com/help/3123245/update-improves-port-exhaustion-identification-in-windows-server-2012) to learn more. 4. Open a command prompt in admin mode and run the below command From ec0d5181e1a8589794f96e4241ee725923e6ab6d Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Fri, 15 Oct 2021 09:52:51 -0700 Subject: [PATCH 125/284] remove reference to whfb feedback --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index a11d68959d..3c1cb2a112 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -212,7 +212,7 @@ sections: - question: Does Windows Hello for Business work with third-party federation servers? answer: | - Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration).

    + Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience.

    | Protocol | Description | | :---: | :--- | From dbf11b4c9e094fb11be7f5363df7682dea3b631d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 15 Oct 2021 09:56:19 -0700 Subject: [PATCH 126/284] Update hello-faq.yml --- .../identity-protection/hello-for-business/hello-faq.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 3c1cb2a112..34170a5423 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -14,7 +14,7 @@ metadata: ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium - ms.date: 01/14/2021 + ms.date: 10/15/2021 ms.reviewer: title: Windows Hello for Business Frequently Asked Questions (FAQ) @@ -224,4 +224,4 @@ sections: - question: Does Windows Hello for Business work with Mac and Linux clients? answer: | Windows Hello for Business is a feature of the Windows platform. At this time, Microsoft is not developing clients for other platforms. - \ No newline at end of file + From f1ddfcf9944b9df9045b1d0491c5916ca0a3e5ea Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Sun, 17 Oct 2021 11:25:32 -0700 Subject: [PATCH 127/284] Update healthattestation-csp.md Addressed comments. Ready for Signoff --- .../mdm/healthattestation-csp.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index d8b7e7ed5a..5f1347d92d 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -14,7 +14,7 @@ ms.date: # Device HealthAttestation CSP -The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT admins to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions. +The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT adminstrators to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions. The following is a list of functions performed by the Device HealthAttestation CSP: @@ -39,7 +39,7 @@ The attestation report provides a health assessment of the boot-time properties **MAA-Session (Microsoft Azure Attestaiton service based device HealthAttestation session)**

    The Microsoft Azure Attestaiton service based device HealthAttestation session (MAA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.

    -**MAA-CSP (Microsoft Azure Attestaiton based Configuration Service Provider)** +**MAA-CSP Nodes (Microsoft Azure Attestaiton based Configuration Service Provider)**

    The Configuration Service Provider nodes added to Windhows 11 to integrate with Microsoft Azure Attestation Service.

    The following list of operations is performed by MAA-CSP:

      @@ -50,7 +50,7 @@ The attestation report provides a health assessment of the boot-time properties
    **MAA endpoint** -Microsoft Azure attestation service is an azure resource, and every intance of the service gets admin configured URL. The URI generated is unique in nature and for the puposes of device health attestation is known as the MAA endpoint. +Microsoft Azure attestation service is an azure resource, and every intance of the service gets adminintrator configured URL. The URI generated is unique in nature and for the puposes of device health attestation is known as the MAA endpoint. **JWT (JSON Web Token)** JSON Web Token (JWT) is an open standard RFC7519 method for securely transmitting information between parties as a JavaScript Object Notation (JSON) object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret or a public/private key pair. @@ -62,8 +62,8 @@ JSON Web Token (JWT) is an open standard RFC7519 method for securely transmittin

    Attestation flow can be broadly in three main steps:

      -
    • An instancne of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
      • -
    • The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrived.
      • +
    • An instance of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
      • +
    • The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrieved.
    • The MDM provider after verifying the token is coming from the attestation service it can parse the attestation token to reflect on the attested state of the device.
    The protocol implemented can be found here: Attestation Protocol @@ -98,7 +98,7 @@ HealthAttestation **TriggerAttestation** (Required)

    Node type: EXECUTE -This node will trigger attestation flow by launching an attestation process. If a process is already running, this node will return code 202 indicating the request is received and being processed. Otherwise, an error will be returned. +This node will trigger attestation flow by launching an attestation process. If the attestation process is launched successfully, this node will return code 202 indicating the request is received and being processed. Otherwise, an error will be returned.

    Templated SyncML Call:

    @@ -231,7 +231,8 @@ This node will retrieve the service generated correlation IDs for the given MDM If success: GUID returned by the attestation service: 1k9+vQOn00S8ZK33;CMc969r1JEuHwDpM If Trigger Attestation call failed and no previous data is present. The field remains empty. - Otherwise, the last service correlation id will be returned. + Otherwise, the last service correlation id will be returned. In a successful attestation there are two + calls between client and MAA and for each call the GUID is separated by semicolon. > **_Note:_** MAA CSP nodes are available on arm64 but is not currently supported. @@ -450,7 +451,7 @@ GetAttestReport return the signed attestation token as a JWT.The JWT can be deco More information about TPM attestation can be found here. Microsoft Azure Attestation

    -## Windhows 10 Device HealthAttestation +## Windows 10 Device HealthAttestation ### Terms From 3956c25ebca67b34e51d0667fe8d3a8809115967 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Mon, 18 Oct 2021 11:44:05 +0530 Subject: [PATCH 128/284] Update config-lock.md Updated CSP links --- windows/client-management/mdm/config-lock.md | 70 +++++++++++++++++--- 1 file changed, 62 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index 5cdbf0d2fb..e6e42754a5 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -19,22 +19,75 @@ ms.date: 10/07/2021 In an enterprise organization, IT administrators enforce policies on their corporate devices to keep the devices in a compliant state and protect the OS by preventing users from changing configurations and creating config drift. Config drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Windows 11 with Config Lock enables IT administrators to prevent config drift and keep the OS configuration in the desired state. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. -Secured-Core Configuration Lock (Config Lock) is a new Secured-Core PC (SCPC) feature that prevents configuration drift from Secured-Core PC features (shown below) caused by unintentional misconfiguration. In short, it ensures a device intended to be a Secured-Core PC remains a Secured-Core PC. +Secured-Core Configuration Lock (Config Lock) is a new [Secured-Core PC (SCPC)](/windows-hardware/design/device-experiences/oem-highly-secure) feature that prevents configuration drift from Secured-Core PC features (shown below) caused by unintentional misconfiguration. In short, it ensures a device intended to be a Secured-Core PC remains a Secured-Core PC. :::image type="content" source="../images/config-lock-mdsl.png" alt-text="mdsl"::: To summarize, Config Lock: -- Enables IT to “lock” a fixed set of configurations on Secured-Core PCs under MDM management -- Detects drift and quickly remediates -- Focuses on security features +- Enables IT to “lock” Secured-Core PC features when managed through MDM +- Detects drift remediates within seconds - DOES NOT prevent malicious attacks -## Flow +## Configuration Flow After a Secured-Core PC reaches the desktop, Config lock will prevent configuration drift as follows: -- Detect whether the device is a Secured-Core PC +Config Lock will prevent configuration drift by detecting if the device is a Secured-Core PC or not. When the device is not a Secured-Core PC, the lock will not apply. If the device is a Secured-Core PC, config lock will lock the policies listed here. + +**List of locked policies** + + +|Policies | +|---------| +|**CSPs** | +|[BitLocker ](bitlocker-csp.md) | +|[PassportForWork](passportforwork-csp.md) | +|[WindowsDefenderApplicationGuard](windowsdefenderapplicationguard-csp.md) | +|[ApplicationControl](applicationcontrol-csp.md) | +| | +|**MDM policies** | +|[DataProtection/AllowDirectMemoryAccess](policy-csp-dataprotection.md) | +|[DataProtection/LegacySelectiveWipeID](policy-csp-dataprotection.md) | +|[DeviceGuard/ConfigureSystemGuardLaunch](policy-csp-deviceguard.md) | +|[DeviceGuard/EnableVirtualizationBasedSecurity](policy-csp-deviceguard.md) | +|[DeviceGuard/LsaCfgFlags](policy-csp-deviceguard.md) | +|[DeviceGuard/RequirePlatformSecurityFeatures](policy-csp-deviceguard.md) | +|[DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md) | +|[DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md) | +|[DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md) | +|[DeviceInstallation/PreventDeviceMetadataFromNetwork](policy-csp-deviceinstallation.md) | +|[DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](policy-csp-deviceinstallation.md) | +|[DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md) | +|[DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md) | +|[DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md) | +|[DmaGuard/DeviceEnumerationPolicy](policy-csp-dmaguard.md) | +|[WindowsDefenderSecurityCenter/CompanyName](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableNotifications](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/Email](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/Phone](policy-csp-windowsdefendersecuritycenter.md) | +|[WindowsDefenderSecurityCenter/URL](policy-csp-windowsdefendersecuritycenter.md) | +|[SmartScreen/EnableAppInstallControl](policy-csp-smartscreen.md)| +|[SmartScreen/EnableSmartScreenInShell](policy-csp-smartscreen.md) | +|[SmartScreen/PreventOverrideForFilesInShell](policy-csp-smartscreen.md) | + - If so, prevent the following Secured-Core PC features from being disabled without IT Admin permission: - Memory Access Protection (kDMA) - Memory Integrity (HVCI) @@ -65,7 +118,7 @@ Helpdesk scenario: Config Lock will be available for all Windows Professional and Enterprise Editions. -## Enabling +## Enabling Config Lock using Microsoft Intune Config Lock isn't enabled by default (or turned on by the OS during boot). Rather, an IT Admin must intentionally turn it on. @@ -106,6 +159,7 @@ Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally m ## FAQ **Can an IT Admin disable Config Lock ?**
    - Yes. IT Admin can use MDM to turn off Config Lock. + Yes. IT Admin can use MDM to turn off Config Lock.
    + **Could an end-user run the BuiltAsSecuredCorePC PowerShell command to disable Config Lock?**
    The PowerShell script is accessible, but the BuiltAsSecuredCorePC becomes read-only after boot, so the command will fail when run from the OS. From dbe0a69c2c68ddf035667badaf55b7ee223858d9 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Mon, 18 Oct 2021 14:38:43 +0530 Subject: [PATCH 129/284] Update config-lock.md Removed unwanted para --- windows/client-management/mdm/config-lock.md | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index e6e42754a5..2e215d289d 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -31,9 +31,7 @@ To summarize, Config Lock: ## Configuration Flow -After a Secured-Core PC reaches the desktop, Config lock will prevent configuration drift as follows: - -Config Lock will prevent configuration drift by detecting if the device is a Secured-Core PC or not. When the device is not a Secured-Core PC, the lock will not apply. If the device is a Secured-Core PC, config lock will lock the policies listed here. +After a Secured-Core PC reaches the desktop, Config Lock will prevent configuration drift by detecting if the device is a Secured-Core PC or not. When the device is not a Secured-Core PC, the lock will not apply. If the device is a Secured-Core PC, config lock will lock the policies listed here. **List of locked policies** @@ -88,19 +86,12 @@ Config Lock will prevent configuration drift by detecting if the device is a Sec |[SmartScreen/EnableSmartScreenInShell](policy-csp-smartscreen.md) | |[SmartScreen/PreventOverrideForFilesInShell](policy-csp-smartscreen.md) | -- If so, prevent the following Secured-Core PC features from being disabled without IT Admin permission: - - Memory Access Protection (kDMA) - - Memory Integrity (HVCI) - - System Guard - - DRTM - - SMM - :::image type="content" source="images/flow_configlock.png" alt-text="config lock flow."::: IT Admin scenario: -1. IT Admin use MDM to enable Config Lock -1. IT Admin use MDM service to set policies +1. IT Admins use MDM to enable Config Lock +1. IT Admins use MDM service to set policies 1. Policies are targeted to user/device 1. Policies come down to device and get set 1. Configurations are locked From fb3e49244f4b19235b697104f8970963abb303f8 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Mon, 18 Oct 2021 15:05:19 +0530 Subject: [PATCH 130/284] Update config-lock.md Acrolinx comments fix --- windows/client-management/mdm/config-lock.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index 2e215d289d..b5f3e187c6 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -31,7 +31,7 @@ To summarize, Config Lock: ## Configuration Flow -After a Secured-Core PC reaches the desktop, Config Lock will prevent configuration drift by detecting if the device is a Secured-Core PC or not. When the device is not a Secured-Core PC, the lock will not apply. If the device is a Secured-Core PC, config lock will lock the policies listed here. +After a Secured-Core PC reaches the desktop, Config Lock will prevent configuration drift by detecting if the device is a Secured-Core PC or not. When the device isn't a Secured-Core PC, the lock won't apply. If the device is a Secured-Core PC, config lock will lock the policies listed here. **List of locked policies** From b1d10ae022211c97e94f715a4578e8e7c95e85c4 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Mon, 18 Oct 2021 16:43:10 +0530 Subject: [PATCH 131/284] Update config-lock.md Minor correction --- windows/client-management/mdm/config-lock.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/config-lock.md b/windows/client-management/mdm/config-lock.md index b5f3e187c6..e34ef24e89 100644 --- a/windows/client-management/mdm/config-lock.md +++ b/windows/client-management/mdm/config-lock.md @@ -31,7 +31,7 @@ To summarize, Config Lock: ## Configuration Flow -After a Secured-Core PC reaches the desktop, Config Lock will prevent configuration drift by detecting if the device is a Secured-Core PC or not. When the device isn't a Secured-Core PC, the lock won't apply. If the device is a Secured-Core PC, config lock will lock the policies listed here. +After a Secured-Core PC reaches the desktop, Config Lock will prevent configuration drift by detecting if the device is a Secured-Core PC or not. When the device isn't a Secured-Core PC, the lock won't apply. If the device is a Secured-Core PC, config lock will lock the policies listed below. **List of locked policies** From ac938e1d57ee55e5b29c3d85a0f050922505067c Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Mon, 18 Oct 2021 17:24:18 -0400 Subject: [PATCH 132/284] Added Windows Insiders info --- windows/application-management/apps-in-windows-10.md | 7 +++++-- windows/whats-new/windows-11-whats-new.md | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 1af4b54568..9b4a7a117c 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -73,9 +73,12 @@ There are different types of apps that can run on your Windows client devices. T ## Android apps -Starting with Windows 11, users can use the Microsoft Store to search, download, and install Android apps. This feature uses the Windows Subsystem for Android, and allows users to interact with Android apps, just like others apps installed from the Microsoft Store. +Starting with Windows 11, users in the [Windows Insider program](https://insider.windows.com/) can use the Microsoft Store to search, download, and install Android apps. This feature uses the Windows Subsystem for Android, and allows users to interact with Android apps, just like others apps installed from the Microsoft Store. -For more information on Android apps and the Windows Subsystem for Android, see [Windows Subsystem for Android developer information](/windows/android/wsa). +For more information, see: + +- [Windows Subsystem for Android](https://support.microsoft.com/windows/abed2335-81bf-490a-92e5-fe01b66e5c48) +- [Windows Subsystem for Android developer information](/windows/android/wsa) ## Add or deploy apps to devices diff --git a/windows/whats-new/windows-11-whats-new.md b/windows/whats-new/windows-11-whats-new.md index 81f1509081..cc1d121e6d 100644 --- a/windows/whats-new/windows-11-whats-new.md +++ b/windows/whats-new/windows-11-whats-new.md @@ -138,11 +138,14 @@ For more information on the security features you can configure, manage, and enf ## Use your same apps, and new apps, improved -- Starting with Windows 11, users can download and install **Android apps** from the Microsoft Store. This feature is called the **Windows Subsystem for Android**, and allows users to use Android apps on their Windows devices, similar to other apps installed from the Microsoft Store. +- Starting with Windows 11, users in the [Windows Insider program](https://insider.windows.com/) can download and install **Android apps** from the Microsoft Store. This feature is called the **Windows Subsystem for Android**, and allows users to use Android apps on their Windows devices, similar to other apps installed from the Microsoft Store. Users open the Microsoft Store, install the **Amazon Appstore** app, and sign in with their Amazon account. When they sign in, they can search, download, and install Android apps. - For more information, see [Windows Subsystem for Android developer information](/windows/android/wsa). + For more information, see: + + - [Windows Subsystem for Android](https://support.microsoft.com/windows/abed2335-81bf-490a-92e5-fe01b66e5c48) + - [Windows Subsystem for Android developer information](/windows/android/wsa) - Your Windows 10 apps will also work on Windows 11. **[App Assure](https://www.microsoft.com/fasttrack/microsoft-365/app-assure)** is also available if there are some issues. From 03e8420ba6622c5653c05e49edd3f37413b14589 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Tue, 19 Oct 2021 13:19:21 +0530 Subject: [PATCH 133/284] Add CongigLock node in DMClient CSP Task 5499285: update the DMClient CSP document to add the 3 new nodes used by Config Lock. --- windows/client-management/mdm/dmclient-csp.md | 27 ++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index b8ddb3ffeb..e2b23b7bf3 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -22,7 +22,7 @@ The following shows the DMClient CSP in tree format. ./Vendor/MSFT DMClient ----Provider --------- +--------ProviderID ------------EntDeviceName ------------ExchangeID ------------EntDMID @@ -45,6 +45,10 @@ DMClient ------------HWDevID ------------ManagementServerAddressList ------------CommercialID +------------ConfigLock +----------------Lock +----------------UnlockDuration +----------------SecureCore ------------Push ----------------PFN ----------------ChannelURI @@ -598,6 +602,27 @@ Optional. Boolean value that allows the IT admin to require the device to start Supported operations are Add, Get, and Replace. +**Provider/*ProviderID*/ConfigLock** + +Configuration Drift is a major concern for commercial customers. Some customers view it as a security risk. This node mitigates the customer concern by bringing the capability to monitor and quickly remediate the policy configuration when a device is MDM managed. + +Default = Locked + +> [!Note] +>If the device is not Secure Core, then this feature will not work. + +**Provider/*ProviderID*/ConfigLock/Lock** + +Supported operations are Add, Delete, Get. Supported values are 0-unlock, 1-lock. + +**Provider/*ProviderID*/ConfigLock/UnlockDuration** + +Supported operations are Add, Delete, Get. Supported values are 1 to 480 (in min). + +**Provider/*ProviderID*/ConfigLock/SecureCore** + +Supported operation is Get only. Supported values are false or true. + **Provider/*ProviderID*/Push** Optional. Not configurable during WAP Provisioning XML. If removed, DM sessions triggered by Push will no longer be supported. From 0ba9b970c011f571fe4ad8172301bc9f21a17b5f Mon Sep 17 00:00:00 2001 From: Mandi Ohlinger Date: Tue, 19 Oct 2021 10:44:51 -0400 Subject: [PATCH 134/284] ADO 5506051: Added ConfigureChatIcon CSP to supported list https://office.visualstudio.com/MAX/_workitems/edit/5506051 --- windows/configuration/supported-csp-taskbar-windows.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/configuration/supported-csp-taskbar-windows.md b/windows/configuration/supported-csp-taskbar-windows.md index 2d7577e32a..61d963827c 100644 --- a/windows/configuration/supported-csp-taskbar-windows.md +++ b/windows/configuration/supported-csp-taskbar-windows.md @@ -35,6 +35,10 @@ For more general information, see [Configuration service provider (CSP) referenc - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not allow pinning programs to the Taskbar` - Local setting: None +- [Experience/ConfigureChatIcon](/windows/client-management/mdm/policy-csp-experience#experience-configurechaticonvisibilityonthetaskbar) + - Group policy: `Computer Configuration\Administrative Templates\Windows Components\Chat` + - Local setting: Settings > Personalization > Tasbkar + ## Existing CSP policies that Windows 11 doesn't support The following list includes some of the CSP policies that aren't supported on Windows 11: From a3ffb5dc202aafdd1a4486d1c4d206960a3935c3 Mon Sep 17 00:00:00 2001 From: Mandi Ohlinger Date: Tue, 19 Oct 2021 11:04:44 -0400 Subject: [PATCH 135/284] Typo --- windows/configuration/supported-csp-taskbar-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/supported-csp-taskbar-windows.md b/windows/configuration/supported-csp-taskbar-windows.md index 61d963827c..1605544834 100644 --- a/windows/configuration/supported-csp-taskbar-windows.md +++ b/windows/configuration/supported-csp-taskbar-windows.md @@ -37,7 +37,7 @@ For more general information, see [Configuration service provider (CSP) referenc - [Experience/ConfigureChatIcon](/windows/client-management/mdm/policy-csp-experience#experience-configurechaticonvisibilityonthetaskbar) - Group policy: `Computer Configuration\Administrative Templates\Windows Components\Chat` - - Local setting: Settings > Personalization > Tasbkar + - Local setting: Settings > Personalization > Taskbar > Chat ## Existing CSP policies that Windows 11 doesn't support From ef4e99945651c2c8655952b9f7bcc1294eeaf89c Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 19 Oct 2021 21:56:18 +0500 Subject: [PATCH 136/284] Update configure-authorized-apps-deployed-with-a-managed-installer.md --- ...-apps-deployed-with-a-managed-installer.md | 42 ++----------------- 1 file changed, 3 insertions(+), 39 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md index 26506a422a..ccdc08e421 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -177,45 +177,9 @@ An example of a valid Managed Installer rule collection, using Microsoft Endpoin ``` -### Enable service enforcement in AppLocker policy -Since many installation processes rely on services, it is typically necessary to enable tracking of services. -Correct tracking of services requires the presence of at least one rule in the rule collection. So, a simple audit-only rule will suffice. The audit rule can be added to the policy created above, which specifies the rule collection of your managed installer. - -For example: - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` +>[!NOTE] +>Since many installation processes rely on services, it is typically necessary to enable tracking of services. Correct tracking of services requires the presence of at least one rule in the rule collection. So, a simple audit-only rule will suffice. ## Enable the managed installer option in WDAC policy @@ -305,4 +269,4 @@ Once you've completed configuring your chosen Managed Installer, by specifying w ```powershell Get-AppLockerPolicy -Effective -Xml -ErrorVariable ev -ErrorAction SilentlyContinue ``` - This command will show the raw XML to verify the individual rules that were set. \ No newline at end of file + This command will show the raw XML to verify the individual rules that were set. From 8b1ab25bec847805cf2ff3922905b8c02dcc5a4c Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Tue, 19 Oct 2021 11:13:13 -0700 Subject: [PATCH 137/284] add new line --- .../identity-protection/hello-for-business/hello-faq.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 48601dc7d6..3a019e09e4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -228,3 +228,4 @@ sections: - question: Does Windows Hello for Business work with Azure Active Directory Domain Services (Azure AD DS) clients? answer: | No, Azure AD DS is a separately managed environment in Azure, and hybrid device registration with cloud Azure AD is not available for it via Azure AD Connect. Hence, Windows Hello for Business does not work with Azure AD. + From ddb95ff7aa85393337d60e634fc4382885c56e7e Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Tue, 19 Oct 2021 11:22:44 -0700 Subject: [PATCH 138/284] Update hello-faq.yml --- .../identity-protection/hello-for-business/hello-faq.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 3a019e09e4..213b9c9999 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -227,5 +227,6 @@ sections: Windows Hello for Business is a feature of the Windows platform. At this time, Microsoft is not developing clients for other platforms. - question: Does Windows Hello for Business work with Azure Active Directory Domain Services (Azure AD DS) clients? - answer: | No, Azure AD DS is a separately managed environment in Azure, and hybrid device registration with cloud Azure AD is not available for it via Azure AD Connect. Hence, Windows Hello for Business does not work with Azure AD. + answer: | + No, Azure AD DS is a separately managed environment in Azure, and hybrid device registration with cloud Azure AD is not available for it via Azure AD Connect. Hence, Windows Hello for Business does not work with Azure AD. From bedf23c6b018ee6cc0fa3f922b2b2bc67af6df41 Mon Sep 17 00:00:00 2001 From: Mandi Ohlinger Date: Tue, 19 Oct 2021 14:43:15 -0400 Subject: [PATCH 139/284] Added TM --- windows/application-management/apps-in-windows-10.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 9b4a7a117c..2584b8cb49 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -71,9 +71,9 @@ There are different types of apps that can run on your Windows client devices. T Using an MDM provider, you can create shortcuts to your web apps and progressive web apps on devices. -## Android apps +## Android™️ apps -Starting with Windows 11, users in the [Windows Insider program](https://insider.windows.com/) can use the Microsoft Store to search, download, and install Android apps. This feature uses the Windows Subsystem for Android, and allows users to interact with Android apps, just like others apps installed from the Microsoft Store. +Starting with Windows 11, users in the [Windows Insider program](https://insider.windows.com/) can use the Microsoft Store to search, download, and install Android™️ apps. This feature uses the Windows Subsystem for Android, and allows users to interact with Android apps, just like others apps installed from the Microsoft Store. For more information, see: From d6f789301f7f84dc66d2eb5abbb6f2dc491b80ee Mon Sep 17 00:00:00 2001 From: Mandi Ohlinger Date: Tue, 19 Oct 2021 14:43:56 -0400 Subject: [PATCH 140/284] =?UTF-8?q?Added=20=E2=84=A2=EF=B8=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- windows/whats-new/windows-11-whats-new.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-whats-new.md b/windows/whats-new/windows-11-whats-new.md index cc1d121e6d..bbabcba6b9 100644 --- a/windows/whats-new/windows-11-whats-new.md +++ b/windows/whats-new/windows-11-whats-new.md @@ -67,7 +67,7 @@ For more information on the security features you can configure, manage, and enf ## Easier access to new services, and services you already use -- **Windows 365** is a desktop operating system that's also a cloud service. From another internet-connected device, including Android and macOS devices, you can run Windows 365, just like a virtual machine. +- **Windows 365** is a desktop operating system that's also a cloud service. From another internet-connected device, including Android™️ and macOS devices, you can run Windows 365, just like a virtual machine. For more information, see [What is Windows 365 Enterprise?](/windows-365/overview). From 54632cda8321740c86d6ae8abe64bbfb8f18ddff Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 19 Oct 2021 11:50:01 -0700 Subject: [PATCH 141/284] Added white background for dark mode There are other possible solutions to make this figure usable in dark mode, but changing the background from transparent to white was expedient. I also adjusted the border sizes around the figure. --- .../mdm/images/maa-attestation-flow.png | Bin 81911 -> 82960 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/client-management/mdm/images/maa-attestation-flow.png b/windows/client-management/mdm/images/maa-attestation-flow.png index 5bd288d0aeb9a5ae32344d19f58903e61da0db4f..ac91ff242ad81299da2ed826dafd4d2e29728109 100644 GIT binary patch literal 82960 zcmeFZXH-*Lw?7>9D93`RC?H5tL{O>}ksceMbU}KRCS6MC&EpXZQUvK;q(cypme3S1 zAP7<;gn;xC2+}3AckLbJJZIc{|KINY^k(Qtva|MDbIvvAZ??60uCA&;dx-fE0)e2t zt$6b;0zp%WKpf!v^8mQwIwx@oyd8X~sOO462-iXX_wZQg6Tn3px7#YWXvPoGpAcfw zXg*CrAUF`WZ(h^#Oq?Z}yfj?#690jlrLe0LZmJB^qV4UKwc?o$k0M{{s1C1SH9PWh zxe9Jtc7J}$GxH_ED(P^1@UsNsp`5$-jw8MIpLn6Ae{W|09GcJIE0JkG;~z?qWzJQl z_jom~D}8AEzEbNYIAw1YHo225GMO0Hu26i!eOqQpYO)nQ;gdX>pR1kM11N-EfhQ^i z=J!%RBT_Z5JO283=SCAP^&`^e&&oa2k36(z#ee;tadr$60C=T}{yjkbgm@hk&O-ed z*m=xlAN8X;^Z!37RTBR@GBp1CJ`)imC0{ncdi=P! z^iR(=>V_lTweRKi*bd%8xQz_#NS*HvI$A&sQ2Yk(bsh4A%f2Tb+f!XdKWALMV)kU5 zpM^Ks^lQZharFm#9d+Xxby9+t6jIu-M_`^5L&8~j`1Xjuz44Vg1;=qP#rf|+ZU-^2 z(lDJwH`AVMYkWe#FuY_k{c}6rz{6UX_9S7v%gGJ3!@}-&q1T=esUZeW7hc^_br_+D zS$5j_wkivT;xK|T7xEwPI794F$^-1B_6&dIZI`5~DUVpv05a`8X@tS?hFy~K^{-!G zB9L*FfLxwAOvV0zul?~3J|mwLQf$0Z4i`!jvTWgnIQ*_VrmE|Q=o@2q!UI_(-&qlo zb+J3@gO>2m$P0fDAZ-SId>{3SL1c8ycvb?T%4$>XWEzqZL{Jw&zMM=p=MrMlXB969 zrJ4qh@L6&7L!1WWHtZkpT!=$RU`qQwH=l*S9y#~FY(tmhJ@z1OJwz?|8eUz%JCD!G zHAd}RWpy5Rc{$+g^K!sNAs@Te;!LE_-ngewuYd0T7-RXTCToAL-nsRHnqDf8>YQT- zf(Dd}Ah7lQfuZM|l=D{Mj&nX?MLiS6x7{MwpdhFwzw$U` zOkbfz-{1WbG>oriHK}4dt-fg0l}5O5Kg@h;aySc()e?QGTq6u4 zS(x-08I8jl@g}yc5Ak}NgC?IE1Cms#LtA#X+qhBh4^?caE8t7D@``>^l)#p)DBDt@ z?7__@+9L%@+_fw^Lq=0Sw{?bgoDC^vl;Ooj_G$(l|IPMFe1|6gygHT#1aVV9$YM^B|?8YWo{k)V3 zlU3uP*Sn8vQ4x(=zS~0Cs5xWjKKtb@ z158Yyy!?^?fU)oo3IsOcB z8Z(kNn|a2g%}pR{V2uz!xvu51 zmaL(v{|+#C0M?0D&uw;OZRj3+ZICyb(c?_@ueZ3z4%{(c=$RZD`S`r5CGaD*;^8?4 z6F>Cy8~_=z`7huU0I0)5s#(@;A;|e|^GagUo&+D}9;u(K?Oc?F96(AgtoebRO z30+6kKMuoz4Rt3hcWx58g+>_ay;pFmV?eFbyt1 z0s#XKd>YAX|Ltl1%**Yu6`MbYm@zWEdYoN$Cn|K_>8(UPI^j7DL|uMg8F&3J_%}%R zVnl?yO%H7s&H43`~P?B+hkOWw%SpGU*6?ln$lyjIPkrfCxHvDLO1rWbL z)uMe1*^x+%dtS%c0hT(^!9Ml#a@>iJ86a`MTd@IoWZ8RE+NbHEQMTQS{aa5dV3YB` z98>czSK9P9aHSzEY`)U-CsIZARiqz?eLe##&oYW@UO{df?-#T?<`ehPmTdiK8@pM82TxF2!yLr>$9^KgR+E~;eb zq|WxJTSHXKWtXM7%PuXfMdU$29Ev1<u+ams``ao-q#&Xv;8)!V@5`66JBH+J2+?2jilGEM`kAn z2=)%`_{4QP4}Yl*2{TT9QL*fdM!D%Lt!(-@Zx_}a*Jd z7bmg)txW|fO0}T|^L#g1k5~6}wn$R_*76<5CB91VSRTLZkg^mlbqF}5qJR0zp7Map zXsnGZZp~!na7w6{$3TidYx&%BlD~})8MUm{qLN?^oKow*$k#71cgn9`8xEbXT|G>P zix!-pR75Gs-EB`zf#PqzcX0=H{HdV+p0`_FV;kD+;s-#Qfm=@hB<2cc-9 z#N63zb-ltD#3YO4>1TN{=3^5C^RejmPn4~IW1Ql|crR9xy9~eqLXr=w3Z$iKP9Yub z1E)!!*yap=Ih7S)O2;o3FGN=ii`TsJIQ=At^NnsP)#|!Ij7qg07Q-XxPI#3b4S3+;MUvIqsqE z(ms&jp6p#uSHpo!WX$Nm>p}3|0KQKeQ62Bw>tH}9GywRRaiarAUV_|*-VFwGp<}<( zsBY4Q?^oK+yvh3?e9YJ2(hVq#As_F(mZYkBtn$a_l2B@rd`E>F%2KXl0CDET7&iLO zYlkPdhti^nL<}|K<`KaI=Wj`MD_5>;`foV?N_==BcVB?1z?0>=ad%P&s1kwqFHrf< z%150Q!yjJ;!4W`>4WJC@79njq3R5~Ph&$s45xN-va~XkUM9 ziUyLRI`_c6z*pA=y14uaPyAT%f4L;^5{gWY8yZQoGpcT)3?(+yoX6!<6$~rSaEcGH zah4ApCy}>Y49orN)q6VLML%O&Z!EaH7-#Yv<>Q}M_}dHt_h}wx{*toE>m}LSYwgin zn==8)&z0n^GBX-)s2c8&0?q(Se{I7Wyt7ER(9sg9vGtuBpipsiO418xSa2Z-O9Q4J z=5Gx=YPF-vA{&HZLH)QPpNq2F*qmoGJq#Wc4p~Zq-1C|BwfkFJwK2C@83#8BAo|UD zro=v}uaH%$)n3auxiiD!ys{b4NbzBB%m3w+&Vy|Y>IL4xd|@R509uG#znw_4tfHN^56{+xD zP$+DSV&8Fvkr;c}d3|i*-|0@C+?ED#5u1_hnI<@FV>aiTa((pXvc-WYDvF3+fXK=a zaRT0k*LqSUJAGra^$nEYOk1*2#o)~a4Ve-Qs3GBA4p1tWNfj$?AT#MO;IGc-gr`9k zLQadh(o4aFt!q`nsWSZ->gLJ3-}{uTzb?^()A;dA;_0E6bGR|b$9W0jUX7$lo3G+`5w~JruRlhKI87K)=|b!mf~p6|EBZ-iia|*Plstr(1|`?G#pHZ8 zx@lUrH_&q|=J-&RtxHhsVafwJng^#aMzUM-?7WXYe6QFu#TT0_he8jVPcky^RI$Rv z4rCbs9@yiE#!3Y&Peb6eVR-y?7eH6wW!y+)uuymyV`h6putMAFiWs}ZJBg#(Wy>pK zklF>kf&%PfvQn7X|KO6?`&>NO^Y%31K75Y;R_SnqTE+?A15ol3ln6w#<_gV1zRB#| zULnzB%FN^jvm0py0{W@2dp)+L@gBz!E0PDN&z<{~3}n%rx+X#OPQy@*2t*Q>oRWOy zYPRR*t+yrRqo6HX4g;?8?OKgZqOirV=8(4th`=dm_G@devdHbr>k#cfB}P9#x{g`s zuwE3{bD#}4C-Ba}h;_Grp>Wi`ZFarH7lw2+Fs$D$?A7J*x_45#eGz(04$2Z>5@Y}* zXAF?qeq#9EJ>qrTKsXI;4lH;5RE^*yWDCI4p*hIYfr^^^H(D8}`UjlC={@4eq^ugs zdiP^^8H(M#QvHGnqd$<`ZR~!M=tM6O5Fv2R-%b4rYFVKu6K_7K9OrQn@npHTd2N(5 zwC#VX9W|D-q3Oj2C_zX<=_r(e#cc0Dilf{7&=&RP1IXq4^8bzpQ3DS6y64Z1Iqq}g zC`jFSwJ*Ua5^{H`?I3h=o2zyj1W|{YU(0P8#OwOQUDhLwoYtCN=>F2m{ct+d#{vRB zP?nbN-aBpl7a7PX6kF!>vRuvYm>`=3cKOUwR$F7+9LwKCh?>)#&9q3oo69~S#hO*d z`G(Dpm1wreDh7{q^h2uCD+U>3svU@q4ycG<^T_)_c`_|>Ibdd>crq8|H{V}$F-jj+ zu_Whl1fuTiM)l58%fgCNKtN-==HXhCSXuhxMWUZK0hLDO5FZ>|l9hX=KwgMA&|$zm z;Y=fas=7Rj9?SpOo@i_TyWJ6GMb)z)cUF zpsFzf@!|n6=7p?)pLr0|a^(J+BEdqv!^QLcHJ1lvSFTlgj?Id(4t|7`$MoAYBul_Q z(*?*B+~>Z%CXiTQ8s8;`vjn0KR_;mNq3%oy2pwRm#&9SskZ_QpeL zOnflksmhS*s(|3>|RjwfTBrtt>2UmpM~jr@tYhW-fHWl+hy z3vUdf`^0Idu z5&V@7x(fJ2ELy#W5GMT8S@Ajq*b&4nDhHiFbC{5Tt<(op4m!{MzR=|60m+RQSQd4} z5qQgyf)J_M_nNBRchY3FI}<>-Z0DT-Rl>rkyof_p#K3I`$Cd=r3bcXF3VB9cTLqYJ z+%?P(OU@Qd0!-&Rf0L|kU$N-tDhBsj&#`>!1UGLQ#sK#O$aVW=Or75rpQ-&t-e3bN@Zrb-;9CNYEi^s)!G+q!eAN9+x1RbI@x4U?RywP(U=f})u!${ zkY3z_Q+Fc@i=PgR%73>HJBe&$tv zGmkS;rOw^o?yme+>Gv2$1xjm$3p54_I{s5qV^C8CfiTLZ!+JOpjva3)By0hP<%&KA zt{x!d+Lr2n!TyQpTp1Lfcl0K}{^_lFj9M+oeboF&U!Z2rSK}=d*3J;d^=aMci8bxEyC`=F!0Ys2nDv6aE>H8|Zrwf-?@O-v-2UfXWMKC{ZnnhYiNJ@T0#i z>SPQ&g*Lzhp+HEz8}at9*MC{*;w32RI|T3yyh*sg+cOmkj0Rl%2&2sd>TmlwA^QlN zfbBzFovL%C)Ngw+5KZ6dVR7;tH-k*P9uy718kC^7bet_g4dt8D#`hb)lF2`ZG8GxYOWa?1=g$k4C|dK zl8Pz6(!(2dFx3a1z&r#!gLn^wg^H*<1_OIwF@!USy6`R{pa~fVFBbR=CPe)x%!BD^ zSg24h4N(2{E3knu5CXv9pQ;YiiZp;lpnej*A=Ug}unz;$awJT`R6J}Y;f(NH@6N%u zeN}^R<2dyZ(m={JSUPV%!=x8OxClD=k+WpT2xkXsu0e)`gd!O5HUZ0sgP*#tlQ9Sp zpqK=N9vLYzE~c&nK$T}fV1fG#M)Mq|a^Qg`KvRI!2vIK0Z}R&r0JwyPr%Pp_PInBZ z+zpf-z|ALLz{d9e+?Z9Ws3eIU@q*kZH+ZUitB?iMz7dCR!_Mb6e%uHQMj%CKcnwCH zG}i=CE(*S#!+ziGhKy!@0#-~broaqSz^lCk?gcqX-DIjmLP*~Gx3|ChT_#}0@Hf*! z-(T`V@xmSJf7@T(F(LFBaGmMTf64v7xZAh4VNQ;m#LodjnCxLLO--u-M(KTHUAX-n zMtvSZSV}@aVD2ANj~*PMg>~RFRsD}}!B#a+-J76zNUc&0;T=JkK`M^agUSbx9FCuV zJj)oCSe;o917NruaHrs<0!LHo(l7~uSKy@@fe!;eO@+fMGDcnM>ppm?br8XT-|_?D zrD~~5T@->slT^81-@Hj<8;~oHenONgcX*aW5dRah#JiyG1a5752JatK_y^xCX8)g_ zI@Omtr{4$$3Xga}RDww5jk?2SWo32l+CCJwSM)RgoT1f{l9D2)p_)YAy*%Qu zki1>tkn^!wPwqXXol8-72FJtG^qZQ0czu6F6TQ9j?VE0B6yit_1i>JdkCCk8l%4(| zyBmW(! z@*y$ODeA?F;)60d%Tn18V>QO}M+$Rta$@7-ZGZNC zFTw2C65gz0UB30u42+JBI?T(7i{qD_iugo*s#QZ1til{t)-3clZt3-2lt|wEFKoVj5aacksN35;|n4rE43^~v-Wn9W_k?QVW+s_DgpYPk%*t!8-wM;?Cf3kN_( zvhQMZsKPbIIS)LCy9+l~oAX6Ec}rAGtdy^N)`CAGEGK4lrHaL&(9t;WUO^HQJ9`*+ zvgezuA)=)*cR(S+q6H3I(PBbL1H7o8KZcd1P{E(Y#IP|FE8JO`nfCiQ&iS)RqL$(w z{`_I4$u8`^`E#L4iRZOBE|h;`J}PKSL_{RV9XIJ0G8GpW$Hc;-v{k{^FUeKD5ve9y z`DSuoYAL0SOd*r?t;@*(hD@12YYwUX35OefM8o#LlTc)iix2wK+}u3JqeaMbVq)U% zwCbZWTQ)lvOE1L^hB96gM|F%XZbO zR8_~&Yd}kpZBMS&TIrjDuCcMPPUmsgKU3vwlL#ITLrhL76jPg*UN;*yb6ksDH{b}p z?km%`aBNR@Q$OS1Up{?oYi+%marg9#R3CSDcfEJQQc?-#VvYB9ZaFq^C;8d@%ifG>g^v9AL2MREBE7^Uavn32?#Mi9)7m|C`U@+<*Ibh-ASfU&eo zF9g-5JV#b47X3C>8<&^e>P^dgUkOjG&Jh@UY*EuGg4`?wtjB!uj_PR3_xB(7rVcP0 zm8BZ-Xm89q_L|+n0CS4*S36pN@Zp!Y61mcS`;$NMkjLgH#^%X@oit(o9eTY-b#%%6yj<@N|ne9y7^6?)SnKBZLH4OF}a0>gwWpls^Sy!F*AzH z(k%G+X{pFDT}NNvsyu;FP-Aeu_2apyLKL^!tp4=4RK&28F?XP{nwm+;mC}RPs(BVA zEf>me?rY~WeIOsz5(*@8W@}Q-EP{Fi{DRdeieG8aBRC{ic*<$>2u5iayud| zD(C1)js7l$3l}a#KluQ5ns?@|K<9JwFMpAZPx>WoZtYc<2EHL0<)P5fS&FrT;q5W9 z$;f)B#t-j%(PsIan2kGMhQ#72L~-I&byUV#^M?K-oruW3*sPwFN0bFGD06~_4% z0MJNQLp&(mvYSu8o0I?GyzQJAvrGUsAj!5=#@i@m%=NvGT2lVKl2XM{-IftuvO6ut zt6*%>aq)as{Zl&e0d8%KYBM6wgj=UnvQ69Nh{vVML1L9LcF4%asU>P#7TuG$>TT^M zeV$9|l@x2v(4ECU3XQQzfb9)0ezFyF($zk@t45h97Z)Dn<({X+6(X_poxykDnP1;U zA#XMm2LK$-k-?9RStx`hBqml(6n)tS8eZ;;?(6G2RhzZ2uuwM7sppzCk8*ckjh~!f zsV>XqE|{FtUM#g`c8GB-?H6b!^gAp$mfaBCxa;E6&4z!#%DhE#3$R_**PGo}jn;`K zyiFLzbok6KuP_(fcpyoNI!e74NL6g%xWx9y&i*R z*&|5*=Sg?Rn4(0cBex&do(Ue74sCA0;d<&KPwkBaa*fP$xRcE=2Mz zW{z3ao$^-fgb&bwPoF+XlF!G-#n}+nqZ^s6&W5}iw{eW&PVp_y3Pl$c6(wWUfKS8W zIputRKE$!UuXYRQS$(AHh8b{=hthl`7g zp1K>r{LpdQDAD6;it`ZAtim0I|y71)IODG%=?CGAvBc z?|8ByR({lbjZ7r;H1)|7a<;`-_9rA&sixCkwYBSNmQ~Nuy6^3cA@!5iimcjYWMyk+ zg%5lg#C3Ofi_O=TU70Jpg&j?Q1;iV4P1}LUTpiO-675$_l14{TC|-PP#RramS&M-n zZ+3RJSdxUlR4Ldk=a>)4hE!h~(OLVXmt)H_ z-(IP?(KHhXDhjTZr#x+5Q6l|a^XB5BB+y(zLU|~=TylTWAIMdx!U(FV8KxUhnPR(V z?+*|>ctwL&&{y4>kg@6KCl$EdMJ`E8$QDN~q=c}QbV~MD%a;^I6GM5`db`k>6v_DN zc0T+&o#r)N!7p>2m7qG4M=XpiwHJK>fT6=S zVA^tHburn;E6IxRrq5jJH1E)t(f(;%(ZHOK%`$V+_6%vo1Xt z{Bn=2^QWl7%r@X*rWB+ z)6*FO#beoD`dzImgY>?YI}M4keoL~C8S_y|$NJyDe-8K+ss5VgwolJi(|;z!B_`VU zuj3#1NqPa?Vy363XGI05K%nnmAYXUEq*jB*S|y#50)mz3mGe$1U^rIAn-~@W!hm%B zf-8pQV6RID+T&SkLsp~Q7p0?dIGlk$gIK>#7u){iAo&ecHBejKQrmm@Qt|$PggFth zFTkR326QD=cxLm8$Boa|+5>84dBPK8W1j(?3Np!EH3v%XD+qBL(`w@oSK3kov)!E{&ku!UmYRLG z6}W6dsT6<#9lVg*0kb5>1gj5ruR_PqeRi!bkz|XQzZe|;p3weCp1b!*{WE*gA4oYk z(Nwp%PCli0;4abE=9^7j-;@NwZ#ZeQSTc{K>Au9ZR^zw9TodD;Z^q!=C!pts_pr+_ zu@4IiW1MJNP%RH|!7g`R8_G3sIXcjGrey)BRUB$gbxC>iZz^!Oa1+{r{MugC7M zrne9nXkFr;j~tN0$^_{MYgjOiR}WgsvPGoqoBL}mDp6O{>Xu>FwfR&UQ?GAELqwy) zSg3}LWCLZc)O_as)>tWwGWnDm2Z+&Sy>rsM_%@C z#!q$cqm%yHF$$DI%INW!-SW~2n(BD4TOinqO-QhlEc3Rqx&Y$yuF$Qq?YBKKfIvg6|1$ zITzEVPCt;C6kix4t78TCgZqRx?iO|^j#`;mWiIUZ;cQk-egARETMuoE?QJIu4u zV>FbVd@X!pV~Xp&175?RT`ai8gOAY&6y)^25id=Zu~J&R3zZlDPPE#yb4NCPDf-ip zW&Jx<#7UF6e&B4SMkeuO2B<)>#WCiX8rhM$bq3#WFY2D2!d+`B=u&Rfr!d%y)*C<@ zNaT?zZ$ZeAAynOZtpy|_XXN~)Ls_Mw`!^IFv$T^6L;h;ePSb1GJQDn$a`p(DJ zb|#+O3XnE56R|9;UGdDQ*3zsRyVO9h#^+P}Wza`FrNgV`{s!%cDG=Z)&2#ZLBeA{flHj|mtEP?K?iDZ!Qh7@i!O2Ku8 zx2jFVN2=GGK>z~$namEUY(pSSNX$;J(2OA-)rVJdch2fFG9gI{xV|&eJUmkpvDxVd zROKkU>=}r@9p-BP@<*iES^M^lhb832;)|n2hF3y*dGbaT0((sAYX+NZjUoaF=kZw` z2ib2$_f8U03+WN#rFOW?s~~z+NX7(QoJ}^l$_RQkEHpK%MrNRn6V80r<0IIav-|2D z>${)b54*&EzFA-c1P3nDJKR!voze@beJfrdYcY3mDYgmJy%}|9Jbudqq`nupxf6mu z5e*GQC4_6}LEd;-N{aVk#ydlk82{S`=JZr)6}RW^vNW1RO2?%)rF5(W(7kmC?>!j! z;T}6&c|CVu@7r#DkVoXK$Mtl<^DIvqy$nT4dYTsf!!D_fZXNxMQedeL>u3DZEEv}% zy}(gf*o(2|zHs3V>aQE=^h#FN*5=;clE8OrZ#HfMcTqg2e)tQNWwCLWn)(5^o{lG5 z|J2la?7~O)*m$+w;^_nZpkYegE&X}n+y3ZY{~@lO-iwRR*+TrwGmM-x@HzI8eX^k+Si9BaZ`(>XH%p<^*4HYQzHg1@?{V_txO zdK4FC?LTtO#e|;}^Eu>ts_0tC*b+Y3hw6t4r;p8F(G?_NvTW2t$BS?Klf|WM(v1Z< zzih1NiTuf}@Y<#t+cD1^QK(}OIp)oZi)22 z(rpOk5;A>Uw{hS~+2dQYZyiTO!^)h^xhrja5=7U^a^@7gmnu+{maWorC?}`+LKT8S zSA)2cQ+#6||4R>~=Z6Cp=KG4z|8b(fyyFTvU4MljtR`} zO6TAnMfkDnjz*H-2Z8T@Nl?LG8+EG?E6ptQU&#waZ%Frb(>)liuBFF$V9=RbXKrvS zuU&J!RO9(jqVI%s8`oHWsh!T<6!R__v?{tj9$h?MDoxM*R}T>jlKhu8^ePcNzo3uUh&0b}#KR+kOdA8-y z^uxpv3C2B$hZiI3$<0I}y_xtUsC*iz)I1&Tv$MSgR>r?)kHyj7k)=$fGx{N_L2Oa+ zcS*o;LR7*_+*}ckO^V&!guE(n>W$H7x3k~IYi5gl*2p#{)+iK8q>y zI@8oJ7u`~w(rO{g-r^=ZSR&SS{&bchc}RHrM`Ka*g*LOU>UPP~qFI!ymWvw<2##vF zK!-rS8ORZ+ySTEl5;Oa!&-VJH^^px*TicOs)AbgU?ZsQ=rGVs~?(RgoE8GDU#wI3m zlShmD`}+?&n%m;uMP`x>Fh95Nbg_>r?XS+c8l)O)V^~3NA|2~JusYkvSudnzVBk{| zO`%X)WQQ~z2xShrIXRW7pPIvV#x{frI6shB$I#+3+0vWs5_)@k+kP^sdaz%RW9w{e zA9f2cwBj@{ZlTXS{Itwz$bb8C($Bv-fEX}E3D+hdf)5B!FJIcVm zNbF2DZ^ZegWMT%~BKu;=RT2yONxq3$hgaymwpu66ln`yd&VOAK|b_(;pN0AZA|KELSuAGf?Q^>XSoT)mlVIG!@-TpK|DY zvkq%#w8*W|(>|T3cN?A>XWO|+#$|-wtGdvun{rVxKQAw#tp3U?R}Bp6!i7tK{YaIy z#$<~FOCm|_qkU>sCZ93gOCp0?S5I|A^6WR4)-l1qU_v-kvxr82uZN4(rdvk_F zVl7-iW6ANWOl`}U+hsS~Od^fQEgH?QKaYx{;?*%p^?ML;4ldvLwM|HN{mq2eot z`1o?g;z3Y|$So+iXJkaomwlJ?r@Ixs6`4>jI81lVI@eiNR=prEPbpg}yR1yR%%NR( z&6oW~ma>Oo;u%eS9UaEC%Xv9DuN(+A>wA_PM%fF2@o+63Tqy`UT54H=7$Tjh|14xCrV38%idP_19hK`k7ve~mGu_sgD(P=^Zot$K0q^F z`*9#j&a9rR98`USvlyvSt*&*gPFZq3Vl7MK#5fzlm^XHm6RAEBu`+niz(8tr$+c`FmUOwM+shu~J>lYbXSpb`WvQ)f za?-OMM=~p$tj}5V6DVB2*?wc8N=^9+amhS0#bP_*d}L_X-<6vQG>E{;pS@jKvvix& z+lT#YR+e+LVxVIerfjFnlDOs`BZL~aw>AWslai(`I?X6rsKy~&dH@s&PJLI!70txT zX{OLENxWf21RhlDEzM24m>M)ux89-)w*#AK^|0VLud-OetFMSa*UV79lrU7~tC~zS zPNj|(q4?yvPy+Q_!$5uf0HRpi&u=TSY^XLMAmY-Vz*cdwugUOufEKRXYZhp0Iz*kl zaz3GY?Kwd}zuae%k?tMbi4T7Q+FxTYacn+(K!J@z8P+b)C&r%)So982IJM3Ze7%7QyLGgBUbVvL>-1Hug* z?6Da02vkvV>zAJ@`d3r<_Y2y{L>FxKWBc19uC-Hiwt| z+9_#j-vs!%Ul&gPzEF1_Zt@_#LGu>e0bZFO;0_;$4B(x5CFUC3L<^VwJ#XMus)TbC z;La5ob)MSBLC#PcLf}e?+goRKg@ho1Ke2hd!S{^rDZ`!itKbO^>a2=;sph!!c=yU1 zZjye_*OTfuT)%Hx(vc0*`0sJ`W6+{cpjIlP@6qpp4-s&^7tu!TA%Wk{e4-NVwM(Mc zb$Gp2>ghT#M5vv5RH&5=Zlr-L;n%6BG@esCT;NJ40t&(r$JpTp82H2yLiLrgr+04( z3Kcy%^PuY(JW^=??)3@k^qb7PSI)wXF6h`f{Nfm;sKbA6a11F0j?y95+d32^ym z+FS6nf%dziw#dmL5__T=bJ3SBK%o{=es}AN&%m9oaFtytoLR6i%43e-Yy046V(sjQ zB;NNKxi<~)QJL?AA@2Nts{u093~sAi2=7w+^fG+HC~o(8Wh!aH2Y&MxxI`t*ZI?7t zeORCzth=fcOKr4w9^AdDf-2By=4EQ8e^Y`ep>A%g z`0f?g)&Cb;7Su*DH2dv(xKsFWcT*4w)b&+&Rp&d;M`(l2)9;e#MYVwQ`~JD209$}n z@GjAx;Z{6{#%}>4?uNpR%x5uDJrKe|uexrI4JjXjz|0SLqXKV&<7@CMP_z+NSLLU> z^XbD!7wRl_=M&xw>o^h|DWcvK{s>lp+N315JBBwXtE{v#|xI71#w z_KUh*`(|XMmp_wxA7VC;kJ`)!6Lavw+sq-gyJbzb{|WVMAp9}Nz4IPrWOIlY;6a`J zu7x)p%!eBG;jFu>jh%r_+CpG=qa@&SYaC1e+~fs!)|<}kav^jO?zK#VhnuL3A~NB# z1mVflc}btE!T_D{-vs~zOb@^lC_*QxsIOyB|63ltz~igGMjX5kcfbDur#e0vJ$!CZ zW*~F?zDYr!hm(gKs0exyIuOR;vn!0cGewXKs@vR^ao~A)vcQsEuIu)|5c&@oA!w*F zt=t`An*5bWYg$IxXBP5O;Z%s;i%<5A_si}_7bvzyTlT&9G`Le_??ntcF?Vi$B|2saD76wY`dpztK?QPcpZamCD5r9?o8$ z%|37=8k3$WdHrsfrESB*42<&ah@rCa^7O@)PTSfvm%_0U2Zx$Bii9iCw)MH^`1#ks z5X3(sbOYywIF?XrG^n4|XXhk3v$~Q-ncvZt(qs&-?VAgKC1L(Srud#c?tRlUTZfu7 zt|yMfs+yYyyuqdZ_g=kNB<2VlM;_fZ$w1MY-)JqO$sbaWiXXLUAC^rbAIz1pnjv1k zv8O)iZ;jFEdMATR8peCPitn*VJJOWo!_bcq6pYzI)fE3pfT!$$`s6A%~qNZy_ogaoRXgDt|FMQ^o^(+3X9h*io#|JHsQdC)OSbGSgnfm6Aw`e)RgnXK1m-3&X z1>e6Po!L)mDo}c#`G%v%a!(WW$Pv9Vi_<~*ueH4{-?)2=FP|mY!C^@EP1wNQw9l5nxc|c%^ro6I z+G3*nyT6{f8qoJxO6P&nz2{|UUKKM-q_^z@=1%bx2RzC8u_S|wjnFNULqdda8CMG5 zy1fCHm9nLy!G6bPbHy@0fr02F>s6VC0yk=;V>XjrFRyv>WX5tm`FQzBdbE9uc7xE# z_bN~9Z&>5_pIBb9S2T-b7BPCkBgQ&&N?TW)QK>wiw^PB<=nabZ#ofC!fvx|TtKLf# z_EB7^d+79rU`h|K3a7W%SM?N$fMNF_f_-xhN4jPj z{rLq}a;^^X7vi*%!9P4#Id6?=e=%RkQwN|C%uJyV9-e>mX!xD#%HQ4HGMTH%sn?@L zkBM|My#8ci+bSexRdJ?ft+uS;#Z>ft141w3bR@fO&aDiur7|Z(-1A*%cljf|^^pn7 znWH2ejpRxR-ltoLd^dQ`**C>s?^4-){i)*j19mnxMFu*BmwHu5FG{n!^BOa}E(yl% z1eQDTye%7aPMV{gP7>kt#yV*2t3NIlddII!X-`+i!WzvRDH|`o{Dk29lr1A(R6DKG znIZPT)?2%7KqBZJOC@<-9J|u4meM<{5fkqacK>JyY4vmOUfwrPG7HANq8S(}O2=QE zb0DbaqIeIz&+eXV@{de&;>nM6sQ2FJes(mGNqt^XnSV4$l3#OQrh@7dC4WMvnAdR! zgK2!dRE*u|%>AdUe{e+pgJhw=VYsOHv{!7ePm6eOwN@CjT^5@_dK6#GX$5C;hC0v1 zWHdfulc{oj(u?M4ow__A^Z0BvK{B7cwl}>uR3j-g)|NKqa1}qzYWdd}4-ASjhA=j- z$U|jX`)j)MUmg9ANF6anmhbhk4S2de*LQ_A*t7dSSAeKj&Z!<@k<3de865il;c)|~DiuPnBDRhHm0r%*v8raj}s-u+s+FIp|jmtFbx|wu?hOb@|{s@ONlBJ0S96KJgTHb?$ zPg*h52Z^j6X-qWzVg4aI`KNQRu{~Rl5~pM1%gU!;Edfw2@)z*9P1Bd_WKU2UZ)b~c z0BDeL%{EYz#iMW3XG$s;e!T4|T~+K>EuOzoD9|zKZys{Ux0%#Q6Mh;BJE$uv30A*l zH1<5(lK}xDB2a>3RvshSBazANKaelua9ph4)ui0(5o?cFO>7z8(zJ)8NiNG3KE>-% zmDU#0xfmVn^8AM6GUZuLiBj%9Skk%IhpTj9kMEdn^tC8P-*KZZ6wmKya{DAD_>w zayP27z*^{SN^NHbJKJn$N2-CfO4!>Q31x4l#>z)4 zJ!ZdM6Q>5$dO>8zx19l1p4vl$Lpd?>1I$+pT`>ivRyTXRG`8A8Eh*pTS|YU0Ua*@# zjo9Drbe&8G@_&n;qq{%^?R z6{}SLX+ZKvA?oRJN8X*~A^)sPw@>X=)PZ7GoC>2$*RMau<8J<1BC)quB(rcUTTd`4 zWa@#%YEs>#e58Wgm+R%*%i`LXWg~U%Y~Id0dgQjXkr!Z)_R!2IOYm~W5IUk= zsvPZ)n1&LR@7dFP$p_tB;p{z}CDYwQM~5K~lNL3bFWFr+Rs3T*^F2&skXC4uao=!p(Ak^ z(HThs`WztLa|`r3@xg*M*)hi6HvP4B4h}u_baK+Q`=NXt5$IKpa>$X@E4fqVke4Qr zihdLh;%&;Rh_wZwtPGvu%CI2i@2$JDCB?lm@Ju0Tb#`Ctio7Db?ntMJY=tU8JchgI zdaL}Sp#rJ$*LJsRavt^WS$UdKq=zmX`3HLj+aY{VFP`NPIX)f z(A`<7iK2|rXn!6TjxgkkNUQpmXN2d!dyOyGbnP96Gw5RplZov83O9Gr+)NLjQk#2^ z7^2!7s+|zikHM2xft(}LBfALt{bt?dly2{WobN?6#e1N`!3qss zjWUmZJzFh=B0Am%+28HXCQq%M_BG~}Wj!T+?Ge@iHa$!qYj>8@CA^NmQ#HfMF9JNb zZ1Z);@JT(EFK9zAp7?X7m9J(@$T4GI?QgE6J~EP zgG9wT;nBRWq?qq{5W*$z3+Tz;x67qt5m=#nBGxUE%i1%3^xi>JSqN1kY_Av%M7Yg# zU!40^bi=MU|F*vdWGD!Z^o%Z^C50M)Wgl?%6H^?UN-)C){7Ck9^VP!Le@-(1Ttd0m z4N6HExIdZK2 zbJHT5L51bs!mT8t!Vrs#=nsETt@Ldg>|wwAB}C~AK?l7-Q8QSctKY*KdV%esVA;8T z^6$RrU-?Ph#8%cgy3O#TG$`e(;%R3}@Dh_>ng~EFHFVyW1K%@D3=~D=a%Ufd@Cuu+ZomJbE znHzxJdsa6IpEGKGf7~h1Pn<`h6uAY@kUQw*qzV{u)y!h8f0v<}ds)5Aw$`8OOgUn< z9=*H)YAYNz6P^F)=&`~VE^NQ*mwqVe34ZFcEGUSYZd_>C zN9KL`%$?79+DW$Lno`T=QLU$Lu8p003yfp4M7Vu=PG3Hy$}v@DnaydNTTp3|5It#k zv4swC8hUgi{ABagNVIMOwQkYcHulb-^Ojk;{TCbBIk1=Z{Vgo<`~D!_?(CL*v$M9L z;_cX)_v{3VTy@inDfE+06FJ`uhL{uD6A|}pM0@PG8APLjKaFPBoXhI9-$DOgYP1KYhgIyvA30p7{@G$pi2v$ZRRQ5IM!Ols-@Ug~>&!bMS`DA4Jz5 zwE_Ka*b|v_O2%(Lz}}b2bnr6kk@d~!E#Py>mbCbb%Tg9BmpzK}cDrDEDIWQiC>SH} zt$@1q+~8izp)>g>ki`u|ZaUX) z2KWx$aUfKE{cz}&&83)AJPa?h3mk5;YHy~`rw64ydM4T{mQOeM?%Rh$d*DK&scJ+e z!aZKs}2$MPs0%>tw!NpjwLYcL}|;Ou1G)SEPzx;<0QiyHkTOvC$!5Mw@&rlQ?%h9>IAP+0C> za! z9V#0cY>Q62akg-KB1d!P@ZV?hkJTAMfNEtai>b(P9sO$JyKoD)M(tN{Bpt@G_m}De zj$CUB6t<_CuB~xxwsd8ou8wK*Jc@l&7djnO^^DCYRrpa4_EpQ3{7aqY>_+Jce#hfp z1iW*udpP~$S=xNHXYYp@MC+~1rPByRti=`12JY(%wLkwqs;)XNs;z5}C~^gn7o}4L z1nEu*MY=nN6p-$c1{GAKyF;3xV_*h`@ru&jjWi4~0s}}4e8+pQ;CFrk|2VVvUT4L# zp0)PgACdBI0{=>GV*^k-pzc!EFFqN4m^sSkxFkxt--d{Mu+i51{`_Yvq#pio9<~_c zxibNmCpx$x5SXKfCk-59l;!{sEV4*1<0kn{T@q3K2f>qOD!*VfPlWq?^-B4_x}RUW zF}9ZV5!LlVd>7WM(1cJPqyKC3=tA#Jph#L#4sj6qk!&dDc)IIAj{ZfadrzM!_EZ78 z6su96x{EjavFyD>(_qoX?vI;zY}dJ|e+AcnpYK2wFBk}{qtZ=(*#y-gr3sfR-s0>q z=|1-^?_~Jimf?SX&Neb~5EVEAu)zc?V~fK+5n`QYHCZ+`<}SLOIq(J;~-58uCZbxiMLFn zik_+=>~x-D-A!?uhO)Cgs${I3W%fO(Eo`D_-pvR(J0Y zU-H$UA1y#pineJRz2!KZR2r9IoOgQ4<-H!slU#NK3hTNzSR_$p)J=X&3n73l6+*f& zA#A6Zz6D~>HWBC(vqq0%uF`CJVaRC%N7L2;SX9>Y3{z#;)aLogLU|kUG}KY66`Fhg zzPvAn-zf#ZOS^+TsqJ3l^<09B^*9c-&q-h&7-`Ztl~yW5&wfwE$3mmrAg&UkM`|}) z<6myLHQx2@c+dB*mRQv&qGHF#=;0F~WRWk71xLU8T`B!U)2 zIHG5BF(zV^>dxGS@eGfCbG8p^l^ zlj@n^zAC%TE3@0V*FbRw0QHYIl;yOd)hB9fm};pz$I^n8BX z^SKIc(;xtgFwB4?vJVZPQIC_P-)}MH$NaO~9YzBy=|b71c>% z!k*6yt-s40idhKvYw|P7Gt^(!HJwo3Zyd3Lk;t2!dc-p;5tJ1}$*5W53dDrC1|m1f zZMvskz>FgV`Sdb~`1{|JnE#&RBW;xYosecJHlp4#eh_OmSQ2dOB2L@9M_GqgPU z&g~6Uo-`};6MVZ=Ghn@qX{r&u0QIToSue3?%C7jhZ^TxBY8avPY?$1vMclO4=J#A; zaqlNN_Ik^kzsQ&aYO;Lz^Y1v9Rhr<8BOp}AEfN$qXeSzZWEz1j#7yP`tEJz`8M{`h zH3OI^DN$n9d-$$3!F5LQSL1H9!T=m@o5iQ5oJ-1lK6rE;Ep9Qi$^6=PrRQ<^W6|<= zXv2!>26kmnpJ2u@0L}L>{QCWmiqXD{B3iG$5H472N4Pp`EfH-v)0GVsb^*>CB)o9Z zGEgzg<+0(ycy4{~NiDCX7NZW6J8JvGQ*G((ROBLk3 z^-SzjZ}-`anG`)_z?z$}-l}E^t&-3d&o;Fc>5dw1;beTZ7sQnKE6T@8$X6;eNl-{*abX2 z-Zq;3f44^eBMHXQkAw)j+u!IvCr)cP8t)7z)t5O&9eeNVSiwDIiso#??LNCaT0iX2 z4WZR)v9eVO(cVhhde2d5-nk~I{oNY^WTCjYCNQHoj!vkU#220xFSIoHDd`J_9&%I7|=wh9@%+Rk!nGs7P(wsG`d%G-`)D z<=;)||I9A#B|F7v<(&gm#L7p%bdK{B3DFeRp{-ok#46!95t- zeOm8{Ct#-_PApAJ{L3Slzx#4Z+*)w`K{8czWJ&J9TL~YzP=HBQb{aqPPGxAga{Iyg zBCpC!XQAL&VKD`AeGNyWj3WC=qwg+Op9_qU<{{AXzVY3*s*{MXOSMl7SnFRHZZ>FF zq(F5O*Gm&a;cls>Y-FeP#r)@70be1X(HbH1c`F21pw{?3Y9%iJ5TLPlsPyc|Qx3B! zhBmTtrWl4cs+8Uo%5|D3G)=FJR<`BGduEVCjOhd z4;xMBEdGxWL6e)37eUUO^V95v-zG(TlO@ZL=RfUct8#l5x`I<_ooGg~gODfSeHu`87awBxYgkycpd34##)W=OW#?_GNB$Sy_{9(k!32!z#hmeKgcD;72GiuJB z90i4R)xETRio(yl-q1ZVR$nj$hiYGJyn%T9(9aI^r~G(51)>>t}6U5OgU{c5je^#NMR zp(zb))tDa8!G)6fj#aWMdVWyw?jBu%ub|xOJt9iawD9(k-=wx_iGNKbTYS`>Z?O1>=SgFvfWuQsbh+qN6Wk2o40!hJn+ zyFM;~FDO#De%0KfvMC1(yB^MZ&pvZ3WmoW2*k24Uz=glC4Uwn`NJT{-Y?>ZHA+FlK zLW_fqJf~)&FDOch)=JQk!G?ZO8-sYP_5K=xciH4Pc^#&qTE;hkmO%>ih4lM|e~vu@ z`tA06#fuIkO?LF+N$24$4L+^Diw%0Ux?DqXRtCJiu;{Hm%OoqvPCaM9KFkXtVOiX| zq9dHeL&&H9LdL_dx_~R7S@R!4xS&G@hDH5%I5^P8;re~{NG`FR>M2*;?_Pih{m{Az z+Tlp*zZzq++{C{pF%I*4pnFMA#>g8`A5N3jTX7$hzYkp{;q*$S6X)9+(rcM7gX@XK z>$15K{d26zKdSpVBjX8Q8Pr^9N!Gtw8b&%e3nsU_b1&vvPdrYx646Yx(KMv{p!SXN zNhdWzRCrMnNjX0fRuXo*0VS(^aK2Xt@Q|2EKRssHi)Eb4asr5(xiX7FTZ{YrtFL=* zox45k4e2#`=r;oY6Sbp?v0iHO^$$gc7)3Sp$i2scAE)st3-3JNBPl~CcJpI4j3IF* zTs73S|DFd2O!IRF%@c|I3LF1e=@8oCG|lJ=BZFlZ9Z*KqM)-?>C8X0>@{UoN@p(?y z)_R%qW@L)myzm6Xd0Qm&D}F4&FRJUmr&f?EqQv5UzWFfu_`%2W6sR_bOCu{tl~+Y8 zyV<&+qN!%tNYC3_o!NSFG=O_6USl5e#x)WT=TUdHRwC1e5hOm*_L;=_$xO)v0~ z<>{5|o>dP)`zt7cZzm0slb^U|5&8{&?K)=6bneqNp4=HlNWT^>wQaFYsl*Q1OHcqZ z8>2GBv7?FH?+Vi{OaWH4ZleNP9Y+V46}0SqrkYJ9*M-q4yz)~T0=DjDO-$!z)2_=0 zhIEMj`4zu#V1>Sa=FB%;WeD4z&UXs|o%_=cl_tf=;~rn^%h24FYV|ME?TiSj-3|0% z)+iT|*CV8qCFvipi>=i{!;|o>z>BZsLL^{~S!jsHiWJlkSt@UO+9NCO@7Ypu@Ro_8 zdOI)f@ZBEfxp5Q9glWC4;IhmI3O2Capcs9Hv*}vN76a8K6VoRS)&{FDkLuA+<@C=Q zR*3CCbDQ>hHZ5maEU`6uab}f1=S1gLtY|6v=R6$6mqe-8v|l7ULcYGY#dhIXf5eF) zlR(%fo_EiZ!o?*sTn1?4O2%91u-jT3R1|l_v>)(Zc9a2`YNGeFtfwHwyyr*K;k1HK zUX@R`?(5AU9aDkNE7i}EC&_)loxL6g?)R8JF_jcqQFiUHX^#J`AiyfND8^GL=NtEc zl0A4VQP_w$*khl%fnzj#rdE4;|I1#7qRq6|FeE#hVodEQ+Y{hbSiMXCJ(us-x1=&t z)sFH}jHH~o8V4oL52P_kyo2DxL`nE>YNm!gXsR&A`{IM&{oZdn%qFYl+@UCmYj5-9 zfB>L>Qr`kh_J2=I6*P+{^3nhJNMH^+3Bd6XFjNbe6=O|rRN>g-^6Z+`2)76K`q;e0 z=%>DO;c+>svCB3%;Ia|1X=-gX;d3Wt=N`>(uYsN2I59gr2%wXDwnkm(^vf+ra&9Bv z>iL2B3rqrE=!2y{y!TsAqPHWI)*aim92_ir9h)DVu}(mYjXx?I!cu>%XC+g#X}XiF zCn*k8(XvIh)vY=huaxn=ImhhNZ_^()8XOaoU(uH1Nv;0;;tZ4x$6wWd4QH&IRhWic z6r**4`h#@h1Fb)YJs^}L5nS9_)>WoXS`!1LuDr0H=DXEU>M@R^RG`bhv;8S7SEz0F zWOdF949gzYt~3NDjy~Vm z5Cl?wVAB8Zv$vyVEIZYk5y{7e<#9OCc>>oulm&!12P@bJw9P}8<{p_fVhn?nCB+67 z%&g?C{}9xJHw?s)ZIZ_NoC?Ph4HgGL<9#;Vy1=O`npHBSdPM~)cX2XfkhwwUUd5Zw zc4Z+kF@t8xVQlB`ACT22tntv4{U!AX+|p4gc|Krgy!7!aLgjhk9X#Wc9fIvUx?vuF zAcMPiqxA9HVI&ogJC_7kRPU4E#rW;CI92a}O^dB=MR1_`5de1>Y$7S~9hj?JbKY-N z41W7IFR3kWw_t{IlC^^&3gqIGJy~zqK+>jd*1kAb=-M+Nl%1C@HvXgH-^woV!Mk@q zOyRdJ62NAm91Y_uE;68+zZY?RPTmkzjNDY?-*KEW^6`c6<%bnMz+;n!U$&P4FY{KY zMNRL|hc}ZQ*|KA(r82xskk7|CF~y7_PCNI^wUDAC+h#iQLVwC~p}0Uec{!=ON+$+r z#=IX$G>=eDZ;oxOoVW0;zj!WH)YL{(hQIMO6LmSkVE5PNN`F@sxbT;x465bMn+cZQy7Y|MF!l++9Krl<*X6&K zr+0Zyvl)xdQRrrGe6UYv$SVvyv`dz_pw<&Mq8$QGm;5b7N=}*&CHD98cmA$|pS%&B z6|cBQYau#KugPfF&3pSBBf#01cPB0Il13<4@F*=2ccOVL<@cHhS12{J9#4+JT&75C zwZ9AKm@JO&?L9HB9w-8M*T{B~@n(H#&6aFo9H|$9-tBGz9{eSoeXCoXt$7INL)6iZ zNp9ThpRZjlIp=hKPo;yq9B3+YpdJjlCoKwWGWvV)J$tf}@dL29Irt5a*3;IJ#^!LU zwiRb?-W8elsZ|m+6&bloGmv&)(!^XPun`7zWW`;aO1gd6G=M?QDV1^ zl|01Bk8-88+-LcBua<6Gfv`4Wo|g4kM?65xik6+nj8F@BxXlctDB}{&hf;qXG|znh z{c=biOSVqYzJ;j3g&3FCaFd!&?bR%Ke)V8r2liJLL4PP5t-2QuZp z)&oPYXf_$^V0#{Qp3mPfm?x5%1adfA{yNw2zlRa`HI|BEN4wu8z3t1j$j~qWGJN^C zHU{K*K+Re6i(_$_wV?ifwzz(+oKTr=9bNU@q1WG%XH2zD-)99Pqt8oODtXFfOPm^Mh)Uz z*s&+uz&n@~6?w^)6>pWiqKR#~{&vP70w|&U`^1dilxsSW?XDFa+)bO?6fJ9st=)&B zi%E6Y)IW;8GsLK#J{9-g5{t`MFVn`hKoW`|EA&VM3ys$lpvHu7-fS-ib{%Z4`GGR~ z3iq39!{y_uw^?cGmpx4bzl!h@UFzHYP0YOoExmTZNlR52Q1P_9 zvvNG`%-7f=K#%rs4iv?FX>BeCRg`u<{0T^2%-iAdxOepJQf9B?7_mpvk$FSaNx>Bc zdZI+5<}Ft-qegb^`(rGs1GzqW6u8jw)0O#EFHd=&Wbx=R9%(JYjt(J>z9EtScZZ#| zmyNs=*ljw=2xtRknvP*tNCHgVAnbwC+UtiPdAxKsr8-eHQC>SXyRSSoGhX)dVpu?C z;a4)-opbQfb*_7oC!{70+5O>C+MOzpOgskvf`C7~u*#%E8WgoVjcrt?Te6+IHUYuJ zOBra$!Wka=@}y+IN}fl_hx0L6wf1+umBU8uIJ9o;e7PAT&}tVM`YGH%lZ8Z!<;7zM zg(YaNRFAr|K0amGvoNJ4UJ`zaYq!nL8;!%DrU)r61eLlo4MR5`VFPNOc8Gi@``scp z`pR}FH@D2s*KP$-RsK@g)b#N)x zI1Z$_ZSP%V5(oQ;ryhx|txwk8{!G^qEFpVMGeq*-#_Sb)>G?txU{nXVU+mBXsPzq= zUwwE~w^+?msUj#*_>@#a=Rt=%Ped#BCHBwu=fG@U!S~5QH8%f;V&OPE@?`$9PIGG+sZ-QZAgKdx~B06JvNn zBbxfJnEO&?_48su!3pHoLUGg^oOBjWMT(SDJvEM=j*7F~Qp3)Tv%FLx{r;_*xc zyR=@psF&%OneU;+y|#5XLs1W3DQcbSr%mFL=!!-99{V6}+PoPe9n}pvj>%nmYLC0?ctI!(awHF!%yt}V6hHLU6 z)8^C`mXngK_L&iEcqoYJhdzH&s3ZJ1PE&Qd21sV!N ze$EFX{|l~hv(U>-yOS}#LKC>$X1R$8O*zU{cextyQ^V$j7SPtB=b3|EX_j!hZ`pZA z(d%;@EpH8utd|)|jW2q^VmvXU4x&7j81I#+s)9{b5b0txhWV`jZ7g!~_j%<8=KHnT zfZkSk`RN;iAaxK6F~pE;DC)Lp}+%lYp&UqbY<*c`AhY0U8Dt8 zT>#vj3U-l+L_aL|jvk`lXhI56untZ=?p8 z4yPAor5;)6Cuwlokwi@3%WzCSy*LaLOd<(4#Ft^}Op13)R2EiLd6^K=v~RfcBsFT& z&ly|Zcbj%(c9U)_GLvXoTnI!GZ!@7g9rvEKUo?$-tgJm64(&6F*q9ov$CZEgEcY_C zCQ0;oRF2-pf&=Wwvstzo*A6I>97)P+Nh|8CtkcI1V@dhLZ#c@7I*3FiP;}e4F^X5# zoPLI7ijEwGM;TA#MbBWU@h8qs=%tRQW(>;P`|j93t4*Gfrp&`yKf-+O#r-Sn^@8!8 z|3Zm6|D43Bw0IL*1L3u3x^{2?AUXBW0+&Sb?YM<+T{ZbO<>l&$1N`8hMj z>un^bwtZ}WKuA9doqJdBIx0?AfC~!pY|ts?5Y7+5Y_+RWDLH3R9Z8VjhsXU6S>KyN zRh_9BbVhJV%j>Nai>3p~rv<~uCc?F+6(g+qB@&W0dmL;0&>L%*!&GuiNH6l!k;55| z)-0&2FMJiB0ESpv^|nu6qpk|yO(aLIf_yNG(M-xMrza? z9FhX@xYO-@JNl7lAd70JvFw$)<9hBbPEUDmJ>C{QPvDHmN*lL$4sn#RbC`SzQI>6} zB?#jf6?{iZuf!&pc8XclsiZrth$3t*0q$6zpw<=+VYQc`}0)qhgQ5KsYz zkeo;N+%G0SEXrK+tt{`C$PZEVOKKaV7HW1bTU*U^4F7|Yl%!47`c_xJkxe9gI{83p zcQ9h8Q>4t4b7SbIhwAt2&H!@n&nO6t;UOs0s*Ws!r!3R^(D|UOXwY>D3 zQm|VaY_H#6Uqaa;48}R;OAlzl_5KRccpt9aM@~^aEWIVa=KgaxId;DxCB|7`f3%YQE8RW-DJ z7gg;1v-l*e==_P0zc!YEdC%`5U;Ua#{*bO&EE*xMx4;Va>R^%BVd2Rd!+|>~X!710 zKX>Os)Xw;8_2P3tO!E%II5{BTJgWoy5nZJ0-%`Rv8`sR7USG>IntwFJOO>Vn6ZMdV z?n<2A`Fys7QJJIPe~J)BWsQbb4~q(U=(pdT8+o-@Q?v%XE}N+I8sFHFgG_&jQ#K^0 zpww3>7GG&e`f-8QvEN;;h^(Q|K`r0?k)!$JCYvflNLqzXdz>e5S_0fp${L@`SBv{{dB*u1upLFo>t1^8g$Q_S9Ot9@vhfp5I5>})XX~a}%)D3MgrMA7J)PcZ*dco%-L;us&5{GD!{IW5rzyA}{_sCan z&w`G=INJlZgN@>4v!D$9l=PYyoLkJ)3Z2GXvdq_hlBeCH!MoGp8Ghl-Ppvltk=r>@ zEB(O#lNMJhc7r-%lOU*CaxKoUFj~_f&H+}l!us9lSgXQ;A(U2b6UC0p8--Jm7gboS zE2vZKXP|ALtY@nN)|qRe?;-5|=S~Q~`AdB`J?Rco$KW>5a^vew#%g_4`ne-Pz zOd_s^gI;(>4~y@M=cMqmIo6UkFVF2RyV*f-(ay@K;aEq1$yKxtzI%AGi{6;LKL10k zt%<_kPGs+MBAC0U!;7cdAuoI?_>%y1=$78b+dSo5{|jNfk%O zw78!iCh-itbx@%I$9ec_;&+Ym`8_&V2j`*6_zmw?AI$YCc}S}vbnA6bG8&sNA+Xe~ z>7X5^R7!Glj{AH9<+OiM;^rm2*4WG}?^bV);K7%TculONq2kDwoaT`jZk?bC@5-M| zZKo$#FX!vma=XqV`k2zV1_z!Wd`DG&&{eMgiKm88i@ydf;RD1`SOL7cNwr=FJx4%8 zAblAsn6@TD#X}`am?jUkb7}ulQLzK|X^3tQSx0CT53y*A2>77kaR3xjg())A7Tk-< z7}2IQk#FbP;#fZhnMu588#1^zG^tVI#aO=9pQV!?Uo`n6IcCJRalnrk^_BD`=L+=G$)I(t(iuIwij>3Z7h*Bkil0X#jwt4MY^LV}2x zjdnewu>FG%^tNT|12t)M<;6{^iMhU`vS~V$rCR*@c^{Um;x-frzn$>M(u~P3zV3^p z)4rI{P+{B`GcZL3p1rx}^96x}R=9%{MYEBdRm_01~wCNFf ziB>&pA(z0VOaH#5wt?E;;^`=tyfJ~<62kH$d!KEA@S70pC(s9Q<+u@%-T;daPig7= z4c^@hDsDK<)_BObp|QAUhFd5R%)^tQE4uKL77v8K7)LswwKN35yE_%I+BnxxZ9?A! zQK?USip)#AeHn>aEEW{OUhiM~i4L08JDHrD8&5Z@Ku|&}D?E_a$f=n_6Gtb%%As*4 z56loJV(`d#d&f^RD!sE?q$`q^J6zjCkA%8p<_}vPv|`s#~T^_P!003ZdXTC~=+h{RfYBWY7OZ8N>PK zgti0P;!x9Ha8O>T=59UvcuedHmGF5pMW zGeiwaeHkjYvhSJj`FW>sd^z94-pUYp(n31brhOEV@*774^IF}e7etok?T9*pvF|IK zXLszQplNjCHOFcPGar!SL{UL9dAkHHtB)TgF`o3CQBRWqGs#36k>KyG2pI z2ZcrRRJ!x(Mr)d~)^SO)k>!n@^QDi;%W}>IUT!X06dkx*Gh+ydyjaX?S-aIPK}@jb z%Zizoa3aI;I-P0VAlXbMrypWnVmn3$k9FQ9uj941d~(kN5@#)%#-wW`xxtPjgGRYg ztN61sYym&}1PP;=Jbz$P4r!=I-A}pf@9)@{_KY#HUKP zfT&`qR5yw1!u8Un1lM?4oJzx+_K5}bJWps>j0HLTqD!TfFk8FG;gFA9ztlP=?*tX& z1bg}6*H6ojKwES*vG^`ZW?K}nhb7qnCn<)P3j$kDh4Ph(G)1w=c$iJ1@{!DOq16Wg zJ~_Wd3`!`7?4}!NAG@evCpuC!F0N?fKox^4FJSvxqC&m{XklPKi~hU;-+(BxQ{?oB4fmUNjACc`)j(>PoyKmJW3YPnL`(XsbhXlww+q2A=yh$%p$f4-Wh!} zi_{&#J)>`!=g-EHJH> z@1sgVsMY93-4Q zIDrV%`)-9w1gyZWZKu_Fx@IY*AY<>?zd)z(_7P+InBjXFb^P4_$@B4XQONIJ0N@e< zY9Wq`oYGdMvnU>C2$djeD#`KJY+v0s1D~WeO&u^J2g*&?@7UMU>bYcP%ZlY!wHzO& zoG*TeKPEJIc$L6eU(Gk5RIa|{9E z#KT!T9mkyuPD_aprW^{w?udvZtq0z`{dSe?s_&(h>Xt~rd(ad|mS90ZZR9aGxm>vyCuOy?J1Y4A7M8kMc{XX}mC9r#{{GMVFZS-9-qRV(9 z)wx;R)QA4dhxCqiafw~QFLB}?mTc3W98H5g<%BD$#2RXR2k=p_^Sbl#d(4Pide1N4 zM^47EcorC#FC~XgppKGGGP<8_3Aoef6&hKtgFK#Ffpa9N%e%9|iC_=J&&RC9n@&H; zZG=mIM*n6QKq_E^Akolhjth3XWkTI3DGl6?;L+STqgN`r;MDfROF5!hD zrTr7gqvjFxUs)xU`p@HMjJiSGd2m!r;7R~3TqG@N8!i$wt09yhG%22sWtJ0H)_Zk1 zq2x1lMGd+SQL*1VaBmQ>4d71QA8(8^`G|{IK_`y$3tfi&oP3?I z&9kWQso`dk^TZ&K%yRq@=QwnQSU?Pht_|qKw;7*I@uH>K<2EqAG$|>{eLvxb{|Qas z*gy0qrJlw=K0o6HwswD88JBES6p|Un?=_#?yWSa07f>4CQ^J|HgLJ zKcf`}*lJ5Q)yr%?gK>c+EODkhIV*&sjSjgD7B00Pq&Q`1_Z5)Iha%>)D8Riuqo0H; zr=uK38&flot7cz@B+sj!6v7_=c5xskM_z$nqkQf9>31E}W6EN-!FN<|8z7vyKYrWr zDZ=Ze=BZlJxgWtFVn}o+ev-;Qk0u0FaW@!`7jN4`Mwav4&eLX>lFohBg5QE{k>Oe&@e|eSadSKO8yWFu|iGE?|^bHbCs82 zd1wky@LjiV0YXDcS5lYRj3~*Xob#2)r_owI@2>PeHFX90o~HSSw0QMJG&ZXGe%^ZpPR`ju zy7QA4%z={I`@H;`%MV2%PMZ_Ce(zv$gZz&~@l0^M_-yfPzPnhgn+`u*dBQ*zYgBsEI ze6F-h-HS#jkNNPTT9pueAl6mpmF=h5Pj~8vv;cv+J{JlI7?O5661-1{kfqJbTT^uI zbi4BJ2BIQ$a?$8hwA;+g5i>^}kOsA259w{$T|3b%pkUsr!g58WvY8~dWE06Px^MQIgRg48nHJzBeXY@tgBz9ason3lnP(rx`EPn5kyFq~{s~aSQR)J@{IHvuy# zpexIAndlHEXMPu6sV<@OHudaV{cX_kkP*G6zN%__lt|LeuzPgOU0hc(o)i;k)^j2* z{}5n)_Iz-M^bUw6fGzz~xG)TXCbW*YbExtvgXJoSOuX`hQ$x zTbGk9=rMxzde8?x<56}qWqEyD<^v#yy+^>PJ+3p8UXjXCp|Ad&r48oPh+E7__WF`C zP?l;YRkBRzauuHDjrtNYR2rH3JLL#=TQPwFf?{X~IN`@sWru5L7R(;5TXkG(H$m)l z@gE{IML6G>H)%2&88Ug>0_B>2AG2$+i{u_6W9aE)E|rY^?HN$;H-@ARmZZ+@c&DU% zn~p<4^(>yt*)us6ig4V76$x>BX_gBZw`80y{(Ni_PidJh#9p5H;@an+d%JZnQfH#- zS6J0wbSEb3{&&GV2t;PXF0nohlUpPY5Ce`~*nQ7L6ItXgHWmlzaefAJ_~ zxVo3P#M_{t{lnfzh2K?#&z}~@8NH_zYJly)pWPXj6e5{vm{gpy|5sX1BOvtriE5(h zC3p#z`Btg0GdLjwP_q6azm~U7ugGFPDMD}R*ko5~0sD2S-mgb$(9CfwTQG@2n_ZyL zrV5_3mYKG=dXN%rQ(RR^3QDNiPhO;wUp@@H=V2^^lT^y)2A*ox|DC4*1!i`d;vZtq zIu)$$Qtg|kP4^={D}`+K8FdId6$UGSa_X=@zQ6Bdbccj6xYgBhZULgOxKw#X{f;aj z9}SD!?yY<&@{wd`8Py{cm2zZl@_Yv~Pn$6K6rdm7bNBM71YjJJCL1qDrcIXq^m@T} z$^LrF#5auKgjn={eYeK6o&QR_#>I+}4||WKXV3f&=yNoUm{3J*gofK{kjT$l5QYjT z6e}VwedX8HkH4Orw^r#cnQ7q#I+;;Rg#>|p5%H`)MU)hvo_K)W2hY%m@>QIBIN>%h z3f!deyiz=teD(Xh-DSEv$aNEC-Y9w|?}dH?&6(6nUBLP}di$gqL=(A15Li7JW&K#F zj-HNhBF`oGR{!!P1Ru$ez$jT*icO*8B9Fa4E&}RV9kS6pRgJd&x~yxc*F@>4ue0sS z>U@dYq;A<4JM{V@H>-?}J$PH#^;A2>?~V5cW^$I;ajD-0u^2Z2o1!eI`h4=@bci>A zOjeE0rvUS^|G%Yz(8ZC0R)~2|#@6r^^y0MJivOyaq0^&NZ2e$C=q(%&)7EsQ$;e=1 z;&e)FY?3~uXT6?pRyV;fJOAgAx&?uBn7CQ^o+r$Nnm$BW_Gq5FXI_``deQWU?zWtoVDE zkB?>{++fFh+I{DA3it_Z|E$y3!?&Zea8pN?3ZLR8NU_`7ly2ZLb54GzV-e~ma{&k9 z03TP$+j?_I<<7rS0jYn+FRAxBh&XDBT86X7MLt}GcX@q)j#cP-=6e(oUi+-HR9$zz zTX2n5d9|hCFfAqzPe{l&rOWS1upjKpw@1KhS?Rlhmv*H+hp zHTS>v1!gKwE2hloI+m!*a%kiMObs3LKG}ugZ!g7EQQ(zyH|D7mN%iDmq;pBCPXP`{ zzo+ey*2(HetY}JCKzNh%W9-&82VEiS?JN4?D+gq=r)3k`-7>@Sq9XkO<&e28O#`Zu z2M+&{*p8kIU;9Z%9}Aho*CU!6S$5?`U)cbY)4>oSKJF(i@k4$g=&~%2djVyou?0I& z-@)+Ef=G%2m}P-Wlaf82=Vl;ZhAM0@GzdT*YM!_cT)o07ZKpkN44SD>(YPMrjtDSFh2exZ9(yZ+yc19`H;1UIox zvJTympO!=?(WZkbSoqE0Z>wLAZv|{mx=)D^_Z1DU74yjG=-G~uRy838^Ck$xn*wABWx-RO2SI5 za22nEzM(5GR_aXF)ix61Pve&Aoea~da84$S9qAsiJ-O2Kdz;e@win0bMTq`H%kZ+5 zJ5%Pf)vFdLhnf7t6BCYd)DJPuNtkdTP*){dpZHGgyRa^l(8YKbg|Uc8u!{2wIECW8 zycWE8*h5W@naDCnq^3=0O{M2W1s)*SNUFN+L!AE@3{ei&23Kn{RDT?vL&FPgperpc zSi0G{V-4eB_$Zpi%F$NmU6QV+&C(t%+-Xt}@oFpG7mJAxY>#6Usdzb~CP-7Pt=66N zdi7fHi+c3e_br%ZN^wb^hSyEs6i|hvq;MbOH*%e4S4oxCrvj+fY_HJfX#9NYVIa^} z6z-IrzSGnsSwQ6YbKZ(_dj9@LW$%45Pl4Iuwk|L1W(e0Qbz8t%P~qsTf32>diC&d3 zNWDxoBYOZHxSi4>Nv7^_=hWrhGOEo+*3{nx_HN@$%fx--KZU94@a*TsqFx%%!T(ob zJ6q}pr_cR<_`%9yc6y)E(Wqs1oF;0$}czPYnWWI-+n9M zI?l`CT>670^A9u|fvI!Qu&_#x;NMn>D(sS>cN$$_f+P0xN-J%4F(Oi4i3_5?gve21 zv%h8-W0|p0sm4&ks;$;ZXf{ZlD!&ok;-k!UN2w?iMmm$Jt9az4i?ZhOXuW&{(2hFpumN%>jmfIs*lQ%!R7FPV7`fDa&>{N3g5~QveCVTJX zO(p&4J?ml7g&S*_`g$kXaXG$|BYLA14fvweB?hx9)Gsni9zQyvy(an6r&ScmpbTkR zAp=lpuydbL%7`;|mKeLVn;+Fz{T;f3T9sG4*v-qdDrBOtj6 zIujC(8@Sltjz2m7ps=lYBazoVTg}O17!K|lma?sy#3Zv`d8ylzx>836=g-D0 zUT)BYG^cI5H8q`T;p0BU?Zg2E`fU$X1#T;y9@IYB+C@J|DyM`VvfbO|(UA zPkExmP}Cy4*lV>3(JVo@KG@zK>ynRx_N{xT_^~)3|7!Ht;&YUr^#SVm?OX&NzwMTf zr0$#avGUmbz@sJOsR^Cr_Jo4at8dj;>Sc8_Y%yN5W`*^R@C$V(acNfI54bgTLG?cu zM$sCMHqLGS52WtmOou3|l$b7BdZU04bn+18yV!74uyfOdBc=v}&b6cAVx{}!bvLfk z@YLxl|0b`@lM2p=%#6eHlKF-vx5w~>5C>dut6~%C)Ww_XF9D`-EU!O%{5+)5B)!U` z^9K1@3Z%Tw$$#iXYP6h>{YPFxwGd(y!Vxv-9>k>DD*GoP5H_M|Eox#aR=c z8qA!J>YSgU+;P&lA9Nc2T#{R{(c%UUl`0^=Ec5lGLS2v5`fk4_dnQ#J9KjQd%`72(ly9#@U-@mHNTj5tuHgDT+2rzpk*7YsM2;Ss@Pdcs{j>AAM{_d?*?1fbml{|lKQn$x zDek>&uPD|@8O_tyl-QjuxkorVy#F|wj@JEPsJi`$pMz3b{W`2E-Ts=Ct0E&G+(jh! zJooJhP;_())GXrs>fy^>@sSd|rX_ow5`1s93$J01yB@m)S9#U|y@{ch9Lf{e);SLN z!E0`m{LLB!3N`N;37Y&d_783g4x*bsE%J4n&+hjRhLkXMi=Uv6(rg%pXJqatD%kJ~ zu1_vecUyA6AfCuH9OUxk@wNMU7CdqmyLFEiDZj-*T%pDw@Ec)rO(Ci)h7erj9lKRh~W&ZN-PD}@Pm70nqzbguDj9QN% z*mX5%A_~fIk8GM%)Usj5(((6jyKjK_I_0}MSS%uVYbs{~QSbD#nCpWK)hotWawC-- zuqUT_n_)Y?&T9WpUu;VaaycOMX|Uy%E(%?X)(lGbgP@ntpr1~(kq57!M`ECaxR=ZY zy@PcUuzDHErt$zNeQx8GHIt=+btUs#uUD?u4_^T0EO}1g1)MSUjeVtOV^Bqu-(T

    GHxj_O9kbm@QXe!j~1O8ARA-`j`|16 z24_*)Ls#Y$J5_^vBl_e=sVWgtd>bn(o5Un?XLzQgPrpJrDcnzZu#a~IM3(t}vv{_z zm?35mxR(UO*U(@Szzi{1zJ3{o*fqORV>aEWcOEB^8%jOeV2s(8lJ>ISqih6^ge}Fc`#bHcn0}vx~NMwGcHhB6xm0P$``7Ba=F= zS}ASoEbjCgA@k57_o%O~m8BN5_c(?7j_QVXp zi0u{@s;Js3*?gETbWB<#JVfl9UDD+rm>0sFCC~#JY zEE|{&8wFp#1R$Wg`pqR#Nnh>C>_E3R3wE%ZQDz+G-aWtzpRd5$n`Fi#vE--RuG@uX#w)Y>Rf4Lk1%Z8 z-I5l`S}1u2>~SAQ&z=qYj)GY&Q(gOB&lVU?Vl!X!1x5+vpst%a#BQ`ZuYW%p<>3^Q;T2&{whr{OqjD zJ?A*46Oj5mdG?H_MC1*YlzC#jdRJC+hm@e68Z*ri)Ew6whsQHbeyY}Cxi|~sTjrXF zjqG2&Ib6=|QD6N0o$sCC6Jm0a&pK;9e8>xVXpv{aVN@p2(U`7$>4U>Ikl+4t#88Uc zYN_~5i|WM;piFtpdY|wt@^T9u?*#vumPP+KXChF?3V7scWQP?fA9+S`1}7<5t|cK+ zk#;PzgY2s(Mfs!;_HNAH#AEPZ0JhK9Q^exvK0$oyT$7Cg1uQnJ3HE;zPm+u|9VKI4!WZLok#T^r0(fhBRRDSLS2>w))d%S0W z+IriB!yLad7%=X5hdkzYhR|qKzIYYv2;lxDgcDc!o=rDbD208HE_&GVP)0$b5KZyn zFIz~7S6G@;+;3WLBKw^~-qDX#Ue%wMe4_b7o~2(!$Yb)@N`bw}j}^uJ;9Yg@OjSSY z3sBI2v2nuZbCb7MrkYI~Js#%1I`QG)PV{goMFH;;C=fxk1p1X^*zG}3Y&&8?IwIJ@ z7FhL$J8UT_Wh9r>#B*qCfrTY+c$rJ%fx^s*Hj4ZP2x2q4hOS&qV}fvfV6T$8J!7xZ zK}}Ff^|HkajKO9;@)*VyLJFR-P`G&7CpGdE(7FCE7guJF}+BPyA9jV}o?@MpC^P%E>W8^}WY=usrm(T<73aTSt&_7d(6V^Tb6oY+j;a-d1Os$lT@JK!} ze|j-b1)aO;Zo}t^q$bJ0k_DuK)n_Hdud zFf!3t$8_QCw@InDkr9F&q5a|qx4#xUAp&fn?pKu$)&KIvExYOE*eB1UOqAy`GwRmA z)7dApgRqi+TJ^t2mIQHM7uucDDk>%If!LvQM}Q%$l?YKMZwXx}Od`4Td|p9y5W$ww zyP4=u_6tH=kFnl6%qvQpa5SDE^t4b|4!^M#zXT3>abB}R{hZpgEmNaEVzX=rk#n-< zXIiF`PJFohukFW%@3UwbLK?qPf}YJ(^t*qUA=H*Nq33LEb%Toy<+QTK9;0>?!LzM^to>-14&=jLr?#S6a`jCzdWw{ z_9`8#ZPnSZs$q3x8t*mPu1>ts_n2qgL{=!^UF14BACJUjuMmOJ<(JY$(+5vTfF+aA zU+(J5^NC2i@T00){7X+Rn))eBvUD{lZhci6gedb?m=*)7E=M zG}cEzmzPjl@P6$a#$hqRos|^)#GBKmt#1Y^z_c%xp0C{1HpxQGi?&y4 zrkypen(SXE%nbeO|GNp}hTKtK0=>TDR$D&~Dk05lcFXblg*^feid7Y8ZN4q;@SBPv zJ&su)?asqxWe_mq5Ae$4uRY_K)7&Pl;Tu*o4%~Ccd)e-v5|JA_7(RmDl%Km!b@25* z1zGR673J=6Qq}TXl92#)PZ1 zq8{)|vVPTfM1M9;r+HVtwlO4&od8-}4rBj89tKi7>aLDDEzhM_y<{UEuu|!YxNgpC zaXFM!a-P27bi)nHf!ju)BDDCmxAJ9VbbJ2>W(ap0L~NMbKiAh)$ivMhO1=yAUg@jP z4Z_@v5ACc!$eT1;DZ-h{`OxrK$K;Mar3(&i^JM&+{F!?&Cvir9_K@j68?`d^?b%#U z_W@^lWnP!3(G54XSH0dI(_ujeBzI5PjV)Rz6!=bAwVQNKcuImjTX3QC*JCFr`RefH zMXZo%2ZxrQQYujgJawS1cF}8QIrMEFczO#wml`Z;tv-e={AYsjco$CAO)ny@^V4b)H#@f4gN@fQT5&DNy1v((}Dc&0Nm7wKqiI z05g=B^M_8X;`=LV&P5JT%~o~s;E41i`yO-g>uh(}d$ya)Ry2?0<2AIE*0zUbJ9wmR zPggeQ{L5Q3uzPqPL7XktpUFm;a86+97W3niOvf~sv~87&`L2${>gwHlY4(C7h6UTt51Uw`EiVd0r*`?4mX@WJj>nezD4)0!`#j6Vk91kLYq4XRN|M(iS}(m@ zrBI0pt34|B(eagTlxdYWLoE|p#5lEys*BX)c>9_P5_YJG5VPSa^(A-0QrAG}>LP8` zy|2u>DqtK+GzQO(8w$}gko_~`+`zps|9@<7cY%c0qKdgW@L ze`j3O4JI-TJ+Kq*DM-t2b>Nzh8PvQDJU*SdjlPT%z9>_r`##nGtN(p$Lb+Vabk*`m zn+Gj(&M>tM+a7F{Fc9R8*OZQ5>W?E0Wv?_3ga|Ii6Ik@tLxkNqQ}nMpSE5IKKGfrHxnzyZpgmeoku!Pyl*A`Vu5;~=(+ugspQGCliV!9g(u z=FqKxJhF-S&~wuC`+RZRvkrMa3M-!jSI^I?d=H=LM_2gg)-d6=1OEJ+UV3VKIDJGz z6qTLXRg}U90+iu6k^Ut@-OTLA+rcq+`mers8SpzmR#xa|YLjG|I>t?|;`;`IXyUdtaaQ};iU(** zfiG8mRkn%yjn;8p1xOWLCWadftk^eR4}OTK1W)5 z$7_~>HuY1`FJ%lW`KLX}WkiRiZv(;9DjJ7)ku0QteNCN4zRLJhJBPUams7!BRayz? zt;tBYe0hZELCPen#1y+^b5j$lcHk9d%u4yU`44%oXq3-B77XJkr)}WU2SZc&ZD_M2 z3Z`LtRSRuENmckAlvZlbguO|-kF8u07O3baoFd@+rfVqEl?sa)!~4Jx1xYCW1+yx1T7v zV&b9(mxJ2U3Q2`i+;_N+sO7sLE?yuF>F@ikv#*_%i~cp~rc16%1E$M0V4@2^mVV3X z<;%50cgR-p3P#?v=T-+outJrq6@p>UDyi9Z983SL-uf?s2{&HS>xL|#IvNeE(pGPj zlS-z8(Ec-JLxay&XU>F`&@{x!esyuh6b>imRgtDfL#Xz#;q{49@GJHqjPz5}1=pn|(hBMI_3vAz4oqK}shw61 zt#iOny96ts@g4n@-VWa#%eakZ2A1Ad?SRcY+K3;@v0pQ!g0H5_9pdl5U06M+ysA(o zIb$BLjDQUcIAe!POTE#1$twN_;(g6Ti^vxR9Q~)gS3GR}7j$M$4^+rdDw$9_HkL5m zL=G#v*``;y62P-ki`P)BET3Pf|mDR_&sam1TY~GokKm`Zc!EPgS%jvsk||t09-F zs>OZx`w?xbz_VCm&;=oess!-*()#dtyDTgJma%uoat=a&kdZwOzh0B{|L(1*2ke2>qjO%|e)IG5 zrALAzOE_-!wzOzZPEFPH_nYkI=XW!1IxiUN%ma(KNeOwOF~m;gEz)dyO}#>QS-q_wrRb@lg?6Ze*WQBKsX9+Yr*cR#X3 z7#uX4oSsHsX}QI-C2;1GX!b+jtWaX?Mf*ORL_CjKKEOi24$MAxUH$Lh2CE}QUtAzF z_Y7A?n=IF0)S1cm@87w@yn}bYWTPjGG~-a!$j@#h?KG0eDoBZ|`hKTCFN8^Bx;u z5sG=yNJ9zmm&bIml(W_;YKG8gG;VSsfnaQ2m<^Bl+F}`)o~*KR=<@P1n~JV(&Dhvj zz(CQG*Fp&pmlA0-L(KzNUxJ%a|Dq{e4QqemKFp)WYrrO zs;Q|xQ?*Wrk2m4F=HTFjd5x zO1D6x(L+!Xd2&6<3sENhQzQjukc1I$?+~i*jG;l1y+6MGv$rYbFqGrLxaAli$i3pD zENLBzC3JUNC-3hefm#%g7IKQ%g_LgI;;Jf@#nndb_HAu$GvukMv)P?7i>bWD(p3Ky zbm|+@=;+O~Iukt|7b9hNPqQ?@i^p1B3xFTJ)8Cm$Hzr z%;Ut^&Ri3;NnrJ0^71vRmqdNVv5z!d!SqheP9>_9uckpQmA&iWPN+b5FY+X^O!_MA z(B3p4X`5B0y=m3e)eo>0uwZAxmma1kxqEoX&P?~ucEyBR^!Z)X(y~gUrR}m*;-D1W zr=gja^;UFd%9+=R5~mA?M@auaO!MAPysTBa2BIC)8vW}+Q45=$7VurcXn*`JEMTQc&4 zn^2k!U~Zf1maJZ{-0DHc5p9B7;E*I~dU*Io%8_^0hsTw9I+>Iocqx7Jv`eyX>Ac=! zSM~jqDEEpY-dtcy;BhxvN1b=X*=x_N+wpZ2n~z%8t*op@>}M(}Djt|JZ`rbCq~F-v z@7=q-R2NrQ$+?n>DbKhYroFwr&sNBT)qy%w=_LtHBv-Ds{;&fF4#>o3TlfuNG+nS0 z^p~e$97^oZxJ{*Lw-evpa|*M&m!#Kz)b3JyfF*bXbg%GS7+dWY4i53yfj|zyP(nvj z)5R;gQa0T(hM#?NDk}H^o03#id=|c)($6m|;}fr1`rcL7=)$KNT+UTJ_^s94zQ>(H zC3!Xw*Wnf`0$;?&$M<`g!ZuW7DriNCw_fT0_)#6;m*&phbe56JVw$We z3jiVZ_nT7cAG+R;+Xi>Hou zhCLsS=a;$Vxt;Rbsnyp+>c~>oUP`^^i6jNJF-=nF&J^bP8EP~~YADYog(Fews z$UQSNGw%sci1OYCJbm)3UA5!L_0EC?FG6fu6c2>kdYcfRWM9_R1$e9FiWd+RG#$5( zqaK{>y;W&>CYGNlsl#$BUrfc(!^6X3!@~T$yC^=~sdKD64jhy|=cQv>=9FD0Lr5To zdiHD^3MZ%co3_28*|$1J~_&kb80*^szyI=$m^dfh^rtqiry``*hxJZ(^JgV zh_Q~S{O6Jlu`;H;SSlj5Botc`m`c#&E5c%v($e@2pg`H+eSd#{VU7 zE!jN-n)t#IZZEF6fV7FqgP#j3DwO8+BbR{|wGgt9mxR`CI4dIuyPCJOw{PEOp1M7v z-)FJ;QFKaXHgD-9nS61lmvr@$4IBauQc(u?Xo-jIjDxj&hIVjQ%I4(fAD`i|wC~s~ zVzp^Dn)>Y(KHYl05MbD#vd6-=!BeIK^Hi$2zrV`8>cI%1F0G3fuRAzQe>&mWcO}p| zUZ@eqhaLQsj2E^Pc@uPKohCatqMbx4>hy%=q{EQYriSgD;4uQPNRHV$mMv}W-!or^ zhleK{3KdS!5-$XoasjXRtW*M6&Cr)Gs6*9c-3dw46cYYennGDNYncOUDL%%c;=6PR z-($aaij9D2C{L;!3(92hhiCmfP}@(4+K%cUM}Shl`eK!CblBTn!?-Ugp z5P{e1%1Jj7^mK5@4tH}7tTqEy3kM&wUKKzEbMy0E#;khgo|Z{A-W*LA$PZ;2ax-rL z^R4wOF>7zCmK3VD^30t0BvKy#ZhtGXkiu`{UZ8oLwNNh9JyN?pT{gwXpaIyt@xX?3 za;Z%&04JceP5=_6C9)Kb3o3eS1?c1~N?p}0%;^VwCDw48mVb_@7@ZljtH{zimgf^` z!Q1h%)bGLOp8ZI05-O$8W3RyK7OmYLBcD=Uq*2%V)i-A|P^mfjj{t{ezP!C7ivRJ_ z1~@~bk|Tt(x6I$q9^<8!#|{S{0?>G2H8%dnjUO*nBd`|F`(;q!yn6I4r2K~O?+;sd z*b$x{{aT+jK|{3x)2*ACaRS&XeW~J>&#dA@wql@!#Bbjufa?NEdO?M#dM&@FV=nq4 z7-@uR1atib#EJ9YaxZAC7iJ;=1rAWb%Qv}4N_mv!W!S8`dkVT*7-ZD|GwYHni!om! znaS=pk#AZHX_BW~8~ zfKM$7r<5ju9xn7&9NKI!9QEB|3lu4JW^!D4wDp*A@YK}Q1)a@YPJ&@&0`;x}mMxnl ztqiQnJ+t)eeCEWW->wwrpmp)p#gD%hjyU1Hy*}(MeW$l9#|o!7aD2?qEAtX)>S(s% zz?^)rfR3{Ih8aiM*h5>(GA*M%Pu_GedPY6j898R?y6r}0bx#{{znsSLlPDAFY8oH+ z%`mp$XP)w>r%E4xZ4}oloGFhPakG%!9ja7UKWoSm3vyII;)L4%vEi7{#dF5ltfxn$ zQp%;txiW5BIRdMjIv(2JQxCr8@44NWuz}bh#F=2pSMPqb{LP8!V{u}MT*^`rEi;7Az{mJQzb=m7$vrFjWKUC5)B8Q= z_-z~0!?S~FiPF~GWH-`?bg%wwA&97V1U_oCdq{hC!mh(y09!QeR_7HXey4%hbMe-- z*Tq;Yda5WaG_+Qrw>(nwW*b1JQRT8RpHQ~qY_|CrGbdmB1Hd#mL5$WiF=xneBZg`D ztl^RnI#%ugSv{mL++en7v{a-=dhKHe}GQbZo$(Eaa?lusS%ButL4#b;4ZKgn3*_yg`B}rML)A zX5ts5zAUYzr$vv(ipMM(Ui5C*)>gH?$=P10(#@~TksxLK`So{7ijozWs7!xw{kKY{ zpQckEZR62&{Kl<&R>azH{CMe1V|nhdBVS%6VD5ir%EXVrr|j z@$_ufGw;Cxx}1lS$wBKd?9J(EY2&3EA?edFA2!lgC2=CW+?JjGox?61kiH`06rrtc z0o}x5&q_=hgxL?iD^R5` z19@A2&lP{Jmh}l}=!EyLS_#*SgF#p4li)j(f4ejC@~+H^ii64%5XK#;5kM%r04LHD4Z+Q>@Ii_{Z+4D;`&v>;+3v++$mg;OGWizBN z@RPbIu@sxlS}at#^S0?(z#1{`HDTtQYYd%?c{i1k-a(o-08i_|zrj~V`P0^eUz+m7 z($b&5e#L|IjeBZV$kXYne)v`COF1$17 zWt7*H9fT@mL{7N#uj|6qVlxwrbt5o*kn|(QNRqFj9XQtCxi8D7W&czbvdt{lfS1oGa1>VE!Bn-_%n%6J7m>dj~3N1L4R`r7;4ZQlqY5`!Na4q1?pqGSQry<;ZO}wIk;Cvyc_7@I1=eVIhU6GOsUe4gbbqq z$@Nk$zOSbj!YSIiF%V+n0C;x~kg*1i9cn;y5uCh|(p_PvCBGuo6LFV?Z12X z=7|L(G+YiKbNbRT-ZH%H=q@mzoQ;e#t5B8}1|}PeDT>@+_ZAy4Z&((X=kTCi8Rxs; zt^hu~MLE9kR!IJAtqI{q7_cjG6v*jBCqqseuXr7ey!oKfcUL=+Cq{GnKtsPO6;?*~ zaR?SbxQK@bHb9ZcS_Xu;~7v(5Q_6{<0g0i*YDH&bu`YwrPw;07O(IS(3FlUo1E+4OZeFaPkG*dqz~L zcbSR50-ka(=p``?f_lstWLf_(SDflkviJWcTgot3edo2=hFCCWyAODg-|SP4=gLp*F3d1Wz?%w)_`<*(=o9j6g^8<6rhF!GgpP zCpKI@f0SqQURZQ=RDyOebiW{DU>e4YsK*GvB<^dR8Sa3;=>Mtywzr?QzP_VSe+=Ld z?jZvd#4hD~_j))(m|h0I#Lk^RwEoV?GiPr6grMSm2yxuH&q;{#H-t;k3pvopYq1M( zZ|fNTHfjeEJX*=cKqkivbcfbl!45UAWAt$t2FIJvkU^qUNuB+`M+ChbE&3NIc+O7~ zN>351XJbOglYpXQA{o9m>h{bqMBiEfGgu>0tR8qh?ozDI`M8dMpqvK`6P1B+9;PxH zjZpcri@}P~j-RX$O9EQ7g#iO%^mDyIm+XyXJ9zw&fsBSR|AUGC%xbp|?9wt34LSud z61P1Mf!&;$%jc6Y3iWxf)6N4-%z1?j30DhT+Qb}|q8Rq_pnMi9gqh$$(s|ogz)SW4 z4t!Va1YF8t921DE9i!5;BQ4Ivx;dmil?TV5Vm=~@hzZdSJCMEe>a3IwlxfE7fluT#pHWA3?^Ux zlgTF;y_|pj7n6$^o?oouPqHr<4K7doP1c^l}`i@w*|6=+CB)E(g6uZQW)C2UM^@eqo${(OlwJl?|kZdB9+4(^CsMLvMw>89?y3 zke|VAmj=Sr=O9MGJYZCwb=Jm|5Zbm&obn~VrVx~YtNS;}6zi$}*UY(`+5_%!1 zkD>nhuSYzbZGg*iqbG)WX%?-vn+R`iTV?BhmWrr*Ltk5_seR3=HcFf_p4bM`F8%SAW_pZjm8popgrH z(l;@|N+iOt*+k7>gTD8h%{I#;aV9Q=;Z~b>A^_uzGCM;Ty_?n#BKkNs09+3fV*Iyt7+2a|j3djE>TZlvp7^&9(g)D>59Vgai+wp`k z+nPUTTZk-oV|Ic};E&mgMLN;9tLEGW<8%aI`hju{fGotv2>(P==-Jp$@q#yH+zdy= zd-cp3S?N#)Sr*`*VJ5Ew;3OT1z*~%TRxQ(fVWS@B9bbfCS?RAlHL`(SbS< z7k)x*ak&!KkEkcebPPLoYuSSo1}vE~{1$FMh;if@D1>{8xbPEf3=_cFBEXh|Lh`|F zkAG?kWQk-E7?!kOb}ONPARBJoQwz^MAUV7SJQn1Vh=9RJ1BeMA{oROaH>ev#g0SO= zE8QDyf}jpYtUPi8mP`SotbzT!xi}M`85I087S2igGvdbGW-Q+G!T~)*KxU5P{2%-* zDjdNY)Tv)l8kA^(WC@r}451>H1IZ&19meMKpGg%IQ;(={@u@!?9wrn)>qJlm05QaG zo)*ka7TH3HaajvWaoZVrm5Y&;yc&=T)-&XLFSM#Cy1uY+vz#w!ZhHQ{p_lXa+?tz(9jYps<{0_ka)vBlQaWToPp^gT(^;Mj5&l^TQzz)DZ_Pc;vbX zp|2E-4`cn*g15rNfzuK8w3s=tc8)1|t_B+I1C1^-%peIiKincH)8YF1ieijF2?LUN zu*g>A#_(2<^nJM3acM$d{}YgC#Q?TY6cg%O)j_*)crw=-dl*ywSWLEqIcX~ZbCMti znuLNT>5{8_r;CB=$7ljhy2#ie^ZFw48z{gXUDs%9oXXq?FiQkRhLd3Y+pJ7OH34h` zR?#aqIa|ZsT_%RW9+zlPwgFH>=!LN>5x8kg!1Gstsaqk)(S+Zg9^^u`@VwsjeMZLj zy500iCbK>4|8cqiA95~ry196>fd%`$O|{|lItMM!HlDQOus;yHEnJop`>f00=Hi81 zm?a>Ogk=C_!6FLa>uj8w0uKU6$H3Txx{5A40ywRQcImX47z3lkG`jmu0dEMZHTE!_ zt3d$13x<4hfbY!$BTYO$_cWDairEP?18M`=@Cngzd-5|AuQwBy0pqsNfuJE6p!H2n zgGlA~>p&i$1BW|z*a*ET3P4pD*(qudoOeUPC?wx=LDR{?(G%3r$Nx63Q?~QMMba_`mFQ^2>lVHb$Nk%*}>eb(#5wjneGcW;0g$TOv5eWnM zj{KfqL%3Fir0wg!@@pu|iq3G{dQejO4a#um5hmG2{S9SM3NoCot!v1Qi7=-p*cf&& z^tJr@S5cxv|L>XRBMCN26NC+GMGTN#AS~{<^mh>hq9EarzR+)E3$G(&r5^uDb_xOR ztJnS}8;q0_aIAjl(DY&mZ*G{pbUo zt@ke7DxH?p)ZVCl=313r%|+)Q>)8y-9OX?ex>vhcCDCwEW|o%qq+@ zLinO8c}*kdXpvmeQ63^KR}QP>?LIOkNNUKls&MIzdyejZj#tb3$I8+wzM>&sjuJOb zX#@BQbs@X(CGLDz9FPZ@ODt@Aju$H?;Y}TotZAf$5fl1}FpO3hJ4t$l!17Eysl`@0 z6V%tBQ6x-|U{_TQ(?qy;qD{7okuAF zL&o(Z!b>@br`(i|0X0bo@?j+_z%3l zI+FCmlL;N2LLaJcGrb%cwRHmIS5PfdypXU2rP=&$#q0_YZ@)PXerRB$+Y*k)tutKh zCOmA7+w?#UrQx1+06h-^A>2ZHJ%~pE=#7_7P1)n(Qr^JPAnFt{{CP7g?_Mt;cFae_ z*d|ZXxg&(9+?VYIg^-NT&p~4@q(+Q7Lzo*j&b)d7_Is%FvGk&l#BH(qqIG0p^_K@( zVK;>1L=@;=Ggwx{4_s`MG|asEQ3niHOkjfk-m>){@@z%>Eygrlk7b6Lk@QJzcBE%YxGe_Y>D4~3riw%v?6L zx1Ste6_;XNV3_$N6#yzq0Us`iYe?WaZL(C2T(tFSOwkt$+*i!&j0E5T~d62I_ z74&If0@{tW`rB_6764R(EMt$;Hz5Z+wdlTzixXC7_@&nn(#<8nWAYE6L#pZRBAy^c zgYH=v1N{K62h9`fWrZa#sR_sEkO-o)PmsUq^DFFNYlfET){JQd^~Ofa<9qi$`6aedWS`2@ zmu1n4dy6_i@f^ba+eB}kB7&z-){!MOL5&@PHfz$emZ)8H3+@s}hT`W6I#lh!$YLO-W#9jQ$@6&@DjXDt!zR>PR=BXcq=>>^Fr1 zAr)>3siV?-3NS7w_8JOQ2xeBtrmHeZK-m)qt1~21LX~JAX4F z3FNG9)J^)_9xCGLvaip(Yz5n0E?^~q4Q_Yrs{iX~VfE{7Zc8=`QQi__piUT8!o6BN=X_dtoPMcKo5J&)TQRt&=~#}rNfj349S0m)Or-_~qz!o<)$KKp~-;HX8-PkTi~%fETV?Ea54M^6Fv z3SPv`U~I`dob~!fMlAb$D2+4y)JmDq-Ex=bWhJm##X~{o+9dnui?B7{zdLsmCHAe8 z;p#3ptsRE_xWkn>>6YX!x?5-v-h&Px_|c|jIem9xp>5lXCL57Vzv%VaPN6nGdybo`Fs5^8D0Va3vCF5UF7 zH>bX=xK~T?5MkO6z4T6e=~Q=;#K}U#%*kzut^gv_+oKnjJ<2ul1(m5M+@`K+kNuHI3DejjQ`%_kx3hjBiG_e%~_Tn~4dRQ%yFIgfwLKIx}fO~bS<3~RQ(<~Rw zEdylliED_Co?ZwT|TCDPmay|i59m~e{J?8khv0_|AutI zY5@L!0Q@ii9+AC!aWgq0BEqAe5-&6O2DPF%+k85=vQqi8TXyMq+QPVA)vo&b`W^8> z*1WFLIk*r{$%CA6pA9ku9Kv-vsGP6kRg-cH3#+H$rNgvSB076y27D+u3@t$1$E=)2 zm=4veT5O+TR{6%9o0oSic?{)eYj0mWg&h#U_Bmfzns)%tIeL=fl(M~tKRjN*ZBX7i z?L$&XmE9Bm*+D9w+wZxaL1ax&k0Cx`)iPf$_fZ))(BeZA-mF*Znq+o)Qs6C@x~3RS(GmH zU+(l*l9rKy2^JI;U7g=}Dd?n?oYw8S-Ww4!N-Sx65FmYWFz6Hv+9#6r^-Q+Gt@vSG z_cB?juYw=Tp;q|^?Ra~gw_tuQY;_?lu2Jd0VjRb0w#JBYcET!f>+QERr&jhV_SahU z4CtVWzIqBYTDHM4101@z|>6shP#js!Gz=Wq~9} zx6>h0Ha}DEcpH_IOAA{ONBYshXZ#P0l2;-gmF-ogJjc(LPlh=7m|p{x2A$aTT==ig zOa&Y~>y5lj`lpY6^2vD@epW(Mg_M761Frn0B8I1A=3|9U!RauruX#A@ei_(S*{Nb`VDO-` zd_+noemz%Py2)Hx@oeh_bj4&PjU4kGJSE(0gjVu=-_6c@R(m6em!T-W=)Rpm$H1x2 z*%=w{KYjZ2H1)q4x3T1Bwc%RIB@-4}%0F)4x5n07PH+Dtz|^F}dA3^!lGwKfjgwx^ zbYz!spyRB>2H>7S;Hv)QT-y~ou9eWkMof?m124po65o|8@gyTF2emT=hKFIV3XQ}+ z@_s9OfXkg!4&DizR!bKMR|MU;iwM)hP`Yc#$)OXvw2h8FAThwaQGX%~Lb7giiPYWd z>m*iph1`RKD(Eh~tz}Qs+%O}=!vtJK!c!C)1X@zXWkzOnv5CoR+824exa-+zR|!cZ zjCfjjYjawJK^omn^F{P%;2U`Ickes7T(NsoRy^wfAb-jei*5uPxRV&%a zFAAE#BYJ>>l^8PJ{n-GWFG&$1?i3mx-W5`NhM7!|jA;ZphIV>;xjq2!<8Zv>F9h6m zd_K&>g-s=9=Ln8v4^d^$rp%}r4S+epDKv)wve$P>&A2LH0niTN;d@M$NBjEUfN(ph zrFlC@1rJTEc)y@Iu+Wt&N^y_OY_2Z>wNu|5_|vwwW$LLjXPyXaa|X~=MFZpm?zt`m zRQtvS#MWVatE49+3F6a<6*l>J@rKRampK{{qy}Y zvH6|z?oWhUZWV%2Y)mgej4Fz^>Z6TJZ=D?dgdh zv~P!VezU5ae;Ms|$NVFYt}wxrvBwtO%_phzs`IbSsPl+(Zm9SmbqlA|;A`J0Ix0}qt`y3>3W5NxNgsRV$ruB4 zz7dkdK~aZK*>hctC!J1sK}gqC(l}Q+pnLDm?Qy?!o1v-SeMDx3r}vKE)m2X1*J#(@$za=)XuZo4O9Ln9G2tj zx5&Rt?Oo_Ep__4(9T=!;q{V5L&&%t`Cv84$@Le+5%$i0~oThoQ?{E!kbp|?VaJ0dt z%LG4AHU+iIcFEhalBI^#L=dn33?r5 z7Ee^0T)Ec-bck-yC)~hLHxf4%Z!lJFF#NX6^La$Ta%DL~87yO`jaR-nj_|^P{29(g zFt@flAE(~iluFGXaeUg_6(+1c-#!w`)3*^@1lCnWc#3K&jFVdKgVb%CRe}*WLs53_ z8@9~)>Zu&LlSs4k46B#0vf*gGRk&zkZwHbJN=6xd=C6A+xSv_V35PDWyc-^PtY6P17mJ5eyeO_+CJ7CeRwab0IJ+P0bkJtLzVRB(%VQycO zFaW#xa@(hlr2|tQE#S3821g&rprm(&M3BG~_e1I+~0qK7_I5puX{wl;=cfpU{&_MaTtepkmQ@-sJym}nio(Kdj zG;B$p^=7iYHt1Tlb0GivQ|@)NfK?c&pIYx?Dxko*c%tFmzJ`dC;+T-_&QygkZ?5RR zZA1lbpV&-C;P_Lm?YQ#Zg5ov=UK$Uu$xxO3E{&xuf4j4mXq3Hl%yEhwGn6B{pD;vL zt}`|^p7Y@b_llhP(0Gkkk56kCNw#;bhfpaG(~T>PqLgg#@Ux?s z!A&L4MTxAbG{VK5O~igSxXuu@&l`v>q0N3^NVox3s2^Y^_E+BcDqT!ZPdB%AR(qHY zj){P1?ddg{5%5$umOSTcyJd>+VY{jRWY&i%XJB!jFw52eL;=o2-C+rk9Z~|w&Yg6x zn)1>Vl?8kvu3*wa7fx4mWMQ91Y!#0Zu##1|0T&M#RpA0q@8rto5NdJUI9{+(Xn!z|5F3`NL{#b-D3<#8s9zMVyudF@o zySA(N(%RF&BBwtz_MLn3YI561bhbF$0!R}DbA4CPOP;YsK+6`ZTi82=HbQ>9B&})B zbt;}DWbAKZSfAu4kmMJK{DSHMLJeteZ-3K=&tQ2=j7=S|)0~)Kj1r{h&-s=O>+`uZ zw1QE)=uI%5fW><yC(tQtq0rCP@A}fI3hahgBbxY@r3=@qdqZOLwk>5~P!2m?9qeG{P z(zd!<8FWzcw0k>~%E3w<{rUu0p0$}ZrEcd%y**n6l6{p%CtAfd=;aMyz5ra%i!6ks zyKO|<0Ig5O@8d_40B{Ohg(qKS%B0SbRA~3&s+=s4p!e((5GH-S%Rcy01SlSY7hhM#Ow3^ zv#Af<6j*QX!jXU7rwZFr!QfVd$Q~IsvrAB)t#sfm^=F>aRKMymvvp*%&Nv1E10ct{ zW*w0nJ6t(#xoD-aR3wy?3aV(}GQp;2_`+oXM=h~lDpzRz27>yN&9*LK3I_!&H9f0n zyZ3`q8@=KM?mMv$c6ZeoL;=n#9Bmr~JAZ&RmuVZ#9}-OHGa$R(Q2B}Q z$4md&S0#E!wUa_r%?D0`onxSYvuKh!up2H_!q>=SaN}`}bNnqTqXO=8Kl~<1o2OKh zj(%QFwU+-zL2kkrzy@q#Ann?0oZjxv9=<^;u}pJPn-7V2_!gYX8YL&|R5vTvBSM5M z;cmgp-}qa~+Lg#)1UtW0kg+W{H_zp6`$; zWGhs5Fo?3N^^Pq^S)iTkv>Ns;;ilxvtLY&H>y^}>+$=N{^7TXJCJ}tMFGmxwPA&sr zv5-ufT7$h z67FU5@I9E(E;bEijdtm9Y{RfyE%T1o9PEOd@E9|{) zXLtC!qF}GD>uKAG4@gTm`fp<|DFaIrtYw`Y9ZfV!Tv1>r@Bl`urmqp@gGg{fA*{al z)%vDzlIQ1Jg?V*!vY7KO$Yvn$*V?-k64##L_`gJB*xx~@e$KPn^RWK|P>w}v{@~+l z#=a5oF~ZDPZrirUBu~j*A$fJEdtW_G823Z}4v&=Gje;tE@PFL<&4tdTEC0EDg>p23 zPZZw)<-J~1Is*3$rD%f9JtuC!NC-fCjGgW~BrqVMEK+YPAXxwl0BO0aR7_)@8odDz zya`G5-%(3}IU6Sq7ubtII7v`(N5u%MuaB=kJZfp;>K{)lET-APNg%MQYUgfd3FEWc zPnFi;8ZNX+epj6K^aR@*(%XyPRr$S;ZFmWuF}JhJoW^@TOK^ajz*RCPR3PB4X4`*O zoM>@$1dh;G0b-!RzUXZ~WJ`j8miDpC8vAQA(wrtcfI+yjalnOD;% z!8u0YatFJEFv^CR9Ua}hIUE1!TlO8hU>bz2oXd0~xOLVPcAD@x_)%hr`3cLm-R7_g z;7)3sA-XnPX!8Yq?L$ju9AZ-Vwx0eTF-xBIfSH7CodV|VWS6`n`k3~#O3|z=j zQC@5biQD5Ijrk{*fhgjiSr1NU(Ja{= zdU%=wRh9-lzP;VxZQ?gO+Op6bsLbi$)fST?3$G`PAW-LZ zKA=8Cd#~T;f>&bBb^%4OLmG6!1N(v?=2$rw%hwYHy;FxY=ujLC>j=br&3mfww6T@7 zwKZ!S+%@hxoT}p>m3ea&F1$zWaW50UFS!2}9waP0ICK%t?4e+K(Vcmz0l%cNG$g)q z9bZ2%6N-M{3#zSS?DSjM=v&xNd*HqMcL>tD>flQ5{pvuDI=Ia1zdSedILt@bZvyL= zJ~;z-i86yRrTP%4GjGG(FP^RhY-hr3uNY)^xGz&a$Ziovw_!GPoVGYQ}xSe`tRC9>qRZu1jT zNmc#)q58b|XFqyiFzF29NYC(L=x!g_}w?@XW5;LrMR1GWP_Aps&f+@baYpfcqVL ze=Ixb9Kh9oc+>Qy-Sn_(@7`OW3}C^bT|{QPU9qtJaF$v0rTqPxIwx`KCeQ-dgpis` z0mr)!wEUa-Ze%C^fEOsQMJxz3v8e>Z}h_?If)`~0pM(N9vg?_I8u`e3TP52$X zvS--jiol%;cCYF^#I{?7ih6K^#P4_eNSkkM-Bdc}w+gWR6aNkFcXsPp`uqY9Z`nhg z{Qfk(Dy{rY#-}A?_;y_RR_BD{8h1Xh-NA|N+RyVn-Op)biPf{ZLDX&X#~DQ~a1X}w zvN%wN$HE_R`)%{PXNUfk(7CtiZmVQmt0Y7Vw=e*OkG#4lQF=SQ+C0eOMc+Q~E+B!@Yf*tdzbiUWX$uSm)!A}z4 ziI~%%Fq9AQ2m}P62J}gQh297?#1NzuL3hN)#s)a1H~CO-YVYTZZC7j%*Q+l}U+seL z7pX2~M70n|KmMQDBC>o4I{h=J`TupN55EqqzF&5t3@Bcj2W2WKd0|?nLM+Q?>rpwgRwfG7kZ^bjH)LbFh$hL!|ElTL{AgpyFc*O~c$x954zbMDT*$^|6vyZ2se z{nl@_f0K5AkN=NQZ`jT% zsdgcJmvFfqinAN1@8~3XwkMw)A8oPEsPnO8mhA;|ark`kl}I|=mfI?iSAG5O*IA1H zB@-eV7i0S2p+~!~RA`&IlMSsqblRxHjPr|TXP`NkSz6DnFc4)WIA|4#Ny!?-q z1x)e1?*?|YG1abnBQNL9-j185e2<^=5W>dgg0!H(XvAOZZ)U+=l_M#tXkjMp8WpMSgXmjeLL0kR?p@r*-*6xel33_DaL+J z49~9BG98;3klg$1Jh1)Gt2sOB1Q?5pA^PrFUpfh}%N)k>g&}GgnMHmxzkXgb7~mmf z%OF~ZZ49G!fl0bq*g>ADk1sMt&ti4U$nM3n=0&H>c6RlXmsL78S7KwkVKzevMtP%RW`6wD8H^hK1j6FXrJ{;PostM2i zgk1J1;@mQwIZ4=0K3T1bo&E<5KLJSgJE>_rIr}*{b$*I-9K!uWlf25q=KU;|c>^Nk zujupobrFYKDnRqb69WD7?$hF!2FF7F6FQ4jY_FvHofIolPK-v&QE9_`3eB=&PhdsA zDMp}`p5HJV8I5D?%onR{iRA_<9(OG#b&?e?7{~jKyQvUbgT>W1$A#xWJh&vFAD&?MWRLStV{4i|Qy=xw%zV#?Wvg%LMGo-LjLW1`4y?#zjpQG@axIXk4QO&hqG&4^M1+VIi7X9rglkUQtDSRVP7JB z`m5OuJc?+tYx{fQG|R~V|KLsi+7R9Z*{wNez64^Mqs;ZaZ(Z_p8Z+Bwz^{a8g(7j{ zwJ{|fJ5sjFQVY{#Kik_F@htOutDmxgL2t$p;bT)e(Tup*fMOB)ut(xjzJapIZ85g?pRp<7Ps%r&b~HpFx5<}H~@~q zL?-ls_ICriT8x(=HeedB+*07hNfYd?N`ZfU(pRNs4Q6F43?^V=tQ z5hoBp3#y^?zG5mcRB5elym-P8KyZH>{mqEDesL>h0uh(H|H`|)N&PrTHAwY_ypfT_ zk7H`e{MHgXOcs7@)XEnqATi+8b(>_`=>2PRp9Z-4G6{y__aGOD>VZOD;mv+^{Y0Z; zzFh2b&?J@QtOL96jXGE$8fu9PsPZ(QLyjcj)IRa+7r4gtoZ%WjkA6Q#ZYLX-PX($TPt2%s?VV6$h$4Wjo6iw{&l0S-1mCw2(ket^n@+>P9C>khrPaoNIvejX1D30yDMdPT)ri7bLpC;!x7o zHxR^sI@c>8PBFMh_Up1~yLJ<2j-mcfgFimcDb@}pX|&8+hOH2a=S=qy2_qeiGZP

    6 zTaDg`I6&?<$Cme_y)j*oWKS)B?Z-j!F(ltZ{8ZPC;H@BMdS@EX)?j6S^|BB9=4AZp zR+-ph^GRK}qu(CRILF*9LrommW?!Vp;9Uz=PIQfq`3IIx&b{Fhypo-`50!bsU zlC&jm$md_mJ)p;Szn)}AcaaqpeMc}Q#CbjTiewl9Hyti&m`&Dd|9iBt^&+O>@MXio z-~lldFd0B|V4DkeLH=qtqF6JhH&eI5ArS|GR7VwHlN`1(1Nq{Oru<}DVO8(|p&xXOOmwL7SGs@^ir7aX!>3n-CobdExe9AppQBy&V}t;s;Dy((>QX}{*Zkr+X<<)lS1AJ~4pfA;bTobl=vWjKEcW;p5FZ2cP9M zn&pgY;LN|i%2O>sd~mkG9g$4n$z^|%&jx4l{P+2JPrvZ3FQz_WNX7c;0Ii3@1Ec3V zK>Yl6n{eDbkIzD-tTTJoT5&7yFRfrZTzv1ilOh?b5l-RSN;}zqViWQy<`wXKx90{; zI5HuY@wwp#%v;VHdoP0y7B5qq+5Voo$YETA(;9N!@Z{`N-)OS%&%Z5S4FAX0e?I(F z!8=x+3ER-Mfx1d0@j~KOi0xv^mHaI8Nzq1K>~^rNvGo(F^?k#OdMvwyg`}7p%0t*? zt!75;TEoiVaO-j-AmLl+`J69#q3BCeC)4Q-Kj)6wehP$qiQE#_U?c08kQu z#qDFwoaf5KwC_j_O`k3*utMN$X8*wgEfxb_>gDr&(>*sf)6>hjO{!~+5Ygn5#-D>aND(`8bRE`*r zX5Khm!|A@3*l@f(1xnXg!`8;QBm8c|=~%tF<%$zT&^JA)OD~v4jIHBJ1Y$B(-9_Mx zu3R3RS~IU{=&B`3N1QKaBUD>$`ULCT6^{tM^Ix%GHjwSH>k(Yaj|rZAcw{{Z$q5Ks z=MkP8BX9lDQxB(@O$PcqG(gEM7juH_TlnkM8(KGl<>ggUX8e3hF754=kIw5~x^%{oau!fL#ye!u_y@t+cZf4Rsr(O@lK=hT~l zudOebV*GS$?Y;|s*Krt@3UyuvhMwadE5r$=+x&qk<$~tH{1-b zz=CuV*AI=vXtCC$+GcrCsZUbs9*-3}9E$U`H>MDyd(&`^Mx7A?1JvrH?d8Qy+z~K_;{rukbz4D6cLH{O!EmN*8X4BY=4nz!vqJ8HZV6A0xW&$HLj9 z_@p?Xqm`fC%Tq(!b#))|)%MRa#6X+Spn{LNIp0?!97affGN^CJV5hSd@TX2fN}b>3 zObjN6NJa1DYucfYK{l7`I%=^ZMZ5G88|SUB8;*S|^9oYLfq~cZHJxT3V#KX3Z)e6o zF8%yk_d27CiOn&4({24TahAgfM_s&h(f1_i zj`lF;v8Q`7c`M@0k8$w$qx(3vfwr%Q`Xj)POnDje_lSRcP_hj)hLkn_M?FNAKn)#cvs*tw$u4g z^j4KSq(nHRn1(S*q^!SkRhzPV<9wq-4gvK%ovKQHVkm8>8IG0O-;zcrA$*P& zo@hT%3S5Gpq0Tw)&gp2Cj2AYT`n!?)0-HD z{vAt#ZXjQ_XwLn|snR4oO{R(M;JGdO(z z8-UYaXe)7M9%>RYN>|i8tr*%iYoRW>C%e?w$3N&!^hJn7p1@34%bhnP!W%rJ#N4dW zcM6;yED`1RD;|?OF6~^kqq|}-jL;}rmX0=6$J=eBsh%jMSdx>huRa)$<_u3S=V zxb#*|T4b~EbB0FlNPqSRDI^Rz+*($qPfO`khfxdb*42aQSElr_WEQHXks?IcJmH{2KO5Zp}<9>3PyPqU(omM$|ZD@q=1E6}MQX2@w~9>TB+Ro}bldKkH6 zdI!%LvhcdNT*^vHm?y|jId{ZrJPUWdI9qCJ#&mGvq)|s;f6sP}f+>%`XF7}@7zpy= zdq#YdOB@<1NASFRa780NqWk5#nkwW_|NaJ(k!diw64BS3oZih6^6ZWj>LbYuE)H9S^r`&BabYyH3jH9(*98=g6! zO^QAa8$>$)(aNtZkKUR*yr0XGWJqZ**t0L3A5TzrPn55@WNi>g(19-Yyj^&0=3?&T<+0$Zd7r#%+KGI_*K*z7ik*29^SH30H=g9araIzGeaNNT_IdW z8XfxUhab)#55mr-_bkDVj@eIBQ8WBzxPo*VtKa!qXRA_=AEiGSbjDN~9len~>fhSe z8Tarhnp)3(o`SYpA4*ON*@lJR8nd08M<{E!C$wS}imh9N%w|I2`T5JX^%dIE)D+ z{bi;jLZHzq`v&)r4skspUhSmFgy8YU32rw;WTb%RQoG*XGyt_=p~O`tBVyQ{&c~I?52~7&RGJ zDk5Ah52vAQvU?R{ZHi37#yEaGIe41rKQmjiJ$;DDX*yrDsA6nRMOfRh3-qq+?;o~; zcG;Hv?PUb2g0)k9{70gcJDgqZHduzeXNHP#KMgN;wMi|h{hL<<6juVphkrjDdh^16 zJkD`^Q?F{CAc~E*Iegu}ad4Ir) zmq)6^c~Weo%qCSDd-Rgt*s?En&AvctogZH;a0OEJX#gx{mvsCSah=VeAM>#J=23mq zX zd&CM<77cT}{^k17H-~xIT)zJzT|glG*EEj!rT)vK>6itJN;mqk!-yaJi0Ofn+R%rT z!(ns}W%8w@haO_97*wwBYG7*Sd%vs%ZH{|g+?9-z2n%mk5VTABiZV!ik8G`zjPEDc z+MR(vrCnxEx}C$Gwda{_&)757*x5I?XR-^84uc(6ZsWgIA9U#e^T%?}i`~Ap9y=Xl|F9md`XUFZ(dhmteCNBPbV+XDoAtiKKJP?}h+AsNlX(rpl?cJv zz0cP58HmS6!>nL7!_W{oLZX*FaiP}xHVD4+-Lwurs4gD^S`wCZ@*!Lu0L@5{i#=7 zz3^LK)pUvJyV@+Lcis=M=yr&*KMEAU^XYq}3FMtB^YTUAO-6!~M^1%YD9nlTgTyS3$12sh&JoPrX;cnd0%06jM{7R0frh z#&`0u83rrgT_tZmG7RPtFtr*4ol9&x{#l^@3HjKQHWWu}Sa#GFXmWo<&~o&QOmFH; zNkEpU*5Vt$Gu)=uXjF^?fN3d_dCkBeriBkH`ji8pBQ9gZD4Ala!IzOI8J-sO@DF-H_SK~3q7!^8oZ4W(Kg&o&Olkhwv zrwvP7OwjdS|8!PgYmZl-LW0(&=MY`jl@v<>V9uO#-B2T+`U;jtU#aa~@-H9q__%y} z$K=BHu}X!cUCLk&Fo@nK+-L8dp?+!A*)UGyVHy*{{ZE@6P zYWo)ONEU=dE=-4?%{UP6_-Ek(_V{zY)x=*!uBpdUu$pVkk;CjY5lM+GfTuP@AzJX? z4qtBU-qiJR@PB5lFCpg~UfbdW0}xMlRC#xg_8e&h6ud|_BS=|%$Utq%X%ov0ORxJN zaPyKK4J6X)3M{j3Wx1Y+s#d>6ylABI3Bcbpk8q2V{jqn)i{vwjj#E7^8$T1*r<)O~ zS$G4ks7U}8wN1&DAVdV+A5>J1C>cWw%BMr_p{JXW#+RWtF9s&^3SOPR{mEp2wT2O- zZ3nm4pPBqXctI#tm#-Ub>v{85 zb`H%8%K&H7`*Xctb&XWQQ^}&j_sswIOn|hf z*#tqQBuCUISlPU8k=C83yxpZWwLgP9uXHPEFeOL5My~OlnSzz;e|*lA=$L>I=rQN@ z-7{LCO+J-B1lL4V*rvayVJaZjg2GpB*Ikqp8C;(qk9$zX^evcXM0eU2Mm9*eScm5S zq~v7s>a;aT6l%0ILd2ezY6T{yP_96R(}(Q>3;iie%CLQFn6iA{*_U2olujss_`OJG z_gFn12lDAtcyRg`QOjcBa4l~eK74pvAtbZ4{Od`f-y0KY9gLkRl87lC3YC06th4cx zh=gfxi=7)@o|WRiGQ=tv;ZgVu>jS0GU#o|BqAI}YsgyprL|~TznFm7V0I)n%!2qR^D{j8Ux*DAWIz|8icp3?==1@5_l=E)B};hRrg!VpoxIIs-OM?gd;l4ueJCI4nNU*23h*+;X%HLru{@6?z2qGW$8Pn08Ut+(Z<+jScd|$GVBzH2nnI0-7hoB)Qo#J#;vnnCd zWgZt|5sa53+@UBy5mY6Os--{_1<#~KpOWCR^mg1R~n-Pf`D-;#t)4`UjluD`bsSA$vtg8sNLD+dCOPHD!{3=km#8;P*X|wg9KsCB3ty3;Qr zq-)3RQB=J{>rSLdVkn2mZQ0^+MKGd{boCRckBBTq`6d)%Xh(xs;F1rX1~xj-xhDI zeRzv5fHwG0kM&k-Q7_#NeFMZ?iin*_(rvu6+EgJ)meFo!-BOH|&V{@Au~p zvB&9j^ zxWx-+LePF|_-#862Cqe;yNxH9-xTzK3wr)e1=c-rx~|sio>W?#QpiZu`?#;O_n*qW zIqz)%d#YHxO!qT+Qp6ij6vt@El<#+H%$p8%MZUL>=!weW`b1b|kt&FnsOXih@EW&7 zih-nTKdffFkC_g4HI4M^WKx646i0NAYkctZJX70=zCV+B?FlaEURS56yV`NugAs0h zoH~n|TUbl5UQ2*~*8}bAmR1V+T_N98&jbqK?74AgB$_Iw;><&@v zj`AAi3zEFq&mnt59&@smpTx}PE$`j<(H5Y+erI#;t$A8+A$S#~1`BTS$;jG9y|>2( z^WQoCUoL>Jx$ew(E_<+D`B?(qq2=nDjd5$$aUOEy?Bv)u#yKIQ&}QwYzFV+?mPp`} z5!+Il^%V3DI+;0@XPZkYRdQt(K^}ZV3Q~d)rcAasKnfkAABbKswXpm2LW}@W*vo5# zu-nn3{y$ozwj?g~a<)6*zE0DPy6&d$Et);!{>f|sp&1{|tEki-)MQl&x*7=_cKWRG zeHR0NNf_HnOn)15MQuMt&P_ij_j;h7ff-c)|tTDkXE6l+!3Li+3FUYN~aq| zT=v~EQf_g;%r-i@l<=+!_HbQI#yreMsdHtwpA~gKybDfDtvNA4kZn?V`;MwUhabD2Y4+)0-)AO4zW6x--Gon<)`;+JOR( zD1xAj^YKEZ-uWMe4S~7cmQKHvVrl1FREZecCBbdxlLBM!C7b^X#p3D8Yzw(euSShG zyU-UmF{vspKm!Y9^7}Wsba#tlGfwDRNy~KiDK93wnb7M<;beiKXi4v3sSOVx7{LV% z{!bnLz4IqvTtxRH&L;=I-xYJ|3Q_mHvArm^oO@L@C<5@AG1KIj1rXu>UbB6|Ulryr z5SPa`R`h#<1ZTe#u-(1uL>sFlr~adUx%ER+C30S32_tMgZen1fIV!a*QP(u`%?~_y zO&u|mm)A_FL-5_FC2{%N53}NG5>NwR)9vN~Yl52&aqjh`!DA3q8rl7_C&}x4+TJNX z{<89y%G?XkgByKw@Wv$4BPXsVCsn8nO8@$wxvWx;JBNgF&dA-m~IosSR+sd6b0hGvcdif& zIzpRot*?@54+BW`!a)Lz`>BFafv%hqKs%XME5fPEl^;OdHMKH^T9&Z!PX>^$fJtr8L<7dFD=djRx9vMgr39nE*D`RuMaw zrb5XlRjG3D%YcodbE zEH@}KKnQR4><&+|GS76oOWlt;=uQ=Z4@ zK#(y=W|nV)S(;?s_mWpYC>{s57^!27eDxz&zZ0{(m!bDlY4IPlG9H=sm}}J?Iy)p3 zZAUa)i4_%MUjuS$GK+CwVsk#FMzB`)-(^B=sB0*NqI?zdA!4c6A2o5StQlRSwhp?j znS?8VMsgEX35C`QSgMU=vO)sQn5P=@!YGVDpx&_-WuK~2PnfreD7PE@TtiKSDYejY zL;Pto0;9_Ud_#{yW+DIM^?u+J0Arlm=mkmau_!;?x_jOcuK^9X0(DUYWhX+4?CG6s zwSH&Q>TA1t>JWAEgUP!_Ip$`o2NCC!7J6~f=fkGzN~dR#+T;{nfMO9UmAgyc_+X@=5$NuYea_Mys`A-B$6=euF!>6Pg2 z=~uJx-pI8yc7;=+zO=ei*Xy7wx7N)1TobxLm;ro6?#@1}3HyGiJO_ma zC}Y%cwWs49-P;%nF{kla0iZMH2HM4wb2P+fRg@ME6;9e$AKFSgqe z2#wYhN$308$yp4u+rCq#-~`sPGUSqUPg^CS*wE5w?;Pt7KWh7>fenwuv1a0*+!{ox zWyu~>zgya}MD5I8ujd)6;1ZFO_~Nlb%#Y1Ri}Pj}KbTbVwr&q?HLuf}*ci`Ft1kJ- z)+Bwa1`?_RF#};L&S31%s{&q3Szy@i=iOqR;i{CCah|IQ#@3!%nV3g8v}_cp=wfE^ z_>71cMN2n{H|W`I%uC&5-WP}2l56@I>bX{v4V8v7Vczu>EB^85UNKia4OVw_d2XgN zx^-LMaN|%n8KH_0Innx`=(GLvy6;Un09mo{?KOJQ^*hAUN?4_qbteT1+TNnLG&e`;=OqJK`YB8p6m-Cdb;o{HM4Lcx%PTKTdy6mDa}A zs9fd0rI%VB(xt}74Hx-MMKOD1c2;Jm;pn9#IolewZR$1lq_|*SOx&j?3AKFM&-rzP z##pYT>CtM*^*Qp(#U1O*0~ra*aSdFD*eVN$tKpBAt}LIuw_>xZt7Ri{RoY1>9*C7Z z8b2KFcQCws%HZZIRRW&Vf@TVe0a&6Nz1`_z>aOqpVYx1N>8%sg7~u2*rnZjL zLpF9_yV)0uHZ2p!znn%S=_}D`Kp^S!A84Q@#6L?D=*Ib}U6P_(R^1uJqAEZ5y{4F9 z$ohF*`5l4kAsAxkXm&Zh!VV;hfqJ^@l_-&4vk>G5Wsj8Bc*N^e4VS~zrZU;sr};oU z;CyVut2d#QqaAz?#d=tn5}$`H_9jH+CZ{AwQM5$Qmgq^##95fQdI`-az6XDO6RJuP z1M&LX?p8vjby8$DP6pQB%GYW2)UCjq6_7TweJ>8W)2=$b90y19;FaJj+8Ndg#0>SK z^jkZv{E8vZKTXS~fHs0!8`7Qjyt{kG4CCTUl~8>(+&U z*hh2-D;>oWeYsikf7e_NXpZx#psubXo-5^9`bUE3i+R$>$?)N1D0`vP)H~g%7o9Fp zQ~k^0xppc)0KkU=6@Go7M4^0lv1L35i)(1SBf1pn(@@eRLdp|AgRDzyC6pT^i()?OGYbB1H`2N-j`B9uWU`1 zpHiqW5zh4woBH%@cXg{VP8lfR&JA_0=RdB6(%Tc!B>Zg86_D@JHs3QRp`(#BPLf7Y zKyTpx_5l4$)C=r6begbfP7^n*9jFVj<-=BXN1V)jydt;nM)=u48b!^mcqo4XcfhnL zb)pCBqlO2an-Ne=B?L+SX$N{T$U_h})Qrj>hrv|3tVF9%Ga(?B20QZfKs_@%DC`c;Pmjz)VZ$Ws@kg#4AlDhe>KH~HUf?t_F z>_Ki7F*3^O8#qQ>LGnQ!%iYu!2>0{@oG#8nCI^RKc)OCE`EoOtSDd3vFV&~ERwB>b zzz58@j9Wv zi6!O6I(_r94Ob&Oi!Na`;7;SGBeE~Pj*PHS@O&iU0s)x#w`TY9{2Dz!Hl5c;{jgSp z$_P?AADjwBM!lnULRkU9AAR@2Tp;(%AK%6_k>i>=+B@+fhe%{F091+$V37cmw`lQ~ zFG~bM5it@Ju!R~f-icUOzXSPla7AcJ6I4-F4&8gWb_R;qG28a5vWVc6iXzFbtK5a; ztGxVWX7N3aE7B7bB(_o z_cmOHj|6OslV`@t7Uhx_%mP$_5HYQ<4w#m zi{GMHPolA24?5_krh6iah&GIzHX=L;XP@*NS%fQhjekR_!fdUmWn@TODq zUlPr)GzG1I!>SAk+t4(GnZmo@Ot5X|$$q|UYS1^dVOwu=LRoIADVt8wXTDbtq_?Gl zLe7A<|Fh_ta=)(q0@ytt`wZqeezk_6NMGM^g@w<&^{`AY8<*k4{daa zXiUmQ-;L7<#7d6EM$o-9E4$Fs+toASoi3rF_j@Tl0t{@eoEs|fZIBVVeBNzu%bvE6 zY{|+B*sU%fignSmwoz&NhU&UJL8G|SVn1Z|mVQcvbyn+{%>Lg{%j=tfq4VPE3ZRiz9}M zSb;7rhcwV?!*623LqmMZ8ru%~-mNQTSG-6H2#zfQ@)d~|qX-g76R?T|2&4GY;#g`; z_#Kq@&z!etm$tw06ZHffnFcg|uTi}!<4gjxITs?fUj8EATi;avQSVjZQFnyRct^O~ zr5oNhrnx83?IJVpdh!%Nzy181Jji~u58B1XGCJmtA&XFo+w+hcP-ae2~8!}`=#b`RlEOLeaEa|5sIB$Fdw?|1a9 zGLrQvThj@{a7RKvt6WlXFIH5gj&h|1?pa1vck9XWaO1a0LOEm-1VyU*A-UjsmEPl|u9WbdXt_D-6AmNzX3# zZN-D&@5E8lSN6Uls$B}vnPE2+u z)P=Y3S-a4h@M|i|^M!t`#|vFY^p%{Wj`2AsXP+jpu>&oy_rp?{_+#waOXY`LzFzW! zBQUF}(2{n`Qw~(D9ALRb1#~{;2^FQ&3RPtGBk*mia(Tx!3ZWCB^Dfpp_fg9i%Jqf^ zYl@B3vkCa{P|e&>N6QDMJ59Eyi&fQv?n)di%3r%8fk`ZDEUHo>|F;91Zop8sAK8tr z4rm(Q)mA z)c>a4t`(3ntAb0S@SRK|HJU@sl-d-Ro5UTcDPr$ypCy@37Tb*SgPb8*>wl*HEdRij z@Rz8I&hjLw;8(g7zU=KnAKcT@VPX7@(TF0}$ss3yeNw(jvGe=s2!z0yU)fKiiMbkO z8cm^3a5T`dTBg_^^aa=hWmSH&yNn~!!&UqLVC!%A1e0sOE%$MWrMl^3xd%wWIK_a& z>cOo1-O424yx}>5{s@(OrVn z%21lc#=dTH092S(vBn1Qe~IAKqWNLs{9g zoype;Npk=Al`?RenU6b=#t3AiU<9}cg*lHQl`^FUy>o8p*xPg5z?Df#)|rgQu4XZ{t=-P&xXr=}4+Z=)=Hn9L}c}J2b>4wsgrC z;7j)J=n+Zya3Q;8gq${VHLt#2|9x4EjS(UdZCIo(cCZ%o2L z@B~4*#lgCzb=Rh14%c%UArmpw(sdTQH}=Mn#hi1?Tp;jn7VF(bC8^rR^EXlB&hkc+gjdl*|v(sv@`qkw!F0WiQI|44-@nnR@3%x-c@}CHhY@d_cth z4p{tc;3_a&exA-Zyb7`FP_?B@8ral?bDLDT#gXfrJ1#1idj_oa%)8Qi(yet#FY~1IkE!A%UHBi z<5!cpU+eD^le0gvN#i+YHq8Cg@(t(OKE_XQvUca|g&e)-#w!K)2SYlCssw+we1z z>%Q4B@9iy4cF=1f6hhR);BFxK2S{#zx3g?Ie>!BU?7&=<*a`9UHW~=7j^kN?u8|6- z3byAuUz=*274>SAdMu;ewnM)JsYh7+*T?I(Ye3%^#V&b?cuM|2!$M!>VuR0U_8pSa zMq}fwBw4=a$G}nFQ|06WmnnAJ1%TqylAh4)haGM+2p!f`Fz%ljwO6mm<~u68rzY>nY2CKTxe?-x*-aw=@a)F z^o*0m&eW@whKJ(L))KTYS~h(Q*j*eIvVm?oZzG(aPSXzeW5~dkJagPoVisId$9LDOm6E7>Djxt! zCV&E)FpX2$?U0ig=CBQGkz-3b2GkM_x3Nyhs4HxQORYXCL8*ghmwrROJBuxGc;rj#72$!gboBEnf;IGAO#ZD`jjnjcF+q9-zWUH}pk)AX?R#oT2r zv*kA+J_=*Fy2&y+ycK8+m?XUyB-gJ?%INxbalTZUBcWS)KgGR~q6`YsHkc<4` zk;uM zA@FOc=%nY=_E-QgJ3;+xK1S3OyJCXYeY(m-Tt|&B4@D7PORmSc>o}Wa0x5!}?al{F ztgAKUl7EHpM-*V+Ro_Nq5(|L10qLMZ67Xm#$H=Py;z9!H-sI13gpFh=ceR}@F5q6r z6LhQGl6cl^IEdzAY1j~hL;x+A=PCxuwuLj^-&$MI?}dKdfM|RIk6$qd&3~O~vTH6d zM!hc*iWHE2GkPJgrUiCPobJeZe1xkHEDf*vIMs4hEm#KC6(S4po7!ESXU{Gm>RcV` za3W8>R+6eF@f2baHL6w)``kPc?2c;-M*ylw9qNEAIy<{pEilIHZ4vY<$l2xXfp;OW zqciuIQ2o8+^8esb^Q9~9mo0sxK9|Ji*b-B@ z>Li#L0Bbs{ELfuBXOA{(iiZ-U+~XSqAYYA5W%7ZfYJh~r+fvHpz23$knw~OhB{!Jg zOIjvAS6vh6K?Rn7%uB$;dR%iyCseu_JjAE^{wgu5?KhUYX@hT{D&%GSF9QN2deado z4nv#uWtA?YkKYjGOkiKlVfVq~iYH3LmS7;pXsHFjKk!KNr>pb-UB$o0r5pa2xb}Yr z6bdi}7G_W>AQjpS-&8R~CE4}o0J}lV=AJH&pc^P4AXNF2mp;RD>*8DfTREdQuY6$m ze05fgF-#hG8Y;)mz)2IQba^y>eLCY6ci7$o!IyeZRNlPQyCmg^hSU?0?vVSHk&&v( zCW&xO2eKz`yml+RO3=bS(sO3b2QU3($DTEh1jEl|&fKsSxE@s`Spp$B>|z7%wV|J|MuJ!V)iBADm!4UHx3vIVCg!01kTL AApigX literal 81911 zcmc$`2UL^W)-D{&wqZft0)l|pP^uzLs=(eBkYb^ih#(LkM1;_rTLBdTw@8r)$dO(W zY9NFJ1OzDoqyn#5@m#yt=5au73Mi z7Fwjxt@cjEBS-h4u9{Ngd-9?*UtllZZoL)!=no<m*R;^uKq#b8Fdc_m%|Ry5C~U>US@So)PLg9x1&^ zO4D1gT@6T1KAD-QZ@g>oN{*HW^&a>x1NSeJRj3D%=f;b_jR<4Ie|KOmcGuEH z!xJd7Q=wmm;rqsnCdZOKmGZsx+&XDyGklYY!@?cPhSl9SCJGGPg_-EWPKl>tvrCoX zWr;dYd>5SWbk!A|A`O##yCi&DYvH1Zt0;{$KhkkKx#*i+m&Vbg;mZ+2yH9UOVkuNX zJ1EHOiGVNpKba#ZO$Hr#V-Ps7P9tCqM;$G;m_Vn(ra{Ig<;p#Igl_;k|1Yyqnv zGs#;QDHBamIMs9b?1tghsg*P!#({}cINbC?gzLmBN^ycJT$OGwFtop|dfZ2%5P7ZS z{Oupg_X{Qq7lr!BuP;VWt7PsPygOx+RX%$ug}L~c`VYYo|6G4MJ({@OhW)!ty9*jo zGVlN{>URPtY|h_qFjBZEy!&-tnT?F(^bUo%`r1zn{0!r&`?hBr&eS~dO+g;#`#!3G zmD~>0C3vlb(aj!`);9b13JOat9&!;-6L!I^*j|zq?%}z(Azy|1Bl5c^bWy6y{jR$0 zEwhTIT?WgQPw2ay+S#+*5NeaL(FYfefk7s9{D z=>Vg0{`HB{v@bA0*9p2Xx!ou5PYB7CveUD8-}wKs&wGF zw6T`|UxVzwn=HG6Wb>W1 z;o^sHCJQIlU6~BQkcNBS(FA=Bxwp z7Iq@>HTl-@uZqhdqJ=L->AruP^sypK+t(HnV34PTdi)XX*iGWr3tC67-dr2!sJ7;Z*(-s!6=B;7KAtM) z`VNf$8*o=Tvx{)3SMDS8>)*R3ijoem4bq&Z??FFandnkD7xvvv6;1-2-8F$Kn7g?F zZPG&jd+h!1+~WTR&~r(Z65VS8byahHlZ?8^!#Yk-&m|D|h!d&^@7py`ZG}lgJ#QM0 zKOUA+OrSIs!cCdV+$BGNOYD}1FBKb!xKIcmq{EndkoUVjJUQ59K$L;0AjZ4gMo>CV zrk+}qBkBwX0X01CHAVKmJ6uIIR@(OB4{zq!Z;>$H{K4B{U`4C6>{O&KfD4ck&>)lt zRg=cfXAi*z)Mjzdmb8q@lK8e<`30NrFrQ|EWiK!Q*mQuElSe}ViZ0;k(H4I8%nuLR zKx$AT9slYoVacla2bz{u(jvMp`^mteaC_Spf-T5QpW^cp+}fwvC_T6gKVJ62)wX=c zcQ@hyxnzQ>GBpfi+UpA!Ws3>-cn`HTWi2^Uh$ihm4adLQNLcd!6HSrZspnW}nrz?| zC`zTLnxE|P&d9{Ib(|Y%4A{u}+=~Jh2_n-OX9mu5EB)ViaP}jokmh532 zFr;}ZHhhU%z^ax>0BPY>Jxld`-i48B$PZG%b*yx+jw5s-KBCJ&T?JLwJWf2|U2((Xs}@A`oDYYH6yVK|P%7L{jztmPMi^Z#{_{Wp`@9kL+X zySMEA@WZFsY%Xw4dq%}8X+s0*CLatiNjslkr!dnjt{z+mDN=fe?$gCyhYxA(mxIW4 z!t1zmQ53#eP7t~Ku(gNaLdel|Fw)$S+FF6FK2WOWLjQ}V_Z{ipMBWrvQ7E+#dZV=t z?VK62y&qOgBZQt5=%ksBGo0dDPaSzz;*V+Xp}xG)6Pb!$2WAc-J1vgSFK@&} ze_m&lL!WO2O?=bWEX?kyHDwny;Pv&TFeY-;+;eJ!bryphak6|pA?$VKF$)eqWN4pm zNbx>iXg`5r{6yKcJl23+YWe*>s{cCorCaZyx^ZMD7JgHC(kmA(G9k1!ligc$k2vWq zlq=pV(l7rj&VF3UJZ@G+Q}a8NWG6jx48PT~^}}hp?=7I}wP84?lTObVcu@bCczd~S z?t2zEm|fu@czADICgBIkJpB5!`othgx{DYE0kx?Q^X*kCpRS4_}?|69sn zuvxRt+F}N4UW_Z>>yB7(0t^k8o0U2SZLM6#9Ny zNukT37hYd(t~DE9dG$Bxs@%5c-ziN=4kuvVcbIi^ue-5R4+>a~9oWbfaN){1zyWj| zO&2=UVlF?wDbm5{@Ro4B{5@>VjXr$i4f=ayE&oj!`+q;k{+r3vGryG> z;3I4<{#s6mmLmQ&_mSNmc(cU{l}b)9z>OsM-fG95B&`CeQA3M5*6XBpz_XU#%M8s} z$ZkSw#gN|h&r0#4be(LUbP6nR@`d>-5a-0i*-s|f&F}b@%eMew?wIqv<;gOZr2!H0Q%;1#fWVb$TBl6vUyb*7O)2} zLJK9+6a9t7sgiurZqIWy%w|X3HH0tUtPm++(qz!G6|&7@M||t%5hsynCqJxasQ?u% zj%*q*V8EY=T@Y{CtX?I;a=|jL#Yt$b6*Y6!#Lk?ZK*V^3?)lw<#3jB!hhO1%7r55P zI@{EuP6HN(+`c|?qTK0_W>Zk-M5<9aTsmB!>h5zMMmbMrL?UuD12zAG(JZ(mNOYJ|4${#oIw zHHFH4SBTw=VsY4eAvfg@Iu>gmC5x^P`}N%VM1QP*Il%M4W}5s5G(szOb%OGi=j)Qq zs2#aOemM5!?&@_Or*&0a6x^A+7Gf{H5Ahr4uS0yhvZhoBm(h_s;lrBvb(8ImTvyBO zi?6xvkk@;Z<$B-0zOBLWF|a|H#u!`nh*PT*=M*OecCaHDvc+CDCoI1D$5Q*hFI8-_ z^JDXUc@fd83%i|@y#9-j$DDlZK?45#u5P18>bLo~f7-AV&yjVp%8zjecQTGDdaiLl zE{k>FIeTK=7j|cTU;Kwh6tGE(?+(z_0H>l-a-8&7(Xn^=> zcD&869BNLD`u@>X4&U{U%zidh)L#Y7?nWXP{(#*6oAb_EtXskoCvtAxe+(%lbHdq>aV@N5b zMIJc@Is3=2>g0M`&|GA3HR3^(>;yYD1B6bjNz5Y!OGJQ3+9D3`T{WhL#Lv@(sF{2< z#U#~U)Izzlv8d!Y{M4oRSf||3-H|kQ=A0o{6oKIG3()?{QOtDT!j8QuJk|bb`cs1kGBvE z?i|?202ev_;WJ_}t?FYY>+o~qA2a8Cw$T_fgSj8M6P#MGjvZR2CSSYs@Z4(2ByTJ` zig1@qbT6PsWqQT+Xy(L-+%G?fWAns#l2c5gLgo3zE=GN zyF4o2;|>xMwT47SQr`m(AV1raXUDKVunvHUpti=C35cAv*Bk$SPP~A%u;g0SfLvVJ zu?D^nAc{~<*u$|!?DrB2GNb!54uB$2a2@LbbROT@;rx69JOCmt^ZXlDK_FaJFd?_> z?;AxBvB#e{6%8r;!JU0)=s%{Z`4x%SgFVq0^Lidvx_f=utmA7c15DxeuVx1ls{X8J z&?fcYm~Z#9Ut${!wrB;y%q)`Lqr!nb zR4yQ;%{X=r)n)pZo56}!eUE3yk5A9a!B!+sZy0GquD!Z2;SJwYwb?@Z3j06zu>Zs< z1lRK=*r(O}PrUd)nuA>^)CkRbpbJdDZ;zJ$B`;ouj$8{);4Z(N`?n;_cA}U)S#MKw zH&Xt^Oa9k0?QitiMuksJH7HC@1Nr*v?F3&B;pBV%%DOY@fX z9NKHYyWo*YW#(k9>9FU>PF+*E_!Ul@EzQS&j^&U)e2y2I2hR4{blq4fuDrKoDV|mH zRt6tGV5!!7@@WBF;m(A^YBx_v_3|RX)i+-J2d-|UWVtM zRzP|;K&)3&tkG*;#2Zp_6oph&Aam5$oHx^u(sRQ7JWo`Zf#r?NQDmA7_hfgF8f9W6 z2cEu*Y&u|K{c)U%B$zc7Ow!u5Pj|tQ(?qjtwBKD@w+CF<@c?477n2@S7^UiP4mB` zYCtp)|48@Sv<67|S#r(lC>uF`Z{)*!&F|&T_IUUh4a7crif9f}ol_r(>5C1)Tpr%S z)#yW*XiZ|_)7qJ;%RS1cd55L1Ovlo2j!LRpgJt_#T=8Kr7VpZD3~mZtxE@DK(S7cA zjZwEaG37SBubqQF+e$wdth%MyHZ`!b@Bka^b_Z3XY!elBvidpSpw96~z{u*QaCD2) zqU^R4iDnOT?kyf_sABGnWDuYeil_Srcz$OoL{~~IyWcW^(FDWWLtI+qEz;(xJ;v&v zJkZ7uyG!Pa6%JdS%f5M5a0R~gV)Q?A>5Q?@bXIG#Bz>Ei+`!o*{j{Txi%1O0;~I{B zR2y2=NFJuv;`4YeLPnnVkI()jO0qzt&S*nxKm% zIx3NM{_4IonHy+t3j{P*vR&!feD>l`q0q#Ocug7{GM1C$JFG%NKk)Fzpz}*S@Tl^f zd$GS=C3Mu^wojB1xSXc;5#w^9VQ6Y1)rKaB*vI^ODMo8Ro-sK2>nk)MYoDK#&#t2N)GqhSgfM3p&1A7V z9Xdi6EG9h0ElWM()EWH*?u>(zO1yK_V&z+M{gX6@!_e)uHyjMZV#qGRkV{5X#Q8&{Y#2CR)T==gm0k*Ejn>2?{b3G~cS)^_cR$uHj9Ckk7VnxrG@$j6WQ;JlD_w|ASwRJY ziU!g%D4{tVKJiA0_G4~*kTQfNJ*ge6#E&^9;P&qaiN6@&`GlamrpwKLDkEN zqy1!Fa@s2pI*ZZ~Zv5E1n2z-8R#d$>Ged~j^B=ij=AtCxHPS2p+?XgaJ*Lovbl$0J zB($#BKh{7_6ZHgf-zMEnPJP&65B|`^+v`gvsmySu+*9(Kp3WY$ahlk$0#T*pg6=d@ zTgHIPrROriBrd{(kY|9OyKLT_+G=Irtt&iyj<)od6Z&tjLX)nN>e-$wwKSWO!=kr@ zX|2~N#m2pgabIWW)$b}-7ehrSnaL5zXUuAccACrKqWXVPY5a>bQ>Yo@Dmq zKBAMVrk^ooh!z-&$8+sQgwD%6$Khl5t|g8-bl3}IcVtV9w`x)rZ4S-t@eh-Ue_P$+oPi0oz_+UXYMERA^nvB>@tBsy zf|gEMv<>s=+nupfPB8C^_GIN7^?Bv{pX$IVa4iwKP zh-91Y0e3xhIHh$q zx0;w}V*G)zS4MCmcs@qKyiANno%c!;>-T(L!;gVQIf%tOM5$y~xj4%7-Z4qNM6fsy z+4jc|mP)ZJg>hx{gmxM9qdZ8}A&3rSUeo-gJCr?jN8u85Yuth{`D$0S8=X>J;Vjn1 z>-N^UTQAqCQ7dYp8m?d*E~XIY?&GI^H|}N;D{u76k{p&J@=q&f4#q$M)&?PJ9w^&=V^Grp#uipEuB>)T%oETm4HqM;2~WrFn_OCOev&K>!_vDt-v5M=cBDM9L5AQ+RX;A(+od5M?Mjn-)LTzf2zyVu2j+)M+e7< zK_6Fza5wdptO0hAN|To%Vh4UE-g|fvv4NWS3(@*M2PNR81$;?M761y#w7LnY)OlXmJN|T)Ik0 zqB8_Uq9I#4g>RjQ4QEA+etFHduYM6(ze8s4fDD#{nJEbEc*>M(1)>{Fs^rbkzwn}T zVJ?U)1KObkrc;=ZMX*I&f=+cPFsK4t&|!=(6&iPC1bsOS9Bhig|1HwQF|Jj%%lq?})-` zKGt^gb_D{Iq;?Y9J13nR3oD4ICtWt}bYvtlbbt}-5V#ivF)G?5R51L|a`!cg_PoKc zkdq>L)Ea91z9xZDQs=ci;O3HTFf8nZ(x-UBg=v#>ruhsVMT{|}ptY8A7tUQ(^KrDa zMnPFF4jV2ryQlqHx6|_u{B>dGj(%*MfMExtNdZ%=oxe~ua2HqIk8`_ko&q}}dMndm zH4L++H{E_5_*17@OUI`*>(ibRu?lT`b#9AO|9d%}VH5fgYB0#AI|YR*fDLTxdDf$& zG-T!=F|5QD-g7OA4?D?da}0f043Dzf1@HHZyCrIj373vL;@)G1e&RMzL$6#?Pss6O zXm=1ojQ2FztqYQZFg}yU)}A^otKYg zyb2$n&+)qb%h@8)oqipvoJ&&H~DunWXiYCB(g^0^BiqRgY{P!HpF7 zX5}K%Z2H|E7W9TH_^MXH6_wFC9c4X}HJGAUEuYsw8t^twhwQluo9M$3jV}e9cmp=y zzkLSAP73YXB?c`{(kVSkW{>%hp-hfLf>ujjT$9d8{0?UYYw(;7G5Q0g>V++%@_A^4 z`PZ&aVg!oB*u}IfOepphjcY8s?jx4HSPj<*geU6e%Y3zVa_$24Hr1X*>-RHWbQNVw zW@ZQysq@d0MXyTsWSCootE`vA_*A<9cjV59#F@#(#iMk(YS`4~l#|>QT2ET*oW_!3 zQY(Yz%Hrz^vNx-lFEr>MXt*B=aD)yLd`9GVJMB*VM?0`w&z>#h&5Or4=fw<8RiWN)vI538^w3^+oQr&WSpwlzVerE1!t zqo{qc@CDLoa-NZ^!So0NC5;#pQ}6Yf&|I9LXZ+r!!ON!y?VPsILia0qWz{hNJw3Uk z{=T1#zYsLPxYOS$1@HocewP;eZljHq9{Z$gPm34uOBQESdh5WbD+`samO9|-68fI` zp+#7m!drwwq}CKYr?sWEvH*aJ#5IaK33i;b=n|8AsCXe9TrX5`5AFBMcD?Ug)o%sskn6piCYIMI?nHJl z9{$J?3QF?!J1o}olrC1mBJ0yN)h4)H|8(rE;whCNy||~$xlx6$Ynl5y(0iz6Q)Ca$ zA!NwKaDzBBpwF1rWoM?IT4{FAMBco7Ywz(~532EE(i3VzBE|R`t?jf*huicvh~SyM zV3&92Y9!&WbB7?h+cP8QZOn`0_m+3JE9J@Pel@xH-DeRof+&O(sQJ5n)$XL4Z z%q_rBpAT5o-`93)NzFCKWB(yjhr>}?cfT8ftApUYq-WgpXKFvox}8+WV{JZgwD)qy zbZ2_C@1r^qx>8|l?WE)*v58!qMZzTSBm3kCY)_+jHWcr2p6v38jTR3}dqZ1>K4~gp zbg0yxEPpGeUe8k4lkoFe2{-`<&L){#QC1dgv3hNzJhzmKv75nX8`zn8^oxx%MY~(f zs!Hx~{>-b)0={QG-D6p_Bt%h-X@U!d)a+FA8Zr4gkKM59;CnZ@=d*#s$4<0)SBb}x z-kObkWoUd8$LmenG3nK#)=L&ptIz@R+&MuY&!L2ntQtX#dA`hEkY>FIjcTRgSuN;S zZY^Qy2z?+4A2e1G;kRVT&c&QMy=&xr!$ZweuMCH{M75>ikq)C?m!`7a)&kU z5}czuRB1$-+>v3gh_mq;!U_anJFEpMOwNL8Q-kAl=+se45Hsny=v0J8PMQ>$1Q)~c zGFME8fv{e_(og5eSqS-RHpKC}n=tjVhoU-E&}XUDy9Vwm_ZD0TJeRkFxdX0|U{J$f z#r%+=;zyv+QzaU*a{=FfJaaioUU@QEy4aB6iN3pA>9>z~ZGb32ll_mnLD z?9;V;mJHf({sP@h+CX&DBv{q<&_t0wwctV!d@{ER4yuWHQiq7c-3#M3v?GhM0+(4v zEtFs~NI2k&nLU1^6-s=}Let>0PF75>_NKcOg``6GNv8yTN;mMfM;U@zF%G_PJYb59 zjEPide;A#TZQPuNNb?XRQG#R~g~wZUD4ywtnFC=(fo^nABad+ly2lnn6-gauZ}}!n z`VGW}Gtjgl7H3hDR9VTrtWe*|gnT=!tTD5u=5V!xaJ<9UgIJl&YAj49i*}2<2^T?x zG{0c?v5m$+I}2&r7i20dcbL|X@{2R*K!qT)XUQW*liD?6EL6`4xM6k&mdf@QKLh77 zy}0fVp=4|iqmzVt%q(ajF|Kn@r0P?h8vTU_w)bS|TLmuD8<2u@P+m#I8{%mhXw;tP?Uf|Weu5$MRFEJBM*C@{sDW((Q9ref0v@z^3}m(LlItDv z$`|jRrwv^~cJPJd7UZfUGstq9ts=A-mPMsOzpr&9RwAxJQe|1pHy>?m#|=uhlYmK@ zZJR8mF!lf{Nz`vACp(*FP7dH6sRp0p6`jEt=F7m{cdOY&bQI~gH)$(6mu2-2q+_6p zleyLxmXAK8I_?1nM?ByA=Iyd_?<(rawN~~gwPDH%a!vI+rayw*;p*k+ypomIm^m4P zf+Lc<*sT?NJu)6OS83L(F{xm!3{?Z=Ph8e@rC~8&MP*y(z-7y_9;0i(ZWP(s-vT_( zV?Dime;k!4e*>V+s`w)p=z;wew_~7MZkl(F-(q66+Qyus{pGA%YQM9BdBkFFb&Vo< zV6280dtgE`(?eNtgim^Q!nMp&n|ID!@c69(6J%cayhnvf-czP*V`8Muu!>{I92F4i z`N@(3#i2{E=?@|e!t~dVb`7NP>ncwAfG^%v=I)8FyhLiWOy@`hZHx znW+=Fkj!tIW>XXW-fXD7v#32+&c53)Evw%uq28MqK~%F^5%Xt0>%z{ znep?_HbH!yO&*(zuI~Pw{aUeSzM7Ags2~H%w#qvaeIk{@M1hKgO>Z!(z3R0+E~DN3 z-%3z?v`|nOi0KpNtRsI)>cGHsJai8yY%zWGx^8w`N!9M z0zW6`_VZ1J`a+^gzInGyT=KD&hlE_(ku`7>PZVF>D{Pi?Zf?;IM9o+pf#|Ggsrac% zh)Dj^W1! z%f_GBYKJ~ozPC)ySb=vXZbVW7l9RStGuRe^-SmXDqay4LEIZyiWRV{mmIr^@!)I@^ zUf$RbEB|?`g}s~gpKU?cbPkO$oFD(sc2WP|?KZLtj(wvX=rzKwtO>`&;=o(l4H-;Xl@C;u}8{LkkIXYZH~aC$2lQpA63jsJ8~ z4FW0uD`rnFINjy^m_NQnXYIrsu(N-|&-+%Z3r_g43BZ2etombv`xi`Lf5`ez!cnza zRu>blF*f;qUmpw*@Y@fhWDm%3N4Bal(yd0w?Z;_IFwOt@F$MOZ8^=omQhJTL-8KdhKYZ?$Y6@$)%aEL1rTvnbWO&;0&Bx82k+DTafy~<(et)-U3T47(IwK zSGt&?zHo>pJK;BLC2-T%QR;X0;1Gz?wa0s;O^U4M4jT?5ygmhWYexq{ynM7qlxf(P z%hPs=Q^9W+>XtvMFJMJ?MVcCL&GxF?==AQ&3}KF!6z5DdhU{XF7r)6_Ax=MKPAC@@ zufz`?WD3gTJw7kHJY@>*zyxA3^%DdnlIWua&%$4Fi9}@8M$cx~8WMf(qGwdArw2)V z*lR1OJ%P&H#J&=Q%9&T7gkrz6wAnE3?bZdr?drkXI|5S^D_cL(rUnyCBSd{=9<@eu z&-yW6^e-zmojFpQON{-IIF?`YN3?IADcSp5SYWhN}9p$cIBx2` zQn2uC{POpx)~S8^O_JkfbA|6;ncBN7yT!~I5oZSYIL>1<_j0TX8({hUB&5;SYD|LP zLTA*7L&xtT{?2#N_q(1}H1uG^1bn{XA}(j>#+F==kr!z5s^}PKAJ*Z|jyG5O)_gaR zP?TM(KZ~i4^tT*{YH5Ev5vOwgg7xa?kRWi_f-8D5eIz>kkigz7!$DE1g+aGJIX@+A z_UrMo?WyrnNEb#{`tf#-5T+AUzth`xet9fceZkktG^I&r{r<)P%ilM^mg9tvJEKx? zyT$Uwb>??Z8QWrSmfo|<`otSw{r+w}mwC|J5c zYOg_jpnGb0^v^%_88oebx;@J5c28F0Yb6uqGLO%_AJs>~kf>DuyGnAtf98Sq4*RwH zxRC4&HHcQWSW&oe-&xvlp&GEnxm{T(!}<8J{8Rf3FF!qBlr8acZ#d!%L0Bm{UhL%B zFDp-NoW>fm)39s`q)iV(cj+E1%K*OmEv^anAX^iYs?DECyfdYT)K9$6v_nr(tEaph zwWGLJhX}Czg)%l1_LyoqkiTe_`5P1O*K3{H>%a0WeIUIrtIi<2%d2#;zqYa+L`~PF z=|Soa|1(F8?blWk^l|OL*YlpBrFcQ(2uc6DcP)oZn-b)g!eMG-N879%4sB)#cZewM zSuXgbAj_OSSR|0(OLxAWpq6%af?N9t+9ICH>?sVKYRokod|^GZdTtfMb17fQ4PBtP zH@EU8fKqB1eZtUF=;vCV^Y#^*;!fIMeXDq(Bcx z%Tr$n1B=Czztk7*TFLTp00s=z53GCFzEG!~XfRmUH*8fX>u;Lbb$NOaubvPIv~FS4 z=}*l(wbuYD3Xj?(Un|{E#(R8A4B=qv6481%;jN9CyS(SJ8>9W1 zb=~pl-%iX2iAQQd%RDDU<;=?F0ujYdL$5HNIOpdLck&tz zG8;Tu+pw-$gLRr}dDXKL=^bAt0bRxc?Z9mh?ekX^zePtX-=$SrGAU3G46?M=2%i7EL(5$z9Uy5kW)S!D7DbhVi7>D^_=%k$L@j0Qw zr?Rv)ER}pHeg_mKNi|^-3eLP*z108$sl4`>bfZY9Xjt4~IvG*s)8G6sJfS9>w3n*P zssM_2dAcvS-SCTOjp1NDUe@u|vK-%iDF0XCXV9|2@(|#~y#*@J_$`McA8mSrWiCLbLrj51s2tF zR7qL;2r*y5XJ$4K_yGtvglU4LV5dBvf#i62<=$zk(dm`1cY*U&Tt+3BcCQeIJHpN% zK~NML3M+UmuBUb1VEWFyYd@H5d!ltMC~kMIA0ZCJ}ma>o?k#J1QEo zUC;+^In;ItS7!)fVWL>U&{HRmc2Y>`kaCnHYkt&hFopcPjg#lcFMXp2y_T+zHN_|y z5R!^lzC_|ibb}^DblukO?km5saYDbmoI{s}CK)>UzWdVWe~sf$e75a1eiTc9)*e_# z%_8Yz9mTq5GOVMuC~UXB%#jQg6n}|OOf6n{kjj{sBjB zXq$>0YWp~P#geL=IX$Q<2=a2mSkPY9=Z=x{HQ1N;`v$6@vYu&+^Dhg>Q!Hei(-dMc zW7OxFW>M@Lc%*i&Y%$fYYh~YDb9UL#)zO12(ZN^0iQDDd<@Oy>2`qV?IPrcus!lqnI?Yu8w`XwUptr5Js7Z)2?*_HClG{H_F=R z*6Zh*Doag@l3(Dnis!JvzFK?a71N`2jw~+&v1dhH25Av}Be|I_k%O7L2E(BSo!&JZ zwi;tIE`JxsDrtm(bd3i3f!$0UbC(6%@gx{-T>FcyuW?|Mj zM;C6GWWH))eN!;Ff)(wBiRx2nEHWR_9@E_9QU>L!P^1x6O%RzS~sCY7Y<5pAUn{k)~bwv3Vx z%VPs%ZV^>~nB`EIZA0G~=CG~+8ekli@*F>sXKe?8M7&5b?TvJafbaGLskyk9C_l;A8~HfJgsFaO%hDgTzo4S#9q@=#Dk zJV%7(CZGs~ofu_bHiR`CxO0&CF1yt>j7!shvj53(sxHT=uJ(i2UNb_{Sr>aGdd8vl zxtLVGzo(Gl0&6;iIiamsV?5d?oKwG@U9A{Mi2?cl5C&^hS{+g8*mn+Q%t?&KmvzuP zSzkW-EO1Do<=@X58DZl+qAAJQ(7tJl=zTije z%R}q+x;a}8eE}80%_eXBE^=#ZMK4u5Xba@_2joFBa{bCYJL7BbQGd+(;P+eSv=cmW zDK|f4`?xO0(XMuvlrRIp_~y`!Ju?##eLTmk0;ialKn>)1CwkND6o`k8Lv>{_ySGEi zIZ;|3^i|(_ll>_*;q7WeN=j0ou*s~}_nBvbpUVij@r;1SQE?APL&+GW8|HD6zV23* zO@p=fb|+4%FVOpr_ay*YK8kEcO8^dcE*`afQR)Z;qG2boYIXKKVn-vs&A5QOFZ4W# z>SLGb!k-MM4k)|cMNdr+bI(yxT=Lk==xYFhM%72Y=^spWWd$?!AeAI{_-aq%qs`S%lLd*#pg88?h?*Oi5Cg`SbW|orbe!OBl~^it zcrUm!>0`*}5{q~u`v$oZDLyIotyck_XzKMIc?+}6W4*-+a)di@q7Ut6k=yd`^l4jF zky4+rjEWVnKc$XneW(^s&NLhraaYBMK$ynBu7$MmuO&<4!zU{@0gU%LybcjD5ueHx zwtl+)pyOZfP1c-zk@%}_L$y-7<=*~{QCf)F$a8CdG;KUH#!lXSg(AQtp z;&hq#;a%V^IY*TW2VE$eb1AoLKjz;&Qmorr7untPwc_hgi#OD~(_PEtO=m{DEYflI z32kyIKG*uRM*}DzBSd$dcUK*HI6~IW-$nH&C_r(vjP9AI)~7-4PF&aluni%)IxhG3 zvQ6oj6B)a;lYf=|fbWAR6ojX4drA`78j2CU z0@V)M1i8IGw&@#XWsDso(<0)pop$FAkn?Vt?9eG$4dbu<-e~rU?F)<+N340|NwGeI zE|RYR(y$6LKokj>7@qdtw*?}mK7AMj+iLbKFV*s`P%xzUQn1fXmOHW8-y&dTPFftC zrtP2JKip^jH^xW$@U|Q9;^j=qBc$kk%C@6+qsX=_0X)Nl(NfXNl;ukCKf0>Se+l*# zuI8Tr;?6`D`{zA>22RxL1f9%FJnPa2*dtaLPPia*(a``z+yP?rd`iu&%y8|Xzf!7q z4U)6#49C4kZ`qPRolgzZ2PjT8G3@p=U^h#)pat167tZF8&4w6Aq3j8QmYS;y8W4jQDl8XMIA3yaF@N*wl6w0C?_g-rzx-q(mY9to=Y&Zq81A5_XRM&J+u6VMb z09A@*#aHwa-OJ8wlTQf4rF|vJP5x}oBXoEhBtT;IsT2VZxVJYEGLi*uBf8CaamSzw z9RoKuSJ)hiZ{ACF@kOHZln!qzk!5GN_f-u&FtSPhYAlZWEOeq&O?`c&uGLfs?{#Fi z&2oK4YRJP{ikGG%o5F_bgJr+e14qm3b^~n3-2w&5>quaQvXbHnbO^_JcMH8vcdF<6 zEpuX$0v?|M@nJTJj^pRr!FNhesk+qP4XlfM8#u-Pc7Z@OF;6>U5rOgX)JD%R*|TBm6`qRb6IIfFHD+InlY%a^ah%$>Vr6o%GpkX2 ze5JQUJel@F=yqerkXC|xW@Y%keS)T{Kx;(n$5CvC@zKa{k)Kv{ZDlmpXQ94uadvRw z)r7^3ZhzYyiIv0z8Dzm?(q2^s)og(>#{3xcn}=6+yfQLr@vkS9?GzOO6F?rbu~a-z z!b%}gZ()!#78-}Lm<*y37m}<&r?qYM5i|i0qPXPeN}}!r5G_PH)r(Of_i&2X@; zwU)E_pw)u%FuE>!!mGb+vW+H@t=_B@D@yg$Ph5Ix9dr3nIICALX88dUHv&CO(%)N# z)x!-&g0NQcpSs5w0U&PcNFpX!bXYks3Mi$32U*KD3xFIW8;j{SRt)R0!j0?;JEWEQ zLIaSTyfwX*$4;c81=GQuhk5lUt&oX%b08bs(7+b#de`MJ;G$!xxi5P5W#=x%%bAaH;Do^*i1;wb?j$UEB=qKV02J5%W4y96G zi}6FiZM3ToHxS$32O}AB&-FxdJ(kJT0)gq+ooA~pwY32c>Z^*WCoEv;@KGr36-e!D z282Hay+AxC$7+-_lbdd^-nj|Fwf1<)@&maF(BXPDP_~YVB_6ElTednGH z&t_=_1rQI5zV!dr-@hCIBi~gWoh2h&0+eyd+Bj1FPZBrS=CUF-$3l`aV(n7D>pGw;m z=?$z;JxrQlHL!ad9>k@^J>&^b2D>Lma~t!!FBKR@=qr&_p3b-f`_wtqk}>Hs5?t-l zYKjIOzWYexeOhuL!9DI~=L#YJRQRogkHO)8_`j>_8_n<;oIM*%E~R}w_~OiF$ZqL1 z)jsE|*Iuc@1#X#3`ppb>NSz2ON$ANQ%XiO)>imzW{C1SC05{a7c)2hFf%Uk#=6Z@w zL5U8a%pMV)_MYY|>MpR<7|)cv>h@7CKhcf&zsUOTxF)af|5$5jU9?rf1yrq~fMB(X z%vh~OML`8*Cn_Q$OIAW4Lu-*L3ND61hzpRF$leKph%yoZA+iz~A&>w8LJ~sO?>>qB zwBOh7AMy2q=RWtIectEX^T@MSNIOOVD5dfMU^=(55yxI;a1{SXvpnXM-*H@RG-{^q z5CAov`&2e>xSs?3x5<}{cqUOMFlV$Jqp6VZnUS9W6U-X^?73^~U0Sq1+_N|G@fk-_ z6-GSHo5oF+@|9MuBgW>SRhc!PrKd%Dyxd~fTb3$`t1bhriETExJ$j5?`?5mtdz6tC zmWk>uY|E^-OQ8T>081?W^tS#43K;_D&1wbuAJ1?l=yUJt@Q zmDkCB6`J86+B(o3ZwQj((U$Vy?Z;IIiUMF)uWeS3N?d!MFU(ZU4c%-2DP~cJ5%$eA zV7u)8)T_^Lg`Ll5kabbB-D!DdIo`}I0B_7U0@#)*yjCRg%rZMxWfBcMP>2VSA|D5m z(|1|G=B>Ki)E6ZW&w+G~nsw5m5}1Ig3uq929nwTeZ@NcY?27TrXM6%mjgXb$-l1&w zqv*BYx{ex?qT4?XUY>WGoGugtu!gn{sA2g0g=;U~pX>!dhIIy8_;k8t&Z2R#_FsvI z9b*J2564tXed;nffVakd%GW#c~54o7mctJ3k?LXiDgi){M+YoW{{U}+`=LF}uw z?pXsWqMBK7%X5r{nRD^Jm(Jj3PIo$x#%C$A+*bE%C2>|A7R?ZS6aK$w?Js?N=^Na33UEvvA72$i1 zJ?a0Oi$`q~fL=;YN=si@z4|u4I#^=QMFItU;Y%FP&MDN(ssAJqrO#d)3ig?;`n!O&-=FJdPzU`04CVjaufqciAW%2 zP;t=y#y7CBF9!2_4`N>b-0k;1IfKq#j%k)>ydUH}d_b-{U*gj=+|6n3Q`Z4N8tBC4 zyYr!Xfa~Zn_=DTaVIR!DFmDxA8`QGGJUzB2oiTg7-^<&3yCSSZ&+QFJc3tvjIg49H zr&o)8%9R4%;YOU{TL4SGe+7f#HfaQV_lB^{JX6zFtkuqk$MU8h`i?z_(7JJ8o_94V zwpJ4Bc;-k9yF9O{D_0ydGU7&!@ZSA1tghzE*&jtp$0yC+FW{I4@@ODMSPAcD$DaFB zb$8c-h_V`3?EwbS^1f0T;xzbv(*Bmr;SR@MZ~}}AN_G9R{bC~|OE{O4=G5@ABEupw zKl(6rmUf?9cXu88boAtFgm?Y^2ipoa z%ENNHOTITMKv;&ptlEb(-8OJ-Q%T`T{OiZq@o?_(jZr^gdk^*s{yZc4tDq@wi}X=U zQ+Nz3WBGTmU1neG$_1aNSYJanTEPRw%ne~lE#MsAd#0GFyrLMSUx1)Xe#?vQ09pmW;jcuYi=;P(#Pf5SoW=eDm7Lf6&P*kz|R`+xc)Rsx?6`(Y|W&p&7*IzJ%P{R_|+D&zm5l1-I&{ zG4)N?vK7IXT+AL>djT<#<3ZYYz)>>|@5VcT63sf5v(ndFHi|mlAL@$qG^%`I{OYg3 zcPD5u7xvZB#jAP8fW2{O9{Nw;YrQ#nv1+dUI4aa{3jRyv{;k-+i>sB-4 z0jlcCwO8#JUpk!%A?SlK`6Qc1laeE~2S3|9X3HL3SPQ#K{=%&{JUQ#o;BZ}MeP%_n zt_1!HSpSd*WLWXr@R;sc!<=HJX%2I1EG`@12C5SvD?i}+MM%&8illNvcRW3<4pwRl z-PRwi`pWt|h{yNp>WJAX;_Bz_HsL%sP>Tth*ekG{{|kC=!k72fRkc-A3@9AvM z?8*g5#Z1n1#xdww7iLoO9i3*hP3iSSZ9+Xz5!Vq3YXe@*r-^$V%a9>PZttI>!hM?-DSfqn~sA&6cW zA8>NzN@#(f75PkCcVQhAUYloz0CRsHek4 z+B^lG^#lzWkNhI1=R`sfX;4g(ZSO^B!QTCkL}8t22v8<)_V{}>)cOE2SR+Du#F9$^ z*2o1=Yu;nniO>EOFb+V1mPlLpy02hQG}*!dQmuc}>ufTpMzH2T&b2g|6DI%6TiQwa z&VXW-K^qrs2=7#(@=rcq+meFE2DY4l*M!=S^X|mXCT$2a_uiMB=M@GeIzEFfj`laA z-?*Jy@CKOo+*yyStC`{368{p^C>y{5wgrS|n%S0%Wm_gC$2@95)o&7gVx0E#z#>?$ z#^twOH}{fc8s6bZ(yh+q-wpxxCtQ&{j`Rk>J?6wyc{xb5Jk1ya#T0*OOo+GpC$wy9 z?4xP`Ak!33hf4B^3BqS6{RUklS5#1HoNgZaIb+!}SqLHW9DC=M*hhT`&-6-P;PmEfeZ4I7iy)_rqp7kNmb?=R>rCB|uY<$^;My8RZqf!8AQL#gx zuQN#2r*UsT7WV8i+&MB{lJN?_d;X;}8GAr-@T~U}ceR+{7`39c+&DZ_HS_1qKw7}T z+FZ~ju%dDtZ3sx@p&?PkCM*^`e@Rd(?YQ$iwxf-*qqV;%|CNf&J+4<^ivbm;@BL1K zF`p3uCP>6O+r6770m5n%$#a{3{3qo<>s>LWM28;irzADy*Se_&--eUW zZFcl^7`|PK;+-d&h@0#~nX+fg5=~`2C(}?nWug;SDY)5^+#pK%caw)`C#sWGV|~H< zWu;8)$Qr+`hq9|6XdXwE^Fh|)nF3NvkYfYLCAASzA8?jTZk>D--T3CIRwuscMHdts z2fa%n{5-xAc2`3PlM0gj(`*VglG_vVXvGWkPLQ{XTk&Vqt0((p4o!}J{$@|YD{$7|#tP!g`C4(orgoGK_ zT*m>F)8+ZyCLm6T9?adDnP^Mk9pMQcRRGK^3KR^n{8&(mTlHWH2FuoryT;8VB-YHX zVNQ4`>3~p#g~#444&8Y2%FBwlL~2!)vLPfdL$b_(Z0jR)b-JF~=v5!^M0elFF;{Q5 zewDQH$O{~?LSB}5XGaG=~shZzgovb*t@kg^8(R}){ygb5W zZI@q&s`%rsEJM+2iYw!#Lipav+?BL1GJhc-7{F;gi_)d5HVunLUSW^wg+Y$@9YXoXtP9WIH+k0`F*Mm7Wu9b{8y<+kyquq*4;+42V`W`ER_6fi=Z zR04}~Ehk8C@I#)4nADi(ym?JFv0J@@H|y=57^l=ovX*^G^({+Qq9#|8jMY{&#r4Kle;*4P!>JP7rqB{e>ZVE}Lz z@ks?Nw=-$?h7$Nf&Jk$4KAy+m8}ZyL(oY#+jP_wcGXU!JKohOW)Ih^I9wWMKIx@Yl$=G|@+Qr@dBfUFE4(nB=ZKr_ zw=JgmB;LpKSl@{vb^`rEsEU72=3|o{Fo+nT!gn0(@4a;(wgu(jDQ;uf2I?AD; z%QG!R*D>9NxX}72fpkvVg;vlpU1l7z>YPufm<8ZN%n;!^JE=g^*b2-)iii>T!LSy;fV+l z=SrvjbY0>%y_j-ZLyZU(EijO7IJSY;NyWG-G+5NTp_AL=zEjo&%rRlVby9}Oy1J8n zZu=KXx?+!wPA}BgQ)vdEoVX3RJAF-#xx0GwhHps4MdmEr*5*|kB7`=R-eZ`@R`o2) ztuzyx=Lfq=d$IMMJpyuD2-(1j>d%~|AgTeYA7n0Gdl^D^vQG@8uRqhY#`Zkc1g=PU zVf?@2c=A#CRz96}DQh5Zo%A@FmU(ckoXW^Rwuz+UykKKhW_+GN)w(2nd0~n|xYyi7 zRr(75{`6PNGb3YX&1$ajj$C%rV+w(yFh`rMKoAZ~)IbC~YlFBJ!^{aUapl~VGMwV0 zA-#Yq(590Vtnre&Q6G%|njG9QGd(lv-;|QMZ_-1Y&BRAYX-AV+pB)2Pm#Poy+Bvc; zZ#Ww2+X6^e`+v5bTWK4lM`c)IQz8Z#oreY+&kXLjovsADXMLJ{@To7*BzW0r1M z`-dyHg^Tp)mk~=|Sr+^e&aq-cExyNrS#H&Y6WQOfyK4Novv7OubDqr7(rAew!?jkK zXqK;YaLnpLX(h@_AgvYVFr9b7A6#BAT%}y5dxou?nTvdP8hB{c zoFhI^YX2Zp%WV#7qfQ4o^IjnRd!>&E`ivC(c3>8FX}+ptJ=(h=**m(8&Y_injfZ3{ zDRAf6&|(mgEhMk~vYB4{%rg1=!(9?N3zNgYmwB0wvkw{|Oct1@hhxHwU^)d|py|^w z4fGj<7eK*c0>|Dq_N#yFn8~@2>cI&nqBx+3z$yvoDetWBG7-@o(>-x2KLcejKhr~? z>R-}@R(4nBfT0b5d-%S+Rw)W*`M|3{m$1t)9b(>Wrb?Nf^E~HVq?bD728~npRbPD} zOx=$WVE3+pRp)vP%_lvSAAn#{P@cu?AVqAZs3a29yJHpP-sl$vPTh}f42liQSX>xi!Nzp1KQ&?rEL9CJ zT-_u#2)34B(t_QT-5$7TvZFhbKR^pd0R4{Xt#XOYZs#tnM%C71^18S{lf+J%uqs>U z?C0B1!#-#o(dww@RnP%^;r)Ojcj#CHJFEG=)s1(F_|Z(q%F!FeO~5!~Wm(=WDmf4t zT8hr!C?_U95F^5oY~XwIUB)usM+ojMo!F4` zlGIdb?DNH$$n0qegGrx?CD(kNQ4#-T99wbT1)W4G@N;9nqWbe~ z*$^Sn(AHT!f&(Ol{r4?wCz-UMn8^k~_;*a7F#oS20s$a4bL5-=07H>pAga=4V-y9D z4bxNtTA%l1BSPGi8-VUx6^-BUEw`3C2S&fz|LxY2DMt=9>Xb-9vLU=aIFS#g55`gY zdPUU%J>*^z;n&KNMGoOEg(VZEvCTWd>K-5#SNVcSHoyx&0|IaXBZ2bXr5ObBW?f3D z4AiV?zhsbDmS<9_7r~}DUD7l}@`Mg-?Phggkg64;d>89T!bMwd{eELfl^ED4w#bU> z!d6u-%d3RfRy7;@1J*pR=6B0@E9WK7J;trMJf&?J3(N}eazKH$Q7@} zH~QzS%ysOyymtnDGn%|Y`1$dM=xVwJ!C3XHYAESR z6M3LizJU2c<+zVZ;&qM?iFDr zwaF?}*!#t;>;IazBxfHV@WPFQE@f~v1oR|qS8<@8As>ONIsCzn#bDZyI$*LvwUIem z9Su}Wexf4aq(aH?0;2$8<8v#4zdO`5M81M(kgi~#QbKyZptkX{JKQX!uFxH1K3ghB z7F}F%K5D>?@fa8`M8B#IK*du~<~=MOZ@<8U)m>G)`vZyIF%7exryHoI#$P`el;se3 z54bLb1&B^u37xd!C44$g*LLG+)%f8q?6KIRh|Aun*>BD#2XloRy=1* z9)Soz)gD{S4&QiLXn=Gc_>t%MS4Xa74LR=$E|#BIdi|R8Z6utgQK5u7A@LX2Jc8Th9&*1RePBPn0{fcnt z6#y8al6Qsk7Y>f6G?h)o1czOM9U!Rz!Y56=vCKi)-<@9_iVPJUB2?xs7_#Thx&-}% z?Kd-G_#_n@?m`P?&jsG~mUrCxXz?e(4!@I^LKR={g3I74oY<#M#z`~u%O%xH{qj^ZEv_%<{yEHK zGcRYH?9NVGTZl0Sqi`|sTQHZAnT!<>SM=zA86&7J+`)%InOzP zhE-gvR_9k-789tv3v?mom&azRK{s;P(XdolowYj9JCInql)_dPhM&G(pXo8^Q$v%t z5yKbUrYo0TlNzo>kSuALh!9o9^!j(Ee=(t^7kVkwC7cL)Q{D>AYw?Gk%AXI%&h|kW zBe>%re+^ZrKp!Bt8MLT@b{-iE+z|rSE^?yeb7hL?PjFXluXJ{@6jQs^!Wnip;|sYx zVwr;Zd5f-o65_>W5kIrsIguse{Cp4*g_O}lT+vuj?#D{gu4pd!YUZ`q!pCSmY`sgG zJvRsxRqLP{T`tzwu^<>usZhmix`YR<2RWPOyo{`8aG+T~C(`qn3ZuR~;j{=AtpQ_g zP?L9BLMp|;(D(!Ax*8F;Ft3!Hp+(Lf_;G`F!XdQMUqqXbwtuuRYmDX^(ofVT`0>91 zz|($kezUbL0!-(^&Q4mDCAf_R^;53=O*~w#@3`W5b%E=NjnP+rMJn^ABcedT_eq>O zOZwnb&+it=?BLF|Tmx#-o5t(hG(+(jc$vT^CmeYhgj70t5O$hZ?ri%5NJ`v6u^bqf z$Ls$*gxl(Pj?Ak4=_P-Kd5S4i^vw0fI!GTevjl1_ZS@d_Q%*Fb-F&6It?aO zVy=XXMkFDQLxZn%GwPIGY51Q-Zpp_0?avhzo@BiOT_mR|2Pf2^i_IsW*wdz<4!X-u z<2imA6pf1vXxPIdfolBsAD5Zwo3j;NABWwIz!`6}H*7+2?2SP@f){@*{CL(fz$Ta% zC91Di%DTBNw1>;JVXfExIUp`t(NzwA^yYOu!(d}yM)Yy}r++c)cJ+aJQ3a@Qhd~Vm zet|X_>mB?G!sBJ&at~5z@cskrK*|@A2Q~1`5G5~oHy)A5N(G#F{MqM5u2uF*SHd`j zl^Pw`00DWQ3i=9Vw?QpJ&H?=sHiQI&t;$@ewzFES3lHYH{1Hl z^pMDqpa{rm+BX5tlzgiYi{Sv=I93=hQ<-8@B0csKGm~{e?_qGu9Kqqn5}4)B8pU6Q zPzB(k7-_m3w09FVl6N4IXHPk5^Y)zS;NDjsZ-YuE4qU{U@;jk-VnufG$5?<8-&u34 z^1>0=lg0m|F0GrSYO}jPkDif@Tx-i|+TRLo;u#1uhM`ux==L{*AFot-+XRF9#I2i; zs+(pz1xG-EboUpP|Bj+6ol?XJer^{GxhkjpPA7(@f+Whs#dS?H#m)02R+$b(=3ntp zqBl9iU7+L0@NHNofdnd>7rq#W?J^Y;(&n|b=J8nbQoTC7=0u4fy zKsXNY*~NLYNHdBLcOs*)%j(d=r#94}g#70^W=Pp=%J83a~~u zadAye5}KLFEv^&@f%b-$6qeO}c8uUbRwz>G}Xl)r7II_%asi1X+Ur5-YBwMye3wGhMR7E66`W4qu7Cb+Z@{|RtSQ`jGwb9HN%DA7F;Ere)%l1ptuJH+u96q@KWk*v^`gjrd*5+k;&im zF}^LYymJb%I08M(TW~?fjAgufF_lcf&cCL=jUYrVSfFjq(^kMvK2a;yjUANo2yzUA z;p+mPmY|h=SJL{{a`qlTvun9!6fCEAK>?5vf}1nCg=tX3Eqvgbs5rfE1MJBG3z3njG|9K2tOk#V^pGvdcolvibXrq8ieyv_(PZ#SKji1vT4{! zu^nw}`p~&kdYonEvjutO@aVVA_gpU&FM{pXoXL$nyKrM?0b`O75ecoeRie!PvN1w7 zd80HjZDqfRd+OA{PKHecfjd$vVmDu01iSDMYLxx3iz7;=Ur(fN$&2peR>k2>`$zZv zfmv~~?Wl26Fh==QR{yNZ)4{EJ*pcCeW1@YFVX%GMq3>QkIj3mmwsMO&fgru6NSW4S0=v56KfF*7!d#(E_u&Pu4MD*^ zU{hVSmqlYwL#(5i+0VecspECtBx@Y|o~vIm>}qB9zpT)Y8kuzO>a%6ma=HIJyOW?w za)kSeKG`7g^VeRzOqi`XB#GRYRcV>F1lDT9fo$xr$1$~;;j%dL`&<^l$fyR(G@Jey zzMw=a*k%@2n4~`rN0wt-u36cBp*DDP*1vDYa~E@=6Q{>;Szkzvqj*@MW?c2E%uI5h zzhF==b3S2uMqs;`8Zy74azIm+2MGYBkMemzB$A9sSOYlzyylyiW_O<9rPr+BYu9w0 zqF&izNG>2ul+>2P;n0?M{<~%2GJ*UWoh?@&eIr9+up*ePPg}TmRX(B5EaTZkE0{vBoA3@5k;_eZDh@Dzj(~xcZt{rYaM7T3?Z5 zKYwP~%+!mL_)vNYb8z1Wi|f2jLw!mI8XhtoN0{B^XnjSz#7`uch@Ng|Psu;_(X9I4 z?z6+J*i|85g}0=n7gZ_k9IfOh-Oi*4Gr88EEc}BMIEVu&UpT<59dFd8O`S-yJVnR0 zV3U|TLTY?m&n#kOIjXuy5%?ih&A$G!GCw{>t%IzWHQ$VJKPv3-Gt#)JWi7nzX2{y% zL}Ybz;4f(#VWSD^uT`$^rqr-v24?#?SrTQ~nI(*5N4z-EiaSuM6WnS2JJ?=&=a~dN zH@UQ0x!EZ9xx9F>K-oW@XQv_shQU&;G^+54&z>8KL#nb)5Vw1BOKMmIg}o(Bs1z0- zi`pj_v2D65dDlow%l!~VlQnIF7_2p*-Z2MvcLF;lU3eBca{nO-8c~UwYwLLd+lAH~ zc^4-#-T5p{Dy0(=H^zFEZ_15lU|xpL@(SUt+m>9d z1R@F22Vm@~xhX7>z=|;Er+q;*Jy#`pULK*Oc_P*YH&`DAC##v`O>-8bl}DY=*hxoA z`{1)gV>`rSNZ`P)A%o|HkkD0@vs;KXRUED5^3b?2g`n^w8mQU?%b7UVvzl+#vT|fo zG2)wfe8NT`{)njQj3x)9&Flh19pirtMHN9~V`kR+;#(&Iqy6jfi&D`RhV|S5 z==|vo610PdMfACSJ7BGAG_p4lg~3f_IjrW0hATNZ+I^SCPVS%8+R*boDCOw1wQYv^ z4$7ij%gD)31k7)Z>==bFkQ^ZWlM=rNU)6bmw`fFAAq?R673W4(VMi&pJ<^*hVeb_p z_ZPs0i|N#`KD1f>fOPyNAf-Xj$iunEp|I3L{~G6BP9?*_y!M&!CPRMe%sR(JiS+{g z3XZ!MdK}ACqH!YQ?rwvGX0?bZ+67)#;uVnOn*WcDrTvP*4aLn-(KRBp%C&+l1e$js z+yP-DZvQpc(kQRR-SP@Eo8eYD`7!V`EOo>G#HwU`kV#5AMgt@MJ@>_J9kd?Jl@ToS zZf7^C1Y_M-yt#Y(=*Vvw!^4=)i(ttWh7^5IRY$n~@)lm$7iL(@8WbH}bT;^l)o$1Q-)QG)(uPmZc#%pMCelQdl_fxf+>uWn@a^+PJUsW*0scK+5)oOOS=%3tpeXk{)u8w00**nS^c&Zq|c_$aHR?jU#5ohlgrY zF!Z__uAkJ!!Hy5coyI7p{==};*{bN3?D<>tY`DbGJ=WTSFrO{?i*GJaZ@|hmkyyg1 zBO2Uk=7nY8>4%69&UCX={?Fc-ppj;Xo_{bST@*)I$qZrvZN5YgU?$Yaw+5iCe}vxK z{)dByx9TLMC|~G!9OG?Pt{BXOUdgnXXE#KqNdUVa3%zBDfta3NJxDmSN1xJn1n?6t z0L|z>snHBNR+tsXz_viV!^p1~TESQSZ6RkWLrEkDUOJc$zYf!$5 zMl)pf@L)wgK8!jx9b;)&P(aw9wi-5iLt{;|YRD-_i`fNmfZLGG;LArsaOjF)AtVps zh+@H53!)0u6!)yCD&5SM`+ClbLV*A0`R?Kx2g(XswEI$NVH$D(GZCWPoOi!TaL;LiquP>c5xZpB7Z!`DKsv+`6@a_k6H;VLx|IuS`fQgoul{lTgZ66J2=!tB`N=yK8-ECzN|j-K8Ic=)EyG; z2Zr%vi@$NX;&c4UeudvDpd@e$`2p^l0KVYef0Segh0iV1_Im8{ei%J)o%TKX0mP4p zx6SQANHnmK5CQ!3sPH>ARMY>QAJC5ku2|8Ej4*Q33jUP}2Vi3_b>!qV;fFL{EG#2t zUP*s%%;)<4hmQ}LqVOJ@kaxKwGqR*Ugu$2BHS-qsGAtuNM3Exgt0kDMIX^j;2wBE| z`QMTi=X6wW6d*dq6p!T7_~B1e(6LF<0>V1-0~2(a_p9$oO*=vW?LUSBA0x3SkKfOn;V)e@yoV`;nHiOClrow?o-IEFNvF)48$tA#lU)#zgTZi20LPI z{_n1za+dewIQPGnekLW*YHVlYT>k>Q^9zU$in;>y6_cjl?0|tq?++3LvFF+X(DcOq55wj2H%7hlq;JA z?~FJz(n&TP?xl;dZkMJ(VOqikaAupDut-I&pQ{|lWLN`DdeP-$2c3B8-xFiqoy8o@ zN>k76AkMOsG29yvJ1hyLcUk4WU>)!D=+AWB^pfa_L&&wOK_tHLp_b@$CQ<1HMYDPu zhZD$`rYSwW#5Nh;DKSA&599PJ_vSrp;+hjA%!bH&nRK$TPJ^)gF0utsuWG*!r;Ldk zeqF6H(NIrxvr}SVvE@JEW0|O?O?Lg6Kxo15XrxaWC%dg%Sv7L9)b$48H393$ebXg^<0qRJ!i(PjpF_(RpX*6EjM3v} zXw!B=dwi=!u<+7#=cPv;W#40Z7CY%*t@D?$MLXGHpA!;q9FDxp)u+mHIB9~x;>t@&qP)fNIQbjwR`$dh(wSSLAHjCqR>WfZZcw97GKQBK4JW_p=ioHySlt!F|Jxs4s zy|YkF)C~}HfMLiWjIriqWOnMmNz;~Blkzt6!KH@J+r0)JVgS%ZL?-EG7krh&Ak(1ul`%bP2`q)!9cIA)HtwLRdZZh5- zg?LtzJl;mPr3s?@q|0Q`vwy1182}t`BkQ=%29b(qi_wHB7vm=J#p3_vu0MRjv=13~ z1f*2^avPVO^WVOEMGxi_mNg2Z;h}(H^)jvriaGO*72Lv?FB0w_n|i=Zz|DX3F1OtS z9c8at3vRzFTegpIQ5L(5xZTS1G@@m08&r?lbGhx;QI27X00ml_}%);66sXbm8}Xs*9*wi%(ve z?Om{fyw$503A2q*M&}!(xaZ^=fqOp|(?emloG@1=Wc8dGWGjnyppiqES{(NQKBhJ6~T$ zq*zA@kbi8AEUy`>8z9AWH3!8(aMd~up+A%@(_!f(UEN`|?>?eE9WN1;TogSH;mbeW z$+kaqRJNy=(RrVk5}2M=+st343+&-O*an9I!WVf)G)Om)wI=B*=Cu3Tq`x0Dvy73wl{}WJw^GtT>yf_kv;FuK<4?;{q>00O+3lgJ z&L~6&S1qe2QI{9D*6ukIB9oYTR}UXL_1l0k_z%B*4@h(!|Ao7@lql}E#rK)@%A1<( zioZEZL+&^F!SEguUQ{j2uwx~;s(P@>q#UGIKeA(tIS2C-8r&g+~E6wCVedHb&P7a(aRX$K>%mryLgj% zJ^8S!S2d~~*yOv+tUt89Udy~=Jo#5%^9HO}#3tt&$dvcKFAz zXXLJA{py(jt?gt|B#2Q!$fIxTBWWi*Zd(Z(JE*3S&nw|jtie+I*Cr2)K(&u5Eb4ve ze`RE`>y0M=kK?YOd+thT49aM6D{;;$7g5=a;>gVJ`309)nG+pJ4g7Hk=ubN z*a2;gYF`i1-H8_g^Nlw*`bPMB=Fm$ZH^D8J!Dh8=Lmi{i{~+qsBG)Mg^+Mcx9}=5k z;hecrA2te#G6`Kz7ihzlzQSH_0-nda7hco@Dx>O<;OudfSIIOjG377sACqo9ry~`U ze#Ky~(-PG*dN6dof5%JyXROJHd}8%Csm9p?c-UKG$gWxd6exZiFRcPbM0~3YLQ%C~ z&Ke`~OAl(Wp0?uFYlffSv1r`<+J-szN?u>R&)(dLil1!_gn`wUIukEs@2cyM>gt^g zptyMx=3BJk-|KWLX8&9)!HXd*BYUb^)YD_K=;~4pv$g><@i9Ay7A1Us>bF!wBVD_7 zSq!%p{^yM*94B}f%iMa4RqP@U!R_mIs_`9QG?JV36=oA{K3%Kfd=)YS4Fdh6Ag_?o z0afm{>A+qd(Qv9{awxX+$xkLfZ(nP-HjA;pg+IR$3t40Njfsy-F4cCPNvs)tm?V}R^QE1BUK~-v z!_V@V&1nPzmlJPzA=~soK<&lJPp-tOun`(g#+x*V0!FFfbk(s8%orq0{KWJ!)tGUy z`(oH$b<}aT73EbkZ!lamee-wU;qCQv>-ygD<7Ejo%ASdbOD+|-PQuF+NdZkPRixGw zNabJTZA)SqlF6!>qX1d+-WLEn3)9F@aY4$?U{>h+Q7yDr(TDFI+-k5dx>vYmWv5{h zv%T=LZKjZXcTzV*Ib9YHW-y|fzbc`R%Mvo8Ks_L2r(Okr6%qwtIbMngvdt zSQa*CRonymJk$VX-PaQ}QNj%<#Qi_qnlRWA{?I#!_p^ZaU4cVFQw9i{@D^4si#&jE zZlT!vbH+}vt57llT=1cmur8@Ra@Hko%AT^6Fn?QNN89W9HJG=fw*JTK%HnkqMZ@>o zXu50SnjSPa{<8YhaZ>0*=AcE2Z&Twk5QI|`hXJ+EW*t^6Yu-q{8DgcD_;(zfW! zs>P=6SSdYT*I?zcH+M$1`nVkcBLx}TTlmAOpPofzB+csfnR;M@p!L%`#nfRb#obDL z-LODErVpLZQog3ZqZmG_`RVKD7TFx3&ZTQv0W6+t=*S|>5vW*MHEqAA3GBo78tQyV zh}R)(+WtN1;T^_bhcB#>rqN`1`MZ7B%N20BcU1c0cj7xQW-Tq7W+y5x49X`yex3TA zTEYDC^{o_Ld3Nk8&AdWSN6S~r*C(_D__?0ADeV^Sx!IaISpl=#zyc#mVEV;t!PaYl z|L=MuS+mPfh@$z*u$%KQRxf>*B}|Zb-|fmeetnC8W@PPf;sr94SR@)cVb5 z(X@-~Q<9^wwVN~t{ghy@ix1;w#uLevKO6sK=CStZN(3&93-?ApKE8i^|L;xNIUCJh zJ{KCdXe)S4X!HV*K>3Qz;j%3 z-j27;sav`9=slyJM|eVX1j1MPv^<@KnQ`Xu zBhDs?yOA}8txyKdMHE&kKlta_As#4_R={qjs(oQr9XM|J;mjfKgF93fzWvW51rrq& z=uqNp5mNr>Rm~4SJZiF5eZUb{F}vX?UUU0(DuvIVA$mx!v;b$BUF~x+nX3ZT8DyyCO zoBNK_tw7=Gg@z364D=sdDIDYNHum@5C3_kBMt=Cg{}6;@HX)ZO?`Taa`+>Jg1R3~TJ>-G5$?|ky zsi!quI9P4Unkxd^l?ORnkM=zJ18Mv!^I-(ycdq>}NQIMYtZ(Aq@A60E>6n+oHE~md zn(5Cri8vvTXyCXd-#kpY0~{R<0Z8UD{u)?nm}b?}R%YJwg)gH_F2=D5J7Ymiw8`4> zmNY>%L#iLL`~8B>?BO^Ap0#j#ag&`3K>-XOC{{6>kW^HY0SQ1YTMQ{=B&wO$UQ7*8 z-P_rN%!Jk521pkeK=ja3c#FeLkL;=UJ+;XFIEV?#mi_UdTs0-tdmKKZO)uaVzz@x&Zo`Ctn8QmIYF_5J;~HWEgX8)`Ey))i>^wU z-=b?Z06bXZtB)J^HS;gt$*p09jvtIdtS;u?YD}7V_!SJ6dQ8KMMSkAYY2)hCi+Z+L znFUkp&LGSKR&yd3YPs#w=@FCkYHqSF;V8-yfD*?wwZ+z}#io5FB|v=HH{;)%r0mo; z+x`5{@DJN5X}^L!`q{bpocXT)z-hgQ%tdJa*Hlp`7o^L z?l7%yeyCz>$V>pF;VdaE3O2@=SHdUvr6zo+-S{`^?-XCTf1QRXR3vmcdhqmLQdI0)+tZ zW6#Kn@{ENNZ&#CkeVwFOfXRp#rk~8`Kd^#Fg+ohd*@gvFkoXt5Z)ff##QXw?bA_Fl zE?L2N=K!Y3Ud_=kcU`gUR^uv071kfeTw_l}^xRuI0jAAE1u5^M?6Cjuk=T6FyP+n)?D4o_rzPMcaThh=^&gYeFbreL zSVwhHl4MT|?unFk%+&8OI+!>5tdD)Si?V$9aSZ;Kews_M;#ur)(;iEDV>*u0@pNJ} zU{C4}jX0dErnoKiysR_XcIWK?NayL@LM_G;KD-+<@2KB;*^M_pmaTje-a~{B^x$S% z>T#Z1$LC#kkkQ_S^Kb`TLylvM1DGdx^$`HT!H;!i+*`T?4glCp|Gw3Fo?aDLSUmY> zELe4)cDf=3XUFZZ!WV`236MR~T06l*+e*b^^9WO#(9bd;g|vE#k$bdJObi?^)#bjshz>0Si(*|5%tU-2P8r(Hs|@_yK?PC1Bx9SkC_ z>vT2}1mYhoggeuGo9`#sN7OV!D6gtNk~6#K|2(%l#x!~+g@o(sP#L8VPp$scnWU!+ zsFjoM?YgtppSzbm=hCxD3$)-YQM;a!55QF*U&(SC!x_}*oKE8nq*G@dkCugOj2mzT z&y63gygYLs$J|-7%jzRIMS-Sxm~6@CoiOXgi8?aRE%G?BF!0{W6g;Q<96rdFAqW@QQ(2?qiMv z4H8Y^LV4g+jk0Zb#6Gdlg4QBGEmlO14y^13wtblSkvS$-yZ0yzY@p+k;{R-Qg5s<m;?p%arzysBMOWFg^ebw3A=x4BG1vSKW3mqHuPud!+?}T-4Y5M z{or8{fQ*SY%&%o8tsT$7rQ|s9%vrLUdsi7&fD$3>n9145(DsFq7wpa&;g3sDzgU?e z#wIGWhW_RUq_E0VRhh0AtHDgnvs0SK413U%$(glGQ{-A5@^2_a)hCNRN#!Arhifq5 ze%!4v}^0CZ-QR|>1l zgC19>OOsC!0b7{I#4>>B!dn2&w+w)&Xg>QQG8GkRkb9gNr|pcmcM6jkQE z3%NwxEi^Y^PhBGX-V;7BtNIkv@EwDJ`URYIiJGcU^2{TspA9Cf@#CsKKqTZ;H6E~K zTw(*DpiL&xeaR(6KVhBR!B-)!f}$%}=>wC>PZ0-?v{$6= zV{_C6QzT4!}C0Q+WE;fjB)J6U^f`~#qn?GLLf&e4G# z4IfP#eiqex|CSiCqJ2M%E^r(Lv~yB8xVy?hCQoh#OK89w*r6VDXR_**;08xa!mh}4 z+8RUl<^|HCo(i9b^#5840a`Q6zwG!1zU&pAcmn%GOJ9*UAXyzu?J4R$(5W+jHR8-o zXl6#JYR-JX8+MI_Ng}{ih}D(h-5_1XF`M}PTeSt%!BXEIa6c7x_JBq(eu$yCTc1g@*kr1#}=`GqUd_ z>CoR;k1knFp>fRi=Oyb(m1bWY12J&>nJJ$>IL|ONNEYqiovB6XDO&PabTI9Eh!X;} zx4>yV>R`_59a`ILf03u|MU?AnFiyA@m`ld~%YzDbLwXHG{TMAGiw?#sSza>7ms!_# z0M%_Dz!>9x9JV*yybRdeJkbBo>|!TiB-;HLO3cY9aI+tX#8EK)$jO~sh^oOac=gE~ z!@ZUUnId!$3kdOfNOi3aUtV-HU7?0W7r3NbPv+OhWDQH1Sdb{UCX21*OtFPYGkve* zx>A6)Vn4%{wm3H1TQp6c?JuM83d=as^&q&N1e2bzGH?#=B$~;HUf&dKotQOeR=Mvu zNyUNc&Dwx|fCFwu9Ym1!(z?IVBpg_3DdV(i4+tIX=(Tc-1IJPpuQ2AJE{oh|jfVx! zD7ey6L_`}6pyYJBE;I!~Sw4Q)t7#h||=Syu)G z`NUZ9jkMg!658Nla9~-f*m));nPQUxMa3;R`SnSAcB5@z1Jv983`et-(s&C#j6)am zrLUvM>%z+!Kz!Brh(pt!GdpRx3>nAbBgdlm*43F5D&#G6(t7*7X>;D%1s6e40S$Pr zpb@i9Mzqp`Hbjd~7$CgOEW^)tDi)T#x6eHfIxBVMW8HZU!gXRqkFN&SB^% z_f+DV0cdb}Ooi3vsl>;2TGfFO8ZMF1=J4NtJ z;<%8$Um0my>W61WsRc`Qpz*$ng=iBZZaiEB9l4^g2))=s0$Gy+S5<$&76n(RNLg3_ zbh!hbAwgFb1F(glON}RREP^Yadx-AfQp^bs7U*{YL{D(_za!LVL9^?^3QI4xzvo9* z4WX)txBG&8txoGIsU)uwaCn77TO5h;*u7OrI5v3p0HC@0N>z|0$CsooU6}flSRu>F zO>)78HB0?)!<+ECai44Nr8tA#N;^qm?`#}RolUQ}d23mR_ z4ONA%&_%n!lNrUh`Y!^6w(r<^p+<~fnZOr1toZ7}gusxvy|rbupHc0|6LoLpOcSRV ze|lcO|2-ucPD;bGgk>;Pot+8ZlL^vaPWKey7Sg6!+Dg{W?zAgO>7;9r;0Sr5YT&*w*t5S zyea_lBA=C#umd${tu*-;!CiU^or$uXQAcHma}LGa#>LhSp4dS1wzz~|2bN=ARo;UP zT8K^7owpavYm;sA#nz{$-y<|c8ND4MC>#%gws3rS!n}8YdC)0G+KHs2?pIu5vG1ou2M4n9diX>W8KXHYH|Knd^-V^l5lC zo_x=f(cPU)X|7~KSVV|YoN$~gJr^Gq!Jp+F);#@4DQ-x+FMPVcW;`vCs^AwR3TWz) zH+U~Lq%g;yS8B+lcETw>#mnSJwu;y7=JnAg2C)VG1zhN8QIcsam+lp_I>sAed;#v_ za=6KoyIL44zNsKQ#QqXrZvgXR`(xK)ZhQA=j>qPe<2ZNT3{Qbavu4H==5)DEUw?0C zp?F+2MKL~7(yJ|DS;?Pv2tPOe3_QW;x%>EHdVOP9#E$Vwro2IKt({r=MDBEPdL5%p z7(cWLRmDx~e+E$c#w?6uy5%e@eN^FB(G*Jc98N;=qDp?dE3o@0fT>*a=-Tys2tjrOl9 zLqqFC9cRtKmUZ*#oZw(^>)BPJAX$aXu|Q|R=96A_6|HGj{^1N^*&|Dx&>bp?>sBH7 zvxICy>*@oNW`v0XhnJ1ev~gk0ILM~4&j%>$V^p-A78EeN_a$-jEd3!fgB8!ITzo;X z0#0oqSBMe%XeBe6IZdPcn>V*%oVr7atz~s>NlCPn_tcA6@+EhiNvnOgLd}))=34ap zUSIB+=Lz$})W`g_p$?3PD`gQ(7rQ>%s%D%ZF}ujD<$8vHIIp1haiFQ)vVWYY04ADL zmNic)74()~^_-VI$HIVD3;2H&0KJW`95_4Sz&RB%Fs$RQc#SOVKGLsld}AuNyt6b@ z0arPGlvog%*O1qzA9nw?P@76yfLaHQ3mu^|r;u8@da%05s=YR$jHo}<>$vw$?~rGd z(C{^aiEg^>CEok=!#I_BmSA~-;{&@os-8xn^L}H^UN7zQE>D1G&B`}FUulu_ouCLU zrcW^a>lU-9%sR$f$8!I;#y0yHe@4r=sSw$IVUkGY!GM?zeO0Ln5{Uf zl*=c^VYSglG@U?(sNcTj&;f zoKqCm+qJzbcBE|7@Whe%6A1*Z#eVP>>djR$;H@yI@-TIOEGL!2OSWIDc>jpL!29)& z1q@@Qg|_&EuIRd!*4JlBEXSYM;T=@q9GzHwCB{0cb<*ETdr3oW$DOXB)0?mNZ7B_^ zvD0-I^e$*}%5>fuQJ6-tsb3$Hoo(xpu=#l(ej=;I-DSr(MZR8b^q8pO@V+co*TC?C zSHUryip#aSdb0b{qtn^uDAddStLq^YUz~b(BP=eiE{=cprkkFU9^sTZG1Z(jeN>C; zxYs`plcu}>eH|+`abjU>g6wK2u`Z6BtBJYR40O|s&{652h2Kv+-SqgmWdUKE?=i=> z_+y&Utr&tFUcEU<)=RAr&ueW|L)VFt<#ZP$+lLYv=CLY;%dHT49qx3I&({!=rm3|w z``ifm#e|Q=p#nj8LM(o>$G-1S+z(Gz6a!C2?)DAkpxNo%(LVlD`YvwYOpok|v&#cE zx}$1`m7NyyvgysENeW&eFTMEMdsiQx9^O7)&#ah;U`{`@UETaV=De>1D}KFE-!sO= zC(_B$dHwg}_Fgs*rR0z1WaefHbUJUNvGSfcP@_UA#hxp3>XKfUBbSZ!Y?Nrtv)!Dk z9Rw2Y81eX(i!?$CzH!c}Bb3B}ve@{(KORui2R+)Or%5K#ZPl7x~FQ>PbQW zjokoOhI!3*RND^!QPk{PvWPx0qVSS%ETNgS`FXi209kaNc^%JXLUpzkWQ#hsPSl)z z*3s*W3!*}Uteoa+T&R6adCus(tq(0{?X~j)d)pQH^eH(@#SV)FLD*V{2a-9O;GQJ5 zGmi+PuaQ}~x`Yzq52p^fi}h!{zq?s?S14(`aHXa>rG4i(!?N}AhV5A<`ZW5&c&#Y} zd>1|%{SJm~^{{Dpdd9XSbUI(2sx%@UkvyZ;HfvmXR6kq>35ArUV)?lsQx{JE&AAww zm#M3_WOCUSLc;PcFNa8%lhV~=l;;DUIwc~xOU1p(C=P!LEhS?+Ftt z!JFlSRrlQ|);G)%(7q1NEn-yjD_`uE@qD$eRgyM;?oL+s1%WBVe~! z%41y_uK(C@UZT8H#1PNR@z@njBW#U6oekEDls}tIsomjcJYRs!RJ?a20W`bXs}5_E zQ=X_}N*2(e!7S$6Wc8@_XOWX4AyJ_>Dd@bhgOeh2x@6a#F2@#T zYg{tH#bjuI{a$O{kbykG-cYnmoyRLNs$SnDeom#Wj`~Q)U}a(dVu3$EQ4-LA=^jyu zMRcGR>(zdx!W#3ujjSq1Kc8z)(ma2QjLNN?Sc0FA`RG(yPE<9;8*KYCDw0wLtFPAOo^pl$HUJ8{N>XL7ShBHk{AZ z-*oGOo}S)gb4jzx)}*ER(|Uq|FYO);pN=_`8f`fwj;l>5Iu5nfNTa7aOac$M@Hzv6 zF5#J8Xbz)DBu85oqPhIJR-YJHIJH3;yZHy>B-ltGI+)Z znN#T!K$R4|l}0cTMg`k5E#2mSC#n@bvf|==cb}zBHzX$Eg|&3AlrV=mv~A1-tCO01 z4=s3_RX1352c0LFmGHPk*SG1*b++U`8ft46t38}1fdk!WerHQ{$C&h`2rV8ktY{k5 zpkgYN@WcAp2#9$yN*o#7)|EGOl?v?2{fsnY?COEHubaQ7$aUBHHtj(92!?xGfjqcs z(4X`7=#PXnh02k4#A#H;20Y)GN)0B~Hs(GULG<#r>emN)nnVjdtYe60GMC)P+sZNp z1-d!QXB(ffxM?}BC|Ui4uuzH>*J9SFOYsOxP``jQ`n*J>QUNDA?{rjPyctW~g$Zd@ zCqzN24u3S*nWaU>X(q7Bsq@k2YI7*V_gfd<*Jn5%i+U@g>J%$T!;upw3WFmO_u>!p^v3YBTLcex{L~;bvMwjXJpz{b?xjd8v z<_^KyeD|3)EW&KGx!QuUXp5vB79=rptE@|Pj1F83Gl^{2g6k$SB11`xBi-2w^C#-- zMM(WhT5Y@0aVw?i%o7aY2ZEQss=06qRhopJBvJF`%UCP{v};21Tz8>e)PPN!x6D(8 z{!8iCT(x`gV+CV*J=6ILEfu5ElX;xLOM*?go?uM*7nsO19a}*k-A323960M4clk0& zXkj7ma?OP-tLgX(L#E%y8Z@IY0F0Y=wvUtL?FJ$-qY6jU-Fw`5Ztx|_@6xAaJi#ss z%Zx~KKF{)vJyN|dLMTp9m~0cX`FV53gx_UTigC>QxhkPMU4??>n{&-Q==t8G$E_aV z_qoK)$nW-39Kwv7z&sxU^E|(`%zUm6p@POiqme19VSW>|-=3QIvqoo!A3|D$`QJUg zF$haj=B3R`CoA+57xVj-QgxnhIT@_Y3v%{M=W86jLwNxsEN$kD;EGY0y*MD4aI~R* zhsUW{hx%YJ6>T7t}jKcLQit)U->D$ai+x=np>*B2+Sj z)M7j~ftk+(??j-U*koOeehf1uj>zJBf72s2owKiPIN`;9k&{9k{&93ezEDb~s$Ey_ ztX9PYCY&=wf%9j(DCR6_H9HrJX*kGJlk;krr_nXi>STkoE469bhHihprn$q6a=J5T zX}+X&fy6cZ@JM56nU{Xj_|Ya(lR{lvXRn`r5=bJ1CQCy-y*Z!vUYWmMSI_Mt2S!d} z9ZOS{VMuw#h*XN3j2`f0dW8+4?|N3$5TvCX!B}-{^(DyH;6DLyi#2lfzq8JO2>oAP zy!c0e*paBV`o503cAz|mh{1d z-1`9-C{dB2W$~IkN%0dqp>ntQp%nukC!QNz_+D;2Fpk(+CjSul4)yZs#pA)yl6%88 zbOUGxH5jUl-Mwi@yC&5hRN)C(Jq3sjC3ZaR;_+RLiSXLcOHLQ?Rn?&Y=A7AHSeh@B ze-wO$dTAF*<^<&}*3Ul$%LzaY?J}hvL{iwQ1uSU;pjJ~SNQY`BKQySJ1d=bF;@knP zEmdu<_bx*87a*?Y4}cXzi)y=94=Uvq3rIL#vjY;0KHLy2LEqhrO8jumNrG*>*d63^v&> zSMu;iIb+9b;hu)S_Wl!UmHRgH$5Cuz*1=xlDrglYGRUC>Nztn#Z{R;Sz3?j{96TNg z5*{y@_AB3e&~T_ZKQP^?P4n>AwmO77d@tpeYe>X9Wiuc)FBD#6vsDWLl6@=O0T6t6 z;B&I5JNhf-?U=v<&=-p!WEIjf)O-izh;_&UyYGd>43*_5@P-1^5OS(0HAA7h+x`XU z1~+miL~6Aya6C#GId`o05IkwJdAm*kBs5+d*97L~slv|){Vu<`m$FwA*K6}BCRS&C_ zg51V96w=ZO6x2X&LvDxw${<}9LQY5!-7vD?cU@!~c-)W=H!k%Ks=(fUj)to@Ajd%S z44v}u3#;H~v3z8YUI_~stf~Q4>{KZtOaj^67`MoS94Uc;yOrAvt7VOB1Y4UF7Xcgj zJVuU_bpcm`qIt+|Yu3SV2j9rU28`rYHUZszV~l*-l2+8@9V7$WqZ4knYFfBb0E%#9 za0@>8r>!0~IQwS0NKINxC#>bCP3sbF*ucn5{Z-Q!YVa$$?*2$Wk(*F8{1Bh9Z&kB+ zUIxoY9yVcd9pJhg`ogC;89vbQS`5+##Xc#GwR6F*u-p)V?0wHcT_SAe2Z+KW$t@kQ zN+?Cd3wfVJqW%T1_67w?^G^`3n>1C;LWI060IXw z;V*o?gMnk=_Nm*S&N0ivW<0eHcAQwGWQqK0v3w2e6z<>PC>dqjk^2$+Fu#fVD%zVuo+kluwO0IV4Fp%eD2^5xP6O0*smyEq`CrP ztrVC5dDy*E1bPQ}#e;LrK5`V%0Gr1gen;8(1Tud`cbmS>(>o zT@rzh3R!d`26l#kV=mF-0HHFOYxgJ|aRI!Id*&1j*0j61f8gR?2M{ z=VG<6z8c1WT~?;`VWTBJQZ__z^vgX6X+GLVKXG9E5x4{fK|(4_9jA05 zU=24Q!1AesTa|pe1S8AG82-5VU|=@Ff)=)LN7w6rVzR0#q{IstOKesi1=P-pJFE*c zHEIuhq96J2^5S>DQ;#G?zSim%5C9z$w{1OCS+X3GqzTE7(p)nXrNu zKf|>TeU^3!{)}K1*#okuK-{bWpGT_l1Qcw~J%aSo8s^$~GsFVcaLC6i>Nv%$KCyw} zAf^j9KK=^=hbj#?JQ}2t>c;Sa9I?{R#1&}-x87w1S4Ozor|XeFW67qN?KuND+!}%q zazz=#PdN}_)dC(v9sct*A`W5ZszKlY zctl271i)=0B!p~cTEvEZ8a9xfX&=HB7$a3&Frrwgvfc8_V5<&fp75y9umkBAa^Bhk zix4h*gBOQ@lTFB1J<3OG!E4OyF@JTb0o#XgH%->!Y~#ull|oB2ee||bKXiI z&-iPD^!HR-YctP$^HD(}JR^wIrg11Hf-{DvLfDZ2RZ^&VMBtk021#_hAf5l+F7Kcz zXp;`)^8r@V5D0dBY4M7(+(P$JFkOk?fVjEgrgjkY0&i~R`Qe@LpoTJb;7TM1-T@Ns zXd~f)a<%|p0gJDHNK|5*SFZE@h&^Wn;Gxr>gQRNT)$4GJW{B_)1WZ81?1K#`RBGZ9 zryZP+qT(O6KyjeYwmK?KreVY$%K3eSTG3BtVCSLS_gKS%(4Q&rl%a1xg|rUXR352? zU5dKOa~UopLyHqfd=md$9%vp3q?aICqVDL}z-5dU9=|}`YI`oMg~E3Vbmj`8 zxNrW542whVffcj+!C}HzKtqQ-D6>Tcj!G?nXxPt|`ts*JUhtIZ7clk=gHvE&Vj#4~ z3k?4aGKdW$e@p~N5PVFhhJE2_D$3%TKh%oPJdyyTG;U8nsH+BLBDIhhs%ro6D`<2m z7#?IHks6_2F7-a;0DWR7 zD$u2d24MY&PBxu_FT@OJpY^YL3)Doc4}Pio<1>z-npOyRL6b30W`NUPA)8TzvtM7SPYYJ`4~B91^Gd@H7%RwNB)82iF|5n21SvVvcM8cEnqX5s%uY_g4`OTW|HT!52mG4g z4pF=M#Tb{qXrA!p^3vzg8MNV(gQTV4^1o0yb-P3#BO@cqLhU{0HP(Ahhx68g^d8KW>b&4b&gJ@AM2)ZuRY#K-uTS+! zjC%*e%H-)xbwvJ*tIyjRn_c)W@sIUU24ylNZ!uWcsz};F^!?-q7fdAR+g-8?hphAt ziDfd&yU;;UKC!US8MxH0+;7?k7q7=dg8CjOnXN6)uSoJx#DB0hoWgKV zfb%A(Q|4(!EA62C&*v|f&1VEYDc|0mR>!!%+@xY{Cf}U#gpsJ!Z06XQ=C09ZgQ{!w zlJ0fv6^8mzw=%EXSNd>Z-G%LsHI#}TdgpHMJ|f>&;})qNttWU=MbH>4o?W;g;H7c1 zOSjDNBga{&xx-r23o-pp%f*2T$9~Qa$&ML`@_$6+xKSc)7d-t;TE3IOWtXR2`P^CW z@Er!uMF0l$Xllj(fzU&{kK4+RN|ovd5+d4;|T`R}UgL52IAyZz^>flGDDvBlft<>>r3 zm*xVK?2nbq>hSg6ZJ~^}WQ=L2v{;ubpAJqRabXMD>%Z#uY8i+?rHlV2M5J$DSb>y?SjPiDS?m3iB{56D*#;>QzMO3g>l)xSO~;eS|PuFCWCY{0^z zoKGR8zkX9dAE)D?lJ&Y1eLs$GT?_f0lRqG=akkX^ zV2xj3&69%d7Sk182V0~fnZF0V+1fIN(M}QP3kL12lq`RBNH>gG;uT5}^9I~GkUxp6PJpexJ@>V-)oy}hs;GPcxUuRnO)nV{9Pycb zl@mV3=YXf!21GDRmVrp{Y#Ad>{W``hsJV0$JBes}P#-7&?gx0OPUt1J9}iCwSp+g{TyLQW*yy?_T&?t}g?jjiSMff8UUIF3wss?KroOYTZ6 z+hr#J{qU7`dAdSr_bG+Q7-@yHY@GBM(!FxzZ3=j%N;td2ZP>+)lHUqJB%Xkz2^uj2zArCD9V55-ZhI(wM1GR> zsXs~1sp+;0;D%A3k_6}DTKeS^VTs#Bj$Clp}g%N@tTt{YyY(*gL4h5qR>Kik z1KeKn-)VgPFpSBnhNDWh$G~i^Luv|T&NjMpTtJGJ6ZuLg+MKQ(5E z@U#~N3yN_g!>zU2)M+d6I{Vb@dmJATY^lX8UY7Lo_YgrWe|12~NG0z{=xK78Ef)7W z{w3f=cVtwy*7=`QW>4X*4gSN*Tog5DsL`wbloSteP8B8Q{GXb;$RJ7rSem^ga7q}7 zkUOJMZa!oL`0d47%59_~$_cd=xd>9az(ffCT)nDOmZVKjE!RjBvS8KupIUgp*sci} z_tPRn7DO=tOn3KWKRrSEJH75oLdp250-YtOd`Xf_UD5g!B&x$&`T%P9q3`hLhfQPC zql&aTw*y8*;Qr_9*172#M$_C!(0Qm6Zd{3Fv3&H?dfmb0d_QqMlB_IyV=enN_C_1l zjrungE9gr(#bq8e*7UbemK#(`soK#xH#t8u1Wk)kd5HTNuj@83Y~zB2{KtO(Clr0^ zV|(0o&q-*PDNhr2Bx5T2oMo>F->r_eKh}8y8arPro!sPgB1);IJY4%5ih#{#_67vX zHW>=QP|BbLCK)eBKk%5tYWY9ZqXEfKeTsDuTTiDH=N+#-`@HWz^zo4P0^z9}xFJ6o zGA?5${~cglzN`WJRck@Dv5Px6KZH@nck@z1<>y`lKAJOD7L*@m>Pbx`NPIS_n4>>h zw8#|-W#>eg0B39)T5TCv?MrB*ekJ*#~5qH5(y9hram4tTv^w86P*D zsr};{zIN`{#KJ~8EB;gV?o*6_uSCu_sGy1e;ud3fLrm0ae7%z=KZWtpfKB}E#X$*l zUDNx24*&AzTNRjs*Ob)ik<~u4Ic4E5|3V1HnF95L)%qC4CH>)$X9P9`dwM zn1}GghI%$8tv18jU;Bo$?BCOMNT@fur+u!3?lCbSB}wjw?vq3*oL{L*+DDuDb2PNP z7rTku3!L{gzu%@D_c}y9F1P}#nbaiRI9OfyHLtVW$X7i79XD&}Of5~!E_>+LOlGv< zCC8RPLn!0qkNZ=&X)_k-;brBs>Xn3Zpp|;vPKKp(ofsqBrjPH%OgHJ%$X}ja{Cw^B z_l*%iLv4Ps-*Tl%1S?}#0ksgy#s3Guel~gZ)ex35Jw3Gg;fOP#Ecf(esnr; zG4jQs>4n%r%G?Y%EBkQ~EMB4Fg9p|{0uGs(cK3-U^{>k&-u{(LPi!8hr+}yV^Oh3Z zNU|#(?92$C9RkclDDI35fYO;y!!tXILbk>9*Gw_lV64Z=Vk`Q$~ z2#M!5o_eP)4ju#@CFGb$_op9;63{}I^C=n15%p(JQ~BS{bo+gBE|QnvDk&$7)>@xE zXuV9Un=2&L^)q&p1BKAg)+*|kUpznP1TagYY@_d|F{{%1t8;`{cT?)yw1mPF=}gI- zEjTpiTJ4npCv+17#lJ1Tf3AR*G)V%liQ5bB35xj)tP2O0UzXCAKhly%h>BF%SAZx)jkx&a;~8=)7@ZP#+4UDZvB?2Eh7iyk>|3DC5=2) z_h*)rruZ|6th9rWNK9bG#EjU<f$+0 zQ=L#suav(0T$EPFzZ7;i9@OG3=Q~G{3vZbwbh~Lveop!92D+~f;%mMs^y+d&EqM=g zn+D3~09)pH>SK~7eIF*yMu&#iO(ZWWF4hJH;{e4!HG%8Zmn#Jp#8}qzlx)wOvr~y*m^_$|jPxk|BphD<^)jXBwPBYrhgly6?0* z2IT&q6a_b2uZTG{L!JLD5zAT7N=YA;iaR}LC`nfE9ho`RolzZ^PPy@Atlb60m5ZXd z*IMdlCsYAyE?Z?D%cGA#dN!1gdl zEl71CkODUTrra~+$@*xG=ssD9gvE4Ps>8t3`$J|tp6RQQ{mOln-XfCKhD&N)xTq&_ zYl$EQC=6~y`$gqj?z-F5ul+|k#4zy*Bk$CJy04@5iSRZaY>rPL(0KHK74XyUMZMvy z#5I!(#{MX!WD&|wZEzm-*H}H%rmQ$BZ+1}7PEHxV-&K!G(H77E+K9}Nhv!q4l1nH) z8f6}P8nY;^6@pz%ho;MLo{8UviE9nFzek5>i|jcId*<-euBG_oh1UEBk0RRf6a zhD#Ia{SWz%pkc`3`veXNLGTd%Bo5t{g5>tz3L_zMv?&G4Sw#KtCz&#<|2gvtJ_jKC z4iLdNlH)f?BV`!XVZ7P`*6=iR@Ivgnmb1~oaXX@pIe9eNNBUW{EHO7TUDUk5(!XMg7ll?gM+{S|ecgPVQ)7oOX<^XJA?BrJN*f z@}MzT{(#mlbcWsiQ?%^BP)6SgO~n6dS||d1OheYdrF;s6WCJPR7HdQjd2$U11}L9xoHKUv;m{^Byi}V4L8)ygTUt{ z34|nB6+Y6ZdE0s@mVV_GFGpf&#mxA8-V?URzgEkLM+t{kN!MXd%}v)q@lq5NiT#E{ zAtfT$wXCa!jGZw4$XbH2HX@+u;-T#aPxH^+()_Tp_>?;s`do=^9XR(#- zjJpNuQH_~jr$Px2tdN=f;BomxS`s@=fhvABSIZ66+{b@gf8e@~B=%Q(&f9$3ItRLs z+ezpCZT5dA2$`}WIX0W3pa#V_5;%e&d{4W}3RjcHhc7@2TVP2_Eyf;->@Ae-ZNh7l zHuf43RQI!WLO5*_3GaE7B`X!G?+!(fvTgYUn;zDFPR{-ck`V6*gD3e*}938N2mb~2LY?~*sUcEw?nRX9KKX-D_o2b(9Qj4@#H=#wRbmN>^F}LoO=6in51e{>V(%~de;=iOfCLVm znywND&)H|pjebZ^zE(Nk?uB;)V8sJBxW_7+9a#&1XqojNY0j0xu*9k9mk;T>R-R|Q z(p4e17B|__K?;Z;k`P|Y?|nerXrDxU(0>izl2T$~N``}TNFo{Zuzfowj&zmYdtt{#~NK)@~k*nJVezt5ZGpO88kbNw3)Sg|H_51}mqSFJ7=4FeXcIrv3x7PGt3` z(nE!!_IUAv*;2Y~w}QU(<}VSZ8R`bPKhL@b5ZnXe?Rv1xY;`EArkTrX^SD{9Dz#yev&<#&+@3GN#~6J zg%_bk%<~6okHQ4|(#%Eq^9nK4Q8oqP70dbl9HJWz%touQ*B#8KdK|qLF>wPQ4L_$X znt-i`XvS72{=sbS>19d^$%Y3^uke983GmZh3J-e=Lb|0-1z z+_&>>%P=!k->BJ=BA#s0(x?32#sp`|)f{TZJ}|G9J={%#q|HRHg7qg7MWH*DLj1I# zeJ`8t08Jgfy#x(e?GtHm80J@L(hZo(aUufalz~@6BNBw``YLx+(lw(`IM(35p5N`jGY*b8WI;8||+Fh0O0BQ#?cl|ABBh$(lD~bdD1< zH2Wu=@k6?L_!0#geOPtvFa<3Qe{-t}>guO#r7@LNGOkebQ<1|>1zZ1m4Mq>+rc0>p zAF~Q}UoU-4f_3J9h;;`8GDlhOqm4AZjlm^VO%W2W(u}9z9sr9$^lD?4hW=)g{>bL3DYju+BE-76z%zShA4w=EP9c2{3LziPae>%yF zPR4tG9S{FznH_4Loq4;TNJ;)fvle4#_P1>R(_X<}=eTPVsn|@_fR~!JYL<$T{{zJp znLn3O&JLV@G!&8Wj1T)29=~jUvKN29;WBzy-O#0{F(m3rGk8EsioSu&KkrHnulD!F zR2g0GoO$8>q9S!Het*XEqKf?$*+=73DLZ#3P{x1zar?cqC)%9THJiWRlYMvpal`H3 z8-{0G>Y3T|#_*o0*s;eAE`}ZS#~MGK`RUC5F_Q}yPOy};Vn#1pmnnvmMn$E2&#OdmgK%@dp01|6opzcw2Q!&f4Hd|j>H3w!R~LrPVv;5aFWLZ1S#ih(&%W^gs!o?X~*a zVN#S2m-WrB|3Ojf-VY~@sAXFCk{9m_@X0@6wSwSRn4=<#Ah8?BVNn`^YHsDM4dloA zqCp+fle)=qF!Phm3)grjrg|2 zEt|-?tQM&R<+6m;kP_JOP6S0#K03uZ`BLmw8Va{9P30`Rh(=Cupq7u!Hs zuXPrzpt?_%^;6Bcli6Aw1zXZmq{@ic%xJ5al5+ZFNlwbczZ%%mc>`JXU0=M|g|u-4 zJ0-^(w&e*p4;_q^+w!`c?7)tK@-!tr22V~(;NR=XX>VN8^VqVn!Qe%!ssYvAARR~8 z`9e3UTMaiDc6CoRV>Kb?xe1P>Y7Si-8$r(yP ztX>=UZ`Vr;#MPw&2XAO+LbX~wo{_%MsHNl!d*v2s>$DW7p5s9s1zATrA6|3~kiz^G z4qKwZyWSJGV%mXHO$x$zz7Sk@q z`9poK*v2sWW}m+_kMAK$8Bk|a-1Rf<4*kt@_S}IVqQJvejMDA+3iz_uHnhA=}$p26`C3FaGYAa~q2{`MHanz(JO7!R)Y26W;9JjJ4Y*0N76nNz>x zngP}GLKrdpw?}rVmee%s-0q=jwco9IBzL#X*gw+o#xYdG3ViALk6D*@mCG7Xb1<|X zL`28z%|12pQc(VekhLMz^P=FVhPX=u_i|xLanOn^N;h?UU3u808(S7md7b3S&A=&T za$Va60K+YLBklW4hRo3-O({AH+WSI9K4@I>i5a&#=|@o-i!<|mvGD+3w5nTUYWK_W zKbR+Rp4GoG^q_)Op?jvkE9ES=p*$=7J*7C(%=cfLzS{;DRo-CSb|TxdI@#IsO>v=4 z&|#>&Mvmoy!@2gMob9A6&;5$j?x8=_9`DV4iW?(k=@d!RubMRH?X;&Jw<^*_>~|f< zKb93*WmABQK%MmZfTox7bYbr_>RX?szRjQ??UWw7f9vXXT0dO+*_O?vgDO6lsC8)u z6U^uo=4r|5-|Q*Rx>}@HuFCuWe#fk~{bl_mJc_;*P%a*<5HW*0TQ|%@=JE74Xw^kwas6fn0n_B6pz5U9AEI=mFa(R6$Mw z=W@5u?bAv>eqV5=WHx|#B|7X8%JbKQ_Lx?b!FZ+ixKGX+5$2xhsKsPo zEuGyg{CmxqT{H(!ZAO)nqsJ)U+N2iqaq-1&=s}1m3l1kzu+G&Zp?^YK8_?%%7Q)E| z&KuzSlTfG|+rBH%xq33Zwg&DHYV4OY*OJ?Bq)x}ei5m2|LRopTS>4 zJl7?X+D&bf2T7qiq}p7)VLL*E(uxMqms9-&BQe!wMsXt-<&V8AbPuTNb-E?I(EP(b(`V9~P%` zH5?2KP@(^;|28|VOr5+_tj@>BtPXw~E>-yP)iaW(?ZwoI)-i4KZnBpj-%mq93eWR< zZ=^1l`}y4-bhVv@9$W$bEI8D^b2K1IzOTU?5Jgumrjk*+4*Ii@o~~vz-;Q?7TbjQ8GMvD@1_`Y7#Wa3Ncn$om;dbX z2CjEAF5yTf14vWw1%rMJ$xA^_pnHqbX7pK?lpo2Y+)v|lmB#k}%?7VkG`$nu>QU#n zHFNhqw~HgD%s+qaym?Y43+@jp@<&8VX>)^>>m%Wm8t2J%Q_c3>8AZoe2u_jYiV{1R z$-oU?h?2RZ0ndJY7ZbJGXkDM-AUnx)GrLC#bivtWOta=`_SF@mQyAg5^FjQ-CN@A!lAl0;D`G*$K7 zX}wzxQ|3-RoHYy0A6+Z?hVGLc!!Jo(zS3El@&}7NUZxR7j3wDOB_A<&wjf0@6ctwX zz6+cx(R=A^k&{OIIO#Vmt^P#GIRY(~&G4=fT40D=3M&^gFV8cA8PSIq@?Cz%yO|gH zb9ZYUk6)&(6!9*uH=Ig%BSr8GN2>1|GL?N=UT|3w$8x8BokvZ4kH&dDV-n*k-8K607rEy}N@ z(_D8m7am_Uyu~_xa=v>yVXl^S087z~U^Q1-m92O=Do~Ewnax$u(8204E#};?iDJ$o zTH=Re%=ZPq^QeBIUt7J2%x!A-m=#nZdh8fF#m>w9n5kQ#tk(U91@!ZVDGvry-iQ$6 z?GyU{g=79V{Wujp@i6QxE=gJlxxWL&C1iWcc@Y7gZdBhDS`> z{M%IBws?8elYcatx$|uD!wx=a7*KEW=ndE$q&=6td70W z$#7h})rRog_TlXZhsnb;i(b@%$v@J4Da?zn{3q>g;72U zD95VT3ZgozWqBo8MKzB;sq8QB&I_BF<@o`mD$F4Et+)UT#a=3#SwrS%RpuT-q& zhD(zSygV}urL*MBZc!T2CEBb??n?~jkMcSN@ta7FOOS`XlD&GOX1l@zi|+mXd1KKg zo|k(H7|KeMI;hy)lk!>STTi()j=lA2>8#OueRe7g&W+o}sme6^g}dur!>Ie#=FSiGNq9A01Vea+apn4TO z<4<#^-@Xx#E;2MDR{VE^Uz(z|Hv>ZWcz6t ztSZ=G)ZM(WllEr{%X090wbF~qS@rbe!@FffjtGmESgy8MjWhUuv0KU=5CQhdEp#{N zp_p*od6G67pF7w5?)C0IDEKo!F8|s`8z0xqaz}^9QuE%sY{%yASibHQCtJAcQ5IAo z-t^9%VQ*K0bN*ycHGzTwhTO7>4 zE_dAZZ21Jyw!DPw#2(3>`ECHCQ_A5oP3Az@a(u#-lUkWBnXL4U&gFi`J{CZ-qB4u!awLVd+MaT{1QA<^L(G@8~Q;w!(P z1LUUm1>oAeC&~RX*jr_Dw^Du}g?xyLc|Z1X(W*b0|2`$c%1Kj80HDh9-Ar!(e9csp z+4MS=D%k`{tDb=c1)!Q>S(7`uYv1ti9i0A-KgJ}#u9z#)U9uf>U4EysQHwcx9^<&T z@MKedS&8+Ccvr-Wr9O{p&#Cy7E2R#T(Ps;n7K?)8?&5VbO-5DnhdcZ(p}o0EY7(Ok z%k|!(j2!~6{6aT%1jmKkz86Ie2;qF zD3brctqZ}eeI{d9jWv~R=vpcpnRg-jE1UJ|~Z$8l1O7oBucnY|Rq@oE4FJXu$-9ea$z`H}^72h><ZPRQTRpn<>>P zS;NLehy z%lTF7?B*Y5bY=<{Hvx{=f~gOrhYtTC&d0nvaex|{zIC4m`6|#PmlG|^=hrfExglfj z4#-ch8b9X++@fk+&5$i@o2+r?BZJm(L16cFN~z#+rL+Uu)Y7-jf91!e7+{8>Zxg{11CN7L}up(7oOeI&j9>{f}!W zx#c^e*9Th?j=9{|s-5ZWSz)E<@Egqsy=Cw$H&N0|6hwmRMb55cag8-ZtmfL)+&BQN zBPU*_nZNp6*3UzxhB0*WqUeTRb^eZHAP12@wesiXYDUontFzHy4r6#t89d9htSQS>Mu7lqJRRs1+Y=H-I#8{X%p z-lgO%&h_Th=?W#I8T*-ouc)0)I$>!Qg+Lwg@pt$V2|VR@j$6IEdu48IC^w948(BJe z$H6I1Y;Hp3j$+N=8RE!xd}?WnXiI?5Z3?SAc#i)&te#Wfistgdt=#_H*~u`~JCxq^ z)Wz3z!UL0o=m1Ky&8?<)95U*e0!VIs%1tp@D)1e?U|QlJZ*!goR^)bhM})Kpg`}$_ zHCuS&7gKapsViP_)(CH5@hmpT#-MLcA>9Zw$p|rYW$NL(Cuf5%<~DgvCcY5eJ!iLP%WQ-2WM{XENtQx-A!ebgk12eH_|fky$<3}O zuJT^(WbXmt<6A&Hd~`LesXV!@ImbK5doE+D(tH0{>GS~%qcNW`vhGFS*?zvl$%wNR z)7`TC$M3E#S}ZvWI+$!SqTfV23ik5gVJmvCR z%X(+L`QPMqNA?=_D=Mr$@+-`?Np4+e3Z%>g?xF2_e4n9a9?Mgky=lUjqdjJnG${Ae zu<`t?8!?H|rZTX);FH5^&0wkPO-`S8SB~rvthQ(+pCDI5{nZio z)IrLlAHY)%PZ%&S#GNtjnHLhyhXZjI>xCh(P=ryc)>W$!PL5Wz$(h1 z(1Ur~HQje4^W%NlPD8(CmEexBzLT*NvSj<>w2zf-{Szvw0CAv z%yaQ6vbsXnW{nmbn~@tDGlIm5>ei0uAJZP6{S9nt#>*(E#g)@s1}hk010{FGx+cA2 zX#}S-?g=(RdKW>AgEhc{Ls(m+Ox(uqT8(r4NOg$rVoUi!!3z!FSx36lGpTn=JAY9g zW-W<=Gn>X|&ioj}nVd)PMmgR#{LVgZ7-y2$M=hUNB0KHc0wd*qnlq;qzl}KNuwyMd z{YveC5?~+Mu6jO(i`x)i&Tc)G%a6TQm!W(r4FEF;un328d#~tOiw1%Nm$I;!kgVYP zK(I-(=o5g?#miMaa|LKbGY zh7^(&UAK|94d-2oM4j53on)`+fXwIXs#2MGwLY;zH^sJcx&b{Eh z(y@NT#*5lj&b1dmva>SiJ+HW6h>*5tkds6>)VE)}OXMGDRf}O6IBgm#!8hX5 zoDTJ0ZJ&X>^RGe&kS*EUVeef6$wc^eRGb>53boGXkAb+${%P$k6SRP)?v;C;RA$@W zjuX0Q_5FRc!N&TKfozQJ@9{!SyMINjBt+_pfeyzf%KboJbqHQO#T-@iC@aCZ2XRi} z?MpfZ)_4Ovq%vm6vi;?1WiTv+`HYBjpNUOAobAJgtRtv_uuc3o{$LQYbI@L&HCq(M zn&Nd%scZZXCU3|y;hGA@YQ>0i6pBu|Ekz4N1=AjzHfw4y#{(_#{OF6+ApeLj_H|kQ% zl{zg`t$x>45U%596E~qG>jP_9Lpz(~m2#dlCf*WW9^NgAhUrl)MfKKyX6@4fe-s%f za=8S9EOj8(UVYd;4|{Ct{g5uH>UL#62=TUQ5QKxTCkkmW94c{Dn?S3uA7m2WHI1e- zh*!j#@te~tmS+tlkog2#GPSp;w`U!)D+!TNW{-*D?DF!*U{xD;m|P8hl ze;M}UVreaN>XNN?;cd5beNa*PPj{>&RN0E8-FpNoREF*%oBioTy*{uyleXrtRa=xB zB2cVF)xUb)%4YU;th5C(r0MzWcanmnc@GHgl%X9PwwPD9($gQQ;zT3Q4G177?V*JuYbX&??)f8U_foGdMb;9k>5CQE!_K<&d?6;w0z~J zGFh9{wNJkbgS-@i7{#u%NQ+YuWUI-suGjvF-;skf|0<+y#|IepzfIH;8${q&hP$ac z+UUiBF|!6Tvb013LYG&|ZAp{ngPu5@gc3A`^lG=)5hHEiy?$lq3sm($vGk!s!^fCX z$(lhtM&a~tT~DG)K=U#c@%5I%4aljt1YI%lCsRG`hvwx2TNRm1u{JKZ@^~+wLDKvFUtaJUB z{X~5~L7|WSC{A}zia;gY^U(fQrO0UJ zWe;!`=5<^MW!dAM(yUvZCUw+NO<|t|hx6sD6Kz+oIJO}Dl(@;3nH+g5NjcQ9wB~u+ z=hP+TbhR%83m^Ws1IfyauAP1QwBGp8D}46CGebw5Q}NO^d4+Yd*Ll#!w6(OZIH%E~ z95&*o?i2HjhY3Do?S+x-vZ_>%A;LEI08~phU%1EHqd;8WM6{+;D~D2lLB6W?h!gv3 z_I>QUdEzlqagCi>3$Mrb<@{6Z_~m2gH-3hVUx19|(;Y6*kp`$f%W$u4DHYl`|AGNM zTkmjm!3cT4(5#VckBJqJRo#sQzZcFxV&ewXo!2Gx8`bu)YL@Ce=!#dTKOef&W7147#LdS~I z?O$XPZ}1zp;aS{%8qRlOaN}8`ACKt5X+H`Dk}5;M%Iw{kx7G>jR%~i^Uih_Qr}qhW zmj8#zdg@nfRG?PglVO>WHnCs;q!=<1q3wo>_GMD=m<0(l187`_-D@2!Z17%PhUZ_C|14OdMrw5PNsNuPJVw#gZ+R5R93 z=a)eEFNX=6Ur85gf;GikwgP9^pfCFhKmPmvN5t7<?qG6bQ4FZ!My==V4ZmVRw*;(+JiubwvR8RxO zZ=yqTlVLbMp~n|ks;m4H``42^)`BeY2h9chm%mSB%jmrQE4kq`)8=0I)|rOx*i{)R zxi)=12;VXIikqKk%(lJ+g(rmSjOS$21CRzt?!7*!+BzmcQ&@w~lrjTrrRP`)XAS&B zq&uyJCu#zPdarha6G_{%lHP%#y1t@x%fVN*IWVZGMxf#Lb05QZ6wp!ZU1ecHhD8J* zSgC0F;|L6Rue;vu5pkb?=9zE7HrgORgiT>E*?)adGxm*yLo=m>s1A zg+;mdioYXatBtRW|1-O=#`m52_;{>SeNN`HZYxt6Pjsc?th=``sNb2xgYr*xwzYBm zSyM>F%NJAZNs-ighuO@#3ihotRP^ED_)b7AP}+m=iCoiVf=MFUe2*A|vly>EY}^>~ z^nM|2vejzu7n}&U?=E;&h<IXLF|)dPL$`_7Lm>O4 z>k+kAqd|tHL$%~C>jJKclh>^(C?)0eQ@9ce12LyqcwMj{v|}q%VlCg#Ni7RCoXTx{ z;4Xez#t+YmCNEIj(-}-U3aqa++XZOHtCIE8BLBbnz=|rMREP9hMhCo-J_|8ynZbKD zynjFi+KU`AIzg)ntsTF3wV2d!eSC5whvz+D6-Xd!Z**c@jE%O^DGWC|oM*v!Bi*i= z{yi>cn0L;0P67!tnP@2N9uvHJJDFLwkQFF7Wo3GbbtM{g=pKmwc61m(VXBo!w$h?# zn=>p_L&N-V%x)|BGB&sl+o^3(1MhtwI)G9Y9pi4F7-ByT&25_|W~Ui*x`k)bGYclb z=U9gA2e?5EsXb!-gATA;q#^b74A53-u!q98$&YL7PW(Pz->}{7X%OAj4#sJPC1O>X zyh}vOEN@nYBv$;yrNE1I*Jq?V?!vbd5JfaIKg`kV)-Fz;_iWtPx_ySIDQ%HkahOA% zX1jp@d*UrHqt@YCkYsH!gwGHub>M0h>AyOsO1kKBzF)R(I_x6D-}*fIc`Ev$^agPC z7yeO?n;c5=IB8Dc+e=_&UzYWn7|Z(>J(5G-5DE`jepB!d2VBC3=xZA54@1RB=PJ5% zW?H;9=j7ud_h!+Pz}jar*jUvv7E)vUJ7Z(9*@OEzi(R0f%0Olf77m@TJB2vsbWKR* zzTLGA#<5ZRwU`eI%eO3>oG-&4i&7VKex3%&c&im$_eHs=Z0EdRP3y#?DMY!|8E?os zgDjNYoT^we7mRmYtJcW$DT71NB_lQgl4NH7gR4w=XSwMvWZsi1)&*Jfk0X{s8%S|S zgvw+mZt5RVI9Uc~TRH)W*@K>!EG+ENO}MMKBxLtc!$^9GlRXZa0$$BQ*;QyYja?a zhnOw03E=;?yOSGe>u#5yYSiAVQmk|VlZ2)#HI!QoF)U03XV)p60vTeota1Pn{L?VPJJx$CKxKQB*k~>MY0h^Yv_jZmOl8! z$c7Pnu46h#eMVMt82cK9UW@9;%FLt*i;q(rMpy%cP)JxjLD5iym;T^Rkrc=!ch~r? zEOlMcz6mKdvk{w;wxf-Hxsm{bxr{szSAT-3J{v8XAuz4XXCI2dJf)x*l2FUFkIIT4 zcv{l{+fa{fj(eMg6?*u6@IG00)6xZ>u=}xkEL!u)FsBf zQxtpyi|uoG&OZ>jj;L%f$;?kqj7&PETha2o9?S=;d55G$RnzhEzF=dc&BIK&NTx;@ zJ-FBXaY~v2XOAUg)~2btrJe?P8}awsGa-`j(eX_5F#mLBZ3}<@jp(L+)LU8t+HDSS ze}PkA3|TJuQokCe9eya)3#(YmpYW&8+A9aAk~g8;JWB%(`ocDun7dCiO|ovLfKRJ` z8XeB`8UA+^TA2!=X3l@GgMjyGkIpVpAH=ct+F=_(=(eS%6NnUO5n`KHLH#C@=8W9Q z+QU&BG<&9NnuIrlJdeB7d3o|4~T$xxtQ_|~RW(>X}Ub3Cs@;zdz@XJcf-exrSF~%|CT3#um|IMuzOM(GMLye<pKNw?^M3}@-Ci?_3EuHD$*L{m&6mUA+h@=wCb5>Zv=%>191ZZ0fFv>UN0P|S z7G?<$Ll~ycr^5ovPTXMLEIOS52qp26?TkDZWAfc@<9ju@jU1&7(_zGL6e{h-sq)}`rY>R<>fz=(1w9NYHMSe%l(&W35%ONlwlDe0T{5rTLNtKDn z7&qHjcM^QP(>p!i#yKAoS0nLTi4kdgM5qYZX7^mscx!l~ zcR_52^8K?k?KRO_Rce7L5NAMVAdJcU>d(owvGOuS!|+9_TCBYq+%O-goOnYFowtnp z_T%)+gF{cY;v#03(SSrWJ|37^*&PfBI>)%r+yKv8mt~7Fd(mT|=gB-a5kj%n{ zYd8};WOiNWV+8db=C=-TBy~JXj{ddPK-E!<4jXY(%j@Aof%QbgNNwl7UvlX9-*gq+eX#v(E( zt8@x%>F|c0swUCtDs9&6UM}hV17SK$^48j}A>L=A&5l!6R!HNtM%E8!rh-pL?wk{Y z@Fv+_ehb{zZFL}LO6-TrmB1^Ct2!q_iUHrx4(D3FgSaCj>ERm^l!}R}cvnP~yU&NH zD1o)Nj!4`Vir7Xf-oaC`7WoIK6z?TZ;H3csV=pU(z7S-r!Fx8xxw)x^T6pdw=&fnA zp=Bc@Qf=5KFPjsU!25>~#gMxMf+6|?weI9t0idx~vEmVr!uJ|kl$g5Cu>5@5wf2Fv zmm{8Z=$qfwc#Gz>=d|*YlJAE%n_|%)QjfxAFJEyJRu3@7E2VolqexR+$u6=~S6x%suEZDdG-8PFdL4j2YY?I8Dv-3Z%x{} zA+}?Vx#|HmpI!7oh*S4EY_t1rFw?Z?^vI&zLA%Jq0`eQ%Nhe4lVe=T{FGaN3iJPY(G-e&?k&^nJaFF zRQk2BtuG@IJV(~@I}N;(-Vwh4X|GpZYejG0Jb;vkIhdQfR;daJ#7${_fP8@H20AWZ z2yA~N-u(w#W@6;cU4R!`A@2hHOhvGwOG2&_fE$~OPMlAwHGNeSoEUj4wiaNgVKYZM z?a5ZHAfc<#dXl`)rVq6!z2nnDR*$O})JIBAW|VCan3%Zn-DR>7R|5{19Z-Om%OA~( z|Db>9FZXnCShrEY1@!Gm>e5n$AY@EXmw^C|K`$vW=~xcIi-%rHS|v24x<0{*;TR^9 z^`1$(<@W-a@7Je;Yu*~-g3ib6zjVDclxvEgZrh=y43VvPF9xhBAvD0rC4ZQxi0B>J z{GXh(3Y(1El7sN;lg4vH>^O*fp}-~Q?A398_sdZl^f_uuH-C1o_pWvi_kHV*$i3|v zj06^4$l)5vs#`6^C+7aW8Kt_i5AOLW&Z)fY8<->zNr&t(A+_{LHY&PXa!=)};Xh>b z#-VVFKlh0FvCp5VO?-RBdN*vytXXh^dC=r)Yk)Wf2HM9Dohu~u+xdi-CSLzoQ09I) zSf5TA$dp925Geu7Jb|XZ7N3mS;|*f=fi4!2qdKxwV{GYY5|uDnZD?7Y+V|+vF*n&` z2FJtl>6cej`-G_)4y;tNL(BPBdpB0*E7@pm2aJiQmfxH=f_`%4pBDWQ23PA7WuuFo zw@@nTN~{LBndbR*>IYSv|{jd!hhP0D3)kcj&fc0`_ z4=^+jn74o0`}oy<)kYPqg^uqe2O*1RrW0~=5Q^}^wZZ70ksF@NYAm)v9%AJ(MPR=4 zV}K#;f@|r5dN7aRVy|A_tCzjGthj7n#%bL~1Rhhk@V<_Wnr)lS4toeTgbl|x%VfCc zW8oQPlT+n{_v;2{sM9~+0 zS9vQ|7brnXcp=w0puA2~u3_Qzumsq{`In3Xdw{OG>JWU4P^a#8A_eGF=vHj&3VP0c z<=4^W=_Wk>nywe-u+L}S;~SFiw8ke^wWHYSqS1d(dTsSR;z!U@*3G`L(A=Xe#cInJ zSo_tCF&6RSm8;>)YuUCduNi5@X8ijSjNcqT=gOHRu!Vts*GI9(YZ>)s;xUsD+^ zCK;#M<6o8kHaLW&>r@kq(UCN{8r0h(^>DHuueA9lJrlHJ6z*m63VbngA}LuCmypEJ zrytFabqQ!F3fo$@{lYSyU)@taO?M1X4k)aw*h;17`MWuLnthx~AYW2B`@j!rAm{@^^DxA3k<>wp>cq>?HHsE7LsTSw1Zv z<2j@3DdQ-Ef@O2cqY(pSc2qS+`A6 zLf4vZpm+&U@=pZn=!sR-WZn!`t@K7Rkej?F6=m5rWTLa3{`~0|gqaw~7KNskZRcQ! zKRr4E9_h%T1O$@^M7#2B%p1X*JZ(fCdl=w)0^DIr@v?b(>ALtCQc>j({LEyfx@q9< zh%L-*Q73*pq|VJ|+dj7dI1GQr!(+Z@sw?1*lxw0!sPg(g@E9M3z@X# z#L&sFnkU(g0l|X+ijoR#9yMh0O2N)cTJJW|bY@s?kmPM3es#CzPg!X-;U#t~y1!&_ z&CTDv!`n1WnqiZqWq1R zQo$@DMmW%5J>t9eCr$FfH1vg(!iG@WkLBr|%8wf*rh-=`xjBPzVBpasp5SJ&4{HR- zxB3Rbkr(-4n>fUiiv3X{M?jqp!@?&F%h(eNQdGw^3ah2qEY-vKc~cZWe?1}vM)`L{ zGiOp1z_)O3oUsVNoD10chsqRpXHe4y(s6M<&-)O^GP@pDA4so_1we^MU;}-{vSfj} z0Eu<-O8k>F|Ln6r%tw~Vuk8^TQJApVqK?)Drav%yL-IV#p3h@BtHAbklQ-olfy^+p7K)h!^fPaJcb6Uz+5{G-? zcEz##;9m=#Zt-OkvEH6!J+*W0Lz;D{`>qJY^waJFwzv+M#V~MBZN`XPmD3p<93N?1 z^v{p2hBeIU2S8u1E~`33c3#5nZI64hhOC$DNXisF`&MDeP58UicJ4I;p93`gY=$@Z zi^e`#v1XDsuEC8k%9BXsg>oJJtN|B4F>AN}A#$Y$3f@{#Z0;TPul*Zjq=^4N~`yLLj+hduYMnTZaG z;{a^elRm%xCf&zh__xDcaxfH0GB9?XQm|6JaaCYYn|~ZXTbo{0TXh{Ko{%B zi-M6kf<8QpkyNB+c(F9>iK@-D<3FogH+-( zRID~#gAS{iB+4WukOxAuSffqb#12A z#2}2~E1FrP=kd5DoL7I$*MPEJPv9Ko$f|kz$*%a4pnCOaQCRli_a;e^NmhTUa+a&o z`kF6}vG)evxsr3K6erQ%HqeCpCqHBZv{8J_iVPg2XS z;tR$zgm0b{?zWT!spNr-x91q#Z|Lby37$i#a|+OWIU)Fl;{Hg?@bUnGHoD|KdSAfZ zzc73#VGzHhL?OQO)BrrTdjPF_rYV@Vxml*IVhDKueUoV4JAGhuLnX@bQdeEU*7=gj6!r;cGxAW-uo*A z<98Zq+Po@(Vl#|1VsEvD@B}-%TrE-}QTIGnSb<`Ns<6*5r!M^FICw5#qt0LBb|QnL z8SK%q4g7X07^=?Xam=!$?Ec?Ra!`G8K zcnc|i`5L2o#ekyjVWmVSt#m2{d?$sb#>V=KV28%1@N@LjJ&J`4`+-0nuF2I!^7vuy#QGP<#wRu`P8uk%2*tMsYggo}m7E6OBlB zlT>4O)^xYkfWFcv4D-*uCO9M;z3qRjPNhws`+Ua~qPtEjv6gTE%@?wp!gjNpv>3c4 z(7ImkOMs)Z(lNQR>tcTvv7{G>b%~ePvMzfB3kk*C9HMGNGM+t?_OQOA?4Y)!!zS99 zbg}9>GAb-AS3c6zaE_W4KNq`5Re<`q`T~LbuX_Ng(76~`rlIQ_BIU|ZG}_0i!!}!) z2qrPPyt1jfHOM5iMW7Wa&Vj5ApEYGjw}EZu+%6erZ1_izBeBz4bn_S9Qwv4Rru<^a z|0uD7MKoL*ojRTz#~~fJy9K5G=HeA}7#*x={5|7z<*zMd>s1NNE9vH97e`(T*cqvB z!vzca0DN{`7IL(Eh1+wVz7{;`rpuB59!!?&I~pJTqRG8Y{fu`3*tW<<=F!!}ejq*r zg{iZd{3c*`gDi|ow7p&i)lQAh)FW0nxbJY8TpI|EJW~Se@6h~P)34I#^;ro*a47g_ z();q!T~S#4oe*%%h5277EbQPTtrLGOIM7`7R(doXn|}I{Q=N=A(nta{fBMVOD4G&|i@qLz z>~YkFl41VuHU~2(?Lm^)85a+4JQG%97@cPVlF`0&h9LJzZ}2981@`Arq|jI7aakFq zUg>0Z^9~rcckpx2s&*`J1NHzb2sVIdek)DT8$HmCLHvRam>5a$h3L{=ywXVl^ijJQ z;)DHoL`tJM=#^={9V@!q4)%S{sknaB63UXN_Y3coO#;>^eft?|maeOzNx1DiYbqs) z47phgU9dDyYKN3w6?&;TK=V_6I4qalF)wIBFT4glae`HQen9nR=PZfhD&pwqUW71Z$g|C#> zoG-?x$-On8OIF4jV?a1eJz%z%4E;soVwJ_787uspMpjk>^tBBc2JPx~ra-ginna4L zeeS0`v-ZH&cyAVug%b2mU%7B`O!)y=2a$ zBn$I@w}%$zM@au!RsHf+o@6~oHXNNC20q#4Jy&bR{o^A~$@(ODi6l$&^NFqMgA>GD zva)$a@Ud5X4(O&UpxWbxNRJt9$nb7hZ{_i)cqcF0i)q?kxBAJCvAVTOWq)##=CeO%~?cysw(`h)oFDZuao9-!+bw)7|9#IGd40Fd1{NSvZZ$+ ze_^uD+KP5SY`C~ehH`(&p!~yQ$tl$<`MTf;4wo}<^^P5k5vFD^lzkZWw7aQil=_Sy z=7G-m2HgoSIMMzr&DQI06;KN1WAq59g#%Dw)2v#te4i!zj9}y!M33idLXn!zcO>(1 zUjOqc1ZJS^gC6Rp#zj4UDm&~Z#37F{2*Ms7?iIeJe7vC`quy%9I;P%5cJ3}XBI!yQ ztjGkOs(*sFrdNB1(VI_7f=m2$B7~6n7HHrDu$?rx@3Ou9kGOLHa|hTHzN5JJZHm-* zXjoJ#Chp=er*cOj09$)@z(LJCk^58NerH(zawZJ=Xq#bg)c6pG>Ol6?NtoA?P~XDj zFwF*p+f)gSjwC@b%N&pw*v7AGIr;^Uw4_jxm1yTBE z73_J!^JtKbWVH zmEMV`D)Tp++z568R#IGDuzSz3(xAXeiy*PtL5iJC)8`~Nk0P~~^L_+ImXYog!ol|# zmdh%gC7;agPeZR@D`PH)DH8!pOX;P|*DMbE(ot0J$sOHL)z9)iK5v`eXHFj4r2o;X z8UU(@;@nY%DlOVVAohV+++=ssHfZuxZ|rF{}=LvIYmPMz63{LG4*T->Yf7vsMD*0F z%v@bQzK&-4*0$V|ZkNwzfvU6i>m$l{(8U7ZYNh2FWkv2aK^WZ83BUG_pP2vk@pu21 ztt|f$w*Ln^(v`-fOrnuI7oVGytYJ}2gOnrdNDSC0E*()ae@w{uJL_TKh6xJhjUF?$bkK_OIVgCQ$|9=Ai&!51r^LwuuKq_lx Wz5izpeyhiE Date: Tue, 19 Oct 2021 14:53:57 -0400 Subject: [PATCH 142/284] =?UTF-8?q?=E2=84=A2=EF=B8=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- windows/whats-new/windows-11-whats-new.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/windows-11-whats-new.md b/windows/whats-new/windows-11-whats-new.md index bbabcba6b9..4eafe42218 100644 --- a/windows/whats-new/windows-11-whats-new.md +++ b/windows/whats-new/windows-11-whats-new.md @@ -67,7 +67,7 @@ For more information on the security features you can configure, manage, and enf ## Easier access to new services, and services you already use -- **Windows 365** is a desktop operating system that's also a cloud service. From another internet-connected device, including Android™️ and macOS devices, you can run Windows 365, just like a virtual machine. +- **Windows 365** is a desktop operating system that's also a cloud service. From another internet-connected device, including Android and macOS devices, you can run Windows 365, just like a virtual machine. For more information, see [What is Windows 365 Enterprise?](/windows-365/overview). @@ -138,7 +138,7 @@ For more information on the security features you can configure, manage, and enf ## Use your same apps, and new apps, improved -- Starting with Windows 11, users in the [Windows Insider program](https://insider.windows.com/) can download and install **Android apps** from the Microsoft Store. This feature is called the **Windows Subsystem for Android**, and allows users to use Android apps on their Windows devices, similar to other apps installed from the Microsoft Store. +- Starting with Windows 11, users in the [Windows Insider program](https://insider.windows.com/) can download and install **Android™️ apps** from the Microsoft Store. This feature is called the **Windows Subsystem for Android**, and allows users to use Android apps on their Windows devices, similar to other apps installed from the Microsoft Store. Users open the Microsoft Store, install the **Amazon Appstore** app, and sign in with their Amazon account. When they sign in, they can search, download, and install Android apps. From 8af64f7c30afdacc797f9afec5b76a8fa437283f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 19 Oct 2021 12:09:39 -0700 Subject: [PATCH 143/284] Replace absolute links with site-relative --- .../mdm/healthattestation-csp.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 5f1347d92d..9583426aee 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -60,14 +60,14 @@ JSON Web Token (JWT) is an open standard RFC7519 method for securely transmittin ![Attestation Flow with Microsoft Azure Attestation Service](./images/maa-attestation-flow.png)
    -

    Attestation flow can be broadly in three main steps: +

    Attestation flow can be broadly in three main steps:

    • An instance of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
    • The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrieved.
    • The MDM provider after verifying the token is coming from the attestation service it can parse the attestation token to reflect on the attested state of the device.
    -The protocol implemented can be found here: Attestation Protocol -

    + +The protocol implemented can be found here: Attestation Protocol. ### Configuration Service Provider Nodes Windows 11 introduces additions to the HealthAttestation CSP node to integrate with Microsoft Azure Attestaiton service. @@ -240,9 +240,9 @@ This node will retrieve the service generated correlation IDs for the given MDM ### MAA CSP Intergation Steps
    1. Setup a MAA provider instance:
      -MAA instance can be created following the steps here Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.
      2. +MAA instance can be created following the steps here Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.
    2. Update the provider with an appropriate policy:
      -The MAA instance should be updated with an appropriate policy. How to author an Azure Attestation policy | Microsoft Docs +The MAA instance should be updated with an appropriate policy. How to author an Azure Attestation policy | Microsoft Docs
      A Sample attestation policy: ``` @@ -447,9 +447,9 @@ GetAttestReport return the signed attestation token as a JWT.The JWT can be deco
    ### Learn More -

    -More information about TPM attestation can be found here. Microsoft Azure Attestation -

    + +More information about TPM attestation can be found here: [Microsoft Azure Attestation](/azure/attestation/). + ## Windows 10 Device HealthAttestation From 8f62eeb9d24a59ab6d1203e37d90e3bac70f52bb Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 19 Oct 2021 12:24:14 -0700 Subject: [PATCH 144/284] Add backticks to apparent code blocks; label some --- .../mdm/healthattestation-csp.md | 181 ++++++++++-------- 1 file changed, 98 insertions(+), 83 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 9583426aee..5e6f472f82 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -103,27 +103,29 @@ This node will trigger attestation flow by launching an attestation process. If

    Templated SyncML Call:

    - - - - VERIFYHEALTHV2 - - - - ./Vendor/MSFT/HealthAttestation/TriggerAttestation - - - - { - rpID : "rpID", serviceEndpoint : “MAA endpoint”, - nonce : “nonce”, aadToken : “aadToken”, "cv" : "CorrelationVector" - } - - - - - - +```xml + + + + VERIFYHEALTHV2 + + + + ./Vendor/MSFT/HealthAttestation/TriggerAttestation + + + + { + rpID : "rpID", serviceEndpoint : “MAA endpoint”, + nonce : “nonce”, aadToken : “aadToken”, "cv" : "CorrelationVector" + } + + + + + + +```

    Data fields:

      @@ -136,15 +138,17 @@ This node will trigger attestation flow by launching an attestation process. If

      Sample Data:

      - - { - "rpid" : "https://www.contoso.com/attestation", - "endpoint" : "https://contoso.eus.attest.azure.net/attest/tpm?api-version=2020-10-01", - "nonce" : "5468697320697320612054657374204e6f6e6365", - "aadToken" : "dummytokenstring", - "cv" : "testonboarded" - } - +```json + +{ +"rpid" : "https://www.contoso.com/attestation", +"endpoint" : "https://contoso.eus.attest.azure.net/attest/tpm?api-version=2020-10-01", +"nonce" : "5468697320697320612054657374204e6f6e6365", +"aadToken" : "dummytokenstring", +"cv" : "testonboarded" +} + +``` **AttestStatus**

      Node type: GET @@ -154,26 +158,30 @@ The status is always cleared prior to making the attest service call.

      Templated SyncML Call:

      - - - - - - - ./Device/Vendor/MSFT/HealthAttestation/AttestStatus - - - - - - - +```xml + + + + + + + ./Device/Vendor/MSFT/HealthAttestation/AttestStatus + + + + + + + +```

      Sample Data:

      - If Successful: 0 - If Failed: A corresponding HRESULT error code - Example: 0x80072efd, WININET_E_CANNOT_CONNECT +``` +If Successful: 0 +If Failed: A corresponding HRESULT error code +Example: 0x80072efd, WININET_E_CANNOT_CONNECT +``` **GetAttestReport**

      Node type: GET @@ -182,28 +190,32 @@ This node will retrieve the attestation report per the call made by the TriggerA

      Templated SyncML Call:

      - - - - - - - ./Device/Vendor/MSFT/HealthAttestation/GetAttestReport - - - - - - - +```xml + + + + + + + ./Device/Vendor/MSFT/HealthAttestation/GetAttestReport + + + + + + + +```

      Sample data:

      - If Success: - JWT token: aaaaaaaaaaaaa.bbbbbbbbbbbbb.cccccccccc - If failed: - Previously cached report if available (the token may have already expired per the attestation policy). - OR Sync ML 404 error if not cached report available. +``` +If Success: +JWT token: aaaaaaaaaaaaa.bbbbbbbbbbbbb.cccccccccc +If failed: +Previously cached report if available (the token may have already expired per the attestation policy). +OR Sync ML 404 error if not cached report available. +``` **GetServiceCorrelationIDs**

      Node type: GET @@ -211,20 +223,22 @@ This node will retrieve the service generated correlation IDs for the given MDM

      Templated SyncML Call:

      - - - - - - - ./Device/Vendor/MSFT/HealthAttestation/GetServiceCorrelationIDs - - - - - - - +```xml + + + + + + + ./Device/Vendor/MSFT/HealthAttestation/GetServiceCorrelationIDs + + + + + + + +```

      Sample data:

      @@ -379,7 +393,8 @@ c1:[type=="bootAppSvnQuery", issuer=="AttestationPolicy"] && c2:[type=="events", c:[type=="events", issuer=="AttestationService"] => issue(type="bootRevListInfo", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_BOOT_REVOCATION_LIST.RawData | @[0]"))); }; -``` +``` +
    • Call TriggerAttestation with your rpid, AAD token and the attestURI:
      Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Azure Attestation) | Microsoft Docs
      • @@ -387,7 +402,7 @@ Use the Attestation URL generated in step 1, and append the appropriate api vers GetAttestReport return the signed attestation token as a JWT.The JWT can be decoded to parse the information per the attestation policy.
      - +```json { "typ": "JWT", "alg": "RS256", @@ -442,7 +457,7 @@ GetAttestReport return the signed attestation token as a JWT.The JWT can be deco "testSigningDisabled": true, "vbsEnabled": true }.[Signature] - +```
From 9afca2687a9200e47faab4ec9f520a6ed79e7f0f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 19 Oct 2021 12:51:07 -0700 Subject: [PATCH 145/284] Added angle brackets to resolve [Suggestion: code-block-indented] --- windows/client-management/mdm/healthattestation-csp.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 5e6f472f82..7e05d3b90b 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -242,11 +242,11 @@ This node will retrieve the service generated correlation IDs for the given MDM

Sample data:

- If success: - GUID returned by the attestation service: 1k9+vQOn00S8ZK33;CMc969r1JEuHwDpM - If Trigger Attestation call failed and no previous data is present. The field remains empty. - Otherwise, the last service correlation id will be returned. In a successful attestation there are two - calls between client and MAA and for each call the GUID is separated by semicolon. +> If success: +> GUID returned by the attestation service: 1k9+vQOn00S8ZK33;CMc969r1JEuHwDpM +> If Trigger Attestation call failed and no previous data is present. The field remains empty. +> Otherwise, the last service correlation id will be returned. In a successful attestation there are two +> calls between client and MAA and for each call the GUID is separated by semicolon. > **_Note:_** MAA CSP nodes are available on arm64 but is not currently supported. From f4cca76942a312c2022de2e4fb4c0e9db572e2bc Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 19 Oct 2021 13:01:54 -0700 Subject: [PATCH 146/284] Acrolinx: many fixes, mostly spelling --- .../mdm/healthattestation-csp.md | 58 +++++++++---------- 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 7e05d3b90b..b6e69dd50e 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -14,7 +14,7 @@ ms.date: # Device HealthAttestation CSP -The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT adminstrators to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions. +The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT administrators to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions. The following is a list of functions performed by the Device HealthAttestation CSP: @@ -36,11 +36,11 @@ The attestation report provides a health assessment of the boot-time properties **DHA (Device HealthAttestation) feature**

The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.

-**MAA-Session (Microsoft Azure Attestaiton service based device HealthAttestation session)** -

The Microsoft Azure Attestaiton service based device HealthAttestation session (MAA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.

+**MAA-Session (Microsoft Azure Attestation service based device HealthAttestation session)** +

The Microsoft Azure Attestation service-based device HealthAttestation session (MAA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.

-**MAA-CSP Nodes (Microsoft Azure Attestaiton based Configuration Service Provider)** -

The Configuration Service Provider nodes added to Windhows 11 to integrate with Microsoft Azure Attestation Service.

+**MAA-CSP Nodes (Microsoft Azure Attestation based Configuration Service Provider)** +

The Configuration Service Provider nodes added to Windows 11 to integrate with Microsoft Azure Attestation Service.

The following list of operations is performed by MAA-CSP:

  • Receives attestation trigger requests from a HealthAttestation enabled MDM provider.
    • @@ -50,7 +50,7 @@ The attestation report provides a health assessment of the boot-time properties
**MAA endpoint** -Microsoft Azure attestation service is an azure resource, and every intance of the service gets adminintrator configured URL. The URI generated is unique in nature and for the puposes of device health attestation is known as the MAA endpoint. +Microsoft Azure attestation service is an Azure resource, and every instance of the service gets administrator configured URL. The URI generated is unique in nature and for the purposes of device health attestation is known as the MAA endpoint. **JWT (JSON Web Token)** JSON Web Token (JWT) is an open standard RFC7519 method for securely transmitting information between parties as a JavaScript Object Notation (JSON) object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret or a public/private key pair. @@ -62,7 +62,7 @@ JSON Web Token (JWT) is an open standard RFC7519 method for securely transmittin

Attestation flow can be broadly in three main steps:

    -
  • An instance of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
    • +
  • An instance of the Azure Attestation service is set up with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
  • The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrieved.
  • The MDM provider after verifying the token is coming from the attestation service it can parse the attestation token to reflect on the attested state of the device.
@@ -70,7 +70,7 @@ JSON Web Token (JWT) is an open standard RFC7519 method for securely transmittin The protocol implemented can be found here: Attestation Protocol. ### Configuration Service Provider Nodes -Windows 11 introduces additions to the HealthAttestation CSP node to integrate with Microsoft Azure Attestaiton service. +Windows 11 introduces additions to the HealthAttestation CSP node to integrate with Microsoft Azure Attestation service. ``` ./Vendor/MSFT HealthAttestation @@ -132,7 +132,7 @@ This node will trigger attestation flow by launching an attestation process. If
  • rpID (Relying Party Identifier): This field contains an identifier that can be used to help determine the caller.
  • serviceEndpoint : This field contains the complete URL of the Microsoft Azure Attestation provider instance to be used for evaluation.
  • nonce : This field contains an arbitrary number that can be used just once in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.
    • -
  • aadToken : The AAD token to used for authentication against the Microsoft Azure Attestation service.
    • +
  • aadToken : The AAD token to be used for authentication against the Microsoft Azure Attestation service.
  • cv : This field contains an identifier(Correlation Vector) that will passed in to the service call, that can be used for diagnostics purposes.
    • @@ -219,7 +219,7 @@ OR Sync ML 404 error if not cached report available. **GetServiceCorrelationIDs**

    Node type: GET -This node will retrieve the service generated correlation IDs for the given MDM provider. If there are more than one correlation id, they are separated by “;” in the string. +This node will retrieve the service-generated correlation IDs for the given MDM provider. If there are more than one correlation IDs, they are separated by “;” in the string.

    Templated SyncML Call:

    @@ -251,9 +251,9 @@ This node will retrieve the service generated correlation IDs for the given MDM > **_Note:_** MAA CSP nodes are available on arm64 but is not currently supported. -### MAA CSP Intergation Steps +### MAA CSP Integration Steps
      -
    1. Setup a MAA provider instance:
      +
    2. Set up a MAA provider instance:
      MAA instance can be created following the steps here Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.

    3. Update the provider with an appropriate policy:
      The MAA instance should be updated with an appropriate policy. How to author an Azure Attestation policy | Microsoft Docs @@ -397,9 +397,9 @@ c:[type=="events", issuer=="AttestationService"] => issue(type="bootRevListInfo"

    4. Call TriggerAttestation with your rpid, AAD token and the attestURI:
      -Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Azure Attestation) | Microsoft Docs
      5. +Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Attestation) | Microsoft Docs
    5. Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties:
      -GetAttestReport return the signed attestation token as a JWT.The JWT can be decoded to parse the information per the attestation policy. +GetAttestReport return the signed attestation token as a JWT. The JWT can be decoded to parse the information per the attestation policy.
      ```json @@ -655,7 +655,7 @@ HealthAttestation - 0 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service - 1 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device - 2 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_FAILED): A valid DHA-EncBlob could not be retrieved from the DHA-Service for reasons other than discussed in the DHA error/status codes -- 3 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_COMPLETE): DHA-Data is ready for pick up +- 3 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_COMPLETE): DHA-Data is ready for pickup **ForceRetrieve** (Optional)

      Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.

      @@ -665,7 +665,7 @@ HealthAttestation **Certificate** (Required)

      Instructs the DHA-CSP to forward DHA-Data to the MDM server.

      -

      Value type is b64.The supported operation is Get.

      +

      Value type is b64. The supported operation is Get.

      **Nonce** (Required)

      Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server.

      @@ -916,7 +916,7 @@ After the MDM server receives the verified data, the information can be used to - Allow the device to access the resources, but flag the device for further investigation. - Prevent a device from accessing resources. -The following list of data points are verified by the DHA-Service in DHA-Report version 3: +The following list of data points is verified by the DHA-Service in DHA-Report version 3: - [Issued](#issued ) - [AIKPresent](#aikpresent) @@ -964,7 +964,7 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI assets -- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history. +- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history. - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **ResetCount** (Reported only for devices that support TPM 2.0) @@ -989,7 +989,7 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI assets -- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history. +- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history. - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **BitLockerStatus** (at boot time) @@ -1005,7 +1005,7 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI assets -- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history. +- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history. - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **BootManagerRevListVersion** @@ -1018,7 +1018,7 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI and MBI assets - Place the device in a watch list to monitor the device more closely for potential risks. -- Trigger a corrective action, such as such as informing the technical support team to contact the owner investigate the issue. +- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue. **CodeIntegrityRevListVersion**

      This attribute indicates the version of the code that is performing integrity checks during the boot sequence. Using this attribute can help you detect if the device is running the latest version of the code that performs integrity checks, or if it is exposed to security risks (revoked) and enforce an appropriate policy action.

      @@ -1030,7 +1030,7 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI and MBI assets - Place the device in a watch list to monitor the device more closely for potential risks. -- Trigger a corrective action, such as such as informing the technical support team to contact the owner investigate the issue. +- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue. **SecureBootEnabled**

      When Secure Boot is enabled the core components used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies this before it lets the machine start. If any files have been tampered with, breaking their signature, the system will not boot.

      @@ -1041,11 +1041,11 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI assets -- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history. +- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history. - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **BootDebuggingEnabled** -

      Boot debug enabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: the device may run unstable code, or be configured with fewer security restrictions that is required for testing and development.

      +

      Boot debug-enabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: the device may run unstable code, or be configured with fewer security restrictions that is required for testing and development.

      Boot debugging can be disabled or enabled by using the following commands in WMI or a PowerShell script:

      @@ -1071,7 +1071,7 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI assets - Place the device in a watch list to monitor the device more closely for potential risks. -- Trigger a corrective action, such as such as informing the technical support team to contact the owner investigate the issue. +- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue. **CodeIntegrityEnabled**

      When code integrity is enabled, code execution is restricted to integrity verified code.

      @@ -1086,7 +1086,7 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI assets -- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history. +- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history. - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **TestSigningEnabled** @@ -1221,7 +1221,7 @@ Each of these are described in further detail in the following sections, along w

      If SBCPHash is not present, or is an accepted allow-listed value, then allow access. -

      If SBCPHash is present in DHA-Report, and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:

      +

      If SBCPHash is present in DHA-Report, and is not an allow-listed value, then take one of the following actions that align with your enterprise policies:

      - Disallow all access - Place the device in a watch list to monitor the device more closely for potential risks. @@ -1407,7 +1407,7 @@ Each of these are described in further detail in the following sections, along w 27 HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_HTTPHANDLE - DHA-CSP failed to create a HTTP request handle. + DHA-CSP failed to create an HTTP request handle. 28 @@ -1442,7 +1442,7 @@ Each of these are described in further detail in the following sections, along w 34 HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_MISSING_RESPONSE - DHA-CSP received an empty response along with a HTTP error code from DHA-Service. + DHA-CSP received an empty response along with an HTTP error code from DHA-Service. 35 From 887b5a6f3711508e8feca5e311eb2d6733a390cf Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 19 Oct 2021 13:06:36 -0700 Subject: [PATCH 147/284] Acrolinx: many fixes, mostly punctuation & grammar --- .../mdm/healthattestation-csp.md | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index b6e69dd50e..32bdbb1eca 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -25,13 +25,13 @@ The following is a list of functions performed by the Device HealthAttestation C ## Windows 11 Device health attestation -Windows 11 introduces an update to the device health attestation feature. This helps add support for deeper insights to Windows boot security, supporting a zero trust approach to device security. Device health attestation on Windows can be accessed by using the HealthAttestation CSP. This CSP helps assess if a device is booted to a trusted and compliant state and then to take appropriate action. Windows 11 introduces additional child nodes to the HealthAttestation node for the MDM providers to connect to the Microsoft Azure Attestation service which provides a simplified approach to attestation. +Windows 11 introduces an update to the device health attestation feature. This helps add support for deeper insights to Windows boot security, supporting a zero trust approach to device security. Device health attestation on Windows can be accessed by using the HealthAttestation CSP. This CSP helps assess if a device is booted to a trusted and compliant state and then to take appropriate action. Windows 11 introduces additional child nodes to the HealthAttestation node for the MDM providers to connect to the Microsoft Azure Attestation service, which provides a simplified approach to attestation. The attestation report provides a health assessment of the boot-time properties of the device to ensure that the devices are automatically secure as soon as they power on. The health attestation result can then be used to allow or deny access to networks, apps, or services, depending on the health of the device. ### Terms **TPM (Trusted Platform Module)** -

      TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption and signing.

      +

      TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption, and signing.

      **DHA (Device HealthAttestation) feature**

      The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.

      @@ -132,8 +132,8 @@ This node will trigger attestation flow by launching an attestation process. If
    6. rpID (Relying Party Identifier): This field contains an identifier that can be used to help determine the caller.
    7. serviceEndpoint : This field contains the complete URL of the Microsoft Azure Attestation provider instance to be used for evaluation.
    8. nonce : This field contains an arbitrary number that can be used just once in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.
      9. -
    9. aadToken : The AAD token to be used for authentication against the Microsoft Azure Attestation service.
      10. -
    10. cv : This field contains an identifier(Correlation Vector) that will passed in to the service call, that can be used for diagnostics purposes.
      11. +
    11. aadToken: The AAD token to be used for authentication against the Microsoft Azure Attestation service.
      12. +
    12. cv: This field contains an identifier(Correlation Vector) that will passed in to the service call, that can be used for diagnostics purposes.

      13. Sample Data:

      @@ -471,7 +471,7 @@ More information about TPM attestation can be found here: [Microsoft Azure Attes ### Terms **TPM (Trusted Platform Module)** -

      TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption and signing.

      +

      TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption, and signing.

      **DHA (Device HealthAttestation) feature**

      The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.

      @@ -504,10 +504,10 @@ More information about TPM attestation can be found here: [Microsoft Azure Attes DHA session data (Device HealthAttestation session data)

      The following list of data is produced or consumed in one DHA-Transaction: