mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 05:47:23 +00:00
added audience metadata
This commit is contained in:
Greg Lindsay
parent
8530777e0f
commit
5a5c2acfde
@ -5,4 +5,4 @@
|
|||||||
## [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md)
|
## [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md)
|
||||||
## [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md)
|
## [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md)
|
||||||
## [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md)
|
## [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md)
|
||||||
## [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md)
|
## [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md)
|
||||||
|
|||||||
@ -1,38 +1,38 @@
|
|||||||
---
|
---
|
||||||
title: What's new in Windows 10 (Windows 10)
|
title: What's new in Windows 10 (Windows 10)
|
||||||
description: Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more.
|
description: Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more.
|
||||||
ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44
|
ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44
|
||||||
keywords: ["What's new in Windows 10", "Windows 10"]
|
keywords: ["What's new in Windows 10", "Windows 10"]
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
author: greg-lindsay
|
audience: itpro
author: greg-lindsay
|
||||||
manager: laurawi
|
manager: laurawi
|
||||||
ms.localizationpriority: high
|
ms.localizationpriority: high
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# What's new in Windows 10
|
# What's new in Windows 10
|
||||||
|
|
||||||
Windows 10 provides IT professionals with advanced protection against modern security threats and comprehensive management and control over devices and apps, as well as flexible deployment, update, and support options. Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more.
|
Windows 10 provides IT professionals with advanced protection against modern security threats and comprehensive management and control over devices and apps, as well as flexible deployment, update, and support options. Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more.
|
||||||
|
|
||||||
## In this section
|
## In this section
|
||||||
|
|
||||||
- [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md)
|
- [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md)
|
||||||
- [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md)
|
- [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md)
|
||||||
- [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md)
|
- [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md)
|
||||||
- [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md)
|
- [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md)
|
||||||
- [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md)
|
- [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md)
|
||||||
- [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md)
|
- [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md)
|
||||||
- [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md)
|
- [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md)
|
||||||
|
|
||||||
## Learn more
|
## Learn more
|
||||||
|
|
||||||
- [Windows 10 release information](https://technet.microsoft.com/windows/release-info)
|
- [Windows 10 release information](https://technet.microsoft.com/windows/release-info)
|
||||||
- [Windows 10 update history](https://support.microsoft.com/help/12387/windows-10-update-history)
|
- [Windows 10 update history](https://support.microsoft.com/help/12387/windows-10-update-history)
|
||||||
- [Windows 10 content from Microsoft Ignite](https://go.microsoft.com/fwlink/p/?LinkId=613210)
|
- [Windows 10 content from Microsoft Ignite](https://go.microsoft.com/fwlink/p/?LinkId=613210)
|
||||||
- [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkId=690485)
|
- [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkId=690485)
|
||||||
|
|
||||||
## See also
|
## See also
|
||||||
|
|
||||||
[Windows 10 Enterprise LTSC](ltsc/index.md)<br>
|
[Windows 10 Enterprise LTSC](ltsc/index.md)<br>
|
||||||
[Edit an existing topic using the Edit link](contribute-to-a-topic.md)
|
[Edit an existing topic using the Edit link](contribute-to-a-topic.md)
|
||||||
|
|
||||||
|
|||||||
@ -1,4 +1,4 @@
|
|||||||
# [Windows 10 Enterprise LTSC](index.md)
|
# [Windows 10 Enterprise LTSC](index.md)
|
||||||
## [What's new in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md)
|
## [What's new in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md)
|
||||||
## [What's new in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md)
|
## [What's new in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md)
|
||||||
## [What's new in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md)
|
## [What's new in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md)
|
||||||
|
|||||||
@ -1,50 +1,50 @@
|
|||||||
---
|
---
|
||||||
title: Windows 10 Enterprise LTSC
|
title: Windows 10 Enterprise LTSC
|
||||||
description: New and updated IT Pro content about new features in Windows 10, LTSC (also known as Windows 10 LTSB).
|
description: New and updated IT Pro content about new features in Windows 10, LTSC (also known as Windows 10 LTSB).
|
||||||
keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 LTSC", "Windows 10 LTSB"]
|
keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 LTSC", "Windows 10 LTSB"]
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: deploy
|
ms.mktglfcycl: deploy
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
author: greg-lindsay
|
audience: itpro
author: greg-lindsay
|
||||||
manager: laurawi
|
manager: laurawi
|
||||||
ms.localizationpriority: low
|
ms.localizationpriority: low
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# Windows 10 Enterprise LTSC
|
# Windows 10 Enterprise LTSC
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
- Windows 10 Enterprise LTSC
|
- Windows 10 Enterprise LTSC
|
||||||
|
|
||||||
## In this topic
|
## In this topic
|
||||||
|
|
||||||
This topic provides links to articles with information about what's new in each release of Windows 10 Enterprise LTSC, and includes a short description of this servicing channel.
|
This topic provides links to articles with information about what's new in each release of Windows 10 Enterprise LTSC, and includes a short description of this servicing channel.
|
||||||
|
|
||||||
[What's New in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md)<br>
|
[What's New in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md)<br>
|
||||||
[What's New in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md)<br>
|
[What's New in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md)<br>
|
||||||
[What's New in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md)
|
[What's New in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md)
|
||||||
|
|
||||||
## The Long Term Servicing Channel (LTSC)
|
## The Long Term Servicing Channel (LTSC)
|
||||||
|
|
||||||
The following table summarizes equivalent feature update versions of Windows 10 LTSC and semi-annual channel (SAC) releases.
|
The following table summarizes equivalent feature update versions of Windows 10 LTSC and semi-annual channel (SAC) releases.
|
||||||
|
|
||||||
| LTSC release | Equivalent SAC release | Availability date |
|
| LTSC release | Equivalent SAC release | Availability date |
|
||||||
| --- | --- | --- |
|
| --- | --- | --- |
|
||||||
| Windows 10 Enterprise 2015 LTSC | Windows 10, Version 1507 | 7/29/2015 |
|
| Windows 10 Enterprise 2015 LTSC | Windows 10, Version 1507 | 7/29/2015 |
|
||||||
| Windows 10 Enterprise 2016 LTSC | Windows 10, Version 1607 | 8/2/2016 |
|
| Windows 10 Enterprise 2016 LTSC | Windows 10, Version 1607 | 8/2/2016 |
|
||||||
| Windows 10 Enterprise 2019 LTSC | Windows 10, Version 1809 | 11/13/2018 |
|
| Windows 10 Enterprise 2019 LTSC | Windows 10, Version 1809 | 11/13/2018 |
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>The Long Term Servicing Channel was previously called the Long Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB.
|
>The Long Term Servicing Channel was previously called the Long Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB.
|
||||||
|
|
||||||
With the LTSC servicing model, customers can delay receiving feature updates and instead only receive monthly quality updates on devices. Features from Windows 10 that could be updated with new functionality, including Cortana, Edge, and all in-box Universal Windows apps, are also not included. Feature updates are offered in new LTSC releases every 2–3 years instead of every 6 months, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. Microsoft is committed to providing bug fixes and security patches for each LTSC release during this 10 year period.
|
With the LTSC servicing model, customers can delay receiving feature updates and instead only receive monthly quality updates on devices. Features from Windows 10 that could be updated with new functionality, including Cortana, Edge, and all in-box Universal Windows apps, are also not included. Feature updates are offered in new LTSC releases every 2–3 years instead of every 6 months, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. Microsoft is committed to providing bug fixes and security patches for each LTSC release during this 10 year period.
|
||||||
|
|
||||||
>[!IMPORTANT]
|
>[!IMPORTANT]
|
||||||
>The Long Term Servicing Channel is not intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides customers with access to a deployment option for their special-purpose devices and environments. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC does not change for the lifetime of the release, over time there might be some external tools that do not continue to provide legacy support. See [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181).
|
>The Long Term Servicing Channel is not intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides customers with access to a deployment option for their special-purpose devices and environments. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC does not change for the lifetime of the release, over time there might be some external tools that do not continue to provide legacy support. See [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181).
|
||||||
|
|
||||||
For detailed information about Windows 10 servicing, see [Overview of Windows as a service](/windows/deployment/update/waas-overview).
|
For detailed information about Windows 10 servicing, see [Overview of Windows as a service](/windows/deployment/update/waas-overview).
|
||||||
|
|
||||||
## See Also
|
## See Also
|
||||||
|
|
||||||
[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.<br>
|
[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.<br>
|
||||||
[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option.
|
[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option.
|
||||||
|
|||||||
@ -1,298 +1,298 @@
|
|||||||
---
|
---
|
||||||
title: What's new in Windows 10 Enterprise 2015 LTSC
|
title: What's new in Windows 10 Enterprise 2015 LTSC
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
manager: laurawi
|
manager: laurawi
|
||||||
ms.author: greglin
|
ms.author: greglin
|
||||||
description: New and updated IT Pro content about new features in Windows 10 Enterprise 2015 LTSC (also known as Windows 10 Enterprise 2015 LTSB).
|
description: New and updated IT Pro content about new features in Windows 10 Enterprise 2015 LTSC (also known as Windows 10 Enterprise 2015 LTSB).
|
||||||
keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise 2015 LTSC"]
|
keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise 2015 LTSC"]
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: deploy
|
ms.mktglfcycl: deploy
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
author: greg-lindsay
|
audience: itpro
author: greg-lindsay
|
||||||
ms.localizationpriority: low
|
ms.localizationpriority: low
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# What's new in Windows 10 Enterprise 2015 LTSC
|
# What's new in Windows 10 Enterprise 2015 LTSC
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
- Windows 10 Enterprise 2015 LTSC
|
- Windows 10 Enterprise 2015 LTSC
|
||||||
|
|
||||||
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise 2015 LTSC (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md).
|
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise 2015 LTSC (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md).
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>Features in Windows 10 Enterprise 2015 LTSC are equivalent to [Windows 10, version 1507](../whats-new-windows-10-version-1507-and-1511.md).
|
>Features in Windows 10 Enterprise 2015 LTSC are equivalent to [Windows 10, version 1507](../whats-new-windows-10-version-1507-and-1511.md).
|
||||||
|
|
||||||
## Deployment
|
## Deployment
|
||||||
|
|
||||||
### Provisioning devices using Windows Imaging and Configuration Designer (ICD)
|
### Provisioning devices using Windows Imaging and Configuration Designer (ICD)
|
||||||
|
|
||||||
With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Using Windows Provisioning, an IT administrator can easily specify the configuration and settings required to enroll devices into management using a wizard-driven user interface, and then apply this configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers.
|
With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Using Windows Provisioning, an IT administrator can easily specify the configuration and settings required to enroll devices into management using a wizard-driven user interface, and then apply this configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers.
|
||||||
|
|
||||||
[Learn more about provisioning in Windows 10](/windows/configuration/provisioning-packages/provisioning-packages)
|
[Learn more about provisioning in Windows 10](/windows/configuration/provisioning-packages/provisioning-packages)
|
||||||
|
|
||||||
## Security
|
## Security
|
||||||
|
|
||||||
### Applocker
|
### Applocker
|
||||||
|
|
||||||
Applocker was available for Windows 8.1, and is improved with Windows 10. See [Requirements to use AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md) for a list of operating system requirements.
|
Applocker was available for Windows 8.1, and is improved with Windows 10. See [Requirements to use AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md) for a list of operating system requirements.
|
||||||
|
|
||||||
Enhancements to Applocker in Windows 10 include:
|
Enhancements to Applocker in Windows 10 include:
|
||||||
|
|
||||||
- A new parameter was added to the [New-AppLockerPolicy](https://technet.microsoft.com/library/hh847211.aspx) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**.
|
- A new parameter was added to the [New-AppLockerPolicy](https://technet.microsoft.com/library/hh847211.aspx) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**.
|
||||||
- A new [AppLocker](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server.
|
- A new [AppLocker](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server.
|
||||||
- You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx).
|
- You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx).
|
||||||
|
|
||||||
[Learn how to manage AppLocker within your organization](/windows/device-security/applocker/applocker-overview).
|
[Learn how to manage AppLocker within your organization](/windows/device-security/applocker/applocker-overview).
|
||||||
|
|
||||||
### Bitlocker
|
### Bitlocker
|
||||||
|
|
||||||
Enhancements to Applocker in Windows 10 include:
|
Enhancements to Applocker in Windows 10 include:
|
||||||
|
|
||||||
- **Encrypt and recover your device with Azure Active Directory**. In addition to using a Microsoft Account, automatic [Device Encryption](https://technet.microsoft.com/itpro/windows/keep-secure/windows-10-security-guide#device-encryption) can now encrypt your devices that are joined to an Azure Active Directory domain. When the device is encrypted, the BitLocker recovery key is automatically escrowed to Azure Active Directory. This will make it easier to recover your BitLocker key online.
|
- **Encrypt and recover your device with Azure Active Directory**. In addition to using a Microsoft Account, automatic [Device Encryption](https://technet.microsoft.com/itpro/windows/keep-secure/windows-10-security-guide#device-encryption) can now encrypt your devices that are joined to an Azure Active Directory domain. When the device is encrypted, the BitLocker recovery key is automatically escrowed to Azure Active Directory. This will make it easier to recover your BitLocker key online.
|
||||||
- **DMA port protection**. You can use the [DataProtection/AllowDirectMemoryAccess](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#dataprotection-allowdirectmemoryaccess) MDM policy to block DMA ports when the device is starting up. Also, when a device is locked, all unused DMA ports are turned off, but any devices that are already plugged into a DMA port will continue to work. When the device is unlocked, all DMA ports are turned back on.
|
- **DMA port protection**. You can use the [DataProtection/AllowDirectMemoryAccess](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#dataprotection-allowdirectmemoryaccess) MDM policy to block DMA ports when the device is starting up. Also, when a device is locked, all unused DMA ports are turned off, but any devices that are already plugged into a DMA port will continue to work. When the device is unlocked, all DMA ports are turned back on.
|
||||||
- **New Group Policy for configuring pre-boot recovery**. You can now configure the pre-boot recovery message and recover URL that is shown on the pre-boot recovery screen. For more info, see the [Configure pre-boot recovery message and URL](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-group-policy-settings#bkmk-configurepreboot) section in "BitLocker Group Policy settings."
|
- **New Group Policy for configuring pre-boot recovery**. You can now configure the pre-boot recovery message and recover URL that is shown on the pre-boot recovery screen. For more info, see the [Configure pre-boot recovery message and URL](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-group-policy-settings#bkmk-configurepreboot) section in "BitLocker Group Policy settings."
|
||||||
|
|
||||||
[Learn how to deploy and manage BitLocker within your organization](/windows/device-security/bitlocker/bitlocker-overview).
|
[Learn how to deploy and manage BitLocker within your organization](/windows/device-security/bitlocker/bitlocker-overview).
|
||||||
|
|
||||||
### Certificate management
|
### Certificate management
|
||||||
|
|
||||||
For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](https://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile)
|
For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](https://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile)
|
||||||
|
|
||||||
### Microsoft Passport
|
### Microsoft Passport
|
||||||
|
|
||||||
In Windows 10, [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) replaces passwords with strong two-factor authentication that consists of an enrolled device and a Windows Hello (biometric) or PIN.
|
In Windows 10, [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) replaces passwords with strong two-factor authentication that consists of an enrolled device and a Windows Hello (biometric) or PIN.
|
||||||
|
|
||||||
Microsoft Passport lets users authenticate to a Microsoft account, an Active Directory account, a Microsoft Azure Active Directory (AD) account, or non-Microsoft service that supports Fast ID Online (FIDO) authentication. After an initial two-step verification during Microsoft Passport enrollment, a Microsoft Passport is set up on the user's device and the user sets a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify identity; Windows then uses Microsoft Passport to authenticate users and help them to access protected resources and services.
|
Microsoft Passport lets users authenticate to a Microsoft account, an Active Directory account, a Microsoft Azure Active Directory (AD) account, or non-Microsoft service that supports Fast ID Online (FIDO) authentication. After an initial two-step verification during Microsoft Passport enrollment, a Microsoft Passport is set up on the user's device and the user sets a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify identity; Windows then uses Microsoft Passport to authenticate users and help them to access protected resources and services.
|
||||||
|
|
||||||
### Security auditing
|
### Security auditing
|
||||||
|
|
||||||
In Windows 10, security auditing has added some improvements:
|
In Windows 10, security auditing has added some improvements:
|
||||||
- [New audit subcategories](#bkmk-auditsubcat)
|
- [New audit subcategories](#bkmk-auditsubcat)
|
||||||
- [More info added to existing audit events](#bkmk-moreinfo)
|
- [More info added to existing audit events](#bkmk-moreinfo)
|
||||||
|
|
||||||
#### <a href="" id="bkmk-auditsubcat"></a>New audit subcategories
|
#### <a href="" id="bkmk-auditsubcat"></a>New audit subcategories
|
||||||
|
|
||||||
In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events:
|
In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events:
|
||||||
- [Audit Group Membership](/windows/device-security/auditing/audit-group-membership) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the logon session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource.
|
- [Audit Group Membership](/windows/device-security/auditing/audit-group-membership) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the logon session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource.
|
||||||
When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. Multiple events are generated if the group membership information cannot fit in a single security audit event.
|
When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. Multiple events are generated if the group membership information cannot fit in a single security audit event.
|
||||||
- [Audit PNP Activity](/windows/device-security/auditing/audit-pnp-activity) Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device.
|
- [Audit PNP Activity](/windows/device-security/auditing/audit-pnp-activity) Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device.
|
||||||
Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play.
|
Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play.
|
||||||
A PnP audit event can be used to track down changes in system hardware and will be logged on the PC where the change took place. A list of hardware vendor IDs are included in the event.
|
A PnP audit event can be used to track down changes in system hardware and will be logged on the PC where the change took place. A list of hardware vendor IDs are included in the event.
|
||||||
|
|
||||||
#### <a href="" id="bkmk-moreinfo"></a>More info added to existing audit events
|
#### <a href="" id="bkmk-moreinfo"></a>More info added to existing audit events
|
||||||
|
|
||||||
With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events:
|
With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events:
|
||||||
- [Changed the kernel default audit policy](#bkmk-kdal)
|
- [Changed the kernel default audit policy](#bkmk-kdal)
|
||||||
- [Added a default process SACL to LSASS.exe](#bkmk-lsass)
|
- [Added a default process SACL to LSASS.exe](#bkmk-lsass)
|
||||||
- [Added new fields in the logon event](#bkmk-logon)
|
- [Added new fields in the logon event](#bkmk-logon)
|
||||||
- [Added new fields in the process creation event](#bkmk-logon)
|
- [Added new fields in the process creation event](#bkmk-logon)
|
||||||
- [Added new Security Account Manager events](#bkmk-sam)
|
- [Added new Security Account Manager events](#bkmk-sam)
|
||||||
- [Added new BCD events](#bkmk-bcd)
|
- [Added new BCD events](#bkmk-bcd)
|
||||||
- [Added new PNP events](#bkmk-pnp)
|
- [Added new PNP events](#bkmk-pnp)
|
||||||
|
|
||||||
#### <a href="" id="bkmk-kdal"></a>Changed the kernel default audit policy
|
#### <a href="" id="bkmk-kdal"></a>Changed the kernel default audit policy
|
||||||
|
|
||||||
In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts.
|
In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts.
|
||||||
|
|
||||||
#### <a href="" id="bkmk-lsass"></a>Added a default process SACL to LSASS.exe
|
#### <a href="" id="bkmk-lsass"></a>Added a default process SACL to LSASS.exe
|
||||||
|
|
||||||
In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**.
|
In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**.
|
||||||
This can help identify attacks that steal credentials from the memory of a process.
|
This can help identify attacks that steal credentials from the memory of a process.
|
||||||
|
|
||||||
#### <a href="" id="bkmk-logon"></a>New fields in the logon event
|
#### <a href="" id="bkmk-logon"></a>New fields in the logon event
|
||||||
|
|
||||||
The logon event ID 4624 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4624:
|
The logon event ID 4624 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4624:
|
||||||
1. **MachineLogon** String: yes or no
|
1. **MachineLogon** String: yes or no
|
||||||
If the account that logged into the PC is a computer account, this field will be yes. Otherwise, the field is no.
|
If the account that logged into the PC is a computer account, this field will be yes. Otherwise, the field is no.
|
||||||
2. **ElevatedToken** String: yes or no
|
2. **ElevatedToken** String: yes or no
|
||||||
If the account that logged into the PC is an administrative logon, this field will be yes. Otherwise, the field is no. Additionally, if this is part of a split token, the linked login ID (LSAP\_LOGON\_SESSION) will also be shown.
|
If the account that logged into the PC is an administrative logon, this field will be yes. Otherwise, the field is no. Additionally, if this is part of a split token, the linked login ID (LSAP\_LOGON\_SESSION) will also be shown.
|
||||||
3. **TargetOutboundUserName** String
|
3. **TargetOutboundUserName** String
|
||||||
**TargetOutboundUserDomain** String
|
**TargetOutboundUserDomain** String
|
||||||
The username and domain of the identity that was created by the LogonUser method for outbound traffic.
|
The username and domain of the identity that was created by the LogonUser method for outbound traffic.
|
||||||
4. **VirtualAccount** String: yes or no
|
4. **VirtualAccount** String: yes or no
|
||||||
If the account that logged into the PC is a virtual account, this field will be yes. Otherwise, the field is no.
|
If the account that logged into the PC is a virtual account, this field will be yes. Otherwise, the field is no.
|
||||||
5. **GroupMembership** String
|
5. **GroupMembership** String
|
||||||
A list of all of the groups in the user's token.
|
A list of all of the groups in the user's token.
|
||||||
6. **RestrictedAdminMode** String: yes or no
|
6. **RestrictedAdminMode** String: yes or no
|
||||||
If the user logs into the PC in restricted admin mode with Remote Desktop, this field will be yes.
|
If the user logs into the PC in restricted admin mode with Remote Desktop, this field will be yes.
|
||||||
For more info on restricted admin mode, see [Restricted Admin mode for RDP](http://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx).
|
For more info on restricted admin mode, see [Restricted Admin mode for RDP](http://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx).
|
||||||
|
|
||||||
#### <a href="" id="bkmk-process"></a>New fields in the process creation event
|
#### <a href="" id="bkmk-process"></a>New fields in the process creation event
|
||||||
|
|
||||||
The logon event ID 4688 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4688:
|
The logon event ID 4688 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4688:
|
||||||
1. **TargetUserSid** String
|
1. **TargetUserSid** String
|
||||||
The SID of the target principal.
|
The SID of the target principal.
|
||||||
2. **TargetUserName** String
|
2. **TargetUserName** String
|
||||||
The account name of the target user.
|
The account name of the target user.
|
||||||
3. **TargetDomainName** String
|
3. **TargetDomainName** String
|
||||||
The domain of the target user..
|
The domain of the target user..
|
||||||
4. **TargetLogonId** String
|
4. **TargetLogonId** String
|
||||||
The logon ID of the target user.
|
The logon ID of the target user.
|
||||||
5. **ParentProcessName** String
|
5. **ParentProcessName** String
|
||||||
The name of the creator process.
|
The name of the creator process.
|
||||||
6. **ParentProcessId** String
|
6. **ParentProcessId** String
|
||||||
A pointer to the actual parent process if it's different from the creator process.
|
A pointer to the actual parent process if it's different from the creator process.
|
||||||
|
|
||||||
#### <a href="" id="bkmk-sam"></a>New Security Account Manager events
|
#### <a href="" id="bkmk-sam"></a>New Security Account Manager events
|
||||||
|
|
||||||
In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited:
|
In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited:
|
||||||
- SamrEnumerateGroupsInDomain
|
- SamrEnumerateGroupsInDomain
|
||||||
- SamrEnumerateUsersInDomain
|
- SamrEnumerateUsersInDomain
|
||||||
- SamrEnumerateAliasesInDomain
|
- SamrEnumerateAliasesInDomain
|
||||||
- SamrGetAliasMembership
|
- SamrGetAliasMembership
|
||||||
- SamrLookupNamesInDomain
|
- SamrLookupNamesInDomain
|
||||||
- SamrLookupIdsInDomain
|
- SamrLookupIdsInDomain
|
||||||
- SamrQueryInformationUser
|
- SamrQueryInformationUser
|
||||||
- SamrQueryInformationGroup
|
- SamrQueryInformationGroup
|
||||||
- SamrQueryInformationUserAlias
|
- SamrQueryInformationUserAlias
|
||||||
- SamrGetMembersInGroup
|
- SamrGetMembersInGroup
|
||||||
- SamrGetMembersInAlias
|
- SamrGetMembersInAlias
|
||||||
- SamrGetUserDomainPasswordInformation
|
- SamrGetUserDomainPasswordInformation
|
||||||
|
|
||||||
#### <a href="" id="bkmk-bcd"></a>New BCD events
|
#### <a href="" id="bkmk-bcd"></a>New BCD events
|
||||||
|
|
||||||
Event ID 4826 has been added to track the following changes to the Boot Configuration Database (BCD):
|
Event ID 4826 has been added to track the following changes to the Boot Configuration Database (BCD):
|
||||||
- DEP/NEX settings
|
- DEP/NEX settings
|
||||||
- Test signing
|
- Test signing
|
||||||
- PCAT SB simulation
|
- PCAT SB simulation
|
||||||
- Debug
|
- Debug
|
||||||
- Boot debug
|
- Boot debug
|
||||||
- Integrity Services
|
- Integrity Services
|
||||||
- Disable Winload debugging menu
|
- Disable Winload debugging menu
|
||||||
|
|
||||||
#### <a href="" id="bkmk-pnp"></a>New PNP events
|
#### <a href="" id="bkmk-pnp"></a>New PNP events
|
||||||
|
|
||||||
Event ID 6416 has been added to track when an external device is detected through Plug and Play. One important scenario is if an external device that contains malware is inserted into a high-value machine that doesn’t expect this type of action, such as a domain controller.
|
Event ID 6416 has been added to track when an external device is detected through Plug and Play. One important scenario is if an external device that contains malware is inserted into a high-value machine that doesn’t expect this type of action, such as a domain controller.
|
||||||
|
|
||||||
[Learn how to manage your security audit policies within your organization](/windows/device-security/auditing/security-auditing-overview).
|
[Learn how to manage your security audit policies within your organization](/windows/device-security/auditing/security-auditing-overview).
|
||||||
|
|
||||||
### Trusted Platform Module
|
### Trusted Platform Module
|
||||||
|
|
||||||
#### New TPM features in Windows 10
|
#### New TPM features in Windows 10
|
||||||
|
|
||||||
The following sections describe the new and changed functionality in the TPM for Windows 10:
|
The following sections describe the new and changed functionality in the TPM for Windows 10:
|
||||||
- [Device health attestation](#bkmk-dha)
|
- [Device health attestation](#bkmk-dha)
|
||||||
- [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) support
|
- [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) support
|
||||||
- [Device Guard](/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies) support
|
- [Device Guard](/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies) support
|
||||||
- [Credential Guard](/windows/access-protection/credential-guard/credential-guard) support
|
- [Credential Guard](/windows/access-protection/credential-guard/credential-guard) support
|
||||||
|
|
||||||
### <a href="" id="bkmk-dha"></a>Device health attestation
|
### <a href="" id="bkmk-dha"></a>Device health attestation
|
||||||
|
|
||||||
Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device health attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource.
|
Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device health attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource.
|
||||||
Some things that you can check on the device are:
|
Some things that you can check on the device are:
|
||||||
- Is Data Execution Prevention supported and enabled?
|
- Is Data Execution Prevention supported and enabled?
|
||||||
- Is BitLocker Drive Encryption supported and enabled?
|
- Is BitLocker Drive Encryption supported and enabled?
|
||||||
- Is SecureBoot supported and enabled?
|
- Is SecureBoot supported and enabled?
|
||||||
|
|
||||||
> **Note** The device must be running Windows 10 and it must support at least TPM 2.0.
|
> **Note** The device must be running Windows 10 and it must support at least TPM 2.0.
|
||||||
|
|
||||||
[Learn how to deploy and manage TPM within your organization](/windows/device-security/tpm//trusted-platform-module-overview).
|
[Learn how to deploy and manage TPM within your organization](/windows/device-security/tpm//trusted-platform-module-overview).
|
||||||
|
|
||||||
### User Account Control
|
### User Account Control
|
||||||
|
|
||||||
User Account Control (UAC) helps prevent malware from damaging a computer and helps organizations deploy a better-managed desktop environment.
|
User Account Control (UAC) helps prevent malware from damaging a computer and helps organizations deploy a better-managed desktop environment.
|
||||||
|
|
||||||
You should not turn off UAC because this is not a supported scenario for devices running Windows 10. If you do turn off UAC, all Univeral Windows Platform apps stop working. You must always set the **HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA** registry value to 1. If you need to provide auto elevation for programmatic access or installation, you could set the **HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin** registry value to 0, which is the same as setting the UAC slider Never Notify. This is not recommended for devices running Windows 10.
|
You should not turn off UAC because this is not a supported scenario for devices running Windows 10. If you do turn off UAC, all Univeral Windows Platform apps stop working. You must always set the **HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA** registry value to 1. If you need to provide auto elevation for programmatic access or installation, you could set the **HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin** registry value to 0, which is the same as setting the UAC slider Never Notify. This is not recommended for devices running Windows 10.
|
||||||
|
|
||||||
For more info about how manage UAC, see [UAC Group Policy Settings and Registry Key Settings](/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings).
|
For more info about how manage UAC, see [UAC Group Policy Settings and Registry Key Settings](/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings).
|
||||||
|
|
||||||
In Windows 10, User Account Control has added some improvements:
|
In Windows 10, User Account Control has added some improvements:
|
||||||
|
|
||||||
- **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](https://msdn.microsoft.com/library/windows/desktop/dn889587.aspx) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked.
|
- **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](https://msdn.microsoft.com/library/windows/desktop/dn889587.aspx) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked.
|
||||||
|
|
||||||
[Learn how to manage User Account Control within your organization](/windows/access-protection/user-account-control/user-account-control-overview).
|
[Learn how to manage User Account Control within your organization](/windows/access-protection/user-account-control/user-account-control-overview).
|
||||||
|
|
||||||
### VPN profile options
|
### VPN profile options
|
||||||
|
|
||||||
Windows 10 provides a set of VPN features that both increase enterprise security and provide an improved user experience, including:
|
Windows 10 provides a set of VPN features that both increase enterprise security and provide an improved user experience, including:
|
||||||
|
|
||||||
- Always-on auto connection behavior
|
- Always-on auto connection behavior
|
||||||
- App=triggered VPN
|
- App=triggered VPN
|
||||||
- VPN traffic filters
|
- VPN traffic filters
|
||||||
- Lock down VPN
|
- Lock down VPN
|
||||||
- Integration with Microsoft Passport for Work
|
- Integration with Microsoft Passport for Work
|
||||||
|
|
||||||
[Learn more about the VPN options in Windows 10.](/windows/access-protection/vpn/vpn-profile-options)
|
[Learn more about the VPN options in Windows 10.](/windows/access-protection/vpn/vpn-profile-options)
|
||||||
|
|
||||||
|
|
||||||
## Management
|
## Management
|
||||||
|
|
||||||
Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices.
|
Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices.
|
||||||
|
|
||||||
### MDM support
|
### MDM support
|
||||||
|
|
||||||
MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more.
|
MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more.
|
||||||
|
|
||||||
MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification.
|
MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification.
|
||||||
|
|
||||||
Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=533172)
|
Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=533172)
|
||||||
|
|
||||||
### Unenrollment
|
### Unenrollment
|
||||||
|
|
||||||
When a person leaves your organization and you unenroll the user account or device from management, the enterprise-controlled configurations and apps are removed from the device. You can unenroll the device remotely or the person can unenroll by manually removing the account from the device.
|
When a person leaves your organization and you unenroll the user account or device from management, the enterprise-controlled configurations and apps are removed from the device. You can unenroll the device remotely or the person can unenroll by manually removing the account from the device.
|
||||||
|
|
||||||
When a personal device is unenrolled, the user's data and apps are untouched, while enterprise information such as certificates, VPN profiles, and enterprise apps are removed.
|
When a personal device is unenrolled, the user's data and apps are untouched, while enterprise information such as certificates, VPN profiles, and enterprise apps are removed.
|
||||||
|
|
||||||
### Infrastructure
|
### Infrastructure
|
||||||
|
|
||||||
Enterprises have the following identity and management choices.
|
Enterprises have the following identity and management choices.
|
||||||
|
|
||||||
| Area | Choices |
|
| Area | Choices |
|
||||||
|---|---|
|
|---|---|
|
||||||
| Identity | Active Directory; Azure AD |
|
| Identity | Active Directory; Azure AD |
|
||||||
| Grouping | Domain join; Workgroup; Azure AD join |
|
| Grouping | Domain join; Workgroup; Azure AD join |
|
||||||
| Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) |
|
| Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) |
|
||||||
|
|
||||||
> **Note**
|
> **Note**
|
||||||
With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512).
|
With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512).
|
||||||
|
|
||||||
|
|
||||||
### Device lockdown
|
### Device lockdown
|
||||||
|
|
||||||
|
|
||||||
Do you need a computer that can only do one thing? For example:
|
Do you need a computer that can only do one thing? For example:
|
||||||
|
|
||||||
- A device in the lobby that customers can use to view your product catalog.
|
- A device in the lobby that customers can use to view your product catalog.
|
||||||
- A portable device that drivers can use to check a route on a map.
|
- A portable device that drivers can use to check a route on a map.
|
||||||
- A device that a temporary worker uses to enter data.
|
- A device that a temporary worker uses to enter data.
|
||||||
|
|
||||||
You can configure a persistent locked down state to [create a kiosk-type device](https://technet.microsoft.com/itpro/windows/manage/set-up-a-device-for-anyone-to-use). When the locked-down account is logged on, the device displays only the app that you select.
|
You can configure a persistent locked down state to [create a kiosk-type device](https://technet.microsoft.com/itpro/windows/manage/set-up-a-device-for-anyone-to-use). When the locked-down account is logged on, the device displays only the app that you select.
|
||||||
|
|
||||||
You can also [configure a lockdown state](https://technet.microsoft.com/itpro/windows/manage/lock-down-windows-10-to-specific-apps) that takes effect when a given user account logs on. The lockdown restricts the user to only the apps that you specify.
|
You can also [configure a lockdown state](https://technet.microsoft.com/itpro/windows/manage/lock-down-windows-10-to-specific-apps) that takes effect when a given user account logs on. The lockdown restricts the user to only the apps that you specify.
|
||||||
|
|
||||||
Lockdown settings can also be configured for device look and feel, such as a theme or a [custom layout on the Start screen](https://technet.microsoft.com/itpro/windows/manage/windows-10-start-layout-options-and-policies).
|
Lockdown settings can also be configured for device look and feel, such as a theme or a [custom layout on the Start screen](https://technet.microsoft.com/itpro/windows/manage/windows-10-start-layout-options-and-policies).
|
||||||
|
|
||||||
### Customized Start layout
|
### Customized Start layout
|
||||||
|
|
||||||
A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Starting in Windows 10, version 1511, administrators can configure a *partial* Start layout, which applies specified tile groups while allowing users to create and customize their own tile groups. Learn how to [customize and export Start layout](/windows/configuration/customize-and-export-start-layout).
|
A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Starting in Windows 10, version 1511, administrators can configure a *partial* Start layout, which applies specified tile groups while allowing users to create and customize their own tile groups. Learn how to [customize and export Start layout](/windows/configuration/customize-and-export-start-layout).
|
||||||
|
|
||||||
Administrators can also use mobile device management (MDM) or Group Policy to disable the use of [Windows Spotlight on the lock screen](/windows/configuration/windows-spotlight).
|
Administrators can also use mobile device management (MDM) or Group Policy to disable the use of [Windows Spotlight on the lock screen](/windows/configuration/windows-spotlight).
|
||||||
|
|
||||||
## Updates
|
## Updates
|
||||||
|
|
||||||
Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service.
|
Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service.
|
||||||
|
|
||||||
By using [Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing:
|
By using [Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing:
|
||||||
|
|
||||||
- **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met).
|
- **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met).
|
||||||
|
|
||||||
- **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient.
|
- **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient.
|
||||||
|
|
||||||
- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](https://go.microsoft.com/fwlink/p/?LinkId=699281).
|
- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](https://go.microsoft.com/fwlink/p/?LinkId=699281).
|
||||||
|
|
||||||
Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](https://technet.microsoft.com/library/hh852345.aspx) and [System Center Configuration Manager](https://technet.microsoft.com/library/gg682129.aspx).
|
Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](https://technet.microsoft.com/library/hh852345.aspx) and [System Center Configuration Manager](https://technet.microsoft.com/library/gg682129.aspx).
|
||||||
|
|
||||||
|
|
||||||
Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
|
Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
|
||||||
|
|
||||||
For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates).
|
For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates).
|
||||||
|
|
||||||
## Microsoft Edge
|
## Microsoft Edge
|
||||||
|
|
||||||
Microsoft Edge is not available in the LTSC release of Windows 10.
|
Microsoft Edge is not available in the LTSC release of Windows 10.
|
||||||
|
|
||||||
## See Also
|
## See Also
|
||||||
|
|
||||||
[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release.
|
[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release.
|
||||||
|
|
||||||
|
|||||||
@ -1,178 +1,178 @@
|
|||||||
---
|
---
|
||||||
title: What's new in Windows 10 Enterprise 2016 LTSC
|
title: What's new in Windows 10 Enterprise 2016 LTSC
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
manager: laurawi
|
manager: laurawi
|
||||||
ms.author: greglin
|
ms.author: greglin
|
||||||
description: New and updated IT Pro content about new features in Windows 10 Enterprise 2016 LTSC (also known as Windows 10 Enterprise 2016 LTSB).
|
description: New and updated IT Pro content about new features in Windows 10 Enterprise 2016 LTSC (also known as Windows 10 Enterprise 2016 LTSB).
|
||||||
keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise 2016 LTSC"]
|
keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise 2016 LTSC"]
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: deploy
|
ms.mktglfcycl: deploy
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
author: greg-lindsay
|
audience: itpro
author: greg-lindsay
|
||||||
ms.localizationpriority: low
|
ms.localizationpriority: low
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# What's new in Windows 10 Enterprise 2016 LTSC
|
# What's new in Windows 10 Enterprise 2016 LTSC
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
- Windows 10 Enterprise 2016 LTSC
|
- Windows 10 Enterprise 2016 LTSC
|
||||||
|
|
||||||
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise 2016 LTSC (LTSB), compared to Windows 10 Enterprise 2015 LTSC (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md).
|
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise 2016 LTSC (LTSB), compared to Windows 10 Enterprise 2015 LTSC (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md).
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>Features in Windows 10 Enterprise 2016 LTSC are equivalent to Windows 10, version 1607.
|
>Features in Windows 10 Enterprise 2016 LTSC are equivalent to Windows 10, version 1607.
|
||||||
|
|
||||||
## Deployment
|
## Deployment
|
||||||
|
|
||||||
### Windows Imaging and Configuration Designer (ICD)
|
### Windows Imaging and Configuration Designer (ICD)
|
||||||
|
|
||||||
In previous versions of the Windows 10 Assessment and Deployment Kit (ADK), you had to install additional features for Windows ICD to run. Starting in this version of Windows 10, you can install just the configuration designer component independent of the rest of the imaging components. [Install the ADK.](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit)
|
In previous versions of the Windows 10 Assessment and Deployment Kit (ADK), you had to install additional features for Windows ICD to run. Starting in this version of Windows 10, you can install just the configuration designer component independent of the rest of the imaging components. [Install the ADK.](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit)
|
||||||
|
|
||||||
Windows ICD now includes simplified workflows for creating provisioning packages:
|
Windows ICD now includes simplified workflows for creating provisioning packages:
|
||||||
|
|
||||||
- [Simple provisioning to set up common settings for Active Directory-joined devices](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment)
|
- [Simple provisioning to set up common settings for Active Directory-joined devices](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment)
|
||||||
- [Advanced provisioning to deploy certificates and apps](/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates)
|
- [Advanced provisioning to deploy certificates and apps](/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates)
|
||||||
- [School provisioning to set up classroom devices for Active Directory](https://technet.microsoft.com/edu/windows/set-up-students-pcs-to-join-domain)
|
- [School provisioning to set up classroom devices for Active Directory](https://technet.microsoft.com/edu/windows/set-up-students-pcs-to-join-domain)
|
||||||
|
|
||||||
[Learn more about using provisioning packages in Windows 10.](/windows/configuration/provisioning-packages/provisioning-packages)
|
[Learn more about using provisioning packages in Windows 10.](/windows/configuration/provisioning-packages/provisioning-packages)
|
||||||
|
|
||||||
### Windows Upgrade Readiness
|
### Windows Upgrade Readiness
|
||||||
|
|
||||||
>[!IMPORTANT]
|
>[!IMPORTANT]
|
||||||
>Upgrade Readiness will not allow you to assess an upgrade to an LTSC release (LTSC builds are not available as target versions). However, you can enroll devices running LTSC to plan for an upgrade to a semi-annual channel release.
|
>Upgrade Readiness will not allow you to assess an upgrade to an LTSC release (LTSC builds are not available as target versions). However, you can enroll devices running LTSC to plan for an upgrade to a semi-annual channel release.
|
||||||
|
|
||||||
Microsoft developed Upgrade Readiness in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Upgrade Readiness was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10.
|
Microsoft developed Upgrade Readiness in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Upgrade Readiness was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10.
|
||||||
|
|
||||||
With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft.
|
With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft.
|
||||||
|
|
||||||
Use Upgrade Readiness to get:
|
Use Upgrade Readiness to get:
|
||||||
|
|
||||||
- A visual workflow that guides you from pilot to production
|
- A visual workflow that guides you from pilot to production
|
||||||
- Detailed computer and application inventory
|
- Detailed computer and application inventory
|
||||||
- Powerful computer level search and drill-downs
|
- Powerful computer level search and drill-downs
|
||||||
- Guidance and insights into application and driver compatibility issues, with suggested fixes
|
- Guidance and insights into application and driver compatibility issues, with suggested fixes
|
||||||
- Data driven application rationalization tools
|
- Data driven application rationalization tools
|
||||||
- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
|
- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
|
||||||
- Data export to commonly used software deployment tools
|
- Data export to commonly used software deployment tools
|
||||||
|
|
||||||
The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are upgrade-ready.
|
The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are upgrade-ready.
|
||||||
|
|
||||||
[Learn more about planning and managing Windows upgrades with Windows Upgrade Readiness.](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness)
|
[Learn more about planning and managing Windows upgrades with Windows Upgrade Readiness.](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness)
|
||||||
|
|
||||||
## Security
|
## Security
|
||||||
|
|
||||||
### Credential Guard and Device Guard
|
### Credential Guard and Device Guard
|
||||||
|
|
||||||
Isolated User Mode is now included with Hyper-V so you don't have to install it separately.
|
Isolated User Mode is now included with Hyper-V so you don't have to install it separately.
|
||||||
|
|
||||||
### Windows Hello for Business
|
### Windows Hello for Business
|
||||||
|
|
||||||
When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name in this version of Windows 10. Customers who have already deployed Microsoft Passport for Work will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics.
|
When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name in this version of Windows 10. Customers who have already deployed Microsoft Passport for Work will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics.
|
||||||
|
|
||||||
Additional changes for Windows Hello in Windows 10 Enterprise 2016 LTSC:
|
Additional changes for Windows Hello in Windows 10 Enterprise 2016 LTSC:
|
||||||
|
|
||||||
- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys.
|
- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys.
|
||||||
- Group Policy settings for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**.
|
- Group Policy settings for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**.
|
||||||
- Beginning in this version of Windows 10, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN, enable the Group Policy setting **Turn on convenience PIN sign-in**.
|
- Beginning in this version of Windows 10, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN, enable the Group Policy setting **Turn on convenience PIN sign-in**.
|
||||||
<!--- Users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser.-->
|
<!--- Users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser.-->
|
||||||
|
|
||||||
[Learn more about Windows Hello for Business.](/windows/access-protection/hello-for-business/hello-identity-verification)
|
[Learn more about Windows Hello for Business.](/windows/access-protection/hello-for-business/hello-identity-verification)
|
||||||
|
|
||||||
### Bitlocker
|
### Bitlocker
|
||||||
|
|
||||||
#### New Bitlocker features
|
#### New Bitlocker features
|
||||||
|
|
||||||
- **XTS-AES encryption algorithm**. BitLocker now supports the XTS-AES encryption algorithm. XTS-AES provides additional protection from a class of attacks on encryption that rely on manipulating cipher text to cause predictable changes in plain text. BitLocker supports both 128-bit and 256-bit XTS-AES keys.
|
- **XTS-AES encryption algorithm**. BitLocker now supports the XTS-AES encryption algorithm. XTS-AES provides additional protection from a class of attacks on encryption that rely on manipulating cipher text to cause predictable changes in plain text. BitLocker supports both 128-bit and 256-bit XTS-AES keys.
|
||||||
It provides the following benefits:
|
It provides the following benefits:
|
||||||
- The algorithm is FIPS-compliant.
|
- The algorithm is FIPS-compliant.
|
||||||
- Easy to administer. You can use the BitLocker Wizard, manage-bde, Group Policy, MDM policy, Windows PowerShell, or WMI to manage it on devices in your organization.
|
- Easy to administer. You can use the BitLocker Wizard, manage-bde, Group Policy, MDM policy, Windows PowerShell, or WMI to manage it on devices in your organization.
|
||||||
>**Note:** Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms.
|
>**Note:** Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms.
|
||||||
|
|
||||||
### Security auditing
|
### Security auditing
|
||||||
|
|
||||||
#### New Security auditing features
|
#### New Security auditing features
|
||||||
|
|
||||||
- The [WindowsSecurityAuditing](https://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](https://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices.
|
- The [WindowsSecurityAuditing](https://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](https://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices.
|
||||||
|
|
||||||
### Trusted Platform Module
|
### Trusted Platform Module
|
||||||
|
|
||||||
#### New TPM features
|
#### New TPM features
|
||||||
|
|
||||||
- Key Storage Providers (KSPs) and srvcrypt support elliptical curve cryptography (ECC).
|
- Key Storage Providers (KSPs) and srvcrypt support elliptical curve cryptography (ECC).
|
||||||
|
|
||||||
### Windows Information Protection (WIP), formerly known as enterprise data protection (EDP)
|
### Windows Information Protection (WIP), formerly known as enterprise data protection (EDP)
|
||||||
|
|
||||||
With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage.
|
With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage.
|
||||||
|
|
||||||
Windows Information Protection (WIP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. WIP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps.
|
Windows Information Protection (WIP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. WIP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps.
|
||||||
|
|
||||||
- [Create a Windows Information Protection (WIP) policy](https://technet.microsoft.com/itpro/windows/keep-secure/overview-create-wip-policy)
|
- [Create a Windows Information Protection (WIP) policy](https://technet.microsoft.com/itpro/windows/keep-secure/overview-create-wip-policy)
|
||||||
- [General guidance and best practices for Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/guidance-and-best-practices-wip)
|
- [General guidance and best practices for Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/guidance-and-best-practices-wip)
|
||||||
|
|
||||||
[Learn more about Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip)
|
[Learn more about Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip)
|
||||||
|
|
||||||
### Windows Defender
|
### Windows Defender
|
||||||
|
|
||||||
Several new features and management options have been added to Windows Defender in this version of Windows 10.
|
Several new features and management options have been added to Windows Defender in this version of Windows 10.
|
||||||
|
|
||||||
- [Windows Defender Offline in Windows 10](/windows/threat-protection/windows-defender-antivirus/windows-defender-offline) can be run directly from within Windows, without having to create bootable media.
|
- [Windows Defender Offline in Windows 10](/windows/threat-protection/windows-defender-antivirus/windows-defender-offline) can be run directly from within Windows, without having to create bootable media.
|
||||||
- [Use PowerShell cmdlets for Windows Defender](/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus) to configure options and run scans.
|
- [Use PowerShell cmdlets for Windows Defender](/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus) to configure options and run scans.
|
||||||
- [Enable the Block at First Sight feature in Windows 10](/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) to leverage the Windows Defender cloud for near-instant protection against new malware.
|
- [Enable the Block at First Sight feature in Windows 10](/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) to leverage the Windows Defender cloud for near-instant protection against new malware.
|
||||||
- [Configure enhanced notifications for Windows Defender in Windows 10](/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus) to see more information about threat detections and removal.
|
- [Configure enhanced notifications for Windows Defender in Windows 10](/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus) to see more information about threat detections and removal.
|
||||||
- [Run a Windows Defender scan from the command line](/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus).
|
- [Run a Windows Defender scan from the command line](/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus).
|
||||||
- [Detect and block Potentially Unwanted Applications with Windows Defender](/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus) during download and install times.
|
- [Detect and block Potentially Unwanted Applications with Windows Defender](/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus) during download and install times.
|
||||||
|
|
||||||
### Windows Defender Advanced Threat Protection (ATP)
|
### Windows Defender Advanced Threat Protection (ATP)
|
||||||
|
|
||||||
With the growing threat from more sophisticated targeted attacks, a new security solution is imperative in securing an increasingly complex network ecosystem. Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service, built into Windows 10 that enables enterprise customers detect, investigate, and respond to advanced threats on their networks.
|
With the growing threat from more sophisticated targeted attacks, a new security solution is imperative in securing an increasingly complex network ecosystem. Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service, built into Windows 10 that enables enterprise customers detect, investigate, and respond to advanced threats on their networks.
|
||||||
|
|
||||||
[Learn more about Windows Defender Advanced Threat Protection (ATP)](/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection).
|
[Learn more about Windows Defender Advanced Threat Protection (ATP)](/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection).
|
||||||
|
|
||||||
### VPN security
|
### VPN security
|
||||||
|
|
||||||
- The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Azure Active Directory, to provide a device compliance option for remote clients.
|
- The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Azure Active Directory, to provide a device compliance option for remote clients.
|
||||||
- The VPN client can integrate with Windows Information Protection (WIP) policy to provide additional security. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection.
|
- The VPN client can integrate with Windows Information Protection (WIP) policy to provide additional security. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection.
|
||||||
- New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [What's new in MDM enrollment and management](https://msdn.microsoft.com/library/windows/hardware/mt299056%28v=vs.85%29.aspx#whatsnew_1607)
|
- New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [What's new in MDM enrollment and management](https://msdn.microsoft.com/library/windows/hardware/mt299056%28v=vs.85%29.aspx#whatsnew_1607)
|
||||||
- Microsoft Intune: *VPN Profile (Windows 10 Desktop and Mobile and later)* policy template includes support for native VPN plug-ins.
|
- Microsoft Intune: *VPN Profile (Windows 10 Desktop and Mobile and later)* policy template includes support for native VPN plug-ins.
|
||||||
|
|
||||||
## Management
|
## Management
|
||||||
|
|
||||||
### Use Remote Desktop Connection for PCs joined to Azure Active Directory
|
### Use Remote Desktop Connection for PCs joined to Azure Active Directory
|
||||||
|
|
||||||
From its release, Windows 10 has supported remote connections to PCs that are joined to Active Directory. Starting in this version of Windows 10, you can also connect to a remote PC that is joined to Azure Active Directory (Azure AD). [Learn about the requirements and supported configurations.](/windows/client-management/connect-to-remote-aadj-pc)
|
From its release, Windows 10 has supported remote connections to PCs that are joined to Active Directory. Starting in this version of Windows 10, you can also connect to a remote PC that is joined to Azure Active Directory (Azure AD). [Learn about the requirements and supported configurations.](/windows/client-management/connect-to-remote-aadj-pc)
|
||||||
|
|
||||||
### Taskbar configuration
|
### Taskbar configuration
|
||||||
|
|
||||||
Enterprise administrators can add and remove pinned apps from the taskbar. Users can pin apps, unpin apps, and change the order of pinned apps on the taskbar after the enterprise configuration is applied. [Learn how to configure the taskbar.](/windows/configuration/windows-10-start-layout-options-and-policies)
|
Enterprise administrators can add and remove pinned apps from the taskbar. Users can pin apps, unpin apps, and change the order of pinned apps on the taskbar after the enterprise configuration is applied. [Learn how to configure the taskbar.](/windows/configuration/windows-10-start-layout-options-and-policies)
|
||||||
|
|
||||||
### Mobile device management and configuration service providers (CSPs)
|
### Mobile device management and configuration service providers (CSPs)
|
||||||
|
|
||||||
Numerous settings have been added to the Windows 10 CSPs to expand MDM capabilities for managing devices. To learn more about the specific changes in MDM policies for this version of Windows 10, see [What's new in MDM enrollment and management](https://msdn.microsoft.com/library/windows/hardware/mt299056%28v=vs.85%29.aspx#whatsnew_1607).
|
Numerous settings have been added to the Windows 10 CSPs to expand MDM capabilities for managing devices. To learn more about the specific changes in MDM policies for this version of Windows 10, see [What's new in MDM enrollment and management](https://msdn.microsoft.com/library/windows/hardware/mt299056%28v=vs.85%29.aspx#whatsnew_1607).
|
||||||
|
|
||||||
### Shared PC mode
|
### Shared PC mode
|
||||||
|
|
||||||
This version of Windows 10, introduces shared PC mode, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Education, and Enterprise. [Learn how to set up a shared or guest PC.](/windows/configuration/set-up-shared-or-guest-pc)
|
This version of Windows 10, introduces shared PC mode, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Education, and Enterprise. [Learn how to set up a shared or guest PC.](/windows/configuration/set-up-shared-or-guest-pc)
|
||||||
|
|
||||||
### Application Virtualization (App-V) for Windows 10
|
### Application Virtualization (App-V) for Windows 10
|
||||||
|
|
||||||
Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points, including the Microsoft Store, and interact with them as if they were installed locally.
|
Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points, including the Microsoft Store, and interact with them as if they were installed locally.
|
||||||
|
|
||||||
With the release of this version of Windows 10, App-V is included with the Windows 10 for Enterprise edition. If you are new to Windows 10 and App-V or if you're upgrading from a previous version of App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users.
|
With the release of this version of Windows 10, App-V is included with the Windows 10 for Enterprise edition. If you are new to Windows 10 and App-V or if you're upgrading from a previous version of App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users.
|
||||||
|
|
||||||
[Learn how to deliver virtual applications with App-V.](/windows/application-management/app-v/appv-getting-started)
|
[Learn how to deliver virtual applications with App-V.](/windows/application-management/app-v/appv-getting-started)
|
||||||
|
|
||||||
### User Experience Virtualization (UE-V) for Windows 10
|
### User Experience Virtualization (UE-V) for Windows 10
|
||||||
|
|
||||||
Many users customize their settings for Windows and for specific applications. Customizable Windows settings include Microsoft Store appearance, language, background picture, font size, and accent colors. Customizable application settings include language, appearance, behavior, and user interface options.
|
Many users customize their settings for Windows and for specific applications. Customizable Windows settings include Microsoft Store appearance, language, background picture, font size, and accent colors. Customizable application settings include language, appearance, behavior, and user interface options.
|
||||||
|
|
||||||
With User Experience Virtualization (UE-V), you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.
|
With User Experience Virtualization (UE-V), you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.
|
||||||
|
|
||||||
With the release of this version of Windows 10, UE-V is included with the Windows 10 for Enterprise edition. If you are new to Windows 10 and UE-V or upgrading from a previous version of UE-V, you’ll need to download, activate, and install server- and client-side components to start synchronizing user-customized settings across devices.
|
With the release of this version of Windows 10, UE-V is included with the Windows 10 for Enterprise edition. If you are new to Windows 10 and UE-V or upgrading from a previous version of UE-V, you’ll need to download, activate, and install server- and client-side components to start synchronizing user-customized settings across devices.
|
||||||
|
|
||||||
[Learn how to synchronize user-customized settings with UE-V.](/windows/configuration/ue-v/uev-for-windows)
|
[Learn how to synchronize user-customized settings with UE-V.](/windows/configuration/ue-v/uev-for-windows)
|
||||||
|
|
||||||
## See Also
|
## See Also
|
||||||
|
|
||||||
[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release.
|
[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release.
|
||||||
|
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
8
windows/whats-new/metadata.ps1
Normal file
8
windows/whats-new/metadata.ps1
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
$files = Get-ChildItem . *.md -rec
|
||||||
|
foreach ($file in $files)
|
||||||
|
{
|
||||||
|
(Get-Content $file.PSPath) |
|
||||||
|
Foreach-Object { $_ -replace "author: greg-lindsay", "audience: itpro`rauthor: greg-lindsay" } |
|
||||||
|
Set-Content $file.PSPath
|
||||||
|
$file.PSPath
|
||||||
|
}
|
||||||
@ -1,151 +1,151 @@
|
|||||||
---
|
---
|
||||||
title: What's new in Windows 10, version 1903
|
title: What's new in Windows 10, version 1903
|
||||||
description: New and updated IT Pro content about new features in Windows 10, version 1903 (also known as the Windows 10 May 2019 Update).
|
description: New and updated IT Pro content about new features in Windows 10, version 1903 (also known as the Windows 10 May 2019 Update).
|
||||||
keywords: ["What's new in Windows 10", "Windows 10", "May 2019 Update"]
|
keywords: ["What's new in Windows 10", "Windows 10", "May 2019 Update"]
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: deploy
|
ms.mktglfcycl: deploy
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
author: greg-lindsay
|
audience: itpro
author: greg-lindsay
|
||||||
manager: laurawi
|
manager: laurawi
|
||||||
ms.localizationpriority: high
|
ms.localizationpriority: high
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# What's new in Windows 10, version 1903 IT Pro content
|
# What's new in Windows 10, version 1903 IT Pro content
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
- Windows 10, version 1903
|
- Windows 10, version 1903
|
||||||
|
|
||||||
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809.
|
This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809.
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>New disk space requirement for Windows 10, version 1903 applies only to OEMs for the manufacture of new PCs. This new requirement does not apply to existing devices. PCs that don’t meet new device disk space requirements will continue to receive updates and the 1903 update will require about the same amount of free disk space as previous updates. For more information, see [Reserved storage](#reserved-storage).
|
>New disk space requirement for Windows 10, version 1903 applies only to OEMs for the manufacture of new PCs. This new requirement does not apply to existing devices. PCs that don’t meet new device disk space requirements will continue to receive updates and the 1903 update will require about the same amount of free disk space as previous updates. For more information, see [Reserved storage](#reserved-storage).
|
||||||
|
|
||||||
## Deployment
|
## Deployment
|
||||||
|
|
||||||
### Windows Autopilot
|
### Windows Autopilot
|
||||||
|
|
||||||
[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. The following Windows Autopilot features are available in Windows 10, version 1903 and later:
|
[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. The following Windows Autopilot features are available in Windows 10, version 1903 and later:
|
||||||
|
|
||||||
- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in this version of Windows. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users.
|
- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in this version of Windows. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users.
|
||||||
- The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions.
|
- The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions.
|
||||||
- [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs.
|
- [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs.
|
||||||
- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE.
|
- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE.
|
||||||
- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE.
|
- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE.
|
||||||
|
|
||||||
### Windows 10 Subscription Activation
|
### Windows 10 Subscription Activation
|
||||||
|
|
||||||
Windows 10 Education support has been added to Windows 10 Subscription Activation.
|
Windows 10 Education support has been added to Windows 10 Subscription Activation.
|
||||||
|
|
||||||
With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation).
|
With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation).
|
||||||
|
|
||||||
### SetupDiag
|
### SetupDiag
|
||||||
|
|
||||||
[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) version 1.4.1 is available.
|
[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) version 1.4.1 is available.
|
||||||
|
|
||||||
SetupDiag is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available.
|
SetupDiag is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available.
|
||||||
|
|
||||||
### Reserved storage
|
### Reserved storage
|
||||||
|
|
||||||
[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327): Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage will be enabled automatically on new PCs with Windows 10, version 1903 pre-installed, and for clean installs. It will not be enabled when updating from a previous version of Windows 10.
|
[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327): Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage will be enabled automatically on new PCs with Windows 10, version 1903 pre-installed, and for clean installs. It will not be enabled when updating from a previous version of Windows 10.
|
||||||
|
|
||||||
## Servicing
|
## Servicing
|
||||||
|
|
||||||
- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with System Center Configuration Manager content coming soon!
|
- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with System Center Configuration Manager content coming soon!
|
||||||
- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed.
|
- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed.
|
||||||
- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period.
|
- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period.
|
||||||
- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally.
|
- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally.
|
||||||
- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again.
|
- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again.
|
||||||
- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar.
|
- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar.
|
||||||
- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns.
|
- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns.
|
||||||
- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions.
|
- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions.
|
||||||
|
|
||||||
## Security
|
## Security
|
||||||
|
|
||||||
### Windows Information Protection
|
### Windows Information Protection
|
||||||
|
|
||||||
With this release, Windows Defender ATP extends discovery and protection of sensitive information with [Auto Labeling](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels#how-wip-protects-automatically-classified-files).
|
With this release, Windows Defender ATP extends discovery and protection of sensitive information with [Auto Labeling](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels#how-wip-protects-automatically-classified-files).
|
||||||
|
|
||||||
### Security configuration framework
|
### Security configuration framework
|
||||||
|
|
||||||
With this release of Windows 10, Microsoft is introducing a [new taxonomy for security configurations](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework), called the **SECCON framework**, comprised of 5 device security configurations.
|
With this release of Windows 10, Microsoft is introducing a [new taxonomy for security configurations](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework), called the **SECCON framework**, comprised of 5 device security configurations.
|
||||||
|
|
||||||
### Security baseline for Windows 10 and Windows Server
|
### Security baseline for Windows 10 and Windows Server
|
||||||
|
|
||||||
The draft release of the [security configuration baseline settings](https://blogs.technet.microsoft.com/secguide/2019/04/24/security-baseline-draft-for-windows-10-v1903-and-windows-server-v1903/) for Windows 10, version 1903 and for Windows Server version 1903 is available.
|
The draft release of the [security configuration baseline settings](https://blogs.technet.microsoft.com/secguide/2019/04/24/security-baseline-draft-for-windows-10-v1903-and-windows-server-v1903/) for Windows 10, version 1903 and for Windows Server version 1903 is available.
|
||||||
|
|
||||||
### Intune security baselines
|
### Intune security baselines
|
||||||
|
|
||||||
[Intune Security Baselines](https://docs.microsoft.com/intune/security-baselines) (Preview): Now includes many settings supported by Intune that you can use to help secure and protect your users and devices. You can automatically set these settings to values recommended by security teams.
|
[Intune Security Baselines](https://docs.microsoft.com/intune/security-baselines) (Preview): Now includes many settings supported by Intune that you can use to help secure and protect your users and devices. You can automatically set these settings to values recommended by security teams.
|
||||||
|
|
||||||
### Microsoft Defender Advanced Threat Protection (ATP):
|
### Microsoft Defender Advanced Threat Protection (ATP):
|
||||||
|
|
||||||
- [Attack surface area reduction](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) – IT admins can configure devices with advanced web protection that enables them to define allow and deny lists for specific URL’s and IP addresses.
|
- [Attack surface area reduction](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) – IT admins can configure devices with advanced web protection that enables them to define allow and deny lists for specific URL’s and IP addresses.
|
||||||
- [Next generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) – Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage.
|
- [Next generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) – Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage.
|
||||||
- Integrity enforcement capabilities – Enable remote runtime attestation of Windows 10 platform.
|
- Integrity enforcement capabilities – Enable remote runtime attestation of Windows 10 platform.
|
||||||
- Tamper-proofing capabilities – Uses virtualization-based security to isolate critical ATP security capabilities away from the OS and attackers.
|
- Tamper-proofing capabilities – Uses virtualization-based security to isolate critical ATP security capabilities away from the OS and attackers.
|
||||||
- [Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) – In addition to Windows 10, Windows Defender ATP’s functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities.
|
- [Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) – In addition to Windows 10, Windows Defender ATP’s functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities.
|
||||||
|
|
||||||
### Microsoft Defender ATP next-gen protection technologies:
|
### Microsoft Defender ATP next-gen protection technologies:
|
||||||
|
|
||||||
- **Advanced machine learning**: Improved with advanced machine learning and AI models that enable it to protect against apex attackers using innovative vulnerability exploit techniques, tools and malware.
|
- **Advanced machine learning**: Improved with advanced machine learning and AI models that enable it to protect against apex attackers using innovative vulnerability exploit techniques, tools and malware.
|
||||||
- **Emergency outbreak protection**: Provides emergency outbreak protection which will automatically update devices with new intelligence when a new outbreak has been detected.
|
- **Emergency outbreak protection**: Provides emergency outbreak protection which will automatically update devices with new intelligence when a new outbreak has been detected.
|
||||||
- **Certified ISO 27001 compliance**: Ensures that the cloud service has analyzed for threats, vulnerabilities and impacts, and that risk management and security controls are in place.
|
- **Certified ISO 27001 compliance**: Ensures that the cloud service has analyzed for threats, vulnerabilities and impacts, and that risk management and security controls are in place.
|
||||||
- **Geolocation support**: Support geolocation and sovereignty of sample data as well as configurable retention policies.
|
- **Geolocation support**: Support geolocation and sovereignty of sample data as well as configurable retention policies.
|
||||||
|
|
||||||
### Threat Protection
|
### Threat Protection
|
||||||
|
|
||||||
- [Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849): Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device.
|
- [Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849): Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device.
|
||||||
- [Microphone privacy settings](https://support.microsoft.com/en-us/help/4468232/windows-10-camera-microphone-and-privacy-microsoft-privacy): A microphone icon appears in the notification area letting you see which apps are using your microphone.
|
- [Microphone privacy settings](https://support.microsoft.com/en-us/help/4468232/windows-10-camera-microphone-and-privacy-microsoft-privacy): A microphone icon appears in the notification area letting you see which apps are using your microphone.
|
||||||
|
|
||||||
- [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements:
|
- [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements:
|
||||||
- Standalone users can install and configure their Windows Defender Application Guard settings without needing to change Registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior.
|
- Standalone users can install and configure their Windows Defender Application Guard settings without needing to change Registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior.
|
||||||
- WDAG is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend WDAG’s browser isolation technology beyond Microsoft Edge. In the latest release, users can install the WDAG extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigations to the WDAG Edge browser. There is also a companion app to enable this feature in the Microsoft Store. Users can quickly launch WDAG from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates.
|
- WDAG is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend WDAG’s browser isolation technology beyond Microsoft Edge. In the latest release, users can install the WDAG extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigations to the WDAG Edge browser. There is also a companion app to enable this feature in the Microsoft Store. Users can quickly launch WDAG from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates.
|
||||||
|
|
||||||
To try this extension:
|
To try this extension:
|
||||||
1. Configure WDAG policies on your device.
|
1. Configure WDAG policies on your device.
|
||||||
2. Go to the Chrome Web Store or Firefox Add-ons and search for Application Guard. Install the extension.
|
2. Go to the Chrome Web Store or Firefox Add-ons and search for Application Guard. Install the extension.
|
||||||
3. Follow any additional configuration steps on the extension setup page.
|
3. Follow any additional configuration steps on the extension setup page.
|
||||||
4. Reboot the device.
|
4. Reboot the device.
|
||||||
5. Navigate to an untrusted site in Chrome and Firefox.
|
5. Navigate to an untrusted site in Chrome and Firefox.
|
||||||
|
|
||||||
- WDAG allows dynamic navigation: Application Guard now allows users to navigate back to their default host browser from the WDAG Microsoft Edge. Previously, users browsing in WDAG Edge would see an error page when they try to go to a trusted site within the container browser. With this new feature, users will automatically be redirected to their host default browser when they enter or click on a trusted site in WDAG Edge. This feature is also available in Windows 10, version 1803 or later with the latest updates.
|
- WDAG allows dynamic navigation: Application Guard now allows users to navigate back to their default host browser from the WDAG Microsoft Edge. Previously, users browsing in WDAG Edge would see an error page when they try to go to a trusted site within the container browser. With this new feature, users will automatically be redirected to their host default browser when they enter or click on a trusted site in WDAG Edge. This feature is also available in Windows 10, version 1803 or later with the latest updates.
|
||||||
|
|
||||||
- [Windows Defender Application Control (WDAC)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903 WDAC has a number of new features that light up key scenarios and provide feature parity with AppLocker.
|
- [Windows Defender Application Control (WDAC)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903 WDAC has a number of new features that light up key scenarios and provide feature parity with AppLocker.
|
||||||
- [Multiple Policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): WDAC now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side-by-side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new ‘supplemental’ policy.
|
- [Multiple Policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): WDAC now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side-by-side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new ‘supplemental’ policy.
|
||||||
- [Path-Based Rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that are not user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it is authorized by something other than a path rule like a signer or hash rule.<br>
|
- [Path-Based Rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that are not user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it is authorized by something other than a path rule like a signer or hash rule.<br>
|
||||||
This brings WDAC to functionality parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that is not available with AppLocker.
|
This brings WDAC to functionality parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that is not available with AppLocker.
|
||||||
- [Allow COM Object Registration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, WDAC enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy.
|
- [Allow COM Object Registration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, WDAC enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy.
|
||||||
|
|
||||||
#### System Guard
|
#### System Guard
|
||||||
|
|
||||||
[System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) has added a new feature in this version of Windows called **SMM Firmware Measurement**. This feature is built on top of [System Guard Secure Launch](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) to check that the System Management Mode (SMM) firmware on the device is operating in a healthy manner - specifically, OS memory and secrets are protected from SMM. There are currently no devices out there with compatible hardware, but they will be coming out in the next few months.
|
[System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) has added a new feature in this version of Windows called **SMM Firmware Measurement**. This feature is built on top of [System Guard Secure Launch](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) to check that the System Management Mode (SMM) firmware on the device is operating in a healthy manner - specifically, OS memory and secrets are protected from SMM. There are currently no devices out there with compatible hardware, but they will be coming out in the next few months.
|
||||||
|
|
||||||
This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly:
|
This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Identity Protection
|
### Identity Protection
|
||||||
|
|
||||||
- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD.
|
- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD.
|
||||||
- [Streamlined Windows Hello PIN reset experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web.
|
- [Streamlined Windows Hello PIN reset experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web.
|
||||||
- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience!
|
- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience!
|
||||||
- [Remote Desktop with Biometrics](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session.
|
- [Remote Desktop with Biometrics](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session.
|
||||||
|
|
||||||
### Security management
|
### Security management
|
||||||
|
|
||||||
- [Windows Defender Firewall now supports Windows Subsystem for Linux (WSL)](https://blogs.windows.com/windowsexperience/2018/04/19/announcing-windows-10-insider-preview-build-17650-for-skip-ahead/#II14f7VlSBcZ0Gs4.97): Lets you add rules for WSL process, just like for Windows processes.
|
- [Windows Defender Firewall now supports Windows Subsystem for Linux (WSL)](https://blogs.windows.com/windowsexperience/2018/04/19/announcing-windows-10-insider-preview-build-17650-for-skip-ahead/#II14f7VlSBcZ0Gs4.97): Lets you add rules for WSL process, just like for Windows processes.
|
||||||
- [Windows Security app](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center) improvements now include Protection history, including detailed and easier to understand information about threats and available actions, Controlled Folder Access blocks are now in the Protection history, Windows Defender Offline Scanning tool actions, and any pending recommendations.
|
- [Windows Security app](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center) improvements now include Protection history, including detailed and easier to understand information about threats and available actions, Controlled Folder Access blocks are now in the Protection history, Windows Defender Offline Scanning tool actions, and any pending recommendations.
|
||||||
- [Tamper Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection) lets you prevent others from tampering with important security features.
|
- [Tamper Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection) lets you prevent others from tampering with important security features.
|
||||||
|
|
||||||
## Microsoft Edge
|
## Microsoft Edge
|
||||||
|
|
||||||
Several new features are coming in the next version of Edge. See the [news from Build 2019](https://blogs.windows.com/msedgedev/2019/05/06/edge-chromium-build-2019-pwa-ie-mode-devtools/#2QJF4u970WjQ2Sv7.97) for more information.
|
Several new features are coming in the next version of Edge. See the [news from Build 2019](https://blogs.windows.com/msedgedev/2019/05/06/edge-chromium-build-2019-pwa-ie-mode-devtools/#2QJF4u970WjQ2Sv7.97) for more information.
|
||||||
|
|
||||||
## See Also
|
## See Also
|
||||||
|
|
||||||
[What's New in Windows Server, version 1903](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1903): New and updated features in Windows Server.<br>
|
[What's New in Windows Server, version 1903](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1903): New and updated features in Windows Server.<br>
|
||||||
[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features.<br>
|
[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features.<br>
|
||||||
[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.<br>
|
[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.<br>
|
||||||
[What's new in Windows 10](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.<br>
|
[What's new in Windows 10](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.<br>
|
||||||
[What's new in Windows 10 for developers](https://blogs.windows.com/buildingapps/2019/04/18/start-developing-on-windows-10-may-2019-update-today/#2Lp8FUFQ3Jm8KVcq.97): New and updated features in Windows 10 that are of interest to developers.
|
[What's new in Windows 10 for developers](https://blogs.windows.com/buildingapps/2019/04/18/start-developing-on-windows-10-may-2019-update-today/#2Lp8FUFQ3Jm8KVcq.97): New and updated features in Windows 10 that are of interest to developers.
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user