From 7230321113ccc666851aba5735a8453ca8187133 Mon Sep 17 00:00:00 2001 From: Steve Syfuhs Date: Thu, 11 Jan 2018 13:57:22 -0800 Subject: [PATCH 1/9] Grammar updates in Credential Guard Considerations A few missing words were added. --- .../credential-guard/credential-guard-considerations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/access-protection/credential-guard/credential-guard-considerations.md b/windows/access-protection/credential-guard/credential-guard-considerations.md index 17598057c2..01dbef4001 100644 --- a/windows/access-protection/credential-guard/credential-guard-considerations.md +++ b/windows/access-protection/credential-guard/credential-guard-considerations.md @@ -61,7 +61,7 @@ Since Credential Manager cannot decrypt saved Windows Credentials, they are dele ### Domain-joined device’s automatically provisioned public key Beginning with Windows 10 and Windows Server 2016, domain-devices automatically provision a bound public key, for more information about automatic public key provisioning, see [Domain-joined Device Public Key Authentication](https://docs.microsoft.com/windows-server/security/kerberos/domain-joined-device-public-key-authentication). -Since Credential Guard cannot decrypt the protected private key, Windows uses the domain-joined computer's password for authentication to the domain. Unless additional policies are deployed, there should not be a loss of functionality. If a device is configured to only use public key, then it cannot authenticate with password until that policy disabled. For more information on Configuring device to only use public key, see [Domain-joined Device Public Key Authentication](https://docs.microsoft.com/windows-server/security/kerberos/domain-joined-device-public-key-authentication). +Since Credential Guard cannot decrypt the protected private key, Windows uses the domain-joined computer's password for authentication to the domain. Unless additional policies are deployed, there should not be a loss of functionality. If a device is configured to only use public key, then it cannot authenticate with password until that policy is disabled. For more information on Configuring devices to only use public key, see [Domain-joined Device Public Key Authentication](https://docs.microsoft.com/windows-server/security/kerberos/domain-joined-device-public-key-authentication). Also if any access control checks including authentication policies require devices to have either the KEY TRUST IDENTITY (S-1-18-4) or FRESH PUBLIC KEY IDENTITY (S-1-18-3) well-known SIDs, then those access checks fail. For more information about authentication policies, see [Authentication Policies and Authentication Policy Silos](https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/authentication-policies-and-authentication-policy-silos). For more information about well-known SIDs, see [[MS-DTYP] Section 2.4.2.4 Well-known SID Structures](https://msdn.microsoft.com/en-us/library/cc980032.aspx). From 559dede7e0ec857c613290c4422278b99228a033 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 12 Jan 2018 00:35:39 +0000 Subject: [PATCH 2/9] Merged PR 5267: Fixed typo in error code Fixed typo in error code --- .../deployment/upgrade/resolve-windows-10-upgrade-errors.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md index bce822bcc6..f67599ce30 100644 --- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md +++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy author: greg-lindsay -ms.date: 10/16/2017 +ms.date: 01/11/2018 ms.localizationpriority: high --- @@ -571,7 +571,7 @@ For more information, see [How to perform a clean boot in Windows](https://suppo Code -800040005 - 0x20007 +80040005 - 0x20007 From 05ee88aec775c856b098ca2a4bb60040168a3a73 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Fri, 12 Jan 2018 17:15:05 +0000 Subject: [PATCH 3/9] Merged PR 5273: Added ControlPolicyConflict to Policy CSP --- windows/client-management/mdm/TOC.md | 1 + .../policy-configuration-service-provider.md | 8 ++ .../mdm/policy-csp-controlpolicyconflict.md | 101 ++++++++++++++++++ 3 files changed, 110 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-controlpolicyconflict.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 10a90e34ec..7e36c48d66 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -187,6 +187,7 @@ #### [Camera](policy-csp-camera.md) #### [Cellular](policy-csp-cellular.md) #### [Connectivity](policy-csp-connectivity.md) +#### [ControlPolicyConflict](policy-csp-controlpolicyconflict.md) #### [CredentialProviders](policy-csp-credentialproviders.md) #### [CredentialsUI](policy-csp-credentialsui.md) #### [Cryptography](policy-csp-cryptography.md) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 70a293fad5..06bc214f80 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -617,6 +617,14 @@ The following diagram shows the Policy configuration service provider in tree fo +### ControlPolicyConflict policies + +
+
+ ControlPolicyConflict/MDMWinsOverGP +
+
+ ### CredentialProviders policies
diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md new file mode 100644 index 0000000000..c628f5e912 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -0,0 +1,101 @@ +--- +title: Policy CSP - ControlPolicyConflict +description: Policy CSP - ControlPolicyConflict +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 01/11/2018 +--- + +# Policy CSP - ControlPolicyConflict + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
+ + +## ControlPolicyConflict policies + +
+
+ ControlPolicyConflict/MDMWinsOverGP +
+
+ +
+ +**ControlPolicyConflict/MDMWinsOverGP** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark4check mark4check mark4check mark4cross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Added in Windows 10, next major update. This policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy are set on the device. + +This policy is used to ensure that MDM policy wins over GP when same setting is set by both GP and MDM channel. This policy doesn’t support Delete command. This policy doesn’t support setting the value to be 0 again after it was previously set 1. The default value is 0. In next major update, the MDM policies in Policy CSP will behave as described if this policy value is set 1. + +The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. This ensures that: + +- GP settings that correspond to MDM applied settings are not conflicting +- The current Policy Manager policies are refreshed from what MDM has set +- Any values set by scripts/user outside of GP that conflict with MDM are removed + + + +The following list shows the supported values: + +- 0 (default) +- 1 - The MDM policy is used and the GP policy is blocked. + + + + + + + + + + +
+ +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. + + + From 69045b87dd642a7fc98ae4e13adac6c3c5dac272 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 12 Jan 2018 09:59:57 -0800 Subject: [PATCH 4/9] clarified domain join --- .../credential-guard/credential-guard-manage.md | 4 ++-- windows/access-protection/remote-credential-guard.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/access-protection/credential-guard/credential-guard-manage.md b/windows/access-protection/credential-guard/credential-guard-manage.md index ee1efd2463..5e972edfb7 100644 --- a/windows/access-protection/credential-guard/credential-guard-manage.md +++ b/windows/access-protection/credential-guard/credential-guard-manage.md @@ -123,9 +123,9 @@ DG_Readiness_Tool_v3.2.ps1 -Ready > [!NOTE] -For client machines that are running Windows 10 1703, LSAIso is running whenever Virtualization based security is enabled for other features. +For client machines that are running Windows 10 1703, LsaIso.exe is running whenever virtualization-based security is enabled for other features. -- If Windows Defender Credential Guard is enabled on a device after it's joined to a domain, the user and device secrets may already be compromised. We recommend that Windows Defender Credential Guard should be enabled before the PC is joined to a domain. +- We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised. - You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. diff --git a/windows/access-protection/remote-credential-guard.md b/windows/access-protection/remote-credential-guard.md index 7bb6243266..bf1b0ebf07 100644 --- a/windows/access-protection/remote-credential-guard.md +++ b/windows/access-protection/remote-credential-guard.md @@ -83,7 +83,7 @@ To use Windows Defender Remote Credential Guard, the Remote Desktop client and r The Remote Desktop client device: -- Must be running at least Windows 10, version 1703 to be able to supply credentials. +- Must be running at least Windows 10, version 1703 to be able to supply credentials. - Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user’s signed-in credentials. This requires the user’s account be able to sign in to both the client device and the remote host. - Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard. - Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk. @@ -162,7 +162,7 @@ mstsc.exe /remoteGuard - Windows Defender Remote Credential Guard does not support compound authentication. For example, if you’re trying to access a file server from a remote host that requires a device claim, access will be denied. -- Windows Defender Remote Credential Guard cannot be used to connect to a device that is not domain-joined to Active Directory, for example, remote hosts joined to Azure Active Directory. +- Windows Defender Remote Credential Guard can be used only when connecting to a device that is joined to a Windows Server Active Directory domain, including AD domain-joined servers that run as Azure virtual machines (VMs). Windows Defender Remote Credential Guard cannot be used when connecting to remote devices joined to Azure Active Directory. - Remote Desktop Credential Guard only works with the RDP protocol. From d24082c9be99ad0628d3277c346e0370012b95c2 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 12 Jan 2018 11:26:48 -0800 Subject: [PATCH 5/9] revised per feedback --- .../credential-guard/credential-guard-manage.md | 2 +- .../credential-guard/credential-guard-requirements.md | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/access-protection/credential-guard/credential-guard-manage.md b/windows/access-protection/credential-guard/credential-guard-manage.md index 5e972edfb7..179aa5ff00 100644 --- a/windows/access-protection/credential-guard/credential-guard-manage.md +++ b/windows/access-protection/credential-guard/credential-guard-manage.md @@ -125,7 +125,7 @@ DG_Readiness_Tool_v3.2.ps1 -Ready For client machines that are running Windows 10 1703, LsaIso.exe is running whenever virtualization-based security is enabled for other features. -- We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised. +- We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised, which is why we recommend turning on Credential Guard as early as possible. - You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. diff --git a/windows/access-protection/credential-guard/credential-guard-requirements.md b/windows/access-protection/credential-guard/credential-guard-requirements.md index 5bea794664..d3be3e2ba8 100644 --- a/windows/access-protection/credential-guard/credential-guard-requirements.md +++ b/windows/access-protection/credential-guard/credential-guard-requirements.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: high author: brianlic-msft -ms.date: 08/17/2017 +ms.date: 01/12/2018 --- # Windows Defender Credential Guard: Requirements @@ -73,6 +73,8 @@ Applications will prompt and expose credentials to risk if they require: Applications may cause performance issues when they attempt to hook the isolated Windows Defender Credential Guard process. +Services or protocols that rely on Kerberos, such as file shares, remote desktop, or BranchCache, continue to work and are not affected by Windows Defender Credential Guard. + See this video: [Credentials Protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) From 49a31c341b943744d2b629e96e13c711feac158e Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 12 Jan 2018 19:41:21 +0000 Subject: [PATCH 6/9] Merged PR 5278: Added link for Panasonic drivers Added link for Panasonic drivers --- windows/deployment/planning/windows-10-enterprise-faq-itpro.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md index f0ce9a70f4..6780c3b222 100644 --- a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md +++ b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md @@ -43,6 +43,7 @@ For many devices, drivers will be automatically installed in Windows 10 and ther - [HP driver pack](http://www8.hp.com/us/en/ads/clientmanagement/drivers-pack.html) - [Dell driver packs for enterprise client OS deployment](http://en.community.dell.com/techcenter/enterprise-client/w/wiki/2065.dell-command-deploy-driver-packs-for-enterprise-client-os-deployment) - [Lenovo Configuration Manager and MDT package index](https://support.lenovo.com/us/en/documents/ht074984) + - [Panasonic Driver Pack for Enterprise](http://pc-dl.panasonic.co.jp/itn/drivers/driver_packages.html) ### Where can I find out if an application or device is compatible with Windows 10? From b6f02ac6e7d25830d6f7b79922c6679c1fae805a Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 12 Jan 2018 11:50:29 -0800 Subject: [PATCH 7/9] updated date --- .../credential-guard/credential-guard-manage.md | 2 +- windows/access-protection/remote-credential-guard.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/access-protection/credential-guard/credential-guard-manage.md b/windows/access-protection/credential-guard/credential-guard-manage.md index 179aa5ff00..f54174f44c 100644 --- a/windows/access-protection/credential-guard/credential-guard-manage.md +++ b/windows/access-protection/credential-guard/credential-guard-manage.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: high author: brianlic-msft -ms.date: 08/17/2017 +ms.date: 01/12/2018 --- # Manage Windows Defender Credential Guard diff --git a/windows/access-protection/remote-credential-guard.md b/windows/access-protection/remote-credential-guard.md index bf1b0ebf07..e5ef6bfcf2 100644 --- a/windows/access-protection/remote-credential-guard.md +++ b/windows/access-protection/remote-credential-guard.md @@ -6,7 +6,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: brianlic-msft -ms.date: 08/28/2017 +ms.date: 01/12/2018 --- # Protect Remote Desktop credentials with Windows Defender Remote Credential Guard From 42bd99f520a0bd5f393f87fa1f1f49fc6595c755 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Fri, 12 Jan 2018 20:18:41 +0000 Subject: [PATCH 8/9] Merged PR 5281: Added Settings/AllowOnlineTips to Policy CSP --- .../policy-configuration-service-provider.md | 3 + .../mdm/policy-csp-settings.md | 58 ++++++++++++++++++- 2 files changed, 60 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 06bc214f80..6efa6508b9 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2582,6 +2582,9 @@ The following diagram shows the Policy configuration service provider in tree fo
Settings/AllowLanguage
+
+ Settings/AllowOnlineTips +
Settings/AllowPowerSleep
diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 00ffefca84..eae7e34484 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/14/2017 +ms.date: 12/19/2017 --- # Policy CSP - Settings +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
@@ -34,6 +36,9 @@ ms.date: 12/14/2017
Settings/AllowLanguage
+
+ Settings/AllowOnlineTips +
Settings/AllowPowerSleep
@@ -313,6 +318,57 @@ The following list shows the supported values:
+**Settings/AllowOnlineTips** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark3check mark3check mark3check mark3cross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Enables or disables the retrieval of online tips and help for the Settings app. + +If disabled, Settings will not contact Microsoft content services to retrieve tips and help content. + + + + + + + + + + + +
+ **Settings/AllowPowerSleep** From c9e69003aaca5407c29b426a08f3cc6bd1cc2b0d Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Fri, 12 Jan 2018 20:18:58 +0000 Subject: [PATCH 9/9] Merged PR 5280: Added DeviceLock/MinimumPasswordAge in Policy CSP --- ...ew-in-windows-mdm-enrollment-management.md | 11 +++- .../policy-configuration-service-provider.md | 5 +- .../mdm/policy-csp-devicelock.md | 62 ++++++++++++++++++- 3 files changed, 74 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 76543bd50f..7ee6468dd6 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -10,7 +10,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/08/2018 +ms.date: 01/12/2018 --- # What's new in MDM enrollment and management @@ -1037,6 +1037,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • DeviceGuard/EnableVirtualizationBasedSecurity
  • DeviceGuard/RequirePlatformSecurityFeatures
  • DeviceGuard/LsaCfgFlags
    • +
  • DeviceLock/MinimumPasswordAge
  • ExploitGuard/ExploitProtectionSettings
  • Games/AllowAdvancedGamingServices
  • Handwriting/PanelDefaultModeDocked
    • @@ -1085,8 +1086,10 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • Education/PrinterNames
  • Search/AllowCloudSearch
  • Security/ClearTPMIfNotReady
    • +
  • Settings/AllowOnlineTips
  • Start/HidePeopleBar
  • Storage/AllowDiskHealthModelUpdates
    • +
  • System/DisableEnterpriseAuthProxy
  • System/LimitEnhancedDiagnosticDataWindowsAnalytics
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
  • Update/DisableDualScan
    • @@ -1495,6 +1498,12 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
  • WindowsDefenderSecurityCenter/HideSecureBoot
  • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
    • +

    Added the following policies the were added in Windows 10, version 1709

    +
      +
    • DeviceLock/MinimumPasswordAge
      • +
    • Settings/AllowOnlineTips
      • +
    • System/DisableEnterpriseAuthProxy
      • +
    diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 6efa6508b9..ad98eba42b 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 11/17/2017 +ms.date: 01/12/2018 --- # Policy CSP @@ -950,6 +950,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    DeviceLock/MinDevicePasswordLength
    +
    + DeviceLock/MinimumPasswordAge +
    DeviceLock/PreventLockScreenSlideShow
    diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index a23b509f96..b056313e5a 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/14/2017 +ms.date: 01/12/2018 --- # Policy CSP - DeviceLock +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
    @@ -61,6 +63,9 @@ ms.date: 12/14/2017
    DeviceLock/MinDevicePasswordLength
    +
    + DeviceLock/MinimumPasswordAge +
    DeviceLock/PreventLockScreenSlideShow
    @@ -115,7 +120,6 @@ ms.date: 12/14/2017 > [!NOTE] > This policy must be wrapped in an Atomic command. - The following list shows the supported values: @@ -918,6 +922,60 @@ The number of authentication failures allowed before the device will be wiped. A
    +**DeviceLock/MinimumPasswordAge** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark3check mark3check mark3check mark3cross markcross mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This security setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0. + +The minimum password age must be less than the Maximum password age, unless the maximum password age is set to 0, indicating that passwords will never expire. If the maximum password age is set to 0, the minimum password age can be set to any value between 0 and 998. + +Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, Enforce password history is set to 1 by default. + + + + + + + + + + + + +
    + **DeviceLock/PreventLockScreenSlideShow**