From bc81ed8bd926c5b37735cb44d16afff15b38887a Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 15 Oct 2020 22:13:19 +0500 Subject: [PATCH 01/23] Note addition As suggested by the user, I have added a note for the user to route to a relevant information page. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8264 --- .../microsoft-defender-atp/mac-install-with-jamf.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md index b02fdd72d5..543ff95c79 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md @@ -30,6 +30,9 @@ ms.topic: conceptual Learn how to deploy Microsoft Defender ATP for macOS with Jamf Pro. +> [!NOTE] +> If you are using macOS Catalina (10.15.4) and newer versions of macOS see [New configuration profiles for macOS Catalina and newer versions of macOS](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies). + This is a multi step process. You'll need to complete all of the following steps: - [Login to the Jamf Portal](mac-install-jamfpro-login.md) From 7044abeed904b35d670678a53ad9eb086de01118 Mon Sep 17 00:00:00 2001 From: Thomas Garrity <31856350+poortom1004@users.noreply.github.com> Date: Thu, 15 Oct 2020 13:56:19 -0500 Subject: [PATCH 02/23] Case sensitivity, re-ordering and other small corrections -Normalized the casing from BuiltIn Local to Builtin Local for group types -Corrected some other group types -Corrected typo for references of Group Policy Creators Owners to Group Policy Creator Owners -Re-ordered the Read-Only Domain Controllers group to be higher in the list to be correctly alphabetized so that it matches the order in the first table -Corrected Guests group membership details -Added missing SID info on a few groups -Changed group types from Domain Global to Global -Replaced "No" with "None" for default membership to be consistent with other groups -RDS Endpoint Servers had an incorrect reference to the domain SID -Users group incorrectly said it's a member of Domain users via primary group membership. This is incorrect because groups do not have primary groups, only users have primary groups. --- .../active-directory-security-groups.md | 235 +++++++++--------- 1 file changed, 117 insertions(+), 118 deletions(-) diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md index 61198672fc..6522607d9d 100644 --- a/windows/security/identity-protection/access-control/active-directory-security-groups.md +++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md @@ -576,7 +576,7 @@ This security group has not changed since Windows Server 2008.

Type

-

BuiltIn Local

+

Builtin Local

Default container

@@ -645,7 +645,7 @@ This security group has not changed since Windows Server 2008.

Type

-

BuiltIn Local

+

Builtin Local

Default container

@@ -717,7 +717,7 @@ This security group includes the following changes since Windows Server 2008:

Type

-

BuiltIn Local

+

Builtin Local

Default container

@@ -865,7 +865,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Builtin local

+

Builtin Local

Default container

@@ -987,7 +987,7 @@ This security group has not changed since Windows Server 2008.

Well-Known SID/RID

-

S-1-5-<domain>-517

+

S-1-5-21-<domain>-517

Type

@@ -1113,7 +1113,7 @@ This security group was introduced in Windows Vista Service Pack 1, and it h

Type

-

Builtin local

+

Builtin Local

Default container

@@ -1241,7 +1241,7 @@ The Device Owners group applies to versions of the Windows Server operating syst

Type

-

BuiltIn Local

+

Builtin Local

Default container

@@ -1430,7 +1430,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Domain local

+

Builtin Local

Default container

@@ -1493,7 +1493,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Domain Global

+

Global

Default container

@@ -1552,7 +1552,7 @@ This security group has not changed since Windows Server 2008.

Well-Known SID/RID

-

S-1-5-<domain>-515

+

S-1-5-21-<domain>-515

Type

@@ -1613,7 +1613,7 @@ This security group has not changed since Windows Server 2008.

Well-Known SID/RID

-

S-1-5-<domain>-516

+

S-1-5-21-<domain>-516

Type

@@ -1674,7 +1674,7 @@ This security group has not changed since Windows Server 2008.

Well-Known SID/RID

-

S-1-5-<domain>-514

+

S-1-5-21-<domain>-514

Type

@@ -1737,11 +1737,11 @@ This security group has not changed since Windows Server 2008.

Well-Known SID/RID

-

S-1-5-<domain>-513

+

S-1-5-21-<domain>-513

Type

-

Domain Global

+

Global

Default container

@@ -1950,7 +1950,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Builtin local

+

Domain local

Default container

@@ -1985,13 +1985,13 @@ This security group has not changed since Windows Server 2008. -### Group Policy Creators Owners +### Group Policy Creator Owners This group is authorized to create, edit, or delete Group Policy Objects in the domain. By default, the only member of the group is Administrator. For information about other features you can use with this security group, see [Group Policy Overview](https://technet.microsoft.com/library/hh831791.aspx). -The Group Policy Creators Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). +The Group Policy Creator Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). This security group has not changed since Windows Server 2008. @@ -2009,7 +2009,7 @@ This security group has not changed since Windows Server 2008.

Well-Known SID/RID

-

S-1-5-<domain>-520

+

S-1-5-21-<domain>-520

Type

@@ -2093,12 +2093,11 @@ This security group has not changed since Windows Server 2008.

Default members

-

Guest

+

Domain Guests

Guest

Default member of

-

Domain Guests

-

Guest

+

None

Protected by ADMINSDHOLDER?

@@ -2150,7 +2149,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

Type

-

Builtin local

+

Builtin Local

Default container

@@ -2162,7 +2161,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

Default member of

-

No

+

None

Protected by ADMINSDHOLDER?

@@ -2211,7 +2210,7 @@ This security group has not changed since Windows Server 2008.

Type

-

BuiltIn Local

+

Builtin Local

Default container

@@ -2286,7 +2285,7 @@ This security group has not changed since Windows Server 2008.

Type

-

BuiltIn local

+

Builtin Local

Default container

@@ -2389,7 +2388,7 @@ This security group has not changed since Windows Server 2008.

Type

-

BuiltIn local

+

Builtin Local

Default container

@@ -2470,7 +2469,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Builtin local

+

Builtin Local

Default container

@@ -2551,7 +2550,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Builtin local

+

Builtin Local

Default container

@@ -2615,7 +2614,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Builtin local

+

Builtin Local

Default container

@@ -2679,7 +2678,7 @@ This security group has not changed since Windows Server 2008. However, in Windo

Type

-

Builtin local

+

Builtin Local

Default container

@@ -2758,7 +2757,7 @@ The following table specifies the properties of the Protected Users group.

Type

-

Domain Global

+

Global

Default container

@@ -2819,7 +2818,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Domain local

+

Builtin Local

Default container

@@ -2876,11 +2875,11 @@ This security group was introduced in Windows Server 2012, and it has not chang

Well-Known SID/RID

-

S-1-5-32-<domain>-576

+

S-1-5-32-576

Type

-

Builtin local

+

Builtin Local

Default container

@@ -2939,7 +2938,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

Type

-

Builtin local

+

Builtin Local

Default container

@@ -3000,7 +2999,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

Type

-

Builtin local

+

Builtin Local

Default container

@@ -3035,6 +3034,78 @@ This security group was introduced in Windows Server 2012, and it has not chang +### Read-Only Domain Controllers + +This group is comprised of the Read-only domain controllers in the domain. A Read-only domain controller makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role. + +Because administration of a Read-only domain controller can be delegated to a domain user or security group, an Read-only domain controller is well suited for a site that should not have a user who is a member of the Domain Admins group. A Read-only domain controller encompasses the following functionality: + +- Read-only AD DS database + +- Unidirectional replication + +- Credential caching + +- Administrator role separation + +- Read-only Domain Name System (DNS) + +For information about deploying a Read-only domain controller, see [Understanding Planning and Deployment for Read-Only Domain Controllers](https://technet.microsoft.com/library/cc754719(v=ws.10).aspx). + +This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
AttributeValue

Well-Known SID/RID

S-1-5-21-<domain>-521

Type

Global

Default container

CN=Users, DC=<domain>, DC=

Default members

None

Default member of

Denied RODC Password Replication Group

Protected by ADMINSDHOLDER?

Yes

Safe to move out of default container?

Yes

Safe to delegate management of this group to non-Service admins?

Default User Rights

See Denied RODC Password Replication Group

+ + ### Remote Desktop Users The Remote Desktop Users group on an RD Session Host server is used to grant users and groups permissions to remotely connect to an RD Session Host server. This group cannot be renamed, deleted, or moved. It appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). @@ -3094,78 +3165,6 @@ This security group has not changed since Windows Server 2008. - - -### Read-Only Domain Controllers - -This group is comprised of the Read-only domain controllers in the domain. A Read-only domain controller makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role. - -Because administration of a Read-only domain controller can be delegated to a domain user or security group, an Read-only domain controller is well suited for a site that should not have a user who is a member of the Domain Admins group. A Read-only domain controller encompasses the following functionality: - -- Read-only AD DS database - -- Unidirectional replication - -- Credential caching - -- Administrator role separation - -- Read-only Domain Name System (DNS) - -For information about deploying a Read-only domain controller, see [Understanding Planning and Deployment for Read-Only Domain Controllers](https://technet.microsoft.com/library/cc754719(v=ws.10).aspx). - -This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-21-<domain>-521

Type

Default container

CN=Users, DC=<domain>, DC=

Default members

None

Default member of

Denied RODC Password Replication Group

Protected by ADMINSDHOLDER?

Yes

Safe to move out of default container?

Yes

Safe to delegate management of this group to non-Service admins?

Default User Rights

See Denied RODC Password Replication Group

@@ -3197,7 +3196,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

Type

-

Builtin local

+

Builtin Local

Default container

@@ -3264,7 +3263,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Builtin local

+

Builtin Local

Default container

@@ -3327,7 +3326,7 @@ This security group has not changed since Windows Server 2008.

Well-Known SID/RID

-

S-1-5-<root domain>-518

+

S-1-5-21-<root domain>-518

Type

@@ -3394,7 +3393,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Builtin local

+

Builtin Local

Default container

@@ -3442,7 +3441,7 @@ The Storage Replica Administrators group applies to versions of the Windows Serv | Attribute | Value | |-----------|-------| | Well-Known SID/RID | S-1-5-32-582 | -| Type | BuiltIn Local | +| Type | Builtin Local | | Default container | CN=BuiltIn, DC=<domain>, DC= | | Default members | None | | Default member of | None | @@ -3463,7 +3462,7 @@ The System Managed Accounts group applies to versions of the Windows Server oper | Attribute | Value | |-----------|-------| | Well-Known SID/RID | S-1-5-32-581 | -| Type | BuiltIn Local | +| Type | Builtin Local | | Default container | CN=BuiltIn, DC=<domain>, DC= | | Default members | Users | | Default member of | None | @@ -3507,7 +3506,7 @@ This security group only applies to Windows Server 2003 and Windows Server 200

Type

-

Builtin local

+

Builtin Local

Default container

@@ -3574,7 +3573,7 @@ This security group includes the following changes since Windows Server 2008:

Type

-

Builtin local

+

Builtin Local

Default container

@@ -3588,7 +3587,7 @@ This security group includes the following changes since Windows Server 2008:

Default member of

-

Domain Users (this membership is due to the fact that the Primary Group ID of all user accounts is Domain Users.)

+

None

Protected by ADMINSDHOLDER?

@@ -3641,7 +3640,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Builtin local

+

Builtin Local

Default container

From 98e827f73c24da46e172350d420c28db74ec80ad Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 16 Oct 2020 11:33:20 +0500 Subject: [PATCH 03/23] Update windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../microsoft-defender-atp/mac-install-with-jamf.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md index 543ff95c79..da3ebf8271 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md @@ -31,7 +31,7 @@ ms.topic: conceptual Learn how to deploy Microsoft Defender ATP for macOS with Jamf Pro. > [!NOTE] -> If you are using macOS Catalina (10.15.4) and newer versions of macOS see [New configuration profiles for macOS Catalina and newer versions of macOS](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies). +> If you are using macOS Catalina (10.15.4) or newer versions of macOS, see [New configuration profiles for macOS Catalina and newer versions of macOS](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies). This is a multi step process. You'll need to complete all of the following steps: @@ -43,4 +43,3 @@ This is a multi step process. You'll need to complete all of the following steps - From 9a2cacd47140a93a2449cb638002d0cdf017b35d Mon Sep 17 00:00:00 2001 From: Nagappan Veerappan Date: Mon, 9 Nov 2020 09:39:50 -0800 Subject: [PATCH 04/23] 0x801C03F2-Delta update Primary SMTP and Email address mismatch -0x801C03F2 --- .../hello-for-business/hello-errors-during-pin-creation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 01f18214de..b58170ab29 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -68,7 +68,7 @@ If the error occurs again, check the error code against the following table to s | 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed.

-or-

Token was not found in the Authorization header.

-or-

Failed to read one or more objects.

-or-

The request sent to the server was invalid. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin. | 0x801C03EE | Attestation failed. | Sign out and then sign in again. | | 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. | -| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). +| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also if no sync conflict. Please verify the "Mail /Email address" in AAD and the Primary SMTP address in the proxy address is the same. | 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. | | | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. | | 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. | From eba9bf94cde48291d87122376b42a63f2ce38e79 Mon Sep 17 00:00:00 2001 From: Nagappan Veerappan Date: Wed, 11 Nov 2020 07:52:20 -0800 Subject: [PATCH 05/23] Update windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../hello-for-business/hello-errors-during-pin-creation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index b58170ab29..a4ca968d29 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -68,7 +68,7 @@ If the error occurs again, check the error code against the following table to s | 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed.

-or-

Token was not found in the Authorization header.

-or-

Failed to read one or more objects.

-or-

The request sent to the server was invalid. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin. | 0x801C03EE | Attestation failed. | Sign out and then sign in again. | | 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. | -| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also if no sync conflict. Please verify the "Mail /Email address" in AAD and the Primary SMTP address in the proxy address is the same. +| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in AAD and the Primary SMTP address is the same in the proxy address. | 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. | | | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. | | 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. | From c1bba1fc63b8a05db9897dafc8fa5f634bd39412 Mon Sep 17 00:00:00 2001 From: Rafal Sosnowski <51166236+rafals2@users.noreply.github.com> Date: Tue, 17 Nov 2020 10:44:22 -0800 Subject: [PATCH 06/23] Update bitlocker-overview.md added more clarity for active partitions --- .../information-protection/bitlocker/bitlocker-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 551b239d72..ca3e14c35a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -74,7 +74,7 @@ The hard disk must be partitioned with at least two drives: - The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system. - The system drive contains the files that are needed to load Windows after the firmware has prepared the system hardware. BitLocker is not enabled on this drive. For BitLocker to work, the system drive must not be encrypted, must differ from the operating system drive, and must be formatted with the FAT32 file system on computers that use UEFI-based firmware or with the NTFS file system on computers that use BIOS firmware. We recommend that system drive be approximately 350 MB in size. After BitLocker is turned on it should have approximately 250 MB of free space. -A fixed data volume or removable data volume cannot be marked as an active partition. +Partition subject to encryption cannot be marked as an active partition (this applies to OS, fixed data and removable data drives). When installed on a new computer, Windows will automatically create the partitions that are required for BitLocker. From b4c0dcb14f6fd6ec627417502c0df32a02b8c205 Mon Sep 17 00:00:00 2001 From: Nagappan Veerappan Date: Wed, 18 Nov 2020 09:48:06 -0800 Subject: [PATCH 07/23] Update windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-errors-during-pin-creation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index a4ca968d29..b7bc415c06 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -68,7 +68,7 @@ If the error occurs again, check the error code against the following table to s | 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed.

-or-

Token was not found in the Authorization header.

-or-

Failed to read one or more objects.

-or-

The request sent to the server was invalid. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin. | 0x801C03EE | Attestation failed. | Sign out and then sign in again. | | 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. | -| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in AAD and the Primary SMTP address is the same in the proxy address. +| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in AAD and the Primary SMTP address are the same in the proxy address. | 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. | | | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. | | 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. | From eb41ea66cdf3477157f9c4c366425fdbbcf3e418 Mon Sep 17 00:00:00 2001 From: Dominic Jean Date: Tue, 24 Nov 2020 11:38:31 -0800 Subject: [PATCH 08/23] Format of resolution for "The TPM is locked out." The resolution for the "The TPM is locked out." issue was missing newline characters in the PowerShell commands. This change adds newline characters between the commands so that the command is easier to run. --- .../bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md index c112d898f7..7d66ced22c 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md @@ -39,7 +39,9 @@ To resolve this issue, follow these steps: 1. Open an elevated PowerShell window and run the following script: ```ps - $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)} + $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" + $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus + if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)} ``` 1. Restart the computer. If you are prompted at the restart screen, press F12 to agree. From b7003007b00444f6eba4859cca91e2efee00a5f3 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 25 Nov 2020 17:14:20 +0200 Subject: [PATCH 09/23] Add info about HTTP error 429 https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8666 --- .../threat-protection/microsoft-defender-atp/common-errors.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/common-errors.md b/windows/security/threat-protection/microsoft-defender-atp/common-errors.md index 34adbf6fbe..c43240cb86 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/common-errors.md +++ b/windows/security/threat-protection/microsoft-defender-atp/common-errors.md @@ -46,6 +46,7 @@ DisallowedOperation | Forbidden (403) | {the disallowed operation and the reason NotFound | Not Found (404) | General Not Found error message. ResourceNotFound | Not Found (404) | Resource {the requested resource} was not found. InternalServerError | Internal Server Error (500) | (No error message, try retry the operation or contact us if it does not resolved) +TooManyRequests | Too Many Requests (429) | Response will represent reaching quota limit either by number of requests or by CPU. ## Body parameters are case-sensitive From 9a40aca0256689b346742cd326cb7827392cde62 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Tue, 1 Dec 2020 12:43:07 -0800 Subject: [PATCH 10/23] Update waas-delivery-optimization.md Added support for Edge browser installations and updates. --- windows/deployment/update/waas-delivery-optimization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index a50997dbcc..02dd9f8971 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -65,7 +65,7 @@ For information about setting up Delivery Optimization, including tips for the b - Office installations and updates - Xbox game pass games - MSIX apps (HTTP downloads only) - + - Edge browser installations and updates ## Requirements From 5c278fc35fe6eac42f6f53d1111e616626319c3c Mon Sep 17 00:00:00 2001 From: Obi Eze Ajoku <62227226+linque1@users.noreply.github.com> Date: Tue, 1 Dec 2020 13:21:23 -0800 Subject: [PATCH 11/23] updated ownership to robsize updated ownership to robsize --- ...ating-system-components-to-microsoft-services-using-MDM.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index d53f7dc795..1c68d554a4 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -8,10 +8,10 @@ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro -author: medgarmedgar +author: robsize ms.author: dansimp manager: robsize -ms.date: 3/25/2020 +ms.date: 12/1/2020 --- # Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server From 2ad29089da2e35427958ce9500d083510ff6aafc Mon Sep 17 00:00:00 2001 From: Obi Eze Ajoku <62227226+linque1@users.noreply.github.com> Date: Tue, 1 Dec 2020 13:22:14 -0800 Subject: [PATCH 12/23] updated ownership to robsize updated ownership to robsize --- windows/privacy/manage-windows-2004-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-2004-endpoints.md b/windows/privacy/manage-windows-2004-endpoints.md index df3f9bb1e9..fa26bc5140 100644 --- a/windows/privacy/manage-windows-2004-endpoints.md +++ b/windows/privacy/manage-windows-2004-endpoints.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.localizationpriority: high audience: ITPro author: linque1 -ms.author: obezeajo +ms.author: robsize manager: robsize ms.collection: M365-security-compliance ms.topic: article From 597175655841106f558a730b9db3caacf3b4e036 Mon Sep 17 00:00:00 2001 From: kasiak-msft <66700245+kasiak-msft@users.noreply.github.com> Date: Wed, 2 Dec 2020 13:43:34 -0800 Subject: [PATCH 13/23] Update non-windows.md Added section on Microsoft Defender for Endpoint on iOS now that iOS is in public preview and soon to be GA. Also updated each section titles to remove the second "for" in the title after "for Endpoint". Did the same in the first sentence of each section. Changed "for" to "on" ex: Microsoft Defender for Endpoint on macOS. Updated "Mac" to "macOS" to refer to the OS name and not the device name. --- .../microsoft-defender-atp/non-windows.md | 33 ++++++++++++------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/non-windows.md index 23dd0567e1..102bb001a2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/non-windows.md @@ -42,38 +42,38 @@ non-Windows platforms, enabling them to get a full picture of what's happening in their environment, which empowers them to more quickly assess and respond to threats. -## Microsoft Defender for Endpoint for Mac +## Microsoft Defender for Endpoint on macOS -Microsoft Defender for Endpoint for Mac offers antivirus and endpoint detection and response (EDR) capabilities for the three +Microsoft Defender for Endpoint on macOS offers antivirus and endpoint detection and response (EDR) capabilities for the three latest released versions of macOS. Customers can deploy and manage the solution through Microsoft Endpoint Manager and Jamf. Just like with Microsoft Office applications on macOS, Microsoft Auto Update is used to manage Microsoft -Defender for Endpoint for Mac updates. For information about the key features and +Defender for Endpoint on Mac updates. For information about the key features and benefits, read our [announcements](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/bg-p/MicrosoftDefenderATPBlog/label-name/macOS). -For more details on how to get started, visit the Defender for Endpoint for Mac +For more details on how to get started, visit the Defender for Endpoint on macOS [documentation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac). -## Microsoft Defender for Endpoint for Linux +## Microsoft Defender for Endpoint on Linux -Microsoft Defender for Endpoint for Linux offers preventative (AV) capabilities for Linux +Microsoft Defender for Endpoint on Linux offers preventative (AV) capabilities for Linux servers. This includes a full command line experience to configure and manage the agent, initiate scans, and manage threats. We support recent versions of the six most common Linux Server distributions: RHEL 7.2+, CentOS Linux 7.2+, Ubuntu 16 LTS, or higher LTS, SLES 12+, Debian 9+, and Oracle Linux 7.2. Microsoft -Defender for Endpoint for Linux can be deployed and configured using Puppet, Ansible, or +Defender for Endpoint on Linux can be deployed and configured using Puppet, Ansible, or using your existing Linux configuration management tool. For information about the key features and benefits, read our [announcements](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/bg-p/MicrosoftDefenderATPBlog/label-name/Linux). -For more details on how to get started, visit the Microsoft Defender for Endpoint for +For more details on how to get started, visit the Microsoft Defender for Endpoint on Linux [documentation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux). -## Microsoft Defender for Endpoint for Android +## Microsoft Defender for Endpoint on Android -Microsoft Defender for Endpoint for Android is our mobile threat defense solution for +Microsoft Defender for Endpoint on Android is our mobile threat defense solution for devices running Android 6.0 and higher. Both Android Enterprise (Work Profile) and Device Administrator modes are supported. On Android, we offer web protection, which includes anti-phishing, blocking of unsafe connections, and @@ -83,11 +83,20 @@ through integration with Microsoft Endpoint Manager and Conditional Access. For information about the key features and benefits, read our [announcements](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/bg-p/MicrosoftDefenderATPBlog/label-name/Android). -For more details on how to get started, visit the Microsoft Defender for Endpoint for +For more details on how to get started, visit the Microsoft Defender for Endpoint on Android [documentation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-android). +## Microsoft Defender for Endpoint on iOS +Microsoft Defender for Endpoint on iOS is our mobile threat defense solution for devices +running iOS 11.0 and higher. Both Supervised and Unsupervised devices are supported. +On iOS, we offer web protection which includes anti-phishing, blocking of unsafe connections, and +setting of custom indicators. For more information about the key features and benefits, +read our [announcements](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/bg-p/MicrosoftDefenderATPBlog/label-name/iOS). + +For more details on how to get started, visit the Microsoft Defender for Endpoint +on iOS [documentation](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-ios). ## Licensing requirements @@ -95,7 +104,7 @@ Eligible Licensed Users may use Microsoft Defender for Endpoint on up to five co devices. Microsoft Defender for Endpoint is also available for purchase from a Cloud Solution Provider (CSP). -Customers can obtain Microsoft Defender for Endpoint for Mac through a standalone +Customers can obtain Microsoft Defender for Endpoint on macOS through a standalone Microsoft Defender for Endpoint license, as part of Microsoft 365 A5/E5, or Microsoft 365 Security. From 9de8233860f5a995b4dd9f03b1fa931d7514fa29 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 3 Dec 2020 06:07:39 +0530 Subject: [PATCH 14/23] Update enroll-a-windows-10-device-automatically-using-group-policy.md This is my own PR , i read that article , and i found latest administrative templates of october 20h2 is missing , so i added to this article --- ...ll-a-windows-10-device-automatically-using-group-policy.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 4354bb8c3e..fa6f14f888 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -183,6 +183,8 @@ Requirements: - 1909 --> [Administrative Templates (.admx) for Windows 10 November 2019 Update (1909)](https://www.microsoft.com/download/confirmation.aspx?id=100591) - 2004 --> [Administrative Templates (.admx) for Windows 10 May 2020 Update (2004)](https://www.microsoft.com/download/confirmation.aspx?id=101445) + + - 20H2 --> [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) 2. Install the package on the Domain Controller. @@ -197,6 +199,8 @@ Requirements: - 1909 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2019 Update (1909)** - 2004 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2020 Update (2004)** + + - 20H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2020 Update (20H2)** 4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**. From 678b680a2d28ceb58c54b20c1d5a51e9134cba06 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 3 Dec 2020 11:34:26 +0500 Subject: [PATCH 15/23] Update enroll-a-windows-10-device-automatically-using-group-policy.md --- ...ll-a-windows-10-device-automatically-using-group-policy.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 4354bb8c3e..f73e248d75 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -113,8 +113,8 @@ Requirements: 4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use. > [!NOTE] - > **Device Credential** Credential Type will also work, however, it is not yet supported for MDM solutions (including Intune). We don't recommend using this option until support is announced. - + > **Device Credential** Credential Type may also work; however, it is not supported by Intune yet. It is not recommended to use this option until support is announced. + ![MDM autoenrollment policy](images/autoenrollment-policy.png) 5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. From 731fe61c1b17b719771cf2d4db38feb5c88eb346 Mon Sep 17 00:00:00 2001 From: julihooper <65675989+julihooper@users.noreply.github.com> Date: Fri, 4 Dec 2020 11:44:11 -0800 Subject: [PATCH 16/23] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index f562eb572d..1f38d5f49f 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -48,6 +48,8 @@ Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft Cloud-delivered protection is always on and requires an active connection to the Internet to function. Security intelligence updates occur on a scheduled cadence (configurable via policy). For more information, see [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md). +For a list of recent security intelligence updates please visit: [Antimalware updates change log - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes). + Engine updates are included with security intelligence updates and are released on a monthly cadence. ## Product updates From 922017ec1684b10935e1de2b463767fa191cca09 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Fri, 4 Dec 2020 15:35:50 -0800 Subject: [PATCH 17/23] Update windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 1f38d5f49f..3f20c7f60a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -48,7 +48,7 @@ Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft Cloud-delivered protection is always on and requires an active connection to the Internet to function. Security intelligence updates occur on a scheduled cadence (configurable via policy). For more information, see [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md). -For a list of recent security intelligence updates please visit: [Antimalware updates change log - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes). +For a list of recent security intelligence updates, please visit: [Antimalware updates change log - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes). Engine updates are included with security intelligence updates and are released on a monthly cadence. From 01ffab00354b5297726bdfa77321ec0dff0d9bc9 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Fri, 4 Dec 2020 15:40:26 -0800 Subject: [PATCH 18/23] Update windows/security/threat-protection/microsoft-defender-atp/non-windows.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../threat-protection/microsoft-defender-atp/non-windows.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/non-windows.md index 102bb001a2..d401c3b594 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/non-windows.md @@ -91,8 +91,8 @@ Android Microsoft Defender for Endpoint on iOS is our mobile threat defense solution for devices running iOS 11.0 and higher. Both Supervised and Unsupervised devices are supported. -On iOS, we offer web protection which includes anti-phishing, blocking of unsafe connections, and -setting of custom indicators. For more information about the key features and benefits, +On iOS, we offer web protection which includes anti-phishing, blocking unsafe connections, and +setting custom indicators. For more information about the key features and benefits, read our [announcements](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/bg-p/MicrosoftDefenderATPBlog/label-name/iOS). For more details on how to get started, visit the Microsoft Defender for Endpoint From 688436d77a78ca879ad3210f7ebfcc85f01074cb Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Fri, 4 Dec 2020 15:41:05 -0800 Subject: [PATCH 19/23] Update non-windows.md --- .../threat-protection/microsoft-defender-atp/non-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/non-windows.md index d401c3b594..0cce3c728b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/non-windows.md @@ -96,7 +96,7 @@ setting custom indicators. For more information about the key features and benef read our [announcements](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/bg-p/MicrosoftDefenderATPBlog/label-name/iOS). For more details on how to get started, visit the Microsoft Defender for Endpoint -on iOS [documentation](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-ios). +on iOS [documentation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-ios). ## Licensing requirements From 446deee5f01ec4637891a2a77093209b6667e498 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Fri, 4 Dec 2020 15:43:50 -0800 Subject: [PATCH 20/23] Update windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- ...nroll-a-windows-10-device-automatically-using-group-policy.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index f73e248d75..03171b42be 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -114,7 +114,6 @@ Requirements: > [!NOTE] > **Device Credential** Credential Type may also work; however, it is not supported by Intune yet. It is not recommended to use this option until support is announced. - ![MDM autoenrollment policy](images/autoenrollment-policy.png) 5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. From 32a997f041ac1eb2a2a12942434738d23a65d9e2 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Fri, 4 Dec 2020 15:45:34 -0800 Subject: [PATCH 21/23] Update enroll-a-windows-10-device-automatically-using-group-policy.md minor edits --- ...roll-a-windows-10-device-automatically-using-group-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 03171b42be..2642cd7819 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -113,7 +113,7 @@ Requirements: 4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use. > [!NOTE] - > **Device Credential** Credential Type may also work; however, it is not supported by Intune yet. It is not recommended to use this option until support is announced. + > **Device Credential** Credential Type may work, however, it is not yet supported by Intune. We don't recommend using this option until it's supported. ![MDM autoenrollment policy](images/autoenrollment-policy.png) 5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. From 2c3c815484aa5a95db707d15287339fe1b67bea8 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Fri, 4 Dec 2020 15:55:11 -0800 Subject: [PATCH 22/23] Update windows/security/information-protection/bitlocker/bitlocker-overview.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../information-protection/bitlocker/bitlocker-overview.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index ca3e14c35a..91df6ad467 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -74,7 +74,7 @@ The hard disk must be partitioned with at least two drives: - The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system. - The system drive contains the files that are needed to load Windows after the firmware has prepared the system hardware. BitLocker is not enabled on this drive. For BitLocker to work, the system drive must not be encrypted, must differ from the operating system drive, and must be formatted with the FAT32 file system on computers that use UEFI-based firmware or with the NTFS file system on computers that use BIOS firmware. We recommend that system drive be approximately 350 MB in size. After BitLocker is turned on it should have approximately 250 MB of free space. -Partition subject to encryption cannot be marked as an active partition (this applies to OS, fixed data and removable data drives). +A partition subject to encryption cannot be marked as an active partition (this applies to the operating system, fixed data, and removable data drives). When installed on a new computer, Windows will automatically create the partitions that are required for BitLocker. @@ -99,4 +99,3 @@ When installing the BitLocker optional component on a server you will also need | [Troubleshoot BitLocker](troubleshoot-bitlocker.md) | This guide describes the resources that can help you troubleshoot BitLocker issues, and provides solutions for several common BitLocker issues. | | [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This topic for IT pros describes how to protect CSVs and SANs with BitLocker.| | [Enabling Secure Boot and BitLocker Device Encryption on Windows 10 IoT Core](https://developer.microsoft.com/windows/iot/docs/securebootandbitlocker) | This topic covers how to use BitLocker with Windows 10 IoT Core | - From 7aff2313b2a8bd2b567aeb2e83d52bf966a995ce Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Fri, 4 Dec 2020 15:58:34 -0800 Subject: [PATCH 23/23] Update windows/security/identity-protection/access-control/active-directory-security-groups.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../access-control/active-directory-security-groups.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md index 6522607d9d..ad2c68650b 100644 --- a/windows/security/identity-protection/access-control/active-directory-security-groups.md +++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md @@ -1950,7 +1950,7 @@ This security group has not changed since Windows Server 2008.

Type

-

Domain local

+

Domain Local

Default container