deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge branch 'main' of https://github.com/MicrosoftDocs/windows-docs-pr into updateseeker-7991583

Browse Source
This commit is contained in:
Meghan Stewart 2023-08-22 08:53:10 -07:00
commit 590e86d6d5
118 changed files with 782 additions and 513 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
education/windows/edu-deployment-recommendations.md
View File

@ -1,7 +1,7 @@
---
title: Deployment recommendations for school IT administrators
description: Provides guidance on ways to customize the OS privacy settings, and some of the apps, for Windows-based devices used in schools so that you can choose what information is shared with Microsoft.
ms.topic: conceptual
ms.topic: best-practice
ms.date: 08/10/2022
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>

2
education/windows/set-up-school-pcs-azure-ad-join.md
View File

@ -1,7 +1,7 @@
---
title: Azure AD Join with Set up School PCs app
description: Learn how Azure AD Join is configured in the Set up School PCs app.
ms.topic: conceptual
ms.topic: reference
ms.date: 08/10/2022
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>

2
education/windows/set-up-windows-10.md
View File

@ -1,7 +1,7 @@
---
title: Set up Windows devices for education
description: Decide which option for setting up Windows 10 is right for you.
ms.topic: conceptual
ms.topic: overview
ms.date: 08/10/2022
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>

2
education/windows/take-tests-in-windows.md
View File

@ -2,7 +2,7 @@
title: Take tests and assessments in Windows
description: Learn about the built-in Take a Test app for Windows and how to use it.
ms.date: 03/31/2023
ms.topic: conceptual
ms.topic: how-to
---
# Take tests and assessments in Windows

2
education/windows/tutorial-school-deployment/index.md
View File

@ -2,7 +2,7 @@
title: Introduction to the tutorial deploy and manage Windows devices in a school
description: Introduction to deployment and management of Windows devices in education environments.
ms.date: 08/31/2022
ms.topic: conceptual
ms.topic: tutorial
---
# Tutorial: deploy and manage Windows devices in a school

4
education/windows/windows-11-se-settings-list.md
View File

@ -1,8 +1,8 @@
---
title: Windows 11 SE settings list
description: Windows 11 SE automatically configures settings in the operating system. Learn more about the settings you can control and manage, and the settings you can't change.
ms.topic: article
ms.date: 03/09/2023
ms.topic: reference
ms.date: 08/18/2023
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11 SE</a>
ms.collection:

2
education/windows/windows-editions-for-education-customers.md
View File

@ -1,7 +1,7 @@
---
title: Windows 10 editions for education customers
description: Learn about the two Windows 10 editions that are designed for the needs of education institutions.
ms.topic: conceptual
ms.topic: overview
ms.date: 07/25/2023
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>

9
includes/configure/gpo-settings-1.md Normal file
View File

@ -0,0 +1,9 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 08/15/2023
ms.topic: include
ms.prod: windows-client
---
To configure devices using group policy, [create a group policy object (GPO)](/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object) and use the settings located under

9
includes/configure/gpo-settings-2.md Normal file
View File

@ -0,0 +1,9 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 08/15/2023
ms.topic: include
ms.prod: windows-client
---
The policy settings can be configured locally by using the Local Group Policy Editor (`gpedit.msc`), linked to the domain or organizational units, and filtered to security groups.

16
includes/configure/intune-custom-settings-1.md Normal file
View File

@ -0,0 +1,16 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 08/15/2023
ms.topic: include
ms.prod: windows-client
---
To configure devices with Microsoft Intune, use a custom policy:
1. Go to the <a href="https://intune.microsoft.com" target="_blank"><b>Microsoft Intune admin center</b></a>
2. Select **Devices > Configuration profiles > Create profile**
3. Select **Platform > Windows 10 and later** and **Profile type > Templates > Custom**
4. Select **Create**
5. Specify a **Name** and, optionally, a **Description > Next**
6. Add the following settings:

12
includes/configure/intune-custom-settings-2.md Normal file
View File

@ -0,0 +1,12 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 08/15/2023
ms.topic: include
ms.prod: windows-client
---
7. Select **Next**
8. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next**
9. Under **Applicability Rules**, select **Next**
10. Review the policy configuration and select **Create**

9
includes/configure/intune-custom-settings-info.md Normal file
View File

@ -0,0 +1,9 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 08/15/2023
ms.topic: include
ms.prod: windows-client
---
For more information about how to create custom settings using Intune, see [Use custom settings for Windows devices in Intune](/mem/intune/configuration/custom-settings-windows-10).

9
includes/configure/intune-settings-catalog-1.md Normal file
View File

@ -0,0 +1,9 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 08/15/2023
ms.topic: include
ms.prod: windows-client
---
To configure devices using Microsoft Intune, [create a *Settings catalog policy*](/mem/intune/configuration/settings-catalog) and use the following settings:

9
includes/configure/intune-settings-catalog-2.md Normal file
View File

@ -0,0 +1,9 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 08/15/2023
ms.topic: include
ms.prod: windows-client
---
Assign the policy to a group that contains as members the devices or users that you want to configure.

9
includes/configure/tab-intro.md Normal file
View File

@ -0,0 +1,9 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 08/15/2023
ms.topic: include
ms.prod: windows-client
---
The following instructions provide details how to configure your devices. Select the option that best suits your needs.

1
store-for-business/microsoft-store-for-business-education-powershell-module.md
View File

@ -9,6 +9,7 @@ author: cmcatee-MSFT
manager: scotv
ms.topic: conceptual
ms.localizationpriority: medium
ms.custom: has-azure-ad-ps-ref
ms.date: 05/24/2023
ms.reviewer:
---

92
windows/application-management/add-apps-and-features.md
View File

@ -1,74 +1,98 @@
---
title: Add or hide optional apps and features on Windows devices | Microsoft Docs
description: Learn how to add Windows 10 and Windows 11 optional features using the Apps & features page in the Settings app. Also see the group policy objects (GPO) and MDM policies that show or hide Apps and Windows Features in the Settings app. Use Windows PowerShell to show or hide specific features in Windows Features.
title: Add or hide Windows features
description: Learn how to add Windows optional features using the Apps & features page in the Settings app. Also see the group policy objects (GPO) and MDM policies that show or hide Apps and Windows Features in the Settings app. Use Windows PowerShell to show or hide specific features in Windows Features.
author: aczechowski
ms.author: aaroncz
manager: aaroncz
ms.date: 08/30/2021
ms.topic: article
ms.date: 08/18/2023
ms.topic: how-to
ms.prod: windows-client
ms.technology: itpro-apps
ms.localizationpriority: medium
ms.collection: tier2
ms.reviewer:
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
---
# Add or hide features on the Windows client OS
# Add or hide Windows features
**Applies to**:
Windows includes optional features that aren't installed by default, but you can add later. These features are called [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities), and can be installed at any time. Some of these features are language resources like language packs or handwriting support. On organization-owned devices, you can control access to these other features. You can use group policy or mobile device management (MDM) policies to hide the UI from users, or use Windows PowerShell to enable or disable specific features.
- Windows 10
- Windows 11
## Use the Windows Settings app to add or uninstall features
The Windows client operating systems include more features that you and your users can install. These features are called [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (opens another Microsoft web site), and can be installed at any time. On your organization-owned devices, you may want to control access to these other features.
### Windows 11
This article:
1. Open the Start menu and search for **Settings**.
- Shows you how to add features using the user interface.
- Lists the group policies and Mobile device management (MDM) policies to hide Windows Features.
- Includes information on using Windows PowerShell to disable specific Windows Features.
1. In the Settings app, search for "optional" and select **Optional features**.
If you're working on your own device, use the **Settings** app to add features.
> [!TIP]
> You can also use the following shortcut to open it directly: [`ms-settings:optionalfeatures`](ms-settings:optionalfeatures).
## Add or uninstall features
1. To add a feature:
1. In the Search bar, search for "apps", and select **Apps and features**.
2. Select **Optional features** > **Add a feature**.
3. Select the feature you want to add, like **XPS Viewer**, and then select **Install.**
1. Select **View features** next to "Add an optional feature."
1. Find the feature you want to add, like **XPS Viewer**. Select the box to add it. You can select multiple features.
1. Select **Next**. Review the list of features you selected, and then select **Install** to add the selected features.
1. To uninstall a feature:
1. Search for it in the list of **Installed features**.
1. Expand the section, and select **Uninstall**.
### Windows 10
1. In the Search bar, search for "apps" and select **Apps and features**.
1. Select **Optional features** > **Add a feature**.
1. Select the feature you want to add, like **XPS Viewer**, and then select **Install.**
When the installation completes, the feature is listed in **Apps & features**. In **Apps & features** > **Optional features** > **More Windows features**, there are more features that you and your users can install.
To uninstall a feature, open the **Settings** app. Select the feature, and then select **Uninstall**.
## Use Group Policy or MDM to hide Windows Features
## Use group policy or MDM policies to hide Windows features
By default, the OS might show Windows Features, and allow users to install and uninstall these optional apps and features.
By default, the OS might show Windows features and allow users to install and uninstall these optional apps and features. To hide Windows features on your user devices, you can use group policy or an MDM provider like Microsoft Intune.
To hide Windows Features on your user devices, you can use Group Policy (on-premises), or use an MDM provider, such as Microsoft Intune (cloud).
### Group policy
### Group Policy
If you use group policy, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Windows Features"` policy. By default, this policy may be set to **Not configured**, which means users can add or remove features. When this setting is **Enabled**, the settings page to add optional features is hidden on the device.
If you use Group Policy, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Windows Features"` policy. By default, this policy may be set to **Not configured**, which means users can add or remove features. When this setting is **Enabled**, the Windows Features is hidden on the device.
You can't use Group Policy to disable specific Windows Features, such as XPS Viewer. If you want to disable specific features, use [Windows PowerShell](#use-windows-powershell-to-disable-specific-features) (in this article).
You can't use group policy to disable specific Windows features, such as XPS Viewer. If you want to disable specific features, use [Windows PowerShell](#use-windows-powershell-to-disable-specific-features).
If you want to hide the entire **Apps** feature in the Settings app, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Programs and Features" page` policy.
### MDM
Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to hide Windows Features.
Using Microsoft Intune, you can use [administrative templates](/mem/intune/configuration/administrative-templates-windows) or the [settings catalog](/mem/intune/configuration/settings-catalog) to hide Windows features.
If you want to hide the entire **Apps** feature in the Settings app, you can use a configuration policy on Intune enrolled devices. For more information on the Control Panel settings you can configure, see [Control Panel settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings).
If you want to hide the entire **Apps** feature in the Settings app, you can use a configuration policy on Intune enrolled devices. For more information on the settings you can configure, see [Control Panel and Settings device restrictions in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings).
## Use Windows PowerShell to disable specific features
To disable specific features, you can use the Windows PowerShell [Disable-WindowsOptionalFeature](/powershell/module/dism/disable-windowsoptionalfeature) command. There isn't a Group Policy that disables specific Windows Features.
To disable specific features, use the Windows PowerShell [Disable-WindowsOptionalFeature](/powershell/module/dism/disable-windowsoptionalfeature) cmdlet.
If you're looking to automate disabling specific features, you can create a scheduled task. Then, use the scheduled task to run your Windows PowerShell script. For more information about Task Scheduler, see [Task Scheduler for developers](/windows/win32/taskschd/task-scheduler-start-page).
> [!NOTE]
> There isn't a group policy that disables specific Windows features.
Microsoft Intune can also execute Windows PowerShell scripts. For more information, see [Use PowerShell scripts on Windows client devices in Intune](/mem/intune/apps/intune-management-extension).
To automate disabling specific features, create a scheduled task to run a PowerShell script. For more information about Windows task scheduler, see [Task Scheduler for developers](/windows/win32/taskschd/task-scheduler-start-page).
## Restore Windows features
Microsoft Intune can also run PowerShell scripts. For more information, see [Use PowerShell scripts on Windows client devices in Intune](/mem/intune/apps/intune-management-extension).
- If you use Group Policy or MDM to hide Windows Features or the entire Apps feature, you can set the policy to **Not configured**. Then, deploy your policy. When the device receives the policy, the features are configurable.
- Using Windows PowerShell, you can also enable specific features using the [Enable-WindowsOptionalFeature](/powershell/module/dism/enable-windowsoptionalfeature) command.
To enable specific features, use the [Enable-WindowsOptionalFeature](/powershell/module/dism/enable-windowsoptionalfeature) cmdlet.
Another useful PowerShell cmdlet is [Get-WindowsOptionalFeature](/powershell/module/dism/get-windowsoptionalfeature). Use this cmdlet to view information about optional features in the current OS or a mounted image. This cmdlet returns the current state of features, and whether a restart may be required when the state changes.
## Related articles
- [Features on Demand overview](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities)
- [Available Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod)
- [Language and region Features on Demand (FOD)](/windows-hardware/manufacture/desktop/features-on-demand-language-fod)

13
windows/application-management/apps-in-windows-10.md
View File

@ -1,25 +1,22 @@
---
title: Learn about the different app types in Windows 10/11 | Microsoft Docs
title: Overview of apps on Windows client devices
description: Learn more and understand the different types of apps that run on Windows 10 and Windows 11. For example, learn more about UWP, WPF, Win32, and Windows Forms apps, including the best way to install these apps.
author: aczechowski
ms.author: aaroncz
manager: aaroncz
ms.date: 02/09/2023
ms.topic: article
ms.topic: overview
ms.prod: windows-client
ms.technology: itpro-apps
ms.localizationpriority: medium
ms.collection: tier2
ms.reviewer:
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
---
# Overview of apps on Windows client devices
**Applies to**:
- Windows 10
- Windows 11
## Before you begin
As organizations become more global, and to support employees working from anywhere, it's recommended to use a Mobile Device Management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use the Microsoft Intune family of products. This family includes Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises.

41
windows/application-management/index.yml
View File

@ -1,39 +1,46 @@
### YamlMime:Landing
title: Windows application management
summary: Learn about managing applications in Windows client, including how to remove background task resource restrictions.
summary: Learn about managing applications in Windows client, including common app types.
metadata:
title: Windows application management
description: Learn about managing applications in Windows 10 and Windows 11.
description: Learn about managing applications in Windows client.
author: aczechowski
ms.author: aaroncz
manager: aaroncz
ms.date: 08/24/2021
ms.date: 08/18/2023
ms.topic: landing-page
ms.prod: windows-client
ms.collection:
- tier1
- highpri
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | tutorial | overview | quickstart | reference | sample | tutorial | video | whats-new
landingContent:
# Cards and links should be based on top customer tasks or top subjects
# Start card title with a verb
# Card (optional)
- title: Manage Windows applications
- title: Manage applications
linkLists:
- linkListType: overview
- linkListType: how-to-guide
links:
- text: Understand apps in Windows client OS
- text: Overview of apps in Windows
url: apps-in-windows-10.md
- text: How to add features
- text: Add or hide Windows features
url: add-apps-and-features.md
- text: Sideload LOB apps
url: sideload-apps-in-windows-10.md
- text: Keep removed apps from returning during an update
url: remove-provisioned-apps-during-update.md
# Card (optional)
- title: Manage services
linkLists:
- linkListType: reference
links:
- text: Per-user services in Windows
url: per-user-services-in-windows.md
- text: Changes to Service Host grouping in Windows 10
url: svchost-service-refactoring.md
- title: Application Virtualization (App-V)
linkLists:
- linkListType: overview
@ -52,15 +59,3 @@ landingContent:
url: app-v/appv-troubleshooting.md
- text: Technical Reference for App-V
url: app-v/appv-technical-reference.md
# Card (optional)
- title: Windows System Services
linkLists:
- linkListType: overview
links:
- text: Changes to Service Host grouping in Windows 10
url: svchost-service-refactoring.md
- text: Per-user services in Windows
url: per-user-services-in-windows.md
- text: Per-user services in Windows
url: per-user-services-in-windows.md

24
windows/application-management/per-user-services-in-windows.md
View File

@ -1,24 +1,21 @@
---
title: Per-user services in Windows 10 and Windows Server
title: Per-user services
description: Learn about per-user services, how to change the template service Startup Type, and manage per-user services through Group Policy and security templates.
author: aczechowski
ms.author: aaroncz
manager: aaroncz
ms.date: 09/14/2017
ms.topic: article
ms.topic: how-to
ms.prod: windows-client
ms.technology: itpro-apps
ms.localizationpriority: medium
ms.collection: tier2
ms.reviewer:
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
- ✅ <a href="https://learn.microsoft.com/windows/release-health/windows-server-release-info" target="_blank">Windows Server</a>
---
# Per-user services in Windows 10 and Windows Server
**Applies to**:
- Windows 10
- Windows Server
# Per-user services in Windows
Per-user services are services that are created when a user signs into Windows or Windows Server and are stopped and deleted when that user signs out. These services run in the security context of the user account - this provides better resource management than the previous approach of running these kinds of services in Explorer, associated with a preconfigured account, or as tasks.
@ -80,9 +77,9 @@ In light of these restrictions, you can use the following methods to manage per-
You can manage the CDPUserSvc and OneSyncSvc per-user services with a [security template](/windows/device-security/security-policy-settings/administer-security-policy-settings#bkmk-sectmpl). For more information, visit [Administer security policy settings](/windows/device-security/security-policy-settings/administer-security-policy-settings).
For example:
For example:
```
```ini
[Unicode]
Unicode=yes
[Version]
@ -128,7 +125,7 @@ If you can't use Group Policy Preferences to manage the per-user services, you c
To disable the Template Services, change the Startup Type for each service to 4 (disabled).
For example:
```code
```cmd
REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\OneSyncSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Start /t REG_DWORD /d 4 /f
@ -163,9 +160,10 @@ You can create a script to change the Startup Type for the per-user services. Th
Sample script using [sc.exe](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc990290(v=ws.11)?f=255&MSPPError=-2147217396):
```
```cmd
sc.exe configure <service name> start= disabled
```
The space after "=" is intentional.
Sample script using the [Set-Service PowerShell cmdlet](/previous-versions/windows/it-pro/windows-powershell-1.0/ee176963(v=technet.10)):

15
windows/application-management/remove-provisioned-apps-during-update.md
View File

@ -1,22 +1,21 @@
---
title: How to keep apps removed from Windows 10 from returning during an update
description: How to keep provisioned apps that were removed from your machine from returning during an update.
title: Keep removed apps from returning during an update
description: When you remove provisioned apps from devices, this article explains how to keep those apps from returning during an update.
author: aczechowski
ms.author: aaroncz
manager: aaroncz
ms.date: 05/25/2018
ms.topic: article
ms.topic: how-to
ms.prod: windows-client
ms.technology: itpro-apps
ms.localizationpriority: medium
ms.collection: tier1
ms.reviewer:
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
---
# How to keep apps removed from Windows 10 from returning during an update
**Applies to**:
# Keep removed apps from returning during an update
- Windows 10
When you update a computer running Windows 10, version 1703 or 1709, you might see provisioned apps that you previously removed post-update. This can happen if the computer was offline when you removed the apps. Windows 10, version 1803 has fixed this issue.
@ -97,7 +96,7 @@ You're now ready to update your computer. After the update, check the list of ap
## Registry keys for provisioned apps
```syntax
```console
Windows Registry Editor Version 5.00
;1709 Registry Keys

19
windows/application-management/sideload-apps-in-windows-10.md
View File

@ -1,24 +1,21 @@
---
title: Sideload LOB apps in Windows client OS | Microsoft Docs
description: Learn how to sideload line-of-business (LOB) apps in Windows client operating systems, including Windows 10/11. When you sideload an app, you deploy a signed app package to a device.
title: Sideload line of business apps
description: Learn how to sideload line-of-business (LOB) apps in Windows client operating systems. When you sideload an app, you deploy a signed app package to a device.
author: aczechowski
ms.author: aaroncz
manager: aaroncz
ms.date: 12/07/2017
ms.topic: article
ms.topic: how-to
ms.prod: windows-client
ms.technology: itpro-apps
ms.localizationpriority: medium
ms.collection: tier2
ms.reviewer:
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
---
# Sideload line of business (LOB) apps in Windows client devices
**Applies to**:
- Windows 10
- Windows 11
# Sideload line of business (LOB) apps
> [!NOTE]
> Starting with Windows 10 2004, sideloading is enabled by default. You can deploy a signed package onto a device without a special configuration.
@ -27,7 +24,7 @@ Sideloading apps is when you install apps that aren't from an official source, s
When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. Sideloading was also available with Windows 8 and Windows 8.1
Starting with Windows 10, sideloading is different than earlier versions of Windows:
Starting with Windows 10, sideloading is different than earlier versions of Windows:
- You can unlock a device for sideloading using an enterprise policy, or through the **Settings** app.
- License keys aren't required.

17
windows/application-management/svchost-service-refactoring.md
View File

@ -1,23 +1,20 @@
---
title: Service Host service refactoring in Windows 10 version 1703
description: Learn about the SvcHost Service Refactoring introduced in Windows 10 version 1703.
title: Service host grouping in Windows 10
description: Learn about the Service Host (SvcHost) service refactoring introduced in Windows 10 version 1703.
author: aczechowski
ms.author: aaroncz
manager: aaroncz
ms.date: 07/20/2017
ms.topic: article
ms.topic: concept-article
ms.prod: windows-client
ms.technology: itpro-apps
ms.localizationpriority: medium
ms.colletion: tier1
ms.reviewer:
ms.colletion: tier2
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
---
# Changes to Service Host grouping in Windows 10
**Applies to**:
- Windows 10
# Service host grouping in Windows 10
The **Service Host (svchost.exe)** is a shared-service process that serves as a shell for loading services from DLL files. Services are organized into related host groups, and each group runs inside a different instance of the Service Host process. In this way, a problem in one instance doesn't affect other instances. Service Host groups are determined by combining the services with matching security requirements. For example:

25
windows/application-management/toc.yml
View File

@ -3,18 +3,22 @@ items:
href: index.yml
- name: Application management
items:
- name: Common app types
- name: Overview of apps in Windows
href: apps-in-windows-10.md
- name: Add features in Windows client
- name: Add or hide Windows features
href: add-apps-and-features.md
- name: Sideload apps
- name: Sideload line of business (LOB) apps
href: sideload-apps-in-windows-10.md
- name: Private app repo on Windows 11
href: private-app-repository-mdm-company-portal-windows-11.md
- name: Remove background task resource restrictions
href: enterprise-background-activity-controls.md
- name: Enable or block Windows Mixed Reality apps in the enterprise
href: /windows/mixed-reality/enthusiast-guide/manage-windows-mixed-reality
- name: Service host grouping in Windows 10
href: svchost-service-refactoring.md
- name: Per-user services in Windows
href: per-user-services-in-windows.md
- name: Keep removed apps from returning during an update
href: remove-provisioned-apps-during-update.md
- name: Application Virtualization (App-V)
items:
- name: App-V for Windows overview
@ -251,14 +255,3 @@ items:
href: app-v/appv-viewing-appv-server-publishing-metadata.md
- name: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications
href: app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md
- name: Reference
items:
- name: Service Host process refactoring
href: svchost-service-refactoring.md
- name: Per-user services in Windows
href: per-user-services-in-windows.md
- name: Disabling System Services in Windows Server
href: /windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server
- name: How to keep apps removed from Windows from returning during an update
href: remove-provisioned-apps-during-update.md

2
windows/configuration/customize-taskbar-windows-11.md
View File

@ -11,7 +11,7 @@ ms.collection:
- highpri
- tier1
ms.technology: itpro-configure
ms.date: 12/31/2017
ms.date: 08/17/2023
ms.topic: article
---

6
windows/configuration/shared-devices-concepts.md
View File

@ -1,14 +1,12 @@
---
title: Manage multi-user and guest Windows devices
description: options to optimize Windows devices used in shared scenarios, such touchdown spaces in an enterprise, temporary customer use in retail or shared devices in a school.
ms.date: 10/15/2022
ms.date: 08/18/2023
ms.prod: windows-client
ms.technology: itpro-configure
ms.topic: conceptual
ms.localizationpriority: medium
ms.topic: concept-article
author: paolomatarazzo
ms.author: paoloma
ms.reviewer:
manager: aaroncz
ms.collection: tier2
appliesto:

6
windows/deployment/do/TOC.yml
View File

@ -13,6 +13,8 @@
items:
- name: Set up Delivery Optimization for Windows
href: waas-delivery-optimization-setup.md
- name: Monitor Delivery Optimization for Windows
href: waas-delivery-optimization-monitor.md
- name: Configure Delivery Optimization settings using Microsoft Intune
href: /mem/intune/configuration/delivery-optimization-windows
- name: Resources for Delivery Optimization
@ -36,11 +38,13 @@
- name: Requirements
href: mcc-enterprise-prerequisites.md
- name: Deploy Microsoft Connected Cache
href: mcc-enterprise-deploy.md
href: mcc-enterprise-portal-deploy.md
- name: Update or uninstall MCC
href: mcc-enterprise-update-uninstall.md
- name: Appendix
href: mcc-enterprise-appendix.md
- name: MCC for Enterprise and Education (early preview)
href: mcc-enterprise-deploy.md
- name: MCC for ISPs
items:
- name: MCC for ISPs Overview

1
windows/deployment/do/delivery-optimization-proxy.md
View File

@ -10,6 +10,7 @@ ms.topic: article
ms.technology: itpro-updates
ms.date: 12/31/2017
ms.collection: tier3
ms.reviewer: mstewart
---
# Using a proxy with Delivery Optimization

1
windows/deployment/do/delivery-optimization-workflow.md
View File

@ -10,6 +10,7 @@ ms.topic: article
ms.technology: itpro-updates
ms.date: 12/31/2017
ms.collection: tier3
ms.reviewer: mstewart
---
# Delivery Optimization client-service communication explained

BIN
windows/deployment/do/images/ent-mcc-deployment-complete.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 57 KiB

BIN
windows/deployment/do/images/ent-mcc-portal-create.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 144 KiB

BIN
windows/deployment/do/images/ent-mcc-portal-resource.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 96 KiB

BIN
windows/deployment/do/images/ent-mcc-provisioning.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 99 KiB

5
windows/deployment/do/includes/get-azure-subscription.md
View File

@ -1,6 +1,7 @@
---
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
manager: aaroncz
ms.date: 10/18/2022
ms.prod: windows-client

5
windows/deployment/do/includes/mcc-prerequisites.md
View File

@ -1,6 +1,7 @@
---
author: amyzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
manager: aaroncz
ms.prod: windows-client
ms.technology: itpro-deploy

6
windows/deployment/do/index.yml
View File

@ -41,10 +41,10 @@ landingContent:
linkLists:
- linkListType: how-to-guide
links:
- text: Delivery Optimization settings
- text: Delivery Optimization recommended settings
url: waas-delivery-optimization-setup.md#recommended-delivery-optimization-settings
- text: Windows PowerShell for Delivery Optimization
url: waas-delivery-optimization-setup.md#windows-powershell-cmdlets
- text: Monitor Delivery Optimization for Windows
url: waas-delivery-optimization-monitor.md
- text: Troubleshoot Delivery Optimization
url: waas-delivery-optimization-setup.md#troubleshooting
- text: Delivery Optimization Frequently Asked Questions

9
windows/deployment/do/mcc-ent-edu-overview.md
View File

@ -3,12 +3,13 @@ title: MCC for Enterprise and Education Overview
manager: aaroncz
description: Overview of Microsoft Connected Cache (MCC) for Enterprise and Education.
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.topic: article
ms.date: 05/09/2023
ms.technology: itpro-updates
ms.collection: tier3
ms.reviewer: mstewart
---
# Microsoft Connected Cache for Enterprise and Education Overview
@ -37,9 +38,9 @@ Connected Cache (early preview) supports the following scenarios:
When clients download cloud-managed content, they use Delivery Optimization from the cache server installed on a Windows server or VM. Cloud-managed content includes the following types:
- Windows Update for Business: Windows feature and quality updates
- Windows updates: Windows feature and quality updates
- Office Click-to-Run apps: Microsoft 365 Apps and updates
- Client apps: Microsoft Store apps and updates
- Client apps: Intune, store apps, and updates
- Endpoint protection: Windows Defender definition updates
For the full list of content endpoints that Microsoft Connected Cache for Enterprise and Education supports, see [Microsoft Connected Cache content and services endpoints](delivery-optimization-endpoints.md).

5
windows/deployment/do/mcc-enterprise-appendix.md
View File

@ -3,8 +3,9 @@ title: Appendix
manager: aaroncz
description: Appendix on Microsoft Connected Cache (MCC) for Enterprise and Education.
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: article
ms.date: 12/31/2017
ms.technology: itpro-updates

13
windows/deployment/do/mcc-enterprise-deploy.md
View File

@ -1,17 +1,18 @@
---
title: Deploying your cache node
title: MCC for Enterprise and Education (early preview)
manager: aaroncz
description: How to deploy Microsoft Connected Cache (MCC) for Enterprise and Education cache node
description: How to deploy a Microsoft Connected Cache (MCC) for Enterprise and Education cache node
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: article
ms.date: 12/31/2017
ms.technology: itpro-updates
ms.collection: tier3
---
# Deploying your cache node
# Deploying your enterprise cache node
**Applies to**
@ -129,7 +130,7 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p
- Downloads, installs, and deploys EFLOW
- Enables Microsoft Update so EFLOW can stay up to date
- Creates a virtual machine
- Enables the firewall and opens ports 80 and 22 for inbound and outbound traffic. Port 80 is used by MCC, and port 22 is used for SSH communications.
- Enables the firewall and opens ports 80 for inbound and outbound traffic. Port 80 is used by MCC.
- Configures Connected Cache tuning settings.
- Creates the necessary *FREE* Azure resource - IoT Hub/IoT Edge.
- Deploys the MCC container to server.

145
windows/deployment/do/mcc-enterprise-portal-deploy.md Normal file
View File

@ -0,0 +1,145 @@
---
title: Deploying your cache node
manager: aaroncz
description: How to deploy Microsoft Connected Cache (MCC) for Enterprise and Education cache node
ms.prod: windows-client
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: article
ms.date: 12/31/2017
ms.technology: itpro-updates
ms.collection: tier3
---
# Deploying your cache node
**Applies to**
- Windows 10
- Windows 11
## Create the Microsoft Connected Cache resource
1. Navigate to Azure portal by using the [following link](https://aka.ms/mcc-enterprise-preview):
> [!IMPORTANT]
> You must access Azure portal using this link (https://aka.ms/mcc-enterprise-preview) in order to find the correct Microsoft Connected Cache resource.
![Screenshot of Azure portal "Create a resource" page, where you search for the Microsoft Connected Cache resource](images/ent-mcc-portal-create.png)
1. In the search bar by **Get Started**, search for `Microsoft Connected Cache for Enterprise`.
![Screenshot of Azure portal after searching for the Microsoft Connected Cache resource](images/ent-mcc-portal-resource.png)
1. Select **Create** to create your Microsoft Connected Cache resource. When prompted, choose the subscription, resource group, and location of your cache node. Also, enter a name for your cache node.
1. The creation of the cache node may take a few minutes. After a successful creation, you'll see a “Deployment complete” page as below. Select **Go to resource**.
![Screenshot of Azure portal after the deployment is complete](images/ent-mcc-deployment-complete.png)
## Create, provision, and deploy the cache node in Azure portal
To create, provision, and deploy the cache node in Azure portal, follow these steps:
1. Open Azure portal and navigate to the Microsoft Connected Cache for Enterprise (preview) resource.
1. Navigate to **Settings** > **Cache nodes** and select **Create Cache Node**.
1. Provide a name for your cache node and select **Create** to create your cache node.
1. You may need to refresh to see the cache node. Select the cache node to configure it.
1. Fill out the Basics and Storage fields. Enter the cache drive size in GB - this has a minimum size of 50 GB.
![Screenshot of Azure portal on the Provisioning page, where the user can configure their cache node.](images/ent-mcc-provisioning.png)
Once complete, select **Save** at the top of the page and select **Provision server**.
1. To deploy your cache node, download the installer by selecting **Download provisioning package**.
1. Run the provided provisioning script - note that this is unique to each cache node.
## Verify proper functioning MCC server
#### Verify client side
Connect to the EFLOW VM and check if MCC is properly running:
1. Open PowerShell as an Administrator.
2. Enter the following commands:
```powershell
Connect-EflowVm
sudo -s
iotedge list
```
:::image type="content" source="./images/ent-mcc-connect-eflowvm.png" alt-text="Screenshot of running connect-EflowVm, sudo -s, and iotedge list from PowerShell." lightbox="./images/ent-mcc-connect-eflowvm.png":::
You should see MCC, edgeAgent, and edgeHub running. If you see edgeAgent or edgeHub but not MCC, try this command in a few minutes. The MCC container can take a few minutes to deploy.
#### Verify server side
For a validation of properly functioning MCC, execute the following command in the EFLOW VM or any device in the network. Replace <CacheServerIP\> with the IP address of the cache server.
```powershell
wget [http://<CacheServerIP>/mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com]
```
A successful test result will display a status code of 200 along with additional information.
:::image type="content" source="./images/ent-mcc-verify-server-ssh.png" alt-text="Screenshot of a successful wget with an SSH client." lightbox="./images/ent-mcc-verify-server-ssh.png":::
:::image type="content" source="./images/ent-mcc-verify-server-powershell.png" alt-text="Screenshot of a successful wget using PowerShell." lightbox="./images/ent-mcc-verify-server-powershell.png":::
Similarly, enter the following URL from a browser in the network:
`http://<YourCacheServerIP>/mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com`
If the test fails, see the [common issues](#common-issues) section for more information.
### Monitoring your metrics
To view the metrics associated with your cache nodes, navigate to the **Overview** > **Monitoring** tab within the Azure portal.
:::image type="content" source="./images/mcc-isp-metrics.png" alt-text="Screenshot of the Azure portal displaying the metrics view in the Overview tab.":::
You can choose to monitor the health and performance of all cache nodes or one at a time by using the dropdown menu. The **Egress bits per second** graph shows your inbound and outbound traffic of your cache nodes over time. You can change the time range (1 hour, 12 hours, 1 day, 7 days, 14 days, and 30 days) by selecting the time range of choice on the top bar.
If you're unable to view metrics for your cache node, it may be that your cache node is unhealthy, inactive, or hasn't been fully configured.
### Intune (or other management software) configuration for MCC
For an [Intune](/mem/intune/) deployment, create a **Configuration Profile** and include the Cache Host eFlow IP Address or FQDN:
:::image type="content" source="./images/ent-mcc-intune-do.png" alt-text="Screenshot of Intune showing the Delivery Optimization cache server host names.":::
## Common Issues
#### PowerShell issues
If you're seeing errors similar to this error: `The term Get-<Something> isn't recognized as the name of a cmdlet, function, script file, or operable program.`
1. Ensure you're running Windows PowerShell version 5.x.
1. Run \$PSVersionTable and ensure you're running version 5.x and *not version 6 or 7*.
1. Ensure you have Hyper-V enabled:
**Windows 10:** [Enable Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v)
**Windows Server:** [Install the Hyper-V role on Windows Server](/windows-server/virtualization/hyper-v/get-started/install-the-hyper-v-role-on-windows-server)
#### Verify Running MCC Container
Connect to the Connected Cache server and check the list of running IoT Edge modules using the following commands:
```bash
Connect-EflowVm
sudo iotedge list
```
:::image type="content" source="./images/ent-mcc-iotedge-list.png" alt-text="Screenshot of the iotedge list command." lightbox="./images/ent-mcc-iotedge-list.png":::
If edgeAgent and edgeHub containers are listed, but not "MCC", you may view the status of the IoT Edge security manager by using the command:
```bash
sudo journalctl -u iotedge -f
```
This command will provide the current status of the starting, stopping of a container, or the container pull and start.
:::image type="content" source="./images/ent-mcc-journalctl.png" alt-text="Screenshot of the output from journalctl -u iotedge -f." lightbox="./images/ent-mcc-journalctl.png":::
> [!NOTE]
> You should consult the IoT Edge troubleshooting guide ([Common issues and resolutions for Azure IoT Edge](/azure/iot-edge/troubleshoot)) for any issues you may encounter configuring IoT Edge, but we've listed a few issues that we encountered during our internal validation.

5
windows/deployment/do/mcc-enterprise-prerequisites.md
View File

@ -3,8 +3,9 @@ title: Requirements for Microsoft Connected Cache (MCC) for Enterprise and Educa
manager: aaroncz
description: Overview of requirements for Microsoft Connected Cache (MCC) for Enterprise and Education.
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: article
ms.date: 12/31/2017
ms.technology: itpro-updates

5
windows/deployment/do/mcc-enterprise-update-uninstall.md
View File

@ -3,8 +3,9 @@ title: Update or uninstall Microsoft Connected Cache for Enterprise and Educatio
manager: aaroncz
description: Details on updating or uninstalling Microsoft Connected Cache (MCC) for Enterprise and Education.
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: article
ms.date: 12/31/2017
ms.technology: itpro-updates

5
windows/deployment/do/mcc-isp-cache-node-configuration.md
View File

@ -3,8 +3,9 @@ title: Cache node configuration
manager: aaroncz
description: Configuring a cache node on Azure portal
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: article
ms.date: 12/31/2017
ms.technology: itpro-updates

3
windows/deployment/do/mcc-isp-create-provision-deploy.md
View File

@ -9,6 +9,7 @@ ms.topic: article
ms.date: 05/09/2023
ms.technology: itpro-updates
ms.collection: tier3
ms.reviewer: mstewart
---
# Create, configure, provision, and deploy the cache node in Azure portal
@ -82,7 +83,7 @@ To set up and enable BGP routing for your cache node, follow the steps below:
1. Under **Routing information**, select the routing method you would like to use. For more information, see [Client routing](#client-routing).
- If you choose **Manual routing**, enter your address range/CIDR blocks.
- If you choose **BGP routing**, enter the ASN and IP addresses of the neighborship.
- If you choose **BGP routing**, enter the ASN and IP addresses of the neighborship. Use your ASN, the one used to sign up for MCC. MCC will be automatically assigned as the same ASN as the neighbor.
> [!NOTE]
> **Prefix count** and **IP Space** will stop displaying `0` when BGP is successfully established.

5
windows/deployment/do/mcc-isp-faq.yml
View File

@ -2,8 +2,9 @@
metadata:
title: Microsoft Connected Cache Frequently Asked Questions
description: The following article is a list of frequently asked questions for Microsoft Connected Cache.
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
manager: aaroncz
ms.collection:
- highpri

9
windows/deployment/do/mcc-isp-overview.md
View File

@ -3,8 +3,9 @@ title: MCC for ISPs Overview
manager: aaroncz
description: Overview for Microsoft Connected Cache for ISPs
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: article
ms.date: 07/27/2023
ms.technology: itpro-updates
@ -31,9 +32,9 @@ Microsoft Connected Cache (preview) supports the following scenarios:
Microsoft Connected Cache uses Delivery Optimization as the backbone for Microsoft content delivery. Microsoft Connected Cache caches the following types:
- Windows Update for Business: Windows feature and quality updates
- Windows updates: Windows feature and quality updates
- Office Click-to-Run apps: Microsoft 365 Apps and updates
- Client apps: Microsoft Store apps and updates
- Client apps: Intune, store apps, and updates
- Endpoint protection: Windows Defender definition updates
- Xbox: Xbox Game Pass (PC only)

1
windows/deployment/do/mcc-isp-signup.md
View File

@ -9,6 +9,7 @@ ms.topic: article
ms.date: 12/31/2017
ms.technology: itpro-updates
ms.collection: tier3
ms.reviewer: mstewart
---
# Operator sign up and service onboarding for Microsoft Connected Cache

1
windows/deployment/do/mcc-isp-support.md
View File

@ -9,6 +9,7 @@ ms.topic: reference
ms.date: 12/31/2017
ms.technology: itpro-updates
ms.collection: tier3
ms.reviewer: mstewart
---
# Support and troubleshooting

5
windows/deployment/do/mcc-isp-update.md
View File

@ -3,8 +3,9 @@ title: Update or uninstall your cache node
manager: aaroncz
description: How to update or uninstall your cache node
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: article
ms.date: 12/31/2017
ms.technology: itpro-updates

5
windows/deployment/do/mcc-isp-verify-cache-node.md
View File

@ -3,8 +3,9 @@ title: Verify cache node functionality and monitor health and performance
manager: aaroncz
description: How to verify the functionality of a cache node
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: article
ms.date: 12/31/2017
ms.technology: itpro-updates

5
windows/deployment/do/mcc-isp-vm-performance.md
View File

@ -3,8 +3,9 @@ title: Enhancing cache performance
manager: aaroncz
description: How to enhance performance on a virtual machine used with Microsoft Connected Cache for ISPs
ms.prod: windows-client
author: amymzhou
ms.author: amyzhou
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
ms.topic: reference
ms.technology: itpro-updates
ms.date: 12/31/2017

6
windows/deployment/do/mcc-isp.md
View File

@ -4,9 +4,9 @@ description: Details on Microsoft Connected Cache (MCC) for Internet Service Pro
ms.prod: windows-client
ms.technology: itpro-updates
ms.localizationpriority: medium
author: amymzhou
ms.author: amyzhou
ms.reviewer: carmenf
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
manager: aaroncz
ms.topic: how-to
ms.date: 05/20/2022

63
windows/deployment/do/includes/waas-delivery-optimization-monitor.md → windows/deployment/do/waas-delivery-optimization-monitor.md
View File

@ -1,22 +1,36 @@
---
author: mestew
ms.author: mstewart
manager: aaroncz
title: Monitor Delivery Optimization
description: How to monitor Delivery Optimization
ms.collection:
- tier3
ms.prod: windows-client
ms.technology: itpro-deploy
ms.topic: include
ms.date: 07/31/2023
ms.technology: itpro-updates
ms.topic: reference
ms.date: 08/13/2023
ms.localizationpriority: medium
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
---
<!--This file is shared by do/waas-delivery-optimization-setup.md and the update/update-compliance-get-started.md articles -->
## Monitor Delivery Optimization
# Monitor Delivery Optimization
### Windows PowerShell cmdlets
To monitor Delivery Optimization, you can use either the Windows Update for Business Delivery Optimization Report or Windows PowerShell cmdlets.
## Monitor with Windows Update for Business Delivery Optimization Report
Windows Update for Business Delivery Optimization Report provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer, Microsoft Connected Cache (MCC), HTTP source/CDN distribution over the past 28 days.
:::image type="content" source="../update/media/wufb-do-overview.png" alt-text="This screenshot shows the Windows Update for Business report, Delivery Optimization status in Update Compliance." lightbox= "../update/media/wufb-do-overview.png":::
For details, see [Windows Update for Business Delivery Optimization Report](/windows/deployment/update/wufb-reports-overview).
## Windows PowerShell cmdlets
**Starting in Windows 10, version 1703**, you can use new PowerShell cmdlets to check the performance of Delivery Optimization.
#### Analyze usage
### Analyze usage
`Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs.
@ -112,7 +126,7 @@ Using the `-Verbose` option returns additional information:
Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to data from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month.
#### Manage the Delivery Optimization cache
### Manage the Delivery Optimization cache
**Starting in Windows 10, version 1903:**
@ -132,7 +146,7 @@ You can now "pin" files to keep them persistent in the cache, only with files th
- `-IncludePinnedFiles` deletes all files that are pinned.
- `-Force` deletes the cache with no prompts.
#### Work with Delivery Optimization logs
### Work with Delivery Optimization logs
**Starting in Windows 10, version 2004:**
@ -183,18 +197,19 @@ The provider is listed as "Default Provider" if it's using the Delivery Optimiza
The cmdlet returns the following data:
- BatteryPctToSeed: Corresponds to the [DOMinBatteryPercentageAllowedToUpload](../waas-delivery-optimization-reference.md#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) policy.
- BatteryPctToSeed: Corresponds to the [DOMinBatteryPercentageAllowedToUpload](waas-delivery-optimization-reference.md#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) policy.
- WorkingDirectory: The local folder containing the Delivery Optimization cache.
- MinTotalDiskSize: Corresponds to the [DOMinDiskSizeAllowedToPeer](../waas-delivery-optimization-reference.md#minimum-disk-size-allowed-to-use-peer-caching) policy.
- MinTotalRAM: Corresponds to the [DOMinRAMAllowedToPeer](../waas-delivery-optimization-reference.md#minimum-ram-inclusive-allowed-to-use-peer-caching) policy.
- VpnPeerCachingAllowed: Corresponds to the [DOAllowVPNPeerCaching](../waas-delivery-optimization-reference.md#enable-peer-caching-while-the-device-connects-via-vpn) policy.
- MinTotalDiskSize: Corresponds to the [DOMinDiskSizeAllowedToPeer](waas-delivery-optimization-reference.md#minimum-disk-size-allowed-to-use-peer-caching) policy.
- MinTotalRAM: Corresponds to the [DOMinRAMAllowedToPeer](waas-delivery-optimization-reference.md#minimum-ram-inclusive-allowed-to-use-peer-caching) policy.
- VpnPeerCachingAllowed: Corresponds to the [DOAllowVPNPeerCaching](waas-delivery-optimization-reference.md#enable-peer-caching-while-the-device-connects-via-vpn) policy.
- VpnKeywords: List of keywords used to identify a VPN adapter.
- SetHoursToLimitDownloadBackground: Corresponds to the [DOSetHoursToLimitBackgroundDownloadBandwidth](../waas-delivery-optimization-reference.md#set-business-hours-to-limit-background-download-bandwidth) policy.
- SetHoursToLimitDownloadForeground: Corresponds to the [DOSetHoursToLimitForegroundDownloadBandwidth](../waas-delivery-optimization-reference.md#set-business-hours-to-limit-foreground-download-bandwidth) policy.
- DownloadMode: Corresponds to the [DODownloadMode](../waas-delivery-optimization-reference.md#download-mode) policy.
- DownBackLimitBps: Corresponds to the [DOMaxBackgroundDownloadBandwidth](../waas-delivery-optimization-reference.md#maximum-background-download-bandwidth-in-kbs) policy.
- DownloadForegroundLimitBps: Corresponds to the [DOMaxForegroundDownloadBandwidth](../waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) policy.
- DownBackLimitPct: Corresponds to the [DOPercentageMaxBackgroundBandwidth](../waas-delivery-optimization-reference.md#maximum-background-download-bandwidth) policy.
- DownloadForegroundLimitPct: Corresponds to the [DOPercentageMaxForegroundBandwidth](../waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth) policy.
- MaxUploadRatePct: Corresponds to the [DOMaxUploadBandwidth](../waas-delivery-optimization-reference.md#max-upload-bandwidth) policy (deprecated in Windows 10, version 2004).
- UploadLimitMonthlyGB: Corresponds to the [DOMonthlyUploadDataCap](../waas-delivery-optimization-reference.md#monthly-upload-data-cap) policy.
- SetHoursToLimitDownloadBackground: Corresponds to the [DOSetHoursToLimitBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#set-business-hours-to-limit-background-download-bandwidth) policy.
- SetHoursToLimitDownloadForeground: Corresponds to the [DOSetHoursToLimitForegroundDownloadBandwidth](waas-delivery-optimization-reference.md#set-business-hours-to-limit-foreground-download-bandwidth) policy.
- DownloadMode: Corresponds to the [DODownloadMode](waas-delivery-optimization-reference.md#download-mode) policy.
- DownBackLimitBps: Corresponds to the [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-background-download-bandwidth-in-kbs) policy.
- DownloadForegroundLimitBps: Corresponds to the [DOMaxForegroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) policy.
- DownBackLimitPct: Corresponds to the [DOPercentageMaxBackgroundBandwidth](waas-delivery-optimization-reference.md#maximum-background-download-bandwidth) policy.
- DownloadForegroundLimitPct: Corresponds to the [DOPercentageMaxForegroundBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth) policy.
- MaxUploadRatePct: Corresponds to the [DOMaxUploadBandwidth](waas-delivery-optimization-reference.md#max-upload-bandwidth) policy (deprecated in Windows 10, version 2004).
- UploadLimitMonthlyGB: Corresponds to the [DOMonthlyUploadDataCap](waas-delivery-optimization-reference.md#monthly-upload-data-cap) policy.

3
windows/deployment/do/waas-delivery-optimization-reference.md
View File

@ -10,6 +10,7 @@ ms.topic: reference
ms.technology: itpro-updates
ms.date: 07/31/2023
ms.collection: tier3
ms.reviewer: mstewart
---
# Delivery Optimization reference
@ -323,7 +324,7 @@ The device can download from peers while on battery regardless of this policy.
MDM Setting: **DOCacheHost**
Set this policy to designate one or more Microsoft Connected Cache servers to be used by Delivery Optimization. You can set one or more FQDNs or IP Addresses that are comma-separated, for example: myhost.somerandomhost.com,myhost2.somerandomhost.com,10.10.1.7. **By default, this policy has no value.**
Set this policy to designate one or more Microsoft Connected Cache servers to be used by Delivery Optimization. You can set one or more FQDNs or IP Addresses that are comma-separated, for example: myhost.somerandomhost.com,myhost2.somerandomhost.com,10.10.1.7. **By default, this policy has no value.** Delivery Optimization client will connect to the listed Microsoft Connected Cache servers in the order as they are listed. When multiple FQDNs or IP Addresses are listed, the Microsoft Connected Cache server priority order is determined based on the order as they are listed. If the first server fails, it will move the the next one. When the last server fails, it will fallback to the CDN.
>[!IMPORTANT]
> Any value will signify that the policy is set. For example, an empty string ("") isn't considered empty.

11
windows/deployment/do/waas-delivery-optimization-setup.md
View File

@ -110,17 +110,6 @@ Using MDM, go to **./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/** an
[Learn more](delivery-optimization-test.md) about Delivery Optimization testing scenarios.
<!--Using include file, waas-delivery-optimization-monitor.md, for shared content on DO monitoring-->
[!INCLUDE [Monitor Delivery Optimization](includes/waas-delivery-optimization-monitor.md)]
### Monitor with Windows Update for Business Delivery Optimization Report
Windows Update for Business Delivery Optimization Report provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer, Microsoft Connected Cache (MCC), HTTP source/CDN distribution over the past 28 days.
:::image type="content" source="/windows/deployment/update/images/wufb-do-overview.png" alt-text="This screenshot shows the Windows Update for Business report, Delivery Optimization status in Update Compliance." lightbox="/windows/deployment/update/images/wufb-do-overview.png":::
For details, see [Windows Update for Business Delivery Optimization Report](../update/wufb-reports-overview.md).
## Troubleshooting
This section summarizes common problems and some solutions to try.

1
windows/deployment/do/waas-delivery-optimization.md
View File

@ -12,6 +12,7 @@ ms.collection:
- highpri
ms.topic: overview
ms.date: 12/31/2017
ms.reviewer: mstewart
---
# What is Delivery Optimization?

1
windows/deployment/do/waas-microsoft-connected-cache.md
View File

@ -10,6 +10,7 @@ ms.topic: article
ms.technology: itpro-updates
ms.date: 05/09/2023
ms.collection: tier3
ms.reviewer: mstewart
---
# What is Microsoft Connected Cache?

5
windows/deployment/do/waas-optimize-windows-10-updates.md
View File

@ -3,8 +3,9 @@ title: Optimize Windows update delivery
description: Two methods of peer-to-peer content distribution are available, Delivery Optimization and BranchCache.
ms.prod: windows-client
ms.localizationpriority: medium
author: mestew
ms.author: mstewart
ms.author: carmenf
author: cmknox
ms.reviewer: mstewart
manager: aaroncz
ms.topic: article
ms.technology: itpro-updates

1
windows/deployment/do/whats-new-do.md
View File

@ -10,6 +10,7 @@ ms.topic: article
ms.technology: itpro-updates
ms.date: 12/31/2017
ms.collection: tier3
ms.reviewer: mstewart
---
# What's new in Delivery Optimization

15
windows/deployment/update/check-release-health.md
View File

@ -1,14 +1,19 @@
---
title: How to check Windows release health
description: Check the release health status of Microsoft 365 services before you call support to see if there's an active service interruption.
ms.date: 06/07/2023
ms.prod: windows-client
ms.technology: itpro-updates
ms.topic: conceptual
ms.author: mstewart
author: mestew
manager: aaroncz
ms.reviewer: mstewart
ms.topic: how-to
ms.prod: windows-client
ms.technology: itpro-updates
ms.collection:
- tier2
ms.localizationpriority: medium
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 06/07/2023
---
# How to check Windows release health

34
windows/deployment/update/create-deployment-plan.md
View File

@ -1,28 +1,28 @@
---
title: Create a deployment plan
description: Devise the number of deployment rings you need and how you want to populate them
description: Devise the number of deployment rings you need and how you want to populate each of the deployment rings.
ms.prod: windows-client
ms.technology: itpro-updates
ms.topic: conceptual
author: mestew
ms.localizationpriority: medium
ms.author: mstewart
manager: aaroncz
ms.topic: article
ms.technology: itpro-updates
ms.collection:
- tier2
ms.localizationpriority: medium
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 12/31/2017
---
# Create a deployment plan
**Applies to**
- Windows 10
- Windows 11
A "service management" mindset means that the devices in your organization fall into a continuum, with the software update process being constantly planned, deployed, monitored, and optimized. And once you use this process for feature updates, quality updates become a lightweight procedure that is simple and fast to execute, ultimately increasing velocity.
When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We’ve found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows client are similar to the deployment groups most organizations constructed for previous major revision upgrades. They're simply a method to separate devices into a deployment timeline.
When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We've found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows client are similar to the deployment groups most organizations constructed for previous major revision upgrades. They're simply a method to separate devices into a deployment timeline.
At the highest level, each “ring” comprises a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur.
At the highest level, each ring comprises a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur.
A common ring structure uses three deployment groups:
@ -31,7 +31,7 @@ A common ring structure uses three deployment groups:
- Broad: Wide deployment
> [!NOTE]
> Organizations often use different names for their “rings," for example:
> Organizations often use different names for their rings, for example:
> - First > Fast > Broad
> - Canaries > Early Adopters > Users
> - Preview > Broad > Critical
@ -45,8 +45,8 @@ There are no definite rules for exactly how many rings to have for your deployme
There are basically two strategies for moving deployments from one ring to the next. One is service-based, the other project based.
- "Red button" (service based): Assumes that content is good until proven bad. Content flows until an issue is discovered, at which point the IT administrator presses the “red button” to stop further distribution.
- Green button (project based): Assumes that content is bad until proven good. Once all validation has passed, the IT administrator presses the “green button” to push the content to the next ring.
- "Red button" (service based): Assumes that content is good until proven bad. Content flows until an issue is discovered, at which point the IT administrator presses the "red button" to stop further distribution.
- Green button (project based): Assumes that content is bad until proven good. Once all validation has passed, the IT administrator presses the "green button" to push the content to the next ring.
When it comes to deployments, having manual steps in the process usually impedes update velocity. A "red button" strategy is better when that is your goal.
@ -84,7 +84,7 @@ Analytics can help with defining a good Limited ring of representative devices a
### Who goes in the Limited ring?
The most important part of this phase is finding a representative sample of devices and applications across your network. If possible, all hardware and all applications should be represented. It's important that the people selected for this ring are using their devices regularly to generate the data you'll need to make a decision for broader deployment across your organization. The IT department, lab devices, and users with the most cutting-edge hardware usually don’t have the applications or device drivers that are truly a representative sample of your network.
The most important part of this phase is finding a representative sample of devices and applications across your network. If possible, all hardware and all applications should be represented. It's important that the people selected for this ring are using their devices regularly to generate the data you'll need to make a decision for broader deployment across your organization. The IT department, lab devices, and users with the most cutting-edge hardware usually don't have the applications or device drivers that are truly a representative sample of your network.
During your pilot and validate phases, you should focus on the following activities:
@ -93,11 +93,11 @@ During your pilot and validate phases, you should focus on the following activit
- Assess and act if issues are encountered.
- Move forward unless blocked.
When you deploy to the Limited ring, you’ll be able to gather data and react to incidents happening in the environment, quickly addressing any issues that might arise. Ensure you monitor for sufficient adoption within this ring. Your Limited ring represents your organization across the board. When you achieve sufficient adoption, you can have confidence that your broader deployment will run more smoothly.
When you deploy to the Limited ring, you'll be able to gather data and react to incidents happening in the environment, quickly addressing any issues that might arise. Ensure you monitor for sufficient adoption within this ring. Your Limited ring represents your organization across the board. When you achieve sufficient adoption, you can have confidence that your broader deployment will run more smoothly.
## Broad deployment
Once the devices in the Limited ring have had a sufficient stabilization period, it’s time for broad deployment across the network.
Once the devices in the Limited ring have had a sufficient stabilization period, it's time for broad deployment across the network.
### Who goes in the Broad deployment ring?

17
windows/deployment/update/deployment-service-drivers.md
View File

@ -1,19 +1,24 @@
---
title: Deploy drivers and firmware updates with Windows Update for Business deployment service.
description: Use Windows Update for Business deployment service to deploy driver and firmware updates.
title: Deploy drivers and firmware updates
titlesuffix: Windows Update for Business deployment service
description: Use Windows Update for Business deployment service to deploy driver and firmware updates to devices.
ms.prod: windows-client
ms.technology: itpro-updates
ms.topic: conceptual
author: mestew
ms.localizationpriority: medium
ms.author: mstewart
manager: aaroncz
ms.topic: article
ms.technology: itpro-updates
ms.collection:
- tier1
ms.localizationpriority: medium
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 06/22/2023
---
# Deploy drivers and firmware updates with Windows Update for Business deployment service
<!--7260403, 7512398-->
***(Applies to: Windows 11 & Windows 10)***
The Windows Update for Business deployment service is used to approve and schedule software updates. The deployment service exposes its capabilities through the [Microsoft Graph API](/graph/use-the-api). You can call the API directly, through a [Graph SDK](/graph/sdks/sdks-overview), or integrate them with a management tool such as [Microsoft Intune](/mem/intune).

22
windows/deployment/update/deployment-service-expedited-updates.md
View File

@ -1,20 +1,24 @@
---
title: Deploy expedited updates with Windows Update for Business deployment service
description: Use Windows Update for Business deployment service to deploy expedited updates.
title: Deploy expedited updates
titlesuffix: Windows Update for Business deployment service
description: Learn how to use Windows Update for Business deployment service to deploy expedited updates to devices in your organization.
ms.prod: windows-client
author: mestew
ms.localizationpriority: medium
ms.author: mstewart
manager: aaroncz
ms.topic: article
ms.technology: itpro-updates
ms.topic: conceptual
ms.author: mstewart
author: mestew
manager: aaroncz
ms.collection:
- tier1
ms.localizationpriority: medium
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 02/14/2023
---
# Deploy expedited updates with Windows Update for Business deployment service
<!--7512398-->
***(Applies to: Windows 11 & Windows 10)***
In this article, you will:
> [!div class="checklist"]

22
windows/deployment/update/deployment-service-feature-updates.md
View File

@ -1,20 +1,24 @@
---
title: Deploy feature updates with Windows Update for Business deployment service.
description: Use Windows Update for Business deployment service to deploy feature updates.
title: Deploy feature updates
titlesuffix: Windows Update for Business deployment service
description: Use Windows Update for Business deployment service to deploy feature updates to devices in your organization.
ms.prod: windows-client
author: mestew
ms.localizationpriority: medium
ms.author: mstewart
manager: aaroncz
ms.topic: article
ms.technology: itpro-updates
ms.topic: conceptual
ms.author: mstewart
author: mestew
manager: aaroncz
ms.collection:
- tier1
ms.localizationpriority: medium
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 02/14/2023
---
# Deploy feature updates with Windows Update for Business deployment service
<!--7512398-->
***(Applies to: Windows 11 & Windows 10)***
The Windows Update for Business deployment service is used to approve and schedule software updates. The deployment service exposes its capabilities through the [Microsoft Graph API](/graph/use-the-api). You can call the API directly, through a [Graph SDK](/graph/sdks/sdks-overview), or integrate them with a management tool such as [Microsoft Intune](/mem/intune).
This article uses [Graph Explorer](/graph/graph-explorer/graph-explorer-overview) to walk through the entire process of deploying a feature update to clients. In this article, you will:

24
windows/deployment/update/deployment-service-overview.md
View File

@ -1,20 +1,24 @@
---
title: Windows Update for Business deployment service
description: Overview of deployment service to control approval, scheduling, and safeguarding of Windows updates
title: Overview of the deployment service
titlesuffix: Windows Update for Business deployment service
description: Overview of deployment service to control approval, scheduling, and safeguarding of Windows updates with the deployment service.
ms.prod: windows-client
author: mestew
ms.localizationpriority: medium
ms.author: mstewart
manager: aaroncz
ms.topic: overview
ms.technology: itpro-updates
ms.date: 12/31/2017
ms.topic: conceptual
ms.author: mstewart
author: mestew
manager: aaroncz
ms.collection:
- tier1
ms.localizationpriority: medium
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 02/14/2023
---
# Windows Update for Business deployment service
***(Applies to: Windows 11 & Windows 10)***
The Windows Update for Business deployment service is a cloud service within the Windows Update for Business product family. It's designed to work with your existing [Windows Update for Business](waas-manage-updates-wufb.md) policies and [Windows Update for Business reports](wufb-reports-overview.md). The deployment service provides control over the approval, scheduling, and safeguarding of updates delivered from Windows Update to managed devices. The service is privacy focused and backed by leading industry compliance certifications.
Windows Update for Business product family has three elements:

22
windows/deployment/update/deployment-service-prerequisites.md
View File

@ -1,20 +1,24 @@
---
title: Prerequisites for the Windows Update for Business deployment service
description: Prerequisites for using the Windows Update for Business deployment service.
title: Prerequisites for the deployment service
titlesuffix: Windows Update for Business deployment service
description: Prerequisites for using the Windows Update for Business deployment service for updating devices in your organization.
ms.prod: windows-client
author: mestew
ms.localizationpriority: medium
ms.author: mstewart
manager: aaroncz
ms.topic: article
ms.technology: itpro-updates
ms.topic: conceptual
ms.author: mstewart
author: mestew
manager: aaroncz
ms.collection:
- tier1
ms.localizationpriority: medium
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 02/14/2023
---
# Windows Update for Business deployment service prerequisites
<!--7512398-->
***(Applies to: Windows 11 & Windows 10)***
Before you begin the process of deploying updates with Windows Update for Business deployment service, ensure you meet the prerequisites.
## Azure and Azure Active Directory

26
windows/deployment/update/deployment-service-troubleshoot.md
View File

@ -1,22 +1,24 @@
---
title: Troubleshoot the Windows Update for Business deployment service
description: Solutions to common problems with the service
title: Troubleshoot the deployment service
titlesuffix: Windows Update for Business deployment service
description: Solutions to commonly encountered problems when using the Windows Update for Business deployment service.
ms.prod: windows-client
author: mestew
ms.localizationpriority: medium
ms.author: mstewart
manager: aaroncz
ms.topic: article
ms.technology: itpro-updates
ms.date: 12/31/2017
ms.topic: troubleshooting
ms.author: mstewart
author: mestew
manager: aaroncz
ms.collection:
- tier1
ms.localizationpriority: medium
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 02/14/2023
---
# Troubleshoot the Windows Update for Business deployment service
***(Applies to: Windows 11 & Windows 10)***
This troubleshooting guide addresses the most common issues that IT administrators face when using the Windows Update for Business [deployment service](deployment-service-overview.md). For a general troubleshooting guide for Windows Update, see [Windows Update troubleshooting](/troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json).
## The device isn't receiving an update that I deployed

7
windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md
View File

@ -1,7 +1,7 @@
---
title: Manage driver and firmware updates
description: This article explains how you can manage driver and firmware updates with Windows Autopatch
ms.date: 07/04/2023
ms.date: 08/21/2023
ms.prod: windows-client
ms.technology: itpro-updates
ms.topic: how-to
@ -15,10 +15,7 @@ ms.collection:
- tier1
---
# Manage driver and firmware updates (public preview)
> [!IMPORTANT]
> This feature is in **public preview**. The feature is being actively developed, and might not be complete. You can test and use these features in production environments and provide feedback.
# Manage driver and firmware updates
You can manage and control your driver and firmware updates with Windows Autopatch. You can choose to receive driver and firmware updates automatically, or self-manage the deployment.

5
windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
View File

@ -1,7 +1,7 @@
---
title: What's new 2023
description: This article lists the 2023 feature releases and any corresponding Message center post numbers.
ms.date: 08/08/2023
ms.date: 08/21/2023
ms.prod: windows-client
ms.technology: itpro-updates
ms.topic: whats-new
@ -27,7 +27,8 @@ Minor corrections such as typos, style, or formatting issues aren't listed.
| Article | Description |
| ----- | ----- |
| [Exclude a device](../operate/windows-autopatch-exclude-device.md) | Renamed Deregister a device to [Exclude a device](../operate/windows-autopatch-exclude-device.md). Added the [Restore device](../operate/windows-autopatch-exclude-device.md#restore-a-device-or-multiple-devices-previously-excluded) feature |
| [Manage driver and firmware updates](../operate/windows-autopatch-manage-driver-and-firmware-updates.md) | General Availability<ul><li>[MC661218](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li></ul> |
| [Exclude a device](../operate/windows-autopatch-exclude-device.md) | Renamed Deregister a device to [Exclude a device](../operate/windows-autopatch-exclude-device.md). Added the [Restore device](../operate/windows-autopatch-exclude-device.md#restore-a-device-or-multiple-devices-previously-excluded) feature <ul><li>[MC667662](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li></ul> |
| [Device alerts](../operate/windows-autopatch-device-alerts.md) | Added `'InstallSetupBlock'` to the [Alert resolutions section](../operate/windows-autopatch-device-alerts.md#alert-resolutions) |
## July 2023

2
windows/security/application-security/application-control/user-account-control/how-it-works.md
View File

@ -4,7 +4,7 @@ description: Learn about User Account Control (UAC) components and how it intera
ms.collection:
- highpri
- tier2
ms.topic: conceptual
ms.topic: concept-article
ms.date: 05/24/2023
---

2
windows/security/application-security/application-control/user-account-control/index.md
View File

@ -4,7 +4,7 @@ description: Learn how User Account Control (UAC) helps to prevent unauthorized
ms.collection:
- highpri
- tier2
ms.topic: conceptual
ms.topic: overview
ms.date: 05/24/2023
---

2
windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md
View File

@ -41,8 +41,6 @@ The blocklist is updated with each new major release of Windows, typically 1-2 t
Customers who always want the most up-to-date driver blocklist can also use Windows Defender Application Control (WDAC) to apply the latest recommended driver blocklist contained in this article. For your convenience, we've provided a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. Otherwise, you can use the XML provided below to create your own custom WDAC policies.
[!INCLUDE [microsoft-vulnerable-driver-blocklist](../../../../../../includes/licensing/microsoft-vulnerable-driver-blocklist.md)]
## Blocking vulnerable drivers using WDAC
Microsoft recommends enabling [HVCI](../../../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md) or S mode to protect your devices against security threats. If this setting isn't possible, Microsoft recommends blocking [this list of drivers](#vulnerable-driver-blocklist-xml) within your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can cause devices or software to malfunction, and in rare cases, blue screen. It's recommended to first validate this policy in [audit mode](/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies) and review the audit block events.

2
windows/security/cloud-security/index.md
View File

@ -2,7 +2,7 @@
title: Windows and cloud security
description: Get an overview of cloud security features in Windows
ms.date: 08/02/2023
ms.topic: conceptual
ms.topic: overview
author: paolomatarazzo
ms.author: paoloma
---

2
windows/security/identity-protection/access-control/local-accounts.md
View File

@ -2,7 +2,7 @@
ms.date: 08/03/2023
title: Local Accounts
description: Learn how to secure and manage access to the resources on a standalone or member server for services or users.
ms.topic: conceptual
ms.topic: concept-article
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>

2
windows/security/identity-protection/enterprise-certificate-pinning.md
View File

@ -1,7 +1,7 @@
---
title: Enterprise certificate pinning
description: Enterprise certificate pinning is a Windows feature for remembering, or pinning, a root issuing certificate authority, or end-entity certificate to a domain name.
ms.topic: conceptual
ms.topic: concept-article
ms.date: 05/24/2023
---

1
windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md
View File

@ -3,6 +3,7 @@ title: Windows Hello for Business cloud-only deployment
description: Learn how to configure Windows Hello for Business in a cloud-only deployment scenario.
ms.date: 06/23/2021
ms.topic: how-to
ms.custom: has-azure-ad-ps-ref
---
# Cloud-only deployment

2
windows/security/identity-protection/hello-for-business/hello-deployment-issues.md
View File

@ -22,7 +22,7 @@ If you're a customer of *Azure US Government* cloud, PIN reset also attempts to
### Resolve PIN Reset allowed domains issue
To resolve the error, you can configure a list of allowed domains for PIN reset using the [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls) policy. For information on how to configure the policy, see [PIN Reset - Configure Web Sign-in Allowed URLs for Third Party Identity Providers on Azure AD Joined Devices](hello-feature-pin-reset.md#configure-web-sign-in-allowed-urls-for-third-party-identity-providers-on-azure-ad-joined-devices).
To resolve the error, you can configure a list of allowed domains for PIN reset using the [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls) policy. For information on how to configure the policy, see [Configure allowed URLs for federated identity providers on Azure AD joined devices](hello-feature-pin-reset.md#configure-allowed-urls-for-federated-identity-providers-on-azure-ad-joined-devices).
## Hybrid key trust sign in broken due to user public key deletion

302
windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md
View File

@ -1,166 +1,117 @@
---
title: Pin Reset
description: Learn how Microsoft PIN reset services enable you to help users recover who have forgotten their PIN.
title: PIN reset
description: Learn how Microsoft PIN reset service enables your users to recover a forgotten Windows Hello for Business PIN.
ms.collection:
- highpri
- tier1
ms.date: 07/03/2023
ms.date: 08/15/2023
ms.topic: how-to
---
# PIN reset
Windows Hello for Business provides the capability for users to reset forgotten PINs using the *I forgot my PIN* link from the Sign-in options page in *Settings* or from the Windows lock screen. Users are required to authenticate and complete multi-factor authentication to reset their PIN.
This article describes how *Microsoft PIN reset service* enables your users to recover a forgotten Windows Hello for Business PIN.
There are two forms of PIN reset:
## Overview
- **Destructive PIN reset**: with this option, the user's existing PIN and underlying credentials, including any keys or certificates added to their Windows Hello container, are deleted from the client and a new login key and PIN are provisioned. Destructive PIN reset is the default option, and doesn't require configuration.
- **Non-destructive PIN reset**: with this option, the user's Windows Hello for Business container and keys are preserved, but the user's PIN that they use to authorize key usage is changed. For non-destructive PIN reset, you must deploy the **Microsoft PIN Reset Service** and configure your clients' policy to enable the **PIN Recovery** feature.
## Using PIN reset
Windows Hello for Business provides the capability for users to reset forgotten PINs. There are two forms of PIN reset:
There are two forms of PIN reset called destructive and non-destructive. Destructive PIN reset is the default and doesn't require configuration. During a destructive PIN reset, the user's existing PIN and underlying credentials, including any keys or certificates added to their Windows Hello container, will be deleted from the client and a new logon key and PIN are provisioned. For non-destructive PIN reset, you must deploy the Microsoft PIN reset service and client policy to enable the PIN recovery feature. During a non-destructive PIN reset, the user's Windows Hello for Business container and keys are preserved, but the user's PIN that they use to authorize key usage is changed.
- *Destructive PIN reset*: with this option, the user's existing PIN and underlying credentials, including any keys or certificates added to their Windows Hello container, are deleted from the client and a new sign in key and PIN are provisioned. Destructive PIN reset is the default option, and doesn't require configuration
- *Non-destructive PIN reset*: with this option, the user's Windows Hello for Business container and keys are preserved, but the user's PIN that they use to authorize key usage is changed. For non-destructive PIN reset, you must deploy the *Microsoft PIN reset service* and configure your clients' policy to enable the *PIN recovery* feature
Destructive and non-destructive PIN reset use the same steps for initiating a PIN reset. If users have forgotten their PINs, but have an alternate sign-in method, they can navigate to Sign-in options in *Settings* and initiate a PIN reset from the PIN options. If users don't have an alternate way to sign into their devices, PIN reset can also be initiated from the Windows lock screen in the PIN credential provider.
>[!IMPORTANT]
>For hybrid Azure AD-joined devices, users must have corporate network connectivity to domain controllers to complete destructive PIN reset. If AD FS is being used for certificate trust or for on-premises only deployments, users must also have corporate network connectivity to federation services to reset their PIN.
### Reset PIN from Settings
1. Sign-in to Windows 10 using an alternate credential.
1. Open **Settings**, select **Accounts** > **Sign-in options**.
1. Select **PIN (Windows Hello)** > **I forgot my PIN** and follow the instructions.
### Reset PIN above the Lock Screen
For Azure AD-joined devices:
1. If the PIN credential provider isn't selected, expand the **Sign-in options** link, and select the PIN pad icon.
1. Select **I forgot my PIN** from the PIN credential provider.
1. Select an authentication option from the list of presented options. This list will be based on the different authentication methods enabled in your tenant (like Password, PIN, Security key).
1. Follow the instructions provided by the provisioning process.
1. When finished, unlock your desktop using your newly created PIN.
For Hybrid Azure AD-joined devices:
1. If the PIN credential provider isn't selected, expand the **Sign-in options** link, and select the PIN pad icon.
1. Select **I forgot my PIN** from the PIN credential provider.
1. Enter your password and press enter.
1. Follow the instructions provided by the provisioning process.
1. When finished, unlock your desktop using your newly created PIN.
> [!NOTE]
> Key trust on hybrid Azure AD-joined devices does not support destructive PIN reset from above the Lock Screen. This is due to the sync delay between when a user provisions their Windows Hello for Business credential and being able to use it for sign-in. For this deployment model, you must deploy non-destructive PIN reset for above lock PIN reset to work.
You may find that PIN reset from settings only works post login. Also, the lock screen PIN reset function won't work if you have any matching limitation of self-service password reset from the lock screen. For more information, see [Enable Azure Active Directory self-service password reset at the Windows sign-in screen - General ](/azure/active-directory/authentication/howto-sspr-windows#general-limitations).
## Non-Destructive PIN reset
## How non-destructive PIN reset works
**Requirements:**
- Azure Active Directory
- Windows Enterprise and Pro editions. There's no licensing requirement for this feature.
- Hybrid Windows Hello for Business deployment
- Azure AD registered, Azure AD joined, and Hybrid Azure AD joined
- Hybrid or cloud-only Windows Hello for Business deployments
- Windows Enterprise, Education and Pro editions. There's no licensing requirement for this feature
When non-destructive PIN reset is enabled on a client, a 256-bit AES key is generated locally. The key is added to a user's Windows Hello for Business container and keys as the PIN reset protector. This PIN reset protector is encrypted using a public key retrieved from the Microsoft PIN reset service and then stored on the client for later use during PIN reset. After a user initiates a PIN reset, completes authentication and multi-factor authentication to Azure AD, the encrypted PIN reset protector is sent to the Microsoft PIN reset service, decrypted, and returned to the client. The decrypted PIN reset protector is used to change the PIN used to authorize Windows Hello for Business keys and it's then cleared from memory.
When non-destructive PIN reset is enabled on a client, a *256-bit AES* key is generated locally. The key is added to a user's Windows Hello for Business container and keys as the *PIN reset protector*. This PIN reset protector is encrypted using a public key retrieved from the Microsoft PIN reset service and then stored on the client for later use during PIN reset. After a user initiates a PIN reset, completes authentication and multi-factor authentication to Azure AD, the encrypted PIN reset protector is sent to the Microsoft PIN reset service, decrypted, and returned to the client. The decrypted PIN reset protector is used to change the PIN used to authorize Windows Hello for Business keys and it's then cleared from memory.
Using Group Policy, Microsoft Intune or a compatible MDM solution, you can configure Windows devices to securely use the **Microsoft PIN Reset Service** which enables users to reset their forgotten PIN without requiring re-enrollment.
Using Group Policy, Microsoft Intune or a compatible MDM solution, you can configure Windows devices to securely use the Microsoft PIN reset service, which enables users to reset their forgotten PIN without requiring re-enrollment.
>[!IMPORTANT]
> The Microsoft PIN Reset service is not currently available in Azure Government.
The following table compares destructive and non-destructive PIN reset:
### Summary
|Category|Destructive PIN Reset|Non-Destructive PIN Reset|
|Category|Destructive PIN reset|Non-Destructive PIN reset|
|--- |--- |--- |
|**Functionality**|The user's existing PIN and underlying credentials, including any keys or certificates added to their Windows Hello container, will be deleted from the client and a new logon key and PIN are provisioned.|You must deploy the Microsoft PIN reset service and client policy to enable the PIN recovery feature. For more information on how to deploy the Microsoft PIN reset service and client policy, see [Connect Azure Active Directory with the PIN reset service](#connect-azure-active-directory-with-the-pin-reset-service). During a non-destructive PIN reset, the user's Windows Hello for Business container and keys are preserved, but the user's PIN that they use to authorize key usage is changed.|
|**Windows editions and versions**| Windows Enterprise and Pro editions.|
|**Functionality**|The user's existing PIN and underlying credentials, including any keys or certificates added to their Windows Hello container, are deleted from the client and a new sign in key and PIN are provisioned.|You must deploy the Microsoft PIN reset service and client policy to enable the PIN recovery feature. During a non-destructive PIN reset, the user's Windows Hello for Business container and keys are preserved, but the user's PIN that they use to authorize key usage is changed.|
|**Azure Active Directory Joined**|Cert Trust, Key Trust, and cloud Kerberos trust|Cert Trust, Key Trust, and cloud Kerberos trust|
|**Hybrid Azure Active Directory Joined**|Cert Trust and cloud Kerberos trust for both settings and above the lock support destructive PIN reset. Key Trust doesn't support this from above the lock screen. This is due to the sync delay between when a user provisions their Windows Hello for Business credential and being able to use it for sign-in. It does support from the settings page and the users must have a corporate network connectivity to the DC. |Cert Trust, Key Trust, and cloud Kerberos trust for both settings and above the lock support non-destructive PIN reset. No network connection is required for the DC.|
|**On Premises**|If ADFS is being used for on premises deployments, users must have a corporate network connectivity to federation services. |The PIN reset service relies on Azure Active Directory identities, so it's only available for Hybrid Azure Active Directory Joined and Azure Active Directory Joined devices.|
|**Additional Configuration required**|Supported by default and doesn't require configuration|Deploy the Microsoft PIN reset service and client policy to enable the PIN recovery feature On-board the Microsoft PIN reset service to respective Azure Active Directory tenant Configure Windows devices to use PIN reset using Group *Policy\MDM*.|
|**Hybrid Azure Active Directory Joined**|Cert Trust and cloud Kerberos trust for both settings and above the lock support destructive PIN reset. Key Trust doesn't support this option from above the lock screen. This is due to the sync delay between when a user provisions their Windows Hello for Business credential and being able to use it for sign-in. It does support from the settings page and the users must have a corporate network connectivity to the DC. |Cert Trust, Key Trust, and cloud Kerberos trust for both settings and above the lock support non-destructive PIN reset. No network connection is required for the DC.|
|**On Premises**|If AD FS is used for on premises deployments, users must have a corporate network connectivity to federation services. |The PIN reset service relies on Azure Active Directory identities, so it's only available for hybrid Azure AD joined and Azure AD Joined devices.|
|**Additional configuration required**|Supported by default and doesn't require configuration|Deploy the Microsoft PIN reset service and client policy to enable the PIN recovery feature.|
|**MSA/Enterprise**|MSA and Enterprise|Enterprise only.|
### Onboarding the Microsoft PIN reset service to your Intune tenant
## Enable the Microsoft PIN Reset Service in your Azure AD tenant
> The **Microsoft PIN Reset Service** is not currently available in Azure Government.
Before you can use non-destructive PIN reset, you must register two applications in your Azure Active Directory tenant:
### Enable the Microsoft PIN Reset Service in your Azure AD tenant
- Microsoft Pin Reset Service Production
- Microsoft Pin Reset Client Production
Before you can remotely reset PINs, you must register two applications in your Azure Active Directory tenant:
To register the applications, follow these steps:
- PIN Reset Service
- PIN Reset Client
:::row:::
:::column span="3":::
1. Go to the [Microsoft PIN Reset Service Production website][APP-1], and sign in using a *Global Administrator* account you use to manage your Azure Active Directory tenant. Review the permissions requested by the *Microsoft Pin Reset Service Production* application and select **Accept** to give consent to the application to access your organization
:::column-end:::
:::column span="1":::
:::image type="content" alt-text="Screenshot showing the PIN reset service permissions page." source="images/pinreset/pin-reset-service-prompt.png" lightbox="images/pinreset/pin-reset-service-prompt.png" border="true":::
:::column-end:::
:::row-end:::
:::row:::
:::column span="3":::
2. Go to the [Microsoft PIN Reset Client Production website][APP-2], and sign in using a *Global Administrator* account you use to manage your Azure Active Directory tenant. Review the permissions requested by the *Microsoft Pin Reset Client Production* application, and select **Next**.
:::column-end:::
:::column span="1":::
:::image type="content" alt-text="Screenshot showing the PIN reset client permissions page." source="images/pinreset/pin-reset-client-prompt.png" lightbox="images/pinreset/pin-reset-client-prompt.png" border="true":::
:::column-end:::
:::row-end:::
:::row:::
:::column span="3":::
3. Review the permissions requested by the *Microsoft Pin Reset Service Production* application and select **Accept** to confirm consent to both applications to access your organization
:::column-end:::
:::column span="1":::
:::image type="content" alt-text="Screenshot showing the PIN reset service permissions final page." source="images/pinreset/pin-reset-service-prompt-2.png" lightbox="images/pinreset/pin-reset-service-prompt-2.png" border="true":::
:::column-end:::
:::row-end:::
#### Connect Azure Active Directory with the PIN Reset Service
### Confirm that the two PIN Reset service principals are registered in your tenant
1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using a Global Administrator account you use to manage your Azure Active Directory tenant.
1. After you've logged in, select **Accept** to give consent to the **PIN Reset Service** to access your organization.
![PIN reset service application in Azure.](images/pinreset/pin-reset-service-prompt.png)
#### Connect Azure Active Directory with the PIN Reset Client
1. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using a Global Administrator account you use to manage your Azure Active Directory tenant.
1. After you've logged in, select **Accept** to give consent for the **PIN Reset Client** to access your organization.
![PIN reset client application in Azure.](images/pinreset/pin-reset-client-prompt.png)
#### Confirm that the two PIN Reset service principals are registered in your tenant
1. Sign in to the [Microsoft Entra Manager admin center](https://entra.microsoft.com).
1. Select **Azure Active Directory** > **Applications** > **Enterprise applications**.
1. Search by application name "Microsoft PIN" and both **Microsoft Pin Reset Service Production** and **Microsoft Pin Reset Client Production** will show up in the list.
1. Sign in to the [Microsoft Entra Manager admin center](https://entra.microsoft.com)
1. Select **Azure Active Directory > Applications > Enterprise applications**
1. Search by application name "Microsoft PIN" and verify that both **Microsoft Pin Reset Service Production** and **Microsoft Pin Reset Client Production** are in the list
:::image type="content" alt-text="PIN reset service permissions page." source="images/pinreset/pin-reset-applications.png" lightbox="images/pinreset/pin-reset-applications-expanded.png":::
### Enable PIN Recovery on your devices
## Enable PIN recovery on the clients
Before you can remotely reset PINs, your devices must be configured to enable PIN Recovery. Follow the instructions below to configure your devices using either Microsoft Intune, Group Policy Objects (GPO), or Configuration Service Providers (CSP).
To enable PIN recovery on the clients, you can use:
- Microsoft Intune/MDM
- Group policy
The following instructions provide details how to configure your devices. Select the option that best suits your needs.
#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune)
You can configure Windows devices to use the **Microsoft PIN Reset Service** using Microsoft Intune.
[!INCLUDE [intune-settings-catalog-1](../../../../includes/configure/intune-settings-catalog-1.md)]
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
1. Select **Devices** > **Configuration profiles** > **Create profile**.
1. Enter the following properties:
- **Platform**: Select **Windows 10 and later**.
- **Profile type**: Select **Settings catalog**.
1. Select **Create**.
1. In **Basics**, enter the following properties:
- **Name**: Enter a descriptive name for the profile.
- **Description**: Enter a description for the profile. This setting is optional, but recommended.
1. Select **Next**.
1. In **Configuration settings**, select **Add settings**.
1. In the settings picker, select **Windows Hello For Business** > **Enable Pin Recovery**.
1. Configure **Enable Pin Recovery** to **true**.
1. Select **Next**.
1. In **Scope tags**, assign any applicable tags (optional).
1. Select **Next**.
1. In **Assignments**, select the security groups that will receive the policy.
1. Select **Next**.
1. In **Review + create**, review your settings and select **Create**.
| Category | Setting name | Value |
|--|--|--|
| **Windows Hello For Business** | Enable Pin Recovery | True |
[!INCLUDE [intune-settings-catalog-2](../../../../includes/configure/intune-settings-catalog-2.md)]
>[!NOTE]
> You can also configure PIN recovery from the **Endpoint security** blade:
> 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
> 1. Select **Endpoint security** > **Account protection** > **Create Policy**.
>
> 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)
> 1. Select **Endpoint security > Account protection > Create Policy**
#### [:::image type="icon" source="../../images/icons/group-policy.svg"::: **GPO**](#tab/gpo)
Alternatively, you can configure devices using a [custom policy][INT-1] with the [PassportForWork CSP][CSP-1].
You can configure Windows devices to use the **Microsoft PIN Reset Service** using a Group Policy Object (GPO).
1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory.
1. Edit the Group Policy object from Step 1.
1. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business**.
1. Close the Group Policy Management Editor to save the Group Policy object.
#### [:::image type="icon" source="../../images/icons/windows-os.svg"::: **CSP**](#tab/CSP)
You can configure Windows devices to use the **Microsoft PIN Reset Service** using the [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp).
- OMA-URI: `./Vendor/MSFT/Policy/PassportForWork/`*TenantId*`/Policies/EnablePinRecovery`
- Data type: **Boolean**
- Value: **True**
| OMA-URI |Data type| Value|
|-|-|-|
| `./Vendor/MSFT/Policy/PassportForWork/`*TenantId*`/Policies/EnablePinRecovery`| Boolean | Tue |
>[!NOTE]
> You must replace `TenantId` with the identifier of your Azure Active Directory tenant. To look up your Tenant ID, see [How to find your Azure Active Directory tenant ID](/azure/active-directory/fundamentals/how-to-find-tenant) or try the following, ensuring to sign-in with your organization's account::
@ -169,6 +120,16 @@ You can configure Windows devices to use the **Microsoft PIN Reset Service** usi
GET https://graph.microsoft.com/v1.0/organization?$select=id
```
#### [:::image type="icon" source="../../images/icons/group-policy.svg"::: **GPO**](#tab/gpo)
[!INCLUDE [gpo-settings-1](../../../../includes/configure/gpo-settings-1.md)] **Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business**:
| Group policy setting | Value |
| - | - |
| **Use PIN Recovery** | **Enabled** |
[!INCLUDE [gpo-settings-2](../../../../includes/configure/gpo-settings-2.md)]
---
#### Confirm that PIN Recovery policy is enforced on the devices
@ -177,7 +138,7 @@ The _PIN reset_ configuration can be viewed by running [**dsregcmd /status**](/a
**Sample User state Output for Destructive PIN Reset**
```console
```cmd
+----------------------------------------------------------------------+
| User State |
+----------------------------------------------------------------------+
@ -196,7 +157,7 @@ The _PIN reset_ configuration can be viewed by running [**dsregcmd /status**](/a
**Sample User state Output for Non-Destructive PIN Reset**
```console
```cmd
+----------------------------------------------------------------------+
| User State |
+----------------------------------------------------------------------+
@ -213,49 +174,72 @@ The _PIN reset_ configuration can be viewed by running [**dsregcmd /status**](/a
+----------------------------------------------------------------------+
```
## Configure Web Sign-in Allowed URLs for Third Party Identity Providers on Azure AD Joined Devices
## Configure allowed URLs for federated identity providers on Azure AD joined devices
**Applies to:**
**Applies to:** Azure AD joined devices
- Azure AD joined devices
PIN reset on Azure AD-joined devices uses a flow called *web sign-in* to authenticate users in the lock screen. Web sign-in only allows navigation to specific domains. If web sign-in attempts to navigate to a domain that isn't allowed, it displays a page with the error message: *We can't open that page right now*.\
If you have a federated environment and authentication is handled using AD FS or a third-party identity provider, then you must configure your devices with a policy to allow a list of domains that can be reached during PIN reset flows. When set, it ensures that authentication pages from that identity provider can be used during Azure AD joined PIN reset.
The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls) policy allows you to specify a list of domains that can be reached during PIN reset flows on Azure AD-joined devices. If you have a federated environment and authentication is handled using AD FS or a third-party identity provider, then this policy should be set. When set, it ensures that authentication pages from that identity provider can be used during Azure AD joined PIN reset.
[!INCLUDE [intune-settings-catalog-1](../../../../includes/configure/intune-settings-catalog-1.md)]
### Configure Web Sign-in Allowed URLs using Microsoft Intune
| Category | Setting name | Value |
|--|--|--|
| **Authentication** | Configure Web Sign In Allowed Urls | Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be **signin.contoso.com;portal.contoso.com**|
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)
1. Select **Devices** > **Configuration profiles** > **Create profile**
1. Enter the following properties:
- **Platform**: Select **Windows 10 and later**
- **Profile type**: Select **Templates**
- In the list of templates that is loaded, select **Custom** > **Create**
1. In **Basics**, enter the following properties:
- **Name**: Enter a descriptive name for the profile
- **Description**: Enter a description for the profile. This setting is optional, but recommended
1. Select **Next**
1. In **Configuration settings**, select **Add** and enter the following settings:
- Name: **Web Sign In Allowed URLs**
- Description: **(Optional) List of domains that are allowed during PIN reset flows**
- OMA-URI: `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`
- Data type: **String**
- Value: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be **signin.contoso.com;portal.contoso.com**
:::image type="content" alt-text="Custom Configuration for ConfigureWebSignInAllowedUrls policy." source="images/pinreset/allowlist.png" lightbox="images/pinreset/allowlist-expanded.png":::
1. Select **Save** > **Next**
1. In **Assignments**, select the security groups that will receive the policy
1. Select **Next**
1. In **Applicability Rules**, select **Next**
1. In **Review + create**, review your settings and select **Create**
[!INCLUDE [intune-settings-catalog-2](../../../../includes/configure/intune-settings-catalog-2.md)]
Alternatively, you can configure devices using a [custom policy][INT-1] with the [Policy CSP][CSP-2].
| Setting |
|--------|
| <li> OMA-URI: `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls` </li><li>Data type: String </li><li>Value: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be **signin.contoso.com;portal.contoso.com**</li>|
> [!NOTE]
> For Azure Government, there is a known issue with PIN reset on Azure AD Joined devices failing. When the user attempts to launch PIN reset, the PIN reset UI shows an error page that says, "We can't open that page right now." The ConfigureWebSignInAllowedUrls policy can be used to work around this issue. If you are experiencing this problem and you are using Azure US Government cloud, set **login.microsoftonline.us** as the value for the ConfigureWebSignInAllowedUrls policy.
## Related articles
## Use PIN reset
- [Windows Hello for Business](hello-identity-verification.md)
- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md)
- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md)
- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md)
- [Windows Hello and password changes](hello-and-password-changes.md)
- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md)
- [Event ID 300 - Windows Hello successfully created](/windows/security/identity-protection/hello-for-business/hello-faq)
- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md)
Destructive and non-destructive PIN reset scenarios use the same steps for initiating a PIN reset. If users have forgotten their PINs, but have an alternate sign-in method, they can navigate to Sign-in options in *Settings* and initiate a PIN reset from the PIN options. If users don't have an alternate way to sign into their devices, PIN reset can also be initiated from the Windows lock screen with the *PIN credential provider*. Users must authenticate and complete multi-factor authentication to reset their PIN. After PIN reset is complete, users can sign in using their new PIN.
>[!IMPORTANT]
>For hybrid Azure AD-joined devices, users must have corporate network connectivity to domain controllers to complete destructive PIN reset. If AD FS is being used for certificate trust or for on-premises only deployments, users must also have corporate network connectivity to federation services to reset their PIN.
### Reset PIN from Settings
1. Sign-in to Windows 10 using an alternate credential
1. Open **Settings > Accounts > Sign-in options**
1. Select **PIN (Windows Hello) > I forgot my PIN** and follow the instructions
### Reset PIN from the lock screen
For Azure AD-joined devices:
1. If the PIN credential provider isn't selected, expand the **Sign-in options** link, and select the PIN pad icon
1. Select **I forgot my PIN** from the PIN credential provider
1. Select an authentication option from the list of presented options. This list is based on the different authentication methods enabled in your tenant (like Password, PIN, Security key)
1. Follow the instructions provided by the provisioning process
1. When finished, unlock your desktop using your newly created PIN
:::image type="content" alt-text="Animation showing the PIN reset experience from the lock screen." source="images/pinreset/pin-reset.gif" border="false":::
For Hybrid Azure AD-joined devices:
1. If the PIN credential provider isn't selected, expand the **Sign-in options** link, and select the PIN pad icon
1. Select **I forgot my PIN** from the PIN credential provider
1. Enter your password and press enter
1. Follow the instructions provided by the provisioning process
1. When finished, unlock your desktop using your newly created PIN
> [!NOTE]
> Key trust on hybrid Azure AD-joined devices doesn't support destructive PIN reset from above the Lock Screen. This is due to the sync delay between when a user provisions their Windows Hello for Business credential and being able to use it for sign-in. For this deployment model, you must deploy non-destructive PIN reset for above lock PIN reset to work.
You may find that PIN reset from Settings only works post sign in. Also, the lock screen PIN reset function doesn't work if you have any matching limitation of self-service password reset from the lock screen. For more information, see [Enable Azure Active Directory self-service password reset at the Windows sign-in screen](/azure/active-directory/authentication/howto-sspr-windows#general-limitations).
<!--links-->
[CSP-1]: /windows/client-management/mdm/passportforwork-csp
[CSP-2]: /windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls
[INT-1]: /mem/intune/configuration/settings-catalog
[APP-1]: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&redirect_uri=https%3A%2F%2Fcred.microsoft.com&prompt=admin_consent
[APP-2]: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&prompt=admin_consent

2
windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md
View File

@ -2,7 +2,7 @@
title: How Windows Hello for Business works - Provisioning
description: Explore the provisioning flows for Windows Hello for Business, from within a variety of environments.
ms.date: 2/15/2022
ms.topic: article
ms.topic: overview
---
# Windows Hello for Business Provisioning

2
windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
View File

@ -2,7 +2,7 @@
title: How Windows Hello for Business works - technology and terms
description: Explore technology and terms associated with Windows Hello for Business. Learn how Windows Hello for Business works.
ms.date: 10/08/2018
ms.topic: article
ms.topic: glossary
---
# Technology and terms

2
windows/security/identity-protection/hello-for-business/hello-how-it-works.md
View File

@ -2,7 +2,7 @@
title: How Windows Hello for Business works
description: Learn how Windows Hello for Business works, and how it can help your users authenticate to services.
ms.date: 05/05/2018
ms.topic: article
ms.topic: overview
---
# How Windows Hello for Business works in Windows Devices

2
windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md
View File

@ -2,7 +2,7 @@
title: Configure single sign-on (SSO) for Azure AD joined devices
description: Learn how to configure single sign-on to on-premises resources for Azure AD-joined devices, using Windows Hello for Business.
ms.date: 12/30/2022
ms.topic: article
ms.topic: how-to
---
# Configure single sign-on for Azure AD joined devices

2
windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md
View File

@ -174,7 +174,7 @@ If you deployed Windows Hello for Business using the key trust model, and want t
1. [Set up Azure AD Kerberos in your hybrid environment](#deploy-azure-ad-kerberos).
1. [Enable cloud Kerberos trust via Group Policy or Intune](#configure-windows-hello-for-business-policy).
1. For hybrid Azure AD joined devices, sign out and sign in to the device using Windows Hello for Business.
1. For Azure AD joined devices, sign out and sign in to the device using Windows Hello for Business.
> [!NOTE]
> For hybrid Azure AD joined devices, users must perform the first sign in with new credentials while having line of sight to a DC.

2
windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md
View File

@ -5,7 +5,7 @@ ms.collection:
- highpri
- tier1
ms.date: 2/15/2022
ms.topic: article
ms.topic: how-to
---
# Manage Windows Hello for Business in your organization

2
windows/security/identity-protection/hello-for-business/hello-planning-guide.md
View File

@ -2,7 +2,7 @@
title: Planning a Windows Hello for Business Deployment
description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure.
ms.date: 09/16/2020
ms.topic: article
ms.topic: overview
---
# Planning a Windows Hello for Business Deployment

2
windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md
View File

@ -2,7 +2,7 @@
title: Prepare people to use Windows Hello
description: When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization.
ms.date: 08/19/2018
ms.topic: article
ms.topic: end-user-help
---
# Prepare people to use Windows Hello

2
windows/security/identity-protection/hello-for-business/hello-videos.md
View File

@ -2,7 +2,7 @@
title: Windows Hello for Business Videos
description: View several informative videos describing features and experiences in Windows Hello for Business in Windows 10 and Windows 11.
ms.date: 03/09/2023
ms.topic: article
ms.topic: get-started
---
# Windows Hello for Business Videos
## Overview of Windows Hello for Business and Features

BIN
windows/security/identity-protection/hello-for-business/images/pinreset/allowlist-expanded.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 85 KiB

BIN
windows/security/identity-protection/hello-for-business/images/pinreset/allowlist.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 19 KiB

BIN
windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-prompt.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 225 KiB

After

Width:  |  Height:  |  Size: 58 KiB

BIN
windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-prompt-2.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 50 KiB

BIN
windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-prompt.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 210 KiB

After

Width:  |  Height:  |  Size: 52 KiB

BIN
windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 3.6 MiB

2
windows/security/identity-protection/hello-for-business/index.md
View File

@ -4,7 +4,7 @@ description: Learn how Windows Hello for Business replaces passwords with strong
ms.collection:
- highpri
- tier1
ms.topic: conceptual
ms.topic: overview
ms.date: 04/24/2023
---
# Windows Hello for Business Overview

4
windows/security/identity-protection/hello-for-business/toc.yml
View File

@ -110,9 +110,9 @@ items:
href: hello-and-password-changes.md
- name: Windows Hello for Business features
items:
- name: PIN Reset
- name: PIN reset
href: hello-feature-pin-reset.md
- name: Dual Enrollment
- name: Dual enrollment
href: hello-feature-dual-enrollment.md
- name: Dynamic Lock
href: hello-feature-dynamic-lock.md

2
windows/security/identity-protection/hello-for-business/webauthn-apis.md
View File

@ -2,7 +2,7 @@
title: WebAuthn APIs
description: Learn how to use WebAuthn APIs to enable passwordless authentication for your sites and apps.
ms.date: 07/27/2023
ms.topic: article
ms.topic: how-to
---
# WebAuthn APIs for passwordless authentication on Windows
<!--MAXADO-6021798-->

2
windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md
View File

@ -2,7 +2,7 @@
ms.date: 09/24/2021
title: Smart Card and Remote Desktop Services
description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in.
ms.topic: article
ms.topic: conceptual
ms.reviewer: ardenw
---
# Smart Card and Remote Desktop Services

2
windows/security/identity-protection/smart-cards/smart-card-architecture.md
View File

@ -2,7 +2,7 @@
title: Smart Card Architecture
description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system.
ms.reviewer: ardenw
ms.topic: article
ms.topic: reference-architecture
ms.date: 09/24/2021
---

2
windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md
View File

@ -2,7 +2,7 @@
title: Certificate Propagation Service
description: This topic for the IT professional describes the certificate propagation service (CertPropSvc), which is used in smart card implementation.
ms.reviewer: ardenw
ms.topic: article
ms.topic: concept-article
ms.date: 08/24/2021
---

6
windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md
View File

@ -2,7 +2,7 @@
title: Certificate Requirements and Enumeration
description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in.
ms.reviewer: ardenw
ms.topic: article
ms.topic: concept-article
ms.date: 09/24/2021
---
@ -175,7 +175,7 @@ The smart card certificate has specific format requirements when it is used with
| **Component** | **Requirements for Windows 8.1, Windows 8, Windows 7, Windows Vista, Windows 10, and Windows 11** | **Requirements for Windows XP** |
|--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CRL distribution point location | Not required | The location must be specified, online, and available, for example:<br>\[1\]CRL Distribution Point<br>Distribution Point Name:<br>Full Name:<br>URL=`<https://server1.contoso.com/CertEnroll/caname.crl>` |
| CRL distribution point location | Not required | The location must be specified, online, and available, for example:<br>\[1\]CRL Distribution Point<br>Distribution Point Name:<br>Full Name:<br>URL=`<http://server1.contoso.com/CertEnroll/caname.crl>` |
| Key usage | Digital signature | Digital signature |
| Basic constraints | Not required | \[Subject Type=End Entity, Path Length Constraint=None\] (Optional) |
| extended key usage (EKU) | The smart card sign-in object identifier is not required.<br><br>**Note**&nbsp;&nbsp;If an EKU is present, it must contain the smart card sign-in EKU. Certificates with no EKU can be used for sign-in. | - Client Authentication (1.3.6.1.5.5.7.3.2)<br>The client authentication object identifier is required only if a certificate is used for SSL authentication.<br><br>- Smart Card Sign-in (1.3.6.1.4.1.311.20.2.2) |
@ -310,4 +310,4 @@ For more information about this option for the command-line tool, see [-SCRoots]
## See also
[How Smart Card Sign-in Works in Windows](smart-card-how-smart-card-sign-in-works-in-windows.md)
[How Smart Card Sign-in Works in Windows](smart-card-how-smart-card-sign-in-works-in-windows.md)

Some files were not shown because too many files have changed in this diff Show More