From 56390591163a4f8feae9ca6d4feb3c22f0f33c8a Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Mon, 10 Jun 2024 08:03:17 -0700
Subject: [PATCH 001/165] recall-optin-9067947
---
windows/client-management/manage-recall.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 2db4f4d49a..405f37736f 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -3,7 +3,7 @@ title: Manage Recall for Windows clients
description: Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features.
ms.topic: how-to
ms.subservice: windows-copilot
-ms.date: 05/23/2024
+ms.date: 06/10/2024
ms.author: mstewart
author: mestew
ms.collection:
From 001c8142868fac73ae4e75ac86cf1ff9e3f5b045 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 21 Jun 2024 12:32:50 -0700
Subject: [PATCH 002/165] recall-optin-edits
---
windows/client-management/manage-recall.md | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 32048d9f76..6057299aa0 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -3,11 +3,7 @@ title: Manage Recall for Windows clients
description: Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features.
ms.topic: how-to
ms.subservice: windows-copilot
-<<<<<<< HEAD
-ms.date: 06/10/2024
-=======
ms.date: 06/13/2024
->>>>>>> be66e0d390a2bd3ff7f8dc15bad31b9119d6c553
ms.author: mstewart
author: mestew
ms.collection:
@@ -22,17 +18,18 @@ appliesto:
>**Looking for consumer information?** See [Retrace your steps with Recall](https://support.microsoft.com/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c).
-Recall allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Recall takes snapshots of your screen and stores them in a timeline. Snapshots are taken every five seconds while content on the screen is different from the previous snapshot. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language.
+Recall allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Windows periodically saves snapshots of your screen while the content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language.
> [!NOTE]
> Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs).
-When Recall opens the snapshot a user selected, it enables screenray, which runs on top of the saved snapshot. Screenray analyzes what's in the snapshot and allows users to interact with individual elements in the snapshot. For instance, users can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
+When Recall opens the snapshot you selected, it enables screenray, which runs on top of the saved snapshot. Screenray analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
:::image type="content" source="images/8908044-recall.png" alt-text="Screenshot of Recall with search results displayed for a query about a restaurant that the user's friend sent them." lightbox="images/8908044-recall.png":::
## System requirements
-Recall has the following minimum system requirements:
+
+Recall has the following minimum hardware requirements:
- A [Copilot+ PC](https://www.microsoft.com/windows/business/devices/copilot-plus-pcs#copilot-plus-pcs)
- 16 GB RAM
@@ -41,6 +38,10 @@ Recall has the following minimum system requirements:
- To enable Recall, you need at least 50 GB of space free
- Snapshot capture automatically pauses once the device has less than 25 GB of disk space
+Recall has the following software requirements:
+
+Recall takes advantage of just in time decryption protected by [Windows Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). To allow Windows to take snapshots, and to launch and use Recall, users must authenticate using [Windows Hello](/windows/security/identity-protection/hello-for-business/). Users need to enroll into Windows Hello with at least one biometric sign-in option enabled, either facial recognition or a fingerprint. The user's search index database for Recall is also encrypted.
+
## Supported browsers
Users need a supported browser for Recall to [filter websites](#user-controlled-settings-for-recall) and to automatically filter private browsing activity. Supported browsers, and their capabilities include:
@@ -63,7 +64,11 @@ Organizations that aren't ready to use AI for historical analysis can disable it
## Limitations
-In two specific scenarios, Recall captures snapshots that include InPrivate windows, blocked apps, and blocked websites. If Recall gets launched, or the **Now** option is selected in Recall, then a snapshot is taken even when InPrivate windows, blocked apps, and blocked websites are displayed. However, Recall doesn't save these snapshots. If you choose to send the information from this snapshot to another app, a temp file is created in `C:\Users\[username]\AppData\Local\Temp` to share the content. The temporary file is deleted once the content is transferred over the app you selected to use.
+In two specific scenarios, Windows captures snapshots that include private browsing windows, blocked apps, and blocked websites. If Recall gets launched, or the **Now** option is selected in Recall, then a snapshot is taken even when private browsing windows, blocked apps, and blocked websites are displayed. However, Recall doesn't save these snapshots. If users choose to send the information from this snapshot to another app, a temp file is created to share the content in either:
+- `C:\Users\[username]\AppData\Local\Temp`
+- `C:\Users\{username}\AppData\Local\Packages\MicrosoftWindows.Client.AIX_cw5n1h2txyewy\TempState`
+
+The temporary file is deleted once the app is finished with the content.
## User controlled settings for Recall
From 8729c36f93ebc6973c00016d6111b5c06cd03f5f Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 25 Jun 2024 11:01:37 -0700
Subject: [PATCH 003/165] edits
---
windows/client-management/manage-recall.md | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 6057299aa0..7dc3ca2345 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -3,7 +3,7 @@ title: Manage Recall for Windows clients
description: Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features.
ms.topic: how-to
ms.subservice: windows-copilot
-ms.date: 06/13/2024
+ms.date: 07/01/2024
ms.author: mstewart
author: mestew
ms.collection:
@@ -23,7 +23,7 @@ Recall allows you to search across time to find the content you need. Just descr
> [!NOTE]
> Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs).
-When Recall opens the snapshot you selected, it enables screenray, which runs on top of the saved snapshot. Screenray analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
+When Recall opens a snapshot you selected, it enables screenray, which runs on top of the saved snapshot. Screenray analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
:::image type="content" source="images/8908044-recall.png" alt-text="Screenshot of Recall with search results displayed for a query about a restaurant that the user's friend sent them." lightbox="images/8908044-recall.png":::
@@ -40,7 +40,7 @@ Recall has the following minimum hardware requirements:
Recall has the following software requirements:
-Recall takes advantage of just in time decryption protected by [Windows Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). To allow Windows to take snapshots, and to launch and use Recall, users must authenticate using [Windows Hello](/windows/security/identity-protection/hello-for-business/). Users need to enroll into Windows Hello with at least one biometric sign-in option enabled, either facial recognition or a fingerprint. The user's search index database for Recall is also encrypted.
+Recall takes advantage of just in time decryption protected by [Windows Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). To allow Windows to take snapshots, and to launch and use Recall, users must authenticate using [Windows Hello](/windows/security/identity-protection/hello-for-business/). Users need to enroll into Windows Hello with at least one biometric sign-in option enabled, either facial recognition or a fingerprint. The user's search index database for Recall is also encrypted and BitLocker is enabled by default on Windows 11. Each time Recall is launched it requires the user to confirm their identity before it opens and before snapshots are accessed.
## Supported browsers
@@ -55,7 +55,9 @@ Users need a supported browser for Recall to [filter websites](#user-controlled-
## Configure policies for Recall
-Organizations that aren't ready to use AI for historical analysis can disable it until they're ready with the **Turn off saving snapshots for Windows** policy. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. The following policy allows you to disable analysis of user content:
+Organizations that aren't ready to use AI for historical analysis can disable it until they're ready with the **Turn off saving snapshots for Windows** policy. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. Administrators can't enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent.
+
+The following policy allows you to disable analysis of user content:
| | Setting |
|---|---|
@@ -74,6 +76,7 @@ The temporary file is deleted once the app is finished with the content.
The following options are user controlled in Recall from the **Settings** > **Privacy & Security** > **Recall & Snapshots** page:
+- Allow Windows to save snapshots
- Website filtering
- App filtering
- Storage allocation
From 2f71a9fb2343e1c693fe018f7b5b393c8236e228 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 25 Jun 2024 11:11:39 -0700
Subject: [PATCH 004/165] edits
---
windows/client-management/manage-recall.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 7dc3ca2345..725e23ae70 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -50,7 +50,7 @@ Users need a supported browser for Recall to [filter websites](#user-controlled-
- **Firefox**: blocks websites and filters private browsing activity
- **Opera**: blocks websites and filters private browsing activity
- **Google Chrome**: blocks websites and filters private browsing activity
-- **Chromium based browsers** (124 or later): For Chromium-based browsers not listed above, filters private browsing activity only, doesn't block specific websites
+- **Chromium based browsers** (124 or later): For Chromium-based browsers not listed, filters private browsing activity only, doesn't block specific websites
## Configure policies for Recall
From 1d9714a1e1b72456fa92250b1bf98ed26d905008 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Wed, 26 Jun 2024 15:54:44 -0700
Subject: [PATCH 005/165] add vdi apps
---
windows/client-management/manage-recall.md | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 725e23ae70..d62b8f3016 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -85,6 +85,13 @@ The following options are user controlled in Recall from the **Settings** > **Pr
- Delete all snapshots
- Delete snapshots within a specific time frame
+Windows won't save snapshots when certain applications are being used. The following apps are automatically excluded:
+
+- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
+- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect) (Remote desktop from the Microsoft Store is saved in snapshots)
+- [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows) (Azure Virtual Desktop apps from the Microsoft Store are saved in snapshots)
+- [remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows
+
### Storage allocation
From 0f190f8ea669aea9b7513d8e3641e2d949215f7e Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Wed, 26 Jun 2024 15:57:22 -0700
Subject: [PATCH 006/165] add vdi apps
---
windows/client-management/manage-recall.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index d62b8f3016..cb082e6d18 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -85,7 +85,7 @@ The following options are user controlled in Recall from the **Settings** > **Pr
- Delete all snapshots
- Delete snapshots within a specific time frame
-Windows won't save snapshots when certain applications are being used. The following apps are automatically excluded:
+Windows won't save snapshots when certain applications are being used. The following apps are automatically excluded:
- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect) (Remote desktop from the Microsoft Store is saved in snapshots)
From fbfc831829d34b2afec251cc3ac68fbe688a2545 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Wed, 26 Jun 2024 15:59:32 -0700
Subject: [PATCH 007/165] add vdi apps
---
windows/client-management/manage-recall.md | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index cb082e6d18..a048bf8f48 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -88,8 +88,10 @@ The following options are user controlled in Recall from the **Settings** > **Pr
Windows won't save snapshots when certain applications are being used. The following apps are automatically excluded:
- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
-- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect) (Remote desktop from the Microsoft Store is saved in snapshots)
-- [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows) (Azure Virtual Desktop apps from the Microsoft Store are saved in snapshots)
+- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
+ - Remote desktop from the Microsoft Store is saved in snapshots, add it to the app filtering list to prevent this
+- [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows)
+ - Azure Virtual Desktop apps from the Microsoft Store are saved in snapshots, add them to the app filtering list to prevent this
- [remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows
From 8b72b80b32a4668a2a987ee2ae38c4fcb0084d84 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Wed, 26 Jun 2024 16:01:24 -0700
Subject: [PATCH 008/165] add vdi apps
---
windows/client-management/manage-recall.md | 2 ++
1 file changed, 2 insertions(+)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index a048bf8f48..57064b3b76 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -85,6 +85,8 @@ The following options are user controlled in Recall from the **Settings** > **Pr
- Delete all snapshots
- Delete snapshots within a specific time frame
+### Applications that are excluded from snapshots
+
Windows won't save snapshots when certain applications are being used. The following apps are automatically excluded:
- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
From 16efc6181450c6dc8ae5ec0f9a6a6639c0459478 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Mon, 1 Jul 2024 14:36:11 -0700
Subject: [PATCH 009/165] recall
---
windows/client-management/manage-recall.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 57064b3b76..a319539a66 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -91,7 +91,7 @@ Windows won't save snapshots when certain applications are being used. The follo
- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
- - Remote desktop from the Microsoft Store is saved in snapshots, add it to the app filtering list to prevent this
+ - Microsoft Remote Desktop from the Microsoft Store is saved in snapshots, add it to the app filtering list to prevent this
- [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows)
- Azure Virtual Desktop apps from the Microsoft Store are saved in snapshots, add them to the app filtering list to prevent this
- [remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows
From 59dc4d30fd929ba35642710ff13ba7d44f6b2241 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Mon, 23 Sep 2024 10:39:01 -0700
Subject: [PATCH 010/165] metadata
---
windows/client-management/manage-recall.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index a319539a66..c27f147e7a 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -3,7 +3,7 @@ title: Manage Recall for Windows clients
description: Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features.
ms.topic: how-to
ms.subservice: windows-copilot
-ms.date: 07/01/2024
+ms.date: 09/23/2024
ms.author: mstewart
author: mestew
ms.collection:
From deae3a807fd1cc16b4149cf5e9c22447d2506a03 Mon Sep 17 00:00:00 2001
From: Harman Thind <63820404+hathin@users.noreply.github.com>
Date: Tue, 15 Oct 2024 11:32:12 -0700
Subject: [PATCH 011/165] Update windows-autopatch-post-reg-readiness-checks.md
Hermes v2 is being introduced. Added the new name Windows Autopatch Client Broker, to go along with v1 until v1 is later deprecated. Some customers will have both apps (until v1 is deprecated), and others with newly registered devices will only have v2 app @tiaraquan FYI
---
.../windows-autopatch-post-reg-readiness-checks.md | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md
index c5f450553f..c4a299bb50 100644
--- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md
+++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md
@@ -36,7 +36,7 @@ Device readiness in Windows Autopatch is divided into two different scenarios:
### Device readiness checks available for each scenario
-| Required device readiness (prerequisite checks) before device registration (powered by Intune Graph API) | Required post-device registration readiness checks (powered by Microsoft Cloud Managed Desktop Extension) |
+| Required device readiness (prerequisite checks) before device registration (powered by Intune Graph API) | Required post-device registration readiness checks (powered by Microsoft Cloud Managed Desktop Extension and Windows Autopatch Client Broker) |
| ----- | ----- |
| - Windows OS (build, architecture, and edition)
- Managed by either Intune or ConfigMgr co-management
- ConfigMgr co-management workloads
- Last communication with Intune
- Personal or non-Windows devices
| - Windows OS (build, architecture, and edition)
- Windows updates & Office Group Policy Object (GPO) versus Intune mobile device management (MDM) policy conflict
- Bind network endpoints (Microsoft Defender, Microsoft Teams, Microsoft Edge, Microsoft Office)
- Internet connectivity
|
@@ -66,7 +66,7 @@ A healthy or active device in Windows Autopatch is:
- Actively sending data
- Passes all post-device registration readiness checks
-The post-device registration readiness checks are powered by the **Microsoft Cloud Managed Desktop Extension**. It's installed right after devices are successfully registered with Windows Autopatch. The **Microsoft Cloud Managed Desktop Extension** has the Device Readiness Check Plugin. The Device Readiness Check Plugin is responsible for performing the readiness checks and reporting the results back to the service. The **Microsoft Cloud Managed Desktop Extension** is a subcomponent of the overall Windows Autopatch service.
+The post-device registration readiness checks are powered by the **Microsoft Cloud Managed Desktop Extension**. It's installed right after devices are successfully registered with Windows Autopatch. The **Microsoft Cloud Managed Desktop Extension** and **Windows Autopatch Client Broker** has the Device Readiness Check Plugin. The Device Readiness Check Plugin is responsible for performing the readiness checks and reporting the results back to the service. The **Microsoft Cloud Managed Desktop Extension** and **Windows Autopatch Client Broker** are subcomponents of the overall Windows Autopatch service.
The following list of post-device registration readiness checks is performed in Windows Autopatch:
@@ -90,8 +90,8 @@ See the following diagram for the post-device registration readiness checks work
| Step | Description |
| ----- | ----- |
| **Steps 1-7** | For more information, see the [Device registration overview diagram](windows-autopatch-device-registration-overview.md).|
-| **Step 8: Perform readiness checks** |- Once devices are successfully registered with Windows Autopatch, the devices are added to the **Ready** tab.
- The Microsoft Cloud Managed Desktop Extension agent performs readiness checks against devices in the **Ready** tab every 24 hours.
|
-| **Step 9: Check readiness status** |- The Microsoft Cloud Managed Desktop Extension service evaluates the readiness results gathered by its agent.
- The readiness results are sent from the Microsoft Cloud Managed Desktop Extension service component to the Device Readiness component within the Windows Autopatch's service.
|
+| **Step 8: Perform readiness checks** |- Once devices are successfully registered with Windows Autopatch, the devices are added to the **Ready** tab.
- The Microsoft Cloud Managed Desktop Extension and Windows Autopatch Client Broker agents perform readiness checks against devices in the **Ready** tab every 24 hours.
|
+| **Step 9: Check readiness status** |- The Microsoft Cloud Managed Desktop Extension and Windows Autopatch Client Broker service evaluates the readiness results gathered by its agent.
- The readiness results are sent from the Microsoft Cloud Managed Desktop Extension and Windows Autopatch Client Broker service component to the Device Readiness component within the Windows Autopatch's service.
|
| **Step 10: Add devices to the Not ready** | When devices don't pass one or more readiness checks, even if they're registered with Windows Autopatch, they're added to the **Not ready** tab so IT admins can remediate devices based on Windows Autopatch recommendations. |
| **Step 11: IT admin understands what the issue is and remediates** | The IT admin checks and remediates issues in the Devices blade (**Not ready** tab). It can take up to 24 hours for devices to show in the **Ready** tab. |
@@ -99,7 +99,7 @@ See the following diagram for the post-device registration readiness checks work
| Question | Answer |
| ----- | ----- |
-| **How frequent are the post-device registration readiness checks performed?** |- The **Microsoft Cloud Managed Desktop Extension** agent collects device readiness statuses when it runs (once a day).
- Once the agent collects results for the post-device registration readiness checks, it generates readiness results in the device in the `%programdata%\Microsoft\CMDExtension\Plugins\DeviceReadinessPlugin\Logs\DRCResults.json.log`.
- The readiness results are sent over to the **Microsoft Cloud Managed Desktop Extension service**.
- The **Microsoft Cloud Managed Desktop Extension** service component sends the readiness results to the Device Readiness component. The results appear in the Windows Autopatch Devices blade (**Not ready** tab).
|
+| **How frequent are the post-device registration readiness checks performed?** |- The **Microsoft Cloud Managed Desktop Extension** and **Windows Autopatch Client Broker** agents collect device readiness statuses when it runs (once a day).
- Once the agent collects results for the post-device registration readiness checks, it generates readiness results in the device in the `%programdata%\Microsoft\CMDExtension\Plugins\DeviceReadinessPlugin\Logs\DRCResults.json.log`.
- The readiness results are sent over to **Microsoft Cloud Managed Desktop Extension** and **Windows Autopatch Client Broker** service.
- The **Microsoft Cloud Managed Desktop Extension** and **Windows Autopatch Client Broker** service component sends the readiness results to the Device Readiness component. The results appear in the Windows Autopatch Devices blade (**Not ready** tab).
|
| **What to expect when one or more checks fail?** | Devices are automatically sent to the **Ready** tab once they're successfully registered with Windows Autopatch. When devices don't meet one or more post-device registration readiness checks, the devices are moved to the **Not ready** tab. IT admins can learn about these devices and take appropriate actions to remediate them. Windows Autopatch provides information about the failure and how to potentially remediate devices.Once devices are remediated, it can take up to **24 hours** to appear in the **Ready** tab.
|
## Additional resources
From 8334cb420a640b1f8c0c567dbd01ca11ba09c156 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 5 Nov 2024 10:49:49 -0800
Subject: [PATCH 012/165] edits
---
windows/client-management/manage-recall.md | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index c27f147e7a..0a2671aa36 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -3,7 +3,7 @@ title: Manage Recall for Windows clients
description: Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features.
ms.topic: how-to
ms.subservice: windows-copilot
-ms.date: 09/23/2024
+ms.date: 10/14/2024
ms.author: mstewart
author: mestew
ms.collection:
@@ -18,12 +18,16 @@ appliesto:
>**Looking for consumer information?** See [Retrace your steps with Recall](https://support.microsoft.com/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c).
-Recall allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Windows periodically saves snapshots of your screen while the content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language.
+Recall (preview) allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Snapshots are taken periodically while content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language.
+
+By default, Recall is removed from commercially managed devices except for devices running Windows Home edition. IT admins, on their own, can't enable Recall for users. Recall is an opt-in experience that requires user consent to save snapshots. Users can choose to enable or disable Recall at any time. IT admins can only give users the option to enable snapshots and configure certain policies for Recall.
> [!NOTE]
-> Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs).
+> - Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs).
+> - For Copilot+ PCs that are running Windows Insiders, Recall (preview) is now available. For more information, see [](https://aka.ms/windowsinsiders).
+> - Recall is optimized for select languages (English, Chinese (simplified), French, German, Japanese, and Spanish. Content-based and storage limitations apply. For more information, see https://aka.ms/nextgenaipcs.
-When Recall opens a snapshot you selected, it enables screenray, which runs on top of the saved snapshot. Screenray analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
+When Recall opens a snapshot you selected, it enables Click to Do, which runs on top of the saved snapshot. Click to Do analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
:::image type="content" source="images/8908044-recall.png" alt-text="Screenshot of Recall with search results displayed for a query about a restaurant that the user's friend sent them." lightbox="images/8908044-recall.png":::
From 7ce7c54743e98fd3a50c84a4dbdaf7a8d03a7d87 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 5 Nov 2024 14:52:49 -0500
Subject: [PATCH 013/165] updates to WH description
---
.../identity-protection/hello-for-business/index.md | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/index.md b/windows/security/identity-protection/hello-for-business/index.md
index e838ad5167..fda6d64688 100644
--- a/windows/security/identity-protection/hello-for-business/index.md
+++ b/windows/security/identity-protection/hello-for-business/index.md
@@ -15,10 +15,13 @@ ms.date: 04/23/2024
The following table lists the main authentication and security differences between Windows Hello and Windows Hello for business:
-||Windows Hello for Business|Windows Hello|
+||Windows Hello|Windows Hello for Business|
|-|-|-|
-|**Authentication**|Users can authenticate to:
- A Microsoft Entra ID account
- An Active Directory account
- Identity provider (IdP) or relying party (RP) services that support [Fast ID Online (FIDO) v2.0](https://fidoalliance.org/) authentication.|Users can authenticate to:
- A Microsoft account
- Identity provider (IdP) or relying party (RP) services that support [Fast ID Online (FIDO) v2.0](https://fidoalliance.org/) authentication.|
-|**Security**|It uses **key-based** or **certificate-based** authentication. There's no symmetric secret (password) which can be stolen from a server or phished from a user and used remotely.
Enhanced security is available on devices with a Trusted Platform Module (TPM).|Users can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Windows Hello is unique to the device on which it's set up, but can use a password hash depending on the account type. This configuration isn't backed by asymmetric (public/private key) or certificate-based authentication.|
+|**Authentication**|Users can authenticate to:
- A Microsoft account (MSA)
- Identity providers (IdPs) that support [Fast ID Online (FIDO) v2.0](https://fidoalliance.org/) authentication|Users can authenticate to:
- A Microsoft Entra ID account
- An Active Directory account
- Identity provider (IdP) or relying party (RP) services that support [Fast ID Online (FIDO) v2.0](https://fidoalliance.org/) authentication|
+|**Security**|It uses **key-based** authentication.
There's no symmetric secret (password) which can be stolen from a server or phished from a user and used remotely. |It uses **key-based** or **certificate-based** authentication.
There's no symmetric secret (password) which can be stolen from a server or phished from a user and used remotely.|
+
+> [!IMPORTANT]
+> Although Windows Hello can be used with local accounts, it doesn't offer the same level of security as key-based or certificate-based authentication. For enhanced security, it's recommended to use Windows Hello with a Microsoft account (MSA) or identity providers (IdPs) that support FIDO2 authentication.
> [!NOTE]
> FIDO2 (Fast Identity Online) authentication is an open standard for passwordless authentication. It allows users to sign in to their devices and apps using biometric authentication or a physical security key, without the need for a traditional password. FIDO2 support in Windows Hello for Business provides an additional layer of security and convenience for users, while also reducing the risk of password-related attacks.
@@ -52,7 +55,7 @@ On devices that support Windows Hello, an easy biometric gesture unlocks users'
- **Facial recognition**: this type of biometric recognition uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors offer external cameras that incorporate this technology, and many laptop manufacturers incorporate it into their devices
- **Fingerprint recognition**: this type of biometric recognition uses a capacitive fingerprint sensor to scan your fingerprint. Most existing fingerprint readers work with Windows, whether they're external or integrated into laptops or USB keyboards
-- **Iris Recognition**: this type of biometric recognition uses cameras to perform scan of your iris. HoloLens 2 is the first Microsoft device to introduce an Iris scanner
+- **Iris Recognition**: this type of biometric recognition uses cameras to perform scan of your iris
Windows stores biometric data that is used to implement Windows Hello securely on the local device only. The biometric data doesn't roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there's no single collection point an attacker can compromise to steal biometric data.
From 8d0cbac176535d37bba5b0b2c4d7b5d29dbd7a25 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 5 Nov 2024 15:14:16 -0800
Subject: [PATCH 014/165] edits
---
windows/client-management/manage-recall.md | 66 +++++++++++++---------
1 file changed, 40 insertions(+), 26 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 0a2671aa36..86d4320950 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -1,6 +1,6 @@
---
title: Manage Recall for Windows clients
-description: Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features.
+description: Learn how to manage Recall for commercial environments and about Recall features.
ms.topic: how-to
ms.subservice: windows-copilot
ms.date: 10/14/2024
@@ -18,22 +18,43 @@ appliesto:
>**Looking for consumer information?** See [Retrace your steps with Recall](https://support.microsoft.com/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c).
-Recall (preview) allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Snapshots are taken periodically while content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language.
-
-By default, Recall is removed from commercially managed devices except for devices running Windows Home edition. IT admins, on their own, can't enable Recall for users. Recall is an opt-in experience that requires user consent to save snapshots. Users can choose to enable or disable Recall at any time. IT admins can only give users the option to enable snapshots and configure certain policies for Recall.
+Recall (preview) allows users to search locally saved and locally analyzed snapshots of their screen using natural language. By default, Recall is removed from commercially managed devices except for devices running Windows Home edition. IT admins, on their own, can't enable Recall for users. Recall is an opt-in experience that requires user consent to save snapshots. Users can choose to enable or disable Recall at any time. IT admins can only give users the option to enable snapshots and configure certain policies for Recall. This article provides information about Recall and how to manage it in a commercial environment.
> [!NOTE]
> - Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs).
-> - For Copilot+ PCs that are running Windows Insiders, Recall (preview) is now available. For more information, see [](https://aka.ms/windowsinsiders).
-> - Recall is optimized for select languages (English, Chinese (simplified), French, German, Japanese, and Spanish. Content-based and storage limitations apply. For more information, see https://aka.ms/nextgenaipcs.
+> - For Copilot+ PCs that are running Windows Insiders, Recall (preview) is now available. For more information, see [**Placeholder WIP Blog link**>](https://aka.ms/windowsinsiders).
+> - Recall is optimized for select languages English, Chinese (simplified), French, German, Japanese, and Spanish. Content-based and storage limitations apply. For more information, see https://aka.ms/nextgenaipcs.
-When Recall opens a snapshot you selected, it enables Click to Do, which runs on top of the saved snapshot. Click to Do analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
+## What is Recall?
+
+Recall (preview) allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Snapshots are taken periodically while content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language.
+
+When Recall opens a snapshot you selected, it enables Click to Do, which runs on top of the saved snapshot. Click to Do analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
:::image type="content" source="images/8908044-recall.png" alt-text="Screenshot of Recall with search results displayed for a query about a restaurant that the user's friend sent them." lightbox="images/8908044-recall.png":::
+### Recall security and privacy architecture
+
+We built privacy and security into Recall's design from the ground up. With Copilot+ PCs, you get powerful AI that runs locally on the device. No internet or cloud connections are required or used to save and analyze snapshots. Snapshots aren't sent to Microsoft. Recall AI processing occurs locally, and snapshots are securely stored on the local device only.
+
+Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. Recall requires users to confirm their identity with [Windows Hello](https://support.microsoft.com/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0) before it launches and before accessing snapshots. At least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall. Before snapshots start getting saved the device, users need to open Recall and authenticate. Recall takes advantage of just in time decryption protected by Windows [Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). Snapshots and any associated information in the vector database are always encrypted. Encryption keys are protected via Trusted Platform Module (TPM), which is tied to the user's Windows Hello ESS identity, and can be used by operations within a secure environment called a [Virtualization-based Security Enclave (VBS Enclave)](/windows/win32/trusted-execution/vbs-enclaves). This means that other users can't access these keys and thus can't decrypt this information. Device Encryption or BitLocker are enabled by default on Windows 11. For more information, see [Recall security and privacy architecture in the Windows Experience Blog](https://blogs.windows.com/windowsexperience/?p=179096).
+
+In keeping with Microsoft's commitment to data privacy and security, all captured images and processed data are kept on the device and processed locally. However, Click to Do allows users to choose if they want to perform additional actions on their content.
+
+Click to Do allows users to choose to get more information about their selected content online. When users choose one of the following Click to Do actions, the selected content is sent to the online provider from the local device to complete the request:
+- **Search the web**: Sends the selected content to the default search engine of the default browser
+- **Open website**: Opens the selected website in the default browser
+- **Visual search with Bing**: Sends the selected content to Bing visual search using the default browser.
+
+When users choose to send content from Click to Do to an app, like Paint, Click to Do will temporarily save the selected content in order to complete the transfer. Click to Do creates a temporary file in one of the following locations:
+- `C:\Users\[username]\AppData\Local\Temp`
+- `C:\Users\{username}\AppData\Local\Packages\MicrosoftWindows.Client.AIX_cw5n1h2txyewy\TempState`
+
+The temporary file is deleted once the app is finished with the content.
+
## System requirements
-Recall has the following minimum hardware requirements:
+Recall has the following minimum requirements:
- A [Copilot+ PC](https://www.microsoft.com/windows/business/devices/copilot-plus-pcs#copilot-plus-pcs)
- 16 GB RAM
@@ -41,10 +62,7 @@ Recall has the following minimum hardware requirements:
- 256 GB storage capacity
- To enable Recall, you need at least 50 GB of space free
- Snapshot capture automatically pauses once the device has less than 25 GB of disk space
-
-Recall has the following software requirements:
-
-Recall takes advantage of just in time decryption protected by [Windows Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). To allow Windows to take snapshots, and to launch and use Recall, users must authenticate using [Windows Hello](/windows/security/identity-protection/hello-for-business/). Users need to enroll into Windows Hello with at least one biometric sign-in option enabled, either facial recognition or a fingerprint. The user's search index database for Recall is also encrypted and BitLocker is enabled by default on Windows 11. Each time Recall is launched it requires the user to confirm their identity before it opens and before snapshots are accessed.
+- Users need to enroll into [Windows Hello](/windows/security/identity-protection/hello-for-business/) with at least one biometric sign-in option enabled in order to authenticate.
## Supported browsers
@@ -68,19 +86,13 @@ The following policy allows you to disable analysis of user content:
| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) |
| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** |
-## Limitations
-In two specific scenarios, Windows captures snapshots that include private browsing windows, blocked apps, and blocked websites. If Recall gets launched, or the **Now** option is selected in Recall, then a snapshot is taken even when private browsing windows, blocked apps, and blocked websites are displayed. However, Recall doesn't save these snapshots. If users choose to send the information from this snapshot to another app, a temp file is created to share the content in either:
-- `C:\Users\[username]\AppData\Local\Temp`
-- `C:\Users\{username}\AppData\Local\Packages\MicrosoftWindows.Client.AIX_cw5n1h2txyewy\TempState`
-
-The temporary file is deleted once the app is finished with the content.
## User controlled settings for Recall
The following options are user controlled in Recall from the **Settings** > **Privacy & Security** > **Recall & Snapshots** page:
-- Allow Windows to save snapshots
+- Allow snapshots to be saved
- Website filtering
- App filtering
- Storage allocation
@@ -89,15 +101,15 @@ The following options are user controlled in Recall from the **Settings** > **Pr
- Delete all snapshots
- Delete snapshots within a specific time frame
-### Applications that are excluded from snapshots
+### Applications that are automatically excluded from snapshots
-Windows won't save snapshots when certain applications are being used. The following apps are automatically excluded:
+snapshots won't be saved when certain applications are being used. The following apps are automatically excluded from snapshots:
- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
- - Microsoft Remote Desktop from the Microsoft Store is saved in snapshots, add it to the app filtering list to prevent this
+ - Microsoft Remote Desktop from the Microsoft Store is saved in snapshots. To prevent the app from being saved in snapshots, add it to the app filtering list.
- [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows)
- - Azure Virtual Desktop apps from the Microsoft Store are saved in snapshots, add them to the app filtering list to prevent this
+ - Azure Virtual Desktop apps from the Microsoft Store are saved in snapshots. To prevent these apps from being saved in snapshots, add then to the app filtering list.
- [remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows
@@ -112,12 +124,14 @@ The amount of disk space users can allocate to Recall varies depending on how mu
| 1 TB, or more | 150 GB (default), 100 GB, 75 GB, 50 GB, 25 GB |
+
+## Information for developers
+
+If you're a developer and want to launch Recall, you can call the `ms-recall` protocol URI. When you call this URI, Recall opens and takes a snapshot of the screen, which is the default behavior for when Recall is launched. For more information about using Recall in your Windows app, see [Recall overview](/windows/ai/apis/recall) in the Windows AI API documentation.
+
## Microsoft's commitment to responsible AI
Microsoft has been on a responsible AI journey since 2017, when we defined our principles and approach to ensuring this technology is used in a way that is driven by ethical principles that put people first. For more about our responsible AI journey, the ethical principles that guide us, and the tooling and capabilities we've created to assure that we develop AI technology responsibly, see [Responsible AI](https://www.microsoft.com/ai/responsible-ai).
Recall uses optical character recognition (OCR), local to the PC, to analyze snapshots and facilitate search. For more information about OCR, see [Transparency note and use cases for OCR](/legal/cognitive-services/computer-vision/ocr-transparency-note). For more information about privacy and security, see [Privacy and control over your Recall experience](https://support.microsoft.com/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15).
-## Information for developers
-
-If you're a developer and want to launch Recall, you can call the `ms-recall` protocol URI. When you call this, Recall opens and takes a snapshot of the screen, which is the default behavior for when Recall is launched. For more information about using Recall in your Windows app, see [Recall overview](/windows/ai/apis/recall) in the Windows AI API documentation.
From 8edf65f20fe05e5af4e24c8ab9c0eae51c515a57 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 5 Nov 2024 16:13:20 -0800
Subject: [PATCH 015/165] edits and reorg
---
windows/client-management/manage-recall.md | 63 ++++++++++++++--------
1 file changed, 40 insertions(+), 23 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 86d4320950..cf58d3db20 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -77,6 +77,16 @@ Users need a supported browser for Recall to [filter websites](#user-controlled-
## Configure policies for Recall
+Policy list:
+| | Setting |
+|---|---|
+| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[AllowRecallEnablement](mdm/policy-csp-windowsai.md#allowrecallenablement) |
+| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows AI > **Allow Recall to be enabled** |
+
+
+
+
+
Organizations that aren't ready to use AI for historical analysis can disable it until they're ready with the **Turn off saving snapshots for Windows** policy. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. Administrators can't enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent.
The following policy allows you to disable analysis of user content:
@@ -86,6 +96,36 @@ The following policy allows you to disable analysis of user content:
| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) |
| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** |
+### Storage policies
+
+#### Storage allocation
+
+The amount of disk space users can allocate to Recall varies depending on how much storage the device has. The following chart shows the storage space options for Recall:
+
+| Device storage capacity | Storage allocation options for Recall |
+|---|---|
+| 256 GB | 25 GB (default), 10 GB |
+| 512 GB | 75 GB (default), 50 GB, 25 GB |
+| 1 TB, or more | 150 GB (default), 100 GB, 75 GB, 50 GB, 25 GB |
+
+
+### App and website filtering policies
+
+
+#### Applications that are automatically excluded from snapshots
+
+Snapshots won't be saved when certain applications are being used. The following apps are automatically excluded from snapshots:
+
+- [Supported web browsers](#supported-browsers) when using private browsing
+- Like other Windows apps such as the Snipping Tool, Recall will not store digital rights management (DRM) content
+- Some remote desktop connection apps:
+ - [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
+ - [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
+ - [Microsoft Remote Desktop from the Microsoft Store](/windows-server/remote/remote-desktop-services/clients/windows) is saved in snapshots. To prevent the app from being saved in snapshots, add it to the app filtering list.
+ - [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows)
+ - [Azure Virtual Desktop apps from the Microsoft Store](/azure/virtual-desktop/users/connect-remote-desktop-client) are saved in snapshots. To prevent these apps from being saved in snapshots, add then to the app filtering list.
+ - [remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows
+
## User controlled settings for Recall
@@ -101,29 +141,6 @@ The following options are user controlled in Recall from the **Settings** > **Pr
- Delete all snapshots
- Delete snapshots within a specific time frame
-### Applications that are automatically excluded from snapshots
-
-snapshots won't be saved when certain applications are being used. The following apps are automatically excluded from snapshots:
-
-- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
-- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
- - Microsoft Remote Desktop from the Microsoft Store is saved in snapshots. To prevent the app from being saved in snapshots, add it to the app filtering list.
-- [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows)
- - Azure Virtual Desktop apps from the Microsoft Store are saved in snapshots. To prevent these apps from being saved in snapshots, add then to the app filtering list.
-- [remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows
-
-
-### Storage allocation
-
-The amount of disk space users can allocate to Recall varies depending on how much storage the device has. The following chart shows the storage space options for Recall:
-
-| Device storage capacity | Storage allocation options for Recall |
-|---|---|
-| 256 GB | 25 GB (default), 10 GB |
-| 512 GB | 75 GB (default), 50 GB, 25 GB |
-| 1 TB, or more | 150 GB (default), 100 GB, 75 GB, 50 GB, 25 GB |
-
-
## Information for developers
From 8a021c56ca2ef9715fe2502c0be38d204f8c3cbd Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 5 Nov 2024 20:22:17 -0800
Subject: [PATCH 016/165] edits and reorg
---
windows/client-management/manage-recall.md | 36 ++++++++++++++--------
1 file changed, 23 insertions(+), 13 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index cf58d3db20..d6555605f0 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -18,7 +18,9 @@ appliesto:
>**Looking for consumer information?** See [Retrace your steps with Recall](https://support.microsoft.com/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c).
-Recall (preview) allows users to search locally saved and locally analyzed snapshots of their screen using natural language. By default, Recall is removed from commercially managed devices except for devices running Windows Home edition. IT admins, on their own, can't enable Recall for users. Recall is an opt-in experience that requires user consent to save snapshots. Users can choose to enable or disable Recall at any time. IT admins can only give users the option to enable snapshots and configure certain policies for Recall. This article provides information about Recall and how to manage it in a commercial environment.
+Recall (preview) allows users to search locally saved and locally analyzed snapshots of their screen using natural language. By default, Recall is removed on commercially managed devices except for devices running Windows Home edition. IT admins, on their own, can't enable Recall for users. Recall is an opt-in experience that requires user consent to save snapshots. Users can choose to enable or disable Recall at any time. IT admins can only set policies that give users the option to enable snapshots and configure certain policies for Recall.
+
+This article provides information about Recall and how to manage it in a commercial environment.
> [!NOTE]
> - Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs).
@@ -35,7 +37,7 @@ When Recall opens a snapshot you selected, it enables Click to Do, which runs on
### Recall security and privacy architecture
-We built privacy and security into Recall's design from the ground up. With Copilot+ PCs, you get powerful AI that runs locally on the device. No internet or cloud connections are required or used to save and analyze snapshots. Snapshots aren't sent to Microsoft. Recall AI processing occurs locally, and snapshots are securely stored on the local device only.
+Privacy and security are built into Recall's design. With Copilot+ PCs, you get powerful AI that runs locally on the device. No internet or cloud connections are required or used to save and analyze snapshots. Snapshots aren't sent to Microsoft. Recall AI processing occurs locally, and snapshots are securely stored on the local device only.
Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. Recall requires users to confirm their identity with [Windows Hello](https://support.microsoft.com/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0) before it launches and before accessing snapshots. At least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall. Before snapshots start getting saved the device, users need to open Recall and authenticate. Recall takes advantage of just in time decryption protected by Windows [Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). Snapshots and any associated information in the vector database are always encrypted. Encryption keys are protected via Trusted Platform Module (TPM), which is tied to the user's Windows Hello ESS identity, and can be used by operations within a secure environment called a [Virtualization-based Security Enclave (VBS Enclave)](/windows/win32/trusted-execution/vbs-enclaves). This means that other users can't access these keys and thus can't decrypt this information. Device Encryption or BitLocker are enabled by default on Windows 11. For more information, see [Recall security and privacy architecture in the Windows Experience Blog](https://blogs.windows.com/windowsexperience/?p=179096).
@@ -77,27 +79,35 @@ Users need a supported browser for Recall to [filter websites](#user-controlled-
## Configure policies for Recall
-Policy list:
+By default, Recall is removed on commercially managed devices except for devices running Windows Home edition. Many of the policies for Recall are available for both the device and the user scope to give you more flexibility. Policies for Recall fall into the following general areas:
+
+- [Allow Recall and snapshots policies](#allow-recall-and-snapshots-policies)
+- [Storage policies](#storage-policies)
+- [App and website filtering policies](#app-and-website-filtering-policies)
+
+
+
+### Allow Recall and snapshots policies
+
+If you want to allow Recall to be available for your users and allow them to choose to save snapshots, you need to configure both the **Allow Recall to be enabled** and **Turn off saving snapshots for Windows** policies.
+
+**Allow Recall to be enabled**:
| | Setting |
|---|---|
| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[AllowRecallEnablement](mdm/policy-csp-windowsai.md#allowrecallenablement) |
-| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows AI > **Allow Recall to be enabled** |
+| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Allow Recall to be enabled** |
-
-
-
-Organizations that aren't ready to use AI for historical analysis can disable it until they're ready with the **Turn off saving snapshots for Windows** policy. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. Administrators can't enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent.
-
-The following policy allows you to disable analysis of user content:
+The **Turn off saving snapshots for Windows** policy allows you to give the users the choice to save snapshots of their screen for use with Recall. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. Administrators can't enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent.
| | Setting |
|---|---|
-| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) |
-| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** |
+| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis)|
+| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** |
### Storage policies
+
#### Storage allocation
The amount of disk space users can allocate to Recall varies depending on how much storage the device has. The following chart shows the storage space options for Recall:
@@ -117,7 +127,7 @@ The amount of disk space users can allocate to Recall varies depending on how mu
Snapshots won't be saved when certain applications are being used. The following apps are automatically excluded from snapshots:
- [Supported web browsers](#supported-browsers) when using private browsing
-- Like other Windows apps such as the Snipping Tool, Recall will not store digital rights management (DRM) content
+- Like other Windows apps such as the Snipping Tool, Recall won't store digital rights management (DRM) content
- Some remote desktop connection apps:
- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
From 7f39421ca87d1993040ad4e7edaa9f3a370c04d3 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 5 Nov 2024 20:23:30 -0800
Subject: [PATCH 017/165] edits
---
windows/client-management/manage-recall.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index d6555605f0..9721aaf6fa 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -102,7 +102,7 @@ The **Turn off saving snapshots for Windows** policy allows you to give the user
| | Setting |
|---|---|
-| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis)|
+| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis)|
| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** |
### Storage policies
From f3be6cdc61e45041c07364e44b6db388b386b7a9 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 5 Nov 2024 22:08:44 -0800
Subject: [PATCH 018/165] edits and add filtering
---
windows/client-management/manage-recall.md | 31 +--
.../recall-sensitive-information-filtering.md | 190 ++++++++++++++++++
windows/client-management/toc.yml | 4 +-
3 files changed, 211 insertions(+), 14 deletions(-)
create mode 100644 windows/client-management/recall-sensitive-information-filtering.md
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 9721aaf6fa..a96d37b5fa 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -41,6 +41,8 @@ Privacy and security are built into Recall's design. With Copilot+ PCs, you get
Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. Recall requires users to confirm their identity with [Windows Hello](https://support.microsoft.com/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0) before it launches and before accessing snapshots. At least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall. Before snapshots start getting saved the device, users need to open Recall and authenticate. Recall takes advantage of just in time decryption protected by Windows [Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). Snapshots and any associated information in the vector database are always encrypted. Encryption keys are protected via Trusted Platform Module (TPM), which is tied to the user's Windows Hello ESS identity, and can be used by operations within a secure environment called a [Virtualization-based Security Enclave (VBS Enclave)](/windows/win32/trusted-execution/vbs-enclaves). This means that other users can't access these keys and thus can't decrypt this information. Device Encryption or BitLocker are enabled by default on Windows 11. For more information, see [Recall security and privacy architecture in the Windows Experience Blog](https://blogs.windows.com/windowsexperience/?p=179096).
+When using Recall, the [**Sensitive Information Filtering**](#user-controlled-settings-for-recall) setting is enabled by default to help ensure your data's confidentiality. This feature operates directly on the device, utilizing the NPU and the Microsoft Classification Engine (MCE), which is the same technology leveraged by Microsoft Purview for detecting and labeling sensitive information. When this setting is enabled, snapshots won't be saved when potentially sensitive information is detected. Most importantly, the sensitive information remains on the device at all times, regardless of whether the **Sensitive Information Filtering setting** is enabled or disabled. For more information about the types of potentially sensitive information, see [Reference for sensitive information filtering in Recall](#sensitive-information-filtering-in-recall).
+
In keeping with Microsoft's commitment to data privacy and security, all captured images and processed data are kept on the device and processed locally. However, Click to Do allows users to choose if they want to perform additional actions on their content.
Click to Do allows users to choose to get more information about their selected content online. When users choose one of the following Click to Do actions, the selected content is sent to the online provider from the local device to complete the request:
@@ -79,7 +81,7 @@ Users need a supported browser for Recall to [filter websites](#user-controlled-
## Configure policies for Recall
-By default, Recall is removed on commercially managed devices except for devices running Windows Home edition. Many of the policies for Recall are available for both the device and the user scope to give you more flexibility. Policies for Recall fall into the following general areas:
+By default, Recall is removed on commercially managed devices except for devices running Windows Home edition. If you want to allow Recall to be available for your users and allow them to choose to save snapshots, you need to configure both the **Allow Recall to be enabled** and **Turn off saving snapshots for Windows** policies. Policies for Recall fall into the following general areas:
- [Allow Recall and snapshots policies](#allow-recall-and-snapshots-policies)
- [Storage policies](#storage-policies)
@@ -89,9 +91,8 @@ By default, Recall is removed on commercially managed devices except for devices
### Allow Recall and snapshots policies
-If you want to allow Recall to be available for your users and allow them to choose to save snapshots, you need to configure both the **Allow Recall to be enabled** and **Turn off saving snapshots for Windows** policies.
+The **Allow Recall to be enabled** policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled for managed commercial devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own.
-**Allow Recall to be enabled**:
| | Setting |
|---|---|
| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[AllowRecallEnablement](mdm/policy-csp-windowsai.md#allowrecallenablement) |
@@ -102,26 +103,30 @@ The **Turn off saving snapshots for Windows** policy allows you to give the user
| | Setting |
|---|---|
-| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis)|
-| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** |
+| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis)|
+| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** |
### Storage policies
+You can define how much disk space Recall can use by using the **Set maximum storage for snapshots used by Recall** policy. You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB. When the storage limit is reached, the oldest snapshots are deleted first. When this setting is not configured, the OS configures the storage allocation for snapshots based on the device storage capacity. 25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.
-#### Storage allocation
-
-The amount of disk space users can allocate to Recall varies depending on how much storage the device has. The following chart shows the storage space options for Recall:
-
-| Device storage capacity | Storage allocation options for Recall |
+| | Setting |
|---|---|
-| 256 GB | 25 GB (default), 10 GB |
-| 512 GB | 75 GB (default), 50 GB, 25 GB |
-| 1 TB, or more | 150 GB (default), 100 GB, 75 GB, 50 GB, 25 GB |
+| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageSpaceForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageSpaceForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots)|
+| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall** User Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall** |
+
+You can define how long snapshots can be retained on the device by using the **Set maximum duration for storing snapshots used by Recall** policy. You can configure the maximum storage duration to be 30, 60, 90, or 180 days. If the policy is not configured, snapshots aren't deleted until the maximum storage allocation is reached, and then the oldest snapshots are deleted first.
+
+| | Setting |
+|---|---|
+| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageDurationForRecallSnapshots](mdm/policy-csp-windowsai.md#SetMaximumStorageDurationForRecallSnapshots) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageDurationForRecallSnapshots](mdm/policy-csp-windowsai.md#sSetMaximumStorageDurationForRecallSnapshots)|
+| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall** User Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum duration for storing snapshots used by Recall** |
### App and website filtering policies
+
#### Applications that are automatically excluded from snapshots
Snapshots won't be saved when certain applications are being used. The following apps are automatically excluded from snapshots:
diff --git a/windows/client-management/recall-sensitive-information-filtering.md b/windows/client-management/recall-sensitive-information-filtering.md
new file mode 100644
index 0000000000..efa0c5a85d
--- /dev/null
+++ b/windows/client-management/recall-sensitive-information-filtering.md
@@ -0,0 +1,190 @@
+---
+title: Sensitive information filtering in Recall
+description: Learn about the types of potentially sensitive information Recall detects.
+ms.topic: reference
+ms.subservice: windows-copilot
+ms.date: 11/14/2024
+ms.author: mstewart
+author: mestew
+ms.collection:
+ - windows-copilot
+ - magic-ai-copilot
+appliesto:
+- ✅ Copilot+ PCs
+---
+
+
+# Reference for sensitive information filtering in Recall
+
+This article provides information about the types of potentially sensitive information that [Recall](manage-recall.md) detects.
+
+## Types of potentially sensitive information
+
+Types of potentially sensitive information that Recall detects and filters include:
+
+ABA Routing Number
+Argentina National Identity (DNI) Number
+Argentina Unique Tax Identification Key (CUIT/CUIL)
+Australia Bank Account Number
+Australia Drivers License Number
+Australia Tax File Number
+Austria Driver's License Number
+Austria Identity Card
+Austria Social Security Number
+Austria Tax Identification Number
+Austria Value Added Tax
+Azure Document DB Auth Key
+Azure IAAS Database Connection String and Azure SQL Connection String
+Azure IoT Connection String
+Azure Redis Cache Connection String
+Azure SAS
+Azure Secrets (Generic)
+Azure Service Bus Connection String
+Azure Storage Account Key
+Belgium Driver's License Number
+Belgium National Number
+Belgium Value Added Tax Number
+Brazil CPF Number
+Brazil Legal Entity Number (CNPJ)
+Brazil National ID Card (RG)
+Bulgaria Driver's License Number
+Bulgaria Uniform Civil Number
+Canada Bank Account Number
+Canada Driver's License Number
+Canada Social Insurance Number
+Chile Identity Card Number
+China Resident Identity Card (PRC) Number
+Colombia National ID
+Credit Card Number
+Croatia Driver's License Number
+Croatia Identity Card Number
+Croatia Personal Identification (OIB) Number
+Cyprus Driver's License Number
+Cyprus Identity Card
+Cyprus Tax Identification Number
+Czech Driver's License Number
+Czech Personal Identity Number
+DEA Number
+Denmark Driver's License Number
+Denmark Personal Identification Number
+Ecuador Unique Identification Number
+Estonia Driver's License Number
+Estonia Personal Identification Code
+EU Debit Card Number
+EU Driver's License Number
+EU National Id Card
+EU SSN or Equivalent Number
+EU Tax File Number
+Finland Driver's License Number
+Finnish National ID
+France CNI
+France Driver's License Number
+France INSEE
+France Tax Identification Number (numéro SPI.)
+France Value Added Tax Number
+General Password
+German Driver's License Number
+Germany Identity Card Number
+Germany Tax Identification Number
+Germany Value Added Tax Number
+Greece Driver's License Number
+Greece National ID Card
+Greece Social Security Number (AMKA)
+Greek Tax Identification Number
+Hong Kong Identity Card (HKID) number
+Hungarian Social Security Number (TAJ)
+Hungarian Value Added Tax Number
+Hungary Driver's License Number
+Hungary Personal Identification Number
+Hungary Tax Identification Number
+IBAN
+India Driver's License Number
+India GST number
+India Permanent Account Number
+India Unique Identification (Aadhaar) number
+India Voter Id Card
+Indonesia Drivers License Number
+Indonesia Identity Card (KTP) Number
+Ireland Driver's License Number
+Ireland Personal Public Service (PPS) Number
+Israel Bank Account Number
+Israel National ID Number
+Italy Driver's license Number
+Italy Fiscal Code
+Italy Value Added Tax
+Japan Bank Account Number
+Japan Driver's License Number
+Japan Residence Card Number
+Japan Resident Registration Number
+Japan Social Insurance Number
+Japanese My Number – Corporate
+Japanese My Number – Personal
+Latvia Driver's License Number
+Latvia Personal Code
+Lithuania Driver's License Number
+Lithuania Personal Code
+Luxembourg Driver's License Number
+Luxembourg National Identification Number (Natural persons)
+Luxembourg National Identification Number (Non-natural persons)
+Malaysia ID Card Number
+Malta Driver's License Number
+Malta Identity Card Number
+Malta Tax ID Number
+Mexico Unique Population Registry Code (CURP)
+Netherlands Citizen's Service (BSN) Number
+Netherlands Driver's License Number
+Netherlands Tax Identification Number
+Netherlands Value Added Tax Number
+New Zealand Bank Account Number
+New Zealand Driver License Number
+New Zealand Inland Revenue Number
+Newzealand Social Welfare Number
+Norway Identification Number
+Philippines National ID
+Philippines Passport Number
+Philippines Unified Multi-Purpose ID number
+Poland Driver's License Number
+Poland Identity Card
+Poland National ID (PESEL)
+Poland Tax Identification Number
+Polish REGON Number
+Portugal Citizen Card Number
+Portugal Driver's License Number
+Portugal Tax Identification Number
+Qatari ID Card Number
+Romania Driver's License Number
+Romania Personal Numerical Code (CNP)
+Saudi Arabia National ID
+Singapore Driving License Number
+Singapore National Registration Identity Card (NRIC) Number
+Slovakia Driver's License Number
+Slovakia Personal Number
+Slovenia Driver's License Number
+Slovenia Tax Identification Number
+Slovenia Unique Master Citizen Number
+South Africa Identification Number
+South Korea Driver's License Number
+South Korea Resident Registration Number
+Spain DNI
+Spain Driver's License Number
+Spain SSN
+Spain Tax Identification Number
+Sweden Driver's License Number
+Sweden National ID
+Sweden Tax Identification Number
+SWIFT Code
+Swiss SSN AHV Number
+Taiwan Resident Certificate (ARC/TARC)
+Taiwanese National ID
+Thai Citizen ID
+Turkish National Identity
+U.K. Driver's License Number
+U.K. Electoral Number
+U.K. NHS Number
+U.K. NINO
+U.K. Unique Taxpayer Reference Number
+U.S. Bank Account Number
+U.S. Driver's License Number
+U.S. Individual Taxpayer Identification Number (ITIN)
+U.S. Social Security Number
+UAE Identity Card Number
diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml
index 4aa913ef53..711bc21aea 100644
--- a/windows/client-management/toc.yml
+++ b/windows/client-management/toc.yml
@@ -51,7 +51,9 @@ items:
- name: Updated Windows and Microsoft Copilot experience
href: manage-windows-copilot.md
- name: Manage Recall
- href: manage-recall.md
+ href: manage-recall.md
+ - name: Reference for sensitive information filtering in Recall
+ href: recall-sensitive-information-filtering.md
- name: Secured-Core PC Configuration Lock
href: config-lock.md
- name: Certificate renewal
From c93580cadc186f366c8e6b7d1fd5868f4e57a75d Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 5 Nov 2024 22:14:39 -0800
Subject: [PATCH 019/165] edits and add filtering
---
windows/client-management/manage-recall.md | 2 +-
.../client-management/recall-sensitive-information-filtering.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index a96d37b5fa..cd9e3f7271 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -41,7 +41,7 @@ Privacy and security are built into Recall's design. With Copilot+ PCs, you get
Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. Recall requires users to confirm their identity with [Windows Hello](https://support.microsoft.com/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0) before it launches and before accessing snapshots. At least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall. Before snapshots start getting saved the device, users need to open Recall and authenticate. Recall takes advantage of just in time decryption protected by Windows [Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). Snapshots and any associated information in the vector database are always encrypted. Encryption keys are protected via Trusted Platform Module (TPM), which is tied to the user's Windows Hello ESS identity, and can be used by operations within a secure environment called a [Virtualization-based Security Enclave (VBS Enclave)](/windows/win32/trusted-execution/vbs-enclaves). This means that other users can't access these keys and thus can't decrypt this information. Device Encryption or BitLocker are enabled by default on Windows 11. For more information, see [Recall security and privacy architecture in the Windows Experience Blog](https://blogs.windows.com/windowsexperience/?p=179096).
-When using Recall, the [**Sensitive Information Filtering**](#user-controlled-settings-for-recall) setting is enabled by default to help ensure your data's confidentiality. This feature operates directly on the device, utilizing the NPU and the Microsoft Classification Engine (MCE), which is the same technology leveraged by Microsoft Purview for detecting and labeling sensitive information. When this setting is enabled, snapshots won't be saved when potentially sensitive information is detected. Most importantly, the sensitive information remains on the device at all times, regardless of whether the **Sensitive Information Filtering setting** is enabled or disabled. For more information about the types of potentially sensitive information, see [Reference for sensitive information filtering in Recall](#sensitive-information-filtering-in-recall).
+When using Recall, the [**Sensitive Information Filtering**](#user-controlled-settings-for-recall) setting is enabled by default to help ensure your data's confidentiality. This feature operates directly on the device, utilizing the NPU and the Microsoft Classification Engine (MCE), which is the same technology leveraged by Microsoft Purview for detecting and labeling sensitive information. When this setting is enabled, snapshots won't be saved when potentially sensitive information is detected. Most importantly, the sensitive information remains on the device at all times, regardless of whether the **Sensitive Information Filtering** setting is enabled or disabled. For more information about the types of potentially sensitive information, see [Reference for sensitive information filtering in Recall](recall-sensitive-information-filtering.md).
In keeping with Microsoft's commitment to data privacy and security, all captured images and processed data are kept on the device and processed locally. However, Click to Do allows users to choose if they want to perform additional actions on their content.
diff --git a/windows/client-management/recall-sensitive-information-filtering.md b/windows/client-management/recall-sensitive-information-filtering.md
index efa0c5a85d..8e8965491b 100644
--- a/windows/client-management/recall-sensitive-information-filtering.md
+++ b/windows/client-management/recall-sensitive-information-filtering.md
@@ -16,7 +16,7 @@ appliesto:
# Reference for sensitive information filtering in Recall
-This article provides information about the types of potentially sensitive information that [Recall](manage-recall.md) detects.
+This article provides information about the types of potentially sensitive information that [Recall](manage-recall.md) detects when the **Sensitive Information Filtering** setting is enabled.
## Types of potentially sensitive information
From 12f9454bf38fb8d9afc2ff03e6398f3b40026171 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 5 Nov 2024 23:04:46 -0800
Subject: [PATCH 020/165] edits and add filtering
---
windows/client-management/manage-recall.md | 36 ++++++++++++----------
1 file changed, 19 insertions(+), 17 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index cd9e3f7271..22951dae08 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -108,14 +108,14 @@ The **Turn off saving snapshots for Windows** policy allows you to give the user
### Storage policies
-You can define how much disk space Recall can use by using the **Set maximum storage for snapshots used by Recall** policy. You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB. When the storage limit is reached, the oldest snapshots are deleted first. When this setting is not configured, the OS configures the storage allocation for snapshots based on the device storage capacity. 25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.
+You can define how much disk space Recall can use by using the **Set maximum storage for snapshots used by Recall** policy. You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB. When the storage limit is reached, the oldest snapshots are deleted first. When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity. 25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.
| | Setting |
|---|---|
| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageSpaceForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageSpaceForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots)|
| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall** User Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall** |
-You can define how long snapshots can be retained on the device by using the **Set maximum duration for storing snapshots used by Recall** policy. You can configure the maximum storage duration to be 30, 60, 90, or 180 days. If the policy is not configured, snapshots aren't deleted until the maximum storage allocation is reached, and then the oldest snapshots are deleted first.
+You can define how long snapshots can be retained on the device by using the **Set maximum duration for storing snapshots used by Recall** policy. You can configure the maximum storage duration to be 30, 60, 90, or 180 days. If the policy isn't configured, snapshots aren't deleted until the maximum storage allocation is reached, and then the oldest snapshots are deleted first.
| | Setting |
|---|---|
@@ -125,6 +125,22 @@ You can define how long snapshots can be retained on the device by using the **S
### App and website filtering policies
+You can filter both apps and websites from being saved in snapshots. Users are able to add to these filter lists from the **Recall & Snapshots** settings page. Some applications are automatically excluded from snapshots. For more information, see the [Applications that are automatically excluded from snapshots](#applications-that-are-automatically-excluded-from-snapshots) section.
+
+To filter apps from being saved in snapshots, use the **Set a list of URIs to be filtered from snapshots for Recall** policy. Define the list using a semicolon to separate URIs. Make sure you include the URL scheme such as `http://`, `ftp://`, `file://`, `https://www.`. Sites local to a supported browser like `edge://`, or `chrome://`, are filtered by default.
+
+| | Setting |
+|---|---|
+| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyUriListForRecall](mdm/policy-csp-windowsai.md#setdenyurilistforrecall) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyUriListForRecall](mdm/policy-csp-windowsai.md#setdenyurilistforrecall)|
+| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **>Set a list of URIs to be filtered from snapshots for Recall** User Configuration > Administrative Templates > Windows Components > Windows AI > **>Set a list of URIs to be filtered from snapshots for Recall** |
+
+
+**Set a list of apps to be filtered from snapshots for Recall** policy allows you to filter apps from being saved in snapshots. Define the list using a semicolon to separate apps. The list can include Application User Model IDs (AUMID) or the name of the executable file.
+
+| | Setting |
+|---|---|
+| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyAppListForRecall](mdm/policy-csp-windowsai.md#setdenyapplistforrecall) ./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyAppListForRecall](mdm/policy-csp-windowsai.md#setdenyapplistforrecall)|
+| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set a list of apps to be filtered from snapshots for Recall** User Configuration > Administrative Templates > Windows Components > Windows AI > **Set a list of apps to be filtered from snapshots for Recall**|
#### Applications that are automatically excluded from snapshots
@@ -132,7 +148,7 @@ You can define how long snapshots can be retained on the device by using the **S
Snapshots won't be saved when certain applications are being used. The following apps are automatically excluded from snapshots:
- [Supported web browsers](#supported-browsers) when using private browsing
-- Like other Windows apps such as the Snipping Tool, Recall won't store digital rights management (DRM) content
+- Like other Windows apps, such as the Snipping Tool, Recall won't store digital rights management (DRM) content
- Some remote desktop connection apps:
- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
@@ -143,20 +159,6 @@ Snapshots won't be saved when certain applications are being used. The following
-## User controlled settings for Recall
-
-The following options are user controlled in Recall from the **Settings** > **Privacy & Security** > **Recall & Snapshots** page:
-
-- Allow snapshots to be saved
-- Website filtering
-- App filtering
-- Storage allocation
- - When the storage limit is reached, the oldest snapshots are deleted first.
-- Deleting snapshots
- - Delete all snapshots
- - Delete snapshots within a specific time frame
-
-
## Information for developers
If you're a developer and want to launch Recall, you can call the `ms-recall` protocol URI. When you call this URI, Recall opens and takes a snapshot of the screen, which is the default behavior for when Recall is launched. For more information about using Recall in your Windows app, see [Recall overview](/windows/ai/apis/recall) in the Windows AI API documentation.
From a6f44de1010a29ff592e7d836303784e2f11f0db Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 5 Nov 2024 23:05:16 -0800
Subject: [PATCH 021/165] edits and add filtering
---
windows/client-management/manage-recall.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 22951dae08..bb27e87aa2 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -3,7 +3,7 @@ title: Manage Recall for Windows clients
description: Learn how to manage Recall for commercial environments and about Recall features.
ms.topic: how-to
ms.subservice: windows-copilot
-ms.date: 10/14/2024
+ms.date: 11/14/2024
ms.author: mstewart
author: mestew
ms.collection:
From d38edcba6c8e5e583700b5179478e54ea1efa914 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Wed, 6 Nov 2024 10:39:26 -0800
Subject: [PATCH 022/165] fix link
---
windows/client-management/manage-recall.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index bb27e87aa2..038622ded5 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -70,7 +70,7 @@ Recall has the following minimum requirements:
## Supported browsers
-Users need a supported browser for Recall to [filter websites](#user-controlled-settings-for-recall) and to automatically filter private browsing activity. Supported browsers, and their capabilities include:
+Users need a supported browser for Recall to [filter websites](#app-and-website-filtering-policies) and to automatically filter private browsing activity. Supported browsers, and their capabilities include:
- **Microsoft Edge**: blocks websites and filters private browsing activity
- **Firefox**: blocks websites and filters private browsing activity
From 0edc7896aa22ef338d0312b4845b481f9d72f2ad Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 7 Nov 2024 12:53:20 -0700
Subject: [PATCH 023/165] Update WindowsAI CSP
---
.../mdm/policies-in-preview.md | 8 +-
.../mdm/policy-csp-windowsai.md | 313 +++++++++++++++++-
2 files changed, 315 insertions(+), 6 deletions(-)
diff --git a/windows/client-management/mdm/policies-in-preview.md b/windows/client-management/mdm/policies-in-preview.md
index 57e70841a5..3e38c5afc5 100644
--- a/windows/client-management/mdm/policies-in-preview.md
+++ b/windows/client-management/mdm/policies-in-preview.md
@@ -1,7 +1,7 @@
---
title: Configuration service provider preview policies
description: Learn more about configuration service provider (CSP) policies that are available for Windows Insider Preview.
-ms.date: 11/05/2024
+ms.date: 11/07/2024
---
@@ -137,9 +137,15 @@ This article lists the policies that are applicable for Windows Insider Preview
## WindowsAI
+- [DisableAIDataAnalysis](policy-csp-windowsai.md#disableaidataanalysis)
- [SetCopilotHardwareKey](policy-csp-windowsai.md#setcopilothardwarekey)
+- [SetDenyAppListForRecall](policy-csp-windowsai.md#setdenyapplistforrecall)
+- [SetDenyUriListForRecall](policy-csp-windowsai.md#setdenyurilistforrecall)
+- [SetMaximumStorageSpaceForRecallSnapshots](policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots)
+- [SetMaximumStorageDurationForRecallSnapshots](policy-csp-windowsai.md#setmaximumstoragedurationforrecallsnapshots)
- [DisableImageCreator](policy-csp-windowsai.md#disableimagecreator)
- [DisableCocreator](policy-csp-windowsai.md#disablecocreator)
+- [AllowRecallEnablement](policy-csp-windowsai.md#allowrecallenablement)
## WindowsLicensing CSP
diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md
index 72d541101b..0d567fabef 100644
--- a/windows/client-management/mdm/policy-csp-windowsai.md
+++ b/windows/client-management/mdm/policy-csp-windowsai.md
@@ -1,7 +1,7 @@
---
title: WindowsAI Policy CSP
description: Learn more about the WindowsAI Area in Policy CSP.
-ms.date: 11/05/2024
+ms.date: 11/07/2024
---
@@ -15,19 +15,87 @@ ms.date: 11/05/2024
+
+## AllowRecallEnablement
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowRecallEnablement
+```
+
+
+
+
+This policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled for managed commercial devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own.
+
+- If this policy isn't configured, end users will have the Recall component in a disabled state.
+
+- If this policy is disabled, the Recall component will be in disabled state and the bits for Recall will be removed from the device. If snapshots were previously saved on the device, they will be deleted when this policy is disabled. Removing Recall requires a device restart.
+
+- If the policy is enabled, end users will have Recall available on their device. Depending on the state of the DenyAIDataAnalysis policy (Turn off saving snapshots for use with Recall), end users will be able to choose if they want to save snapshots of their screen and use Recall to find things they've seen on their device.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 1 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Recall isn't available. |
+| 1 (Default) | Recall is available. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | AllowRecallEnablement |
+| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+
+
+
+
+
+
+
+
## DisableAIDataAnalysis
| Scope | Editions | Applicable OS |
|:--|:--|:--|
-| ❌ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later |
+| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
```User
./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis
```
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis
+```
@@ -258,12 +326,247 @@ This policy setting determines which app opens when the user presses the Copilot
+
+## SetDenyAppListForRecall
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```User
+./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall
+```
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall
+```
+
+
+
+
+This policy allows you to define a list of apps that won't be included in snapshots for Recall. Users will be able to add additional applications to exclude from snapshots using Recall settings. The list can include Application User Model IDs (AUMID) or the name of the executable file. Use a semicolon-separated list of apps to define the deny app list for Recall. For example: code.exe;Microsoft. WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `chr` (string) |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | List (Delimiter: `;`) |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | DenyAppListForRecall |
+| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+
+
+
+
+
+
+
+
+
+## SetDenyUriListForRecall
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```User
+./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall
+```
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall
+```
+
+
+
+
+This policy setting lets you define a list of URIs that won't be included in snapshots for Recall when a supported browser is used. People within your organization can use Recall settings to add more websites to the list. Define the list using a semicolon to separate URIs. Adding to the list would also filter and /Account. For example: ;;https://www. Adatum.com.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `chr` (string) |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | List (Delimiter: `;`) |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | DenyUriListForRecall |
+| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+
+
+
+
+
+
+
+
+
+## SetMaximumStorageDurationForRecallSnapshots
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```User
+./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots
+```
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots
+```
+
+
+
+
+This policy setting allows you to control the maximum amount of time (in days) that Windows saves snapshots for Recall. When the policy is enabled, you can configure the maximum storage duration to be 30, 60, 90, or 180 days. When this policy isn't configured, a time frame isn't set for deleting snapshots. Snapshots aren't deleted until the maximum storage allocation for Recall is reached, and then the oldest snapshots are deleted first.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Let the OS define the maximum amount of time the snapshots will be saved. |
+| 30 | 30 days. |
+| 60 | 60 days. |
+| 90 | 90 days. |
+| 180 | 180 days. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | SetMaximumStorageDurationForRecallSnapshots |
+| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+
+
+
+
+
+
+
+
+
+## SetMaximumStorageSpaceForRecallSnapshots
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```User
+./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots
+```
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots
+```
+
+
+
+
+This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall. You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB. When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity. 25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Let the OS define the maximum storage amount based on hard drive storage size. |
+| 10000 | 10GB. |
+| 25000 | 25GB. |
+| 50000 | 50GB. |
+| 75000 | 75GB. |
+| 100000 | 100GB. |
+| 150000 | 150GB. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | SetMaximumStorageSpaceForRecallSnapshots |
+| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+
+
+
+
+
+
+
+
## TurnOffWindowsCopilot
-> [!NOTE]
-> This policy is deprecated and may be removed in a future release.
-
| Scope | Editions | Applicable OS |
|:--|:--|:--|
From 0751303ba990131df9b4ea0bba1760192b5e3692 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 7 Nov 2024 16:02:24 -0700
Subject: [PATCH 024/165] Fix table
---
.../mdm/policy-csp-windowsai.md | 107 ++++++++++++++----
1 file changed, 84 insertions(+), 23 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md
index 0d567fabef..eec9d85257 100644
--- a/windows/client-management/mdm/policy-csp-windowsai.md
+++ b/windows/client-management/mdm/policy-csp-windowsai.md
@@ -31,7 +31,7 @@ ms.date: 11/07/2024
-
+
This policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled for managed commercial devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own.
- If this policy isn't configured, end users will have the Recall component in a disabled state.
@@ -70,7 +70,12 @@ This policy setting allows you to determine whether the Recall optional componen
| Name | Value |
|:--|:--|
| Name | AllowRecallEnablement |
-| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+| Friendly Name | Allow Recall to be enabled |
+| Location | Computer Configuration |
+| Path | Windows Components > Windows AI |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
+| Registry Value Name | AllowRecallEnablement |
+| ADMX File Name | WindowsCopilot.admx |
@@ -100,11 +105,13 @@ This policy setting allows you to determine whether the Recall optional componen
-This policy setting allows you to control whether Windows saves snapshots of the screen and analyzes the user's activity on their device.
+This policy setting allows you to determine whether snapshots of the screen can be saved for use with Recall. By default, snapshots for Recall aren't enabled. IT administrators cannot, on their own, enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent.
-- If you enable this policy setting, Windows won't be able to save snapshots and users won't be able to search for or browse through their historical device activity using Recall.
+- If the policy isn't configured, snapshots won't be saved for use with Recall.
-- If you disable or don't configure this policy setting, Windows will save snapshots of the screen and users will be able to search for or browse through a timeline of their past activities using Recall.
+- If you enable this policy, snapshots won't be saved for use with Recall. If snapshots were previously saved on the device, they will be deleted when this policy is enabled.
+
+If you set this policy to disabled, end users will have a choice to save snapshots of their screen and use Recall to find things they've seen on their device.
@@ -136,8 +143,8 @@ This policy setting allows you to control whether Windows saves snapshots of the
| Name | Value |
|:--|:--|
| Name | DisableAIDataAnalysis |
-| Friendly Name | Turn off Saving Snapshots for Windows |
-| Location | User Configuration |
+| Friendly Name | Turn off saving snapshots for use with Recall |
+| Location | Computer and User Configuration |
| Path | Windows Components > Windows AI |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
| Registry Value Name | DisableAIDataAnalysis |
@@ -290,7 +297,7 @@ This policy setting allows you to control whether Image Creator functionality is
-
+
This policy setting determines which app opens when the user presses the Copilot key on their keyboard.
- If the policy is enabled, the specified app will open when the user presses the Copilot key. Users can change the key assignment in Settings.
@@ -317,7 +324,11 @@ This policy setting determines which app opens when the user presses the Copilot
| Name | Value |
|:--|:--|
| Name | SetCopilotHardwareKey |
-| Path | WindowsCopilot > AT > WindowsComponents > WindowsCopilot |
+| Friendly Name | Set Copilot Hardware Key |
+| Location | User Configuration |
+| Path | Windows Components > Windows Copilot |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CopilotKey |
+| ADMX File Name | WindowsCopilot.admx |
@@ -346,8 +357,19 @@ This policy setting determines which app opens when the user presses the Copilot
-
-This policy allows you to define a list of apps that won't be included in snapshots for Recall. Users will be able to add additional applications to exclude from snapshots using Recall settings. The list can include Application User Model IDs (AUMID) or the name of the executable file. Use a semicolon-separated list of apps to define the deny app list for Recall. For example: code.exe;Microsoft. WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe.
+
+This policy allows you to define a list of apps that won't be included in snapshots for Recall.
+
+Users will be able to add additional applications to exclude from snapshots using Recall settings.
+
+The list can include Application User Model IDs (AUMID) or name of the executable file.
+
+Use a semicolon-separated list of apps to define the deny app list for Recall.
+
+For example: code.exe;Microsoft. WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe.
+
+> [!IMPORTANT]
+> When configuring this policy setting, changes won't take effect until the device restarts.
@@ -369,8 +391,13 @@ This policy allows you to define a list of apps that won't be included in snapsh
| Name | Value |
|:--|:--|
-| Name | DenyAppListForRecall |
-| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+| Name | SetDenyAppListForRecall |
+| Friendly Name | Set a list of apps to be filtered from snapshots for Recall |
+| Location | Computer and User Configuration |
+| Path | Windows Components > Windows AI |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
+| Registry Value Name | SetDenyAppListForRecall |
+| ADMX File Name | WindowsCopilot.admx |
@@ -399,8 +426,15 @@ This policy allows you to define a list of apps that won't be included in snapsh
-
-This policy setting lets you define a list of URIs that won't be included in snapshots for Recall when a supported browser is used. People within your organization can use Recall settings to add more websites to the list. Define the list using a semicolon to separate URIs. Adding to the list would also filter and /Account. For example: ;;https://www. Adatum.com.
+
+This policy setting lets you define a list of URIs that won't be included in snapshots for Recall when a supported browser is used. People within your organization can use Recall settings to add more websites to the list. Define the list using a semicolon to separate URIs.
+
+For example: ;;https://www. Adatum.com.
+
+Adding to the list would also filter and /Account.
+
+> [!IMPORTANT]
+> Changes to this policy take effect after device restart.
@@ -422,8 +456,13 @@ This policy setting lets you define a list of URIs that won't be included in sna
| Name | Value |
|:--|:--|
-| Name | DenyUriListForRecall |
-| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+| Name | SetDenyUriListForRecall |
+| Friendly Name | Set a list of URIs to be filtered from snapshots for Recall |
+| Location | Computer and User Configuration |
+| Path | Windows Components > Windows AI |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
+| Registry Value Name | SetDenyUriListForRecall |
+| ADMX File Name | WindowsCopilot.admx |
@@ -452,8 +491,14 @@ This policy setting lets you define a list of URIs that won't be included in sna
-
-This policy setting allows you to control the maximum amount of time (in days) that Windows saves snapshots for Recall. When the policy is enabled, you can configure the maximum storage duration to be 30, 60, 90, or 180 days. When this policy isn't configured, a time frame isn't set for deleting snapshots. Snapshots aren't deleted until the maximum storage allocation for Recall is reached, and then the oldest snapshots are deleted first.
+
+This policy setting allows you to control the maximum amount of time (in days) that Windows saves snapshots for Recall.
+
+When the policy is enabled, you can configure the maximum storage duration to be 30, 60, 90, or 180 days.
+
+When this policy isn't configured, a time frame isn't set for deleting snapshots.
+
+Snapshots aren't deleted until the maximum storage allocation for Recall is reached, and then the oldest snapshots are deleted first.
@@ -488,7 +533,12 @@ This policy setting allows you to control the maximum amount of time (in days) t
| Name | Value |
|:--|:--|
| Name | SetMaximumStorageDurationForRecallSnapshots |
-| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+| Friendly Name | Set maximum duration for storing snapshots used by Recall |
+| Location | Computer and User Configuration |
+| Path | Windows Components > Windows AI |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
+| Registry Value Name | SetMaximumStorageDurationForRecallSnapshots |
+| ADMX File Name | WindowsCopilot.admx |
@@ -517,8 +567,14 @@ This policy setting allows you to control the maximum amount of time (in days) t
-
-This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall. You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB. When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity. 25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.
+
+This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall.
+
+You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB.
+
+When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity.
+
+25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.
@@ -555,7 +611,12 @@ This policy setting allows you to control the maximum amount of disk space that
| Name | Value |
|:--|:--|
| Name | SetMaximumStorageSpaceForRecallSnapshots |
-| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+| Friendly Name | Set maximum storage for snapshots used by Recall |
+| Location | Computer and User Configuration |
+| Path | Windows Components > Windows AI |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
+| Registry Value Name | SetMaximumStorageSpaceForRecallSnapshots |
+| ADMX File Name | WindowsCopilot.admx |
From eac069762953869743531ec6c2e04f3e6be19987 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 11 Nov 2024 15:51:56 -0500
Subject: [PATCH 025/165] updates
---
education/windows/take-tests-in-windows.md | 2 +-
windows/configuration/taskbar/xsd.md | 2 +-
windows/security/identity-protection/remote-credential-guard.md | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/education/windows/take-tests-in-windows.md b/education/windows/take-tests-in-windows.md
index 8c46ac4b93..55856b5df0 100644
--- a/education/windows/take-tests-in-windows.md
+++ b/education/windows/take-tests-in-windows.md
@@ -1,7 +1,7 @@
---
title: Take tests and assessments in Windows
description: Learn about the built-in Take a Test app for Windows and how to use it.
-ms.date: 02/29/2024
+ms.date: 11/11/2024
ms.topic: how-to
---
diff --git a/windows/configuration/taskbar/xsd.md b/windows/configuration/taskbar/xsd.md
index c6d5ded3aa..b6e5d620fe 100644
--- a/windows/configuration/taskbar/xsd.md
+++ b/windows/configuration/taskbar/xsd.md
@@ -2,7 +2,7 @@
title: Taskbar XML Schema Definition (XSD)
description: Taskbar XSD reference article.
ms.topic: reference
-ms.date: 02/15/2024
+ms.date: 11/11/2024
---
# Taskbar XML Schema Definition (XSD)
diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md
index 494d9a4978..f7dbf10cd7 100644
--- a/windows/security/identity-protection/remote-credential-guard.md
+++ b/windows/security/identity-protection/remote-credential-guard.md
@@ -2,7 +2,7 @@
title: Remote Credential Guard
description: Learn how Remote Credential Guard helps to secure Remote Desktop credentials by never sending them to the target device.
ms.topic: how-to
-ms.date: 03/12/2024
+ms.date: 11/11/2024
appliesto:
- ✅ Windows 11
- ✅ Windows 10
From 51cdbe4c03bfddd55d478017861099c75b25ae6e Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Mon, 11 Nov 2024 17:34:19 -0700
Subject: [PATCH 026/165] Fix description formatting
---
windows/client-management/mdm/policy-csp-windowsai.md | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md
index eec9d85257..63156607f8 100644
--- a/windows/client-management/mdm/policy-csp-windowsai.md
+++ b/windows/client-management/mdm/policy-csp-windowsai.md
@@ -1,7 +1,7 @@
---
title: WindowsAI Policy CSP
description: Learn more about the WindowsAI Area in Policy CSP.
-ms.date: 11/07/2024
+ms.date: 11/11/2024
---
@@ -366,7 +366,7 @@ The list can include Application User Model IDs (AUMID) or name of the executabl
Use a semicolon-separated list of apps to define the deny app list for Recall.
-For example: code.exe;Microsoft. WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe.
+For example: `code.exe;Microsoft. WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe`
> [!IMPORTANT]
> When configuring this policy setting, changes won't take effect until the device restarts.
@@ -429,9 +429,9 @@ For example: code.exe;Microsoft. WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe.
This policy setting lets you define a list of URIs that won't be included in snapshots for Recall when a supported browser is used. People within your organization can use Recall settings to add more websites to the list. Define the list using a semicolon to separate URIs.
-For example: ;;https://www. Adatum.com.
+For example: `https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com`.
-Adding to the list would also filter and /Account.
+Adding `https://www.WoodgroveBank.com` to the list would also filter `https://Account.WoodgroveBank.com` and `https://www.WoodgroveBank.com/Account`.
> [!IMPORTANT]
> Changes to this policy take effect after device restart.
From 0d7e2701ac7f95095f1028c57b9415fed7ae2b5b Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 12 Nov 2024 14:05:07 -0800
Subject: [PATCH 027/165] edits for wip
---
windows/client-management/manage-recall.md | 54 +++++++++++++---------
1 file changed, 33 insertions(+), 21 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 038622ded5..3eb1e0c7b9 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -3,7 +3,7 @@ title: Manage Recall for Windows clients
description: Learn how to manage Recall for commercial environments and about Recall features.
ms.topic: how-to
ms.subservice: windows-copilot
-ms.date: 11/14/2024
+ms.date: 11/15/2024
ms.author: mstewart
author: mestew
ms.collection:
@@ -18,20 +18,21 @@ appliesto:
>**Looking for consumer information?** See [Retrace your steps with Recall](https://support.microsoft.com/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c).
-Recall (preview) allows users to search locally saved and locally analyzed snapshots of their screen using natural language. By default, Recall is removed on commercially managed devices except for devices running Windows Home edition. IT admins, on their own, can't enable Recall for users. Recall is an opt-in experience that requires user consent to save snapshots. Users can choose to enable or disable Recall at any time. IT admins can only set policies that give users the option to enable snapshots and configure certain policies for Recall.
+Recall (preview) allows users to search locally saved and locally analyzed snapshots of their screen using natural language. By default, Recall is disabled and removed on managed devices. IT admins can choose if they want to allow Recall to be used in their organizations and users, on their own, won't be able to install or enable it on their managed device if the Allow Recall policy is disabled. IT admins, on their own, can't start saving snapshots for end users. Recall is an opt-in experience that requires end user consent to save snapshots. Users can choose to enable or disable saving snapshots for themselves anytime. IT admins can only set policies that give users the option to enable saving snapshots and configure certain policies for Recall.
This article provides information about Recall and how to manage it in a commercial environment.
> [!NOTE]
-> - Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs).
+> - Recall is coming soon through a post-launch Windows update. See [https://aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs).
> - For Copilot+ PCs that are running Windows Insiders, Recall (preview) is now available. For more information, see [**Placeholder WIP Blog link**>](https://aka.ms/windowsinsiders).
-> - Recall is optimized for select languages English, Chinese (simplified), French, German, Japanese, and Spanish. Content-based and storage limitations apply. For more information, see https://aka.ms/nextgenaipcs.
+> - In-market commercial devices are defined as devices with an Enterprise (ENT) or Education (EDU) SKU or any premium SKU device that is managed by an IT administrator (whether via Microsoft Endpoint Manager or other endpoint management solution), has a volume license key, or is joined to a domain. Commercial devices during Out of Box Experience (OOBE) are defined as those with ENT or EDU SKU or any premium SKU device that has a volume license key or is Microsoft Entra joined.
+> - Recall is optimized for select languages English, Chinese (simplified), French, German, Japanese, and Spanish. Content-based and storage limitations apply. For more information, see [https://aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs).
## What is Recall?
-Recall (preview) allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Snapshots are taken periodically while content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language.
+Recall (preview) allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Snapshots are taken periodically while content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language.
-When Recall opens a snapshot you selected, it enables Click to Do, which runs on top of the saved snapshot. Click to Do analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
+When Recall opens a snapshot you selected, it enables Click to Do, which runs on top of the saved snapshot. Click to Do analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files.
:::image type="content" source="images/8908044-recall.png" alt-text="Screenshot of Recall with search results displayed for a query about a restaurant that the user's friend sent them." lightbox="images/8908044-recall.png":::
@@ -39,13 +40,14 @@ When Recall opens a snapshot you selected, it enables Click to Do, which runs on
Privacy and security are built into Recall's design. With Copilot+ PCs, you get powerful AI that runs locally on the device. No internet or cloud connections are required or used to save and analyze snapshots. Snapshots aren't sent to Microsoft. Recall AI processing occurs locally, and snapshots are securely stored on the local device only.
-Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. Recall requires users to confirm their identity with [Windows Hello](https://support.microsoft.com/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0) before it launches and before accessing snapshots. At least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall. Before snapshots start getting saved the device, users need to open Recall and authenticate. Recall takes advantage of just in time decryption protected by Windows [Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). Snapshots and any associated information in the vector database are always encrypted. Encryption keys are protected via Trusted Platform Module (TPM), which is tied to the user's Windows Hello ESS identity, and can be used by operations within a secure environment called a [Virtualization-based Security Enclave (VBS Enclave)](/windows/win32/trusted-execution/vbs-enclaves). This means that other users can't access these keys and thus can't decrypt this information. Device Encryption or BitLocker are enabled by default on Windows 11. For more information, see [Recall security and privacy architecture in the Windows Experience Blog](https://blogs.windows.com/windowsexperience/?p=179096).
+Recall doesn't share snapshots with other users that are signed into Windows on the same device and IT admins can't access or view the snapshots on end-user devices. Microsoft can't access or view the snapshots. Recall requires users to confirm their identity with [Windows Hello](https://support.microsoft.com/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0) before it launches and before accessing snapshots. At least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall. Before snapshots start getting saved to the device, users need to open Recall and authenticate. Recall takes advantage of just in time decryption protected by [Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). Snapshots and any associated information in the vector database are always encrypted. Encryption keys are protected via Trusted Platform Module (TPM), which is tied to the user's Windows Hello ESS identity, and can be used by operations within a secure environment called a [Virtualization-based Security Enclave (VBS Enclave)](/windows/win32/trusted-execution/vbs-enclaves). This means that other users can't access these keys and thus can't decrypt this information. Device Encryption or BitLocker are enabled by default on Windows 11. For more information, see [Recall security and privacy architecture in the Windows Experience Blog](https://blogs.windows.com/windowsexperience/?p=179096).
-When using Recall, the [**Sensitive Information Filtering**](#user-controlled-settings-for-recall) setting is enabled by default to help ensure your data's confidentiality. This feature operates directly on the device, utilizing the NPU and the Microsoft Classification Engine (MCE), which is the same technology leveraged by Microsoft Purview for detecting and labeling sensitive information. When this setting is enabled, snapshots won't be saved when potentially sensitive information is detected. Most importantly, the sensitive information remains on the device at all times, regardless of whether the **Sensitive Information Filtering** setting is enabled or disabled. For more information about the types of potentially sensitive information, see [Reference for sensitive information filtering in Recall](recall-sensitive-information-filtering.md).
+When using Recall, the [**Sensitive information filtering**](#user-controlled-settings-for-recall) setting is enabled by default to help ensure your data's confidentiality. Recall leverages the libraries that [power Microsoft's Purview information protection product](/purview/sit-learn-about-exact-data-match-based-sits), which is deployed in enterprises globally. When this setting is enabled, snapshots won't be saved when potentially sensitive information is detected. Most importantly, the sensitive information remains on the device at all times, regardless of whether the Sensitive Information Filtering setting is enabled or disabled. For more information about the types of potentially sensitive information, see [Reference for sensitive information filtering in Recall](recall-sensitive-information-filtering.md).
-In keeping with Microsoft's commitment to data privacy and security, all captured images and processed data are kept on the device and processed locally. However, Click to Do allows users to choose if they want to perform additional actions on their content.
+In keeping with Microsoft's commitment to data privacy and security, all captured images and processed data are kept on the device and processed locally. However, Click to Do allows users to choose if they want to perform additional actions on their content.
Click to Do allows users to choose to get more information about their selected content online. When users choose one of the following Click to Do actions, the selected content is sent to the online provider from the local device to complete the request:
+
- **Search the web**: Sends the selected content to the default search engine of the default browser
- **Open website**: Opens the selected website in the default browser
- **Visual search with Bing**: Sends the selected content to Bing visual search using the default browser.
@@ -61,6 +63,7 @@ The temporary file is deleted once the app is finished with the content.
Recall has the following minimum requirements:
- A [Copilot+ PC](https://www.microsoft.com/windows/business/devices/copilot-plus-pcs#copilot-plus-pcs)
+- 40 TOPs Neural Processing Unit (NPU)
- 16 GB RAM
- 8 logical processors
- 256 GB storage capacity
@@ -81,17 +84,16 @@ Users need a supported browser for Recall to [filter websites](#app-and-website-
## Configure policies for Recall
-By default, Recall is removed on commercially managed devices except for devices running Windows Home edition. If you want to allow Recall to be available for your users and allow them to choose to save snapshots, you need to configure both the **Allow Recall to be enabled** and **Turn off saving snapshots for Windows** policies. Policies for Recall fall into the following general areas:
+By default, Recall is removed on commercially managed devices. If you want to allow Recall to be available for users in your organization and allow them to choose to save snapshots, you need to configure both the **Allow Recall to be enabled** and **Turn off saving snapshots for Windows** policies. Policies for Recall fall into the following general areas:
- [Allow Recall and snapshots policies](#allow-recall-and-snapshots-policies)
- [Storage policies](#storage-policies)
- [App and website filtering policies](#app-and-website-filtering-policies)
-
### Allow Recall and snapshots policies
-The **Allow Recall to be enabled** policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled for managed commercial devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own.
+The **Allow Recall to be enabled** policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled and removed for managed devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own.
| | Setting |
|---|---|
@@ -99,7 +101,7 @@ The **Allow Recall to be enabled** policy setting allows you to determine whethe
| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Allow Recall to be enabled** |
-The **Turn off saving snapshots for Windows** policy allows you to give the users the choice to save snapshots of their screen for use with Recall. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. Administrators can't enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent.
+The **Turn off saving snapshots for Windows** policy allows you to give the users the choice to save snapshots of their screen for use with Recall. Administrators can't enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent. By default, snapshots won't be saved for use with Recall. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. If you set this policy to disabled, end users will have a choice to save snapshots of their screen and use Recall to find things they've seen on their device.
| | Setting |
|---|---|
@@ -125,9 +127,12 @@ You can define how long snapshots can be retained on the device by using the **S
### App and website filtering policies
-You can filter both apps and websites from being saved in snapshots. Users are able to add to these filter lists from the **Recall & Snapshots** settings page. Some applications are automatically excluded from snapshots. For more information, see the [Applications that are automatically excluded from snapshots](#applications-that-are-automatically-excluded-from-snapshots) section.
+You can filter both apps and websites from being saved in snapshots. Users are able to add to these filter lists from the **Recall & Snapshots** settings page. Some applications are automatically excluded from snapshots. For more information, see the [Applications that are automatically excluded from snapshots](#applications-that-are-automatically-excluded-from-snapshots) section.
-To filter apps from being saved in snapshots, use the **Set a list of URIs to be filtered from snapshots for Recall** policy. Define the list using a semicolon to separate URIs. Make sure you include the URL scheme such as `http://`, `ftp://`, `file://`, `https://www.`. Sites local to a supported browser like `edge://`, or `chrome://`, are filtered by default.
+To filter apps from being saved in snapshots, use the **Set a list of URIs to be filtered from snapshots for Recall** policy. Define the list using a semicolon to separate URIs. Make sure you include the URL scheme such as `http://`, `file://`, `https://www.`. Sites local to a supported browser like `edge://`, or `chrome://`, are filtered by default. For example: `https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com`
+
+> [!NOTE]
+> Private browsing activity is filtered by default when using [Supported web browsers](#supported-browsers).
| | Setting |
|---|---|
@@ -135,7 +140,8 @@ To filter apps from being saved in snapshots, use the **Set a list of URIs to be
| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **>Set a list of URIs to be filtered from snapshots for Recall** User Configuration > Administrative Templates > Windows Components > Windows AI > **>Set a list of URIs to be filtered from snapshots for Recall** |
-**Set a list of apps to be filtered from snapshots for Recall** policy allows you to filter apps from being saved in snapshots. Define the list using a semicolon to separate apps. The list can include Application User Model IDs (AUMID) or the name of the executable file.
+**Set a list of apps to be filtered from snapshots for Recall** policy allows you to filter apps from being saved in snapshots. Define the list using a semicolon to separate apps. The list can include Application User Model IDs (AUMID) or the name of the executable file. For example: `code.exe;Microsoft. WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe`
+
| | Setting |
|---|---|
@@ -143,13 +149,10 @@ To filter apps from being saved in snapshots, use the **Set a list of URIs to be
| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set a list of apps to be filtered from snapshots for Recall** User Configuration > Administrative Templates > Windows Components > Windows AI > **Set a list of apps to be filtered from snapshots for Recall**|
-#### Applications that are automatically excluded from snapshots
+#### Remote desktop connection clients filtered from snapshots
-Snapshots won't be saved when certain applications are being used. The following apps are automatically excluded from snapshots:
+Snapshots won't be saved when supported remote desktop connection clients are used. The following remote desktop connection clients are filtered from snapshots:
-- [Supported web browsers](#supported-browsers) when using private browsing
-- Like other Windows apps, such as the Snipping Tool, Recall won't store digital rights management (DRM) content
-- Some remote desktop connection apps:
- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
- [Microsoft Remote Desktop from the Microsoft Store](/windows-server/remote/remote-desktop-services/clients/windows) is saved in snapshots. To prevent the app from being saved in snapshots, add it to the app filtering list.
@@ -157,6 +160,9 @@ Snapshots won't be saved when certain applications are being used. The following
- [Azure Virtual Desktop apps from the Microsoft Store](/azure/virtual-desktop/users/connect-remote-desktop-client) are saved in snapshots. To prevent these apps from being saved in snapshots, add then to the app filtering list.
- [remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows
+> [!Note]
+> Like other Windows apps, such as the Snipping Tool, Recall won't store digital rights management (DRM) content.
+
## Information for developers
@@ -169,3 +175,9 @@ Microsoft has been on a responsible AI journey since 2017, when we defined our p
Recall uses optical character recognition (OCR), local to the PC, to analyze snapshots and facilitate search. For more information about OCR, see [Transparency note and use cases for OCR](/legal/cognitive-services/computer-vision/ocr-transparency-note). For more information about privacy and security, see [Privacy and control over your Recall experience](https://support.microsoft.com/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15).
+## Related links
+[Policy CSP - WindowsAI](/windows/client-management/mdm/policy-csp-windowsai)
+[Update on Recall security and privacy architecture](https://blogs.windows.com/windowsexperience/2024/09/27/update-on-recall-security-and-privacy-architecture/)
+[Retrace your steps with Recall](https://support.microsoft.com/windows/aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c)
+[Privacy and control over your Recall experience](https://support.microsoft.com/windows/d404f672-7647-41e5-886c-a3c59680af15)
+[](https://aka.ms/wip)
From 8553da3080c68953e6ae98748db48682289d610b Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 12 Nov 2024 14:13:59 -0800
Subject: [PATCH 028/165] edits for wip
---
windows/client-management/manage-recall.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 3eb1e0c7b9..7594f092cd 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -42,7 +42,7 @@ Privacy and security are built into Recall's design. With Copilot+ PCs, you get
Recall doesn't share snapshots with other users that are signed into Windows on the same device and IT admins can't access or view the snapshots on end-user devices. Microsoft can't access or view the snapshots. Recall requires users to confirm their identity with [Windows Hello](https://support.microsoft.com/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0) before it launches and before accessing snapshots. At least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall. Before snapshots start getting saved to the device, users need to open Recall and authenticate. Recall takes advantage of just in time decryption protected by [Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). Snapshots and any associated information in the vector database are always encrypted. Encryption keys are protected via Trusted Platform Module (TPM), which is tied to the user's Windows Hello ESS identity, and can be used by operations within a secure environment called a [Virtualization-based Security Enclave (VBS Enclave)](/windows/win32/trusted-execution/vbs-enclaves). This means that other users can't access these keys and thus can't decrypt this information. Device Encryption or BitLocker are enabled by default on Windows 11. For more information, see [Recall security and privacy architecture in the Windows Experience Blog](https://blogs.windows.com/windowsexperience/?p=179096).
-When using Recall, the [**Sensitive information filtering**](#user-controlled-settings-for-recall) setting is enabled by default to help ensure your data's confidentiality. Recall leverages the libraries that [power Microsoft's Purview information protection product](/purview/sit-learn-about-exact-data-match-based-sits), which is deployed in enterprises globally. When this setting is enabled, snapshots won't be saved when potentially sensitive information is detected. Most importantly, the sensitive information remains on the device at all times, regardless of whether the Sensitive Information Filtering setting is enabled or disabled. For more information about the types of potentially sensitive information, see [Reference for sensitive information filtering in Recall](recall-sensitive-information-filtering.md).
+When using Recall, the **Sensitive information filtering** setting is enabled by default to help ensure your data's confidentiality. Recall leverages the libraries that [power Microsoft's Purview information protection product](/purview/sit-learn-about-exact-data-match-based-sits), which is deployed in enterprises globally. When this setting is enabled, snapshots won't be saved when potentially sensitive information is detected. Most importantly, the sensitive information remains on the device at all times, regardless of whether the Sensitive Information Filtering setting is enabled or disabled. For more information about the types of potentially sensitive information, see [Reference for sensitive information filtering in Recall](recall-sensitive-information-filtering.md).
In keeping with Microsoft's commitment to data privacy and security, all captured images and processed data are kept on the device and processed locally. However, Click to Do allows users to choose if they want to perform additional actions on their content.
@@ -127,7 +127,7 @@ You can define how long snapshots can be retained on the device by using the **S
### App and website filtering policies
-You can filter both apps and websites from being saved in snapshots. Users are able to add to these filter lists from the **Recall & Snapshots** settings page. Some applications are automatically excluded from snapshots. For more information, see the [Applications that are automatically excluded from snapshots](#applications-that-are-automatically-excluded-from-snapshots) section.
+You can filter both apps and websites from being saved in snapshots. Users are able to add to these filter lists from the **Recall & Snapshots** settings page. Some remote desktop connection clients are filtered by default from snapshots. For more information, see the [Remote desktop connection clients filtered from snapshots](#remote-desktop-connection-clients-filtered-from-snapshots) section.
To filter apps from being saved in snapshots, use the **Set a list of URIs to be filtered from snapshots for Recall** policy. Define the list using a semicolon to separate URIs. Make sure you include the URL scheme such as `http://`, `file://`, `https://www.`. Sites local to a supported browser like `edge://`, or `chrome://`, are filtered by default. For example: `https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com`
@@ -151,7 +151,7 @@ To filter apps from being saved in snapshots, use the **Set a list of URIs to be
#### Remote desktop connection clients filtered from snapshots
-Snapshots won't be saved when supported remote desktop connection clients are used. The following remote desktop connection clients are filtered from snapshots:
+Snapshots won't be saved when some remote desktop connection clients are used. The following remote desktop connection clients are filtered by default from snapshots:
- [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
From 427ce103235db7dec77ad66fe2fcf247ae4ae9f9 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 12 Nov 2024 14:15:17 -0800
Subject: [PATCH 029/165] edits for wip
---
windows/client-management/manage-recall.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 7594f092cd..03f277533a 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -132,7 +132,7 @@ You can filter both apps and websites from being saved in snapshots. Users are a
To filter apps from being saved in snapshots, use the **Set a list of URIs to be filtered from snapshots for Recall** policy. Define the list using a semicolon to separate URIs. Make sure you include the URL scheme such as `http://`, `file://`, `https://www.`. Sites local to a supported browser like `edge://`, or `chrome://`, are filtered by default. For example: `https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com`
> [!NOTE]
-> Private browsing activity is filtered by default when using [Supported web browsers](#supported-browsers).
+> Private browsing activity is filtered by default when using [supported web browsers](#supported-browsers).
| | Setting |
|---|---|
From 64dd5be9bbb5ee2205697e75d97dcdd4158caf5a Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 12 Nov 2024 14:26:32 -0800
Subject: [PATCH 030/165] edits for wip
---
windows/client-management/manage-recall.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md
index 03f277533a..7f1fe4ccd3 100644
--- a/windows/client-management/manage-recall.md
+++ b/windows/client-management/manage-recall.md
@@ -153,12 +153,12 @@ To filter apps from being saved in snapshots, use the **Set a list of URIs to be
Snapshots won't be saved when some remote desktop connection clients are used. The following remote desktop connection clients are filtered by default from snapshots:
- - [mstsc.exe](/windows-server/administration/windows-commands/mstsc)
+ - [Remote Desktop Connection (mstsc.exe)](/windows-server/administration/windows-commands/mstsc)
- [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect)
- [Microsoft Remote Desktop from the Microsoft Store](/windows-server/remote/remote-desktop-services/clients/windows) is saved in snapshots. To prevent the app from being saved in snapshots, add it to the app filtering list.
- [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows)
- [Azure Virtual Desktop apps from the Microsoft Store](/azure/virtual-desktop/users/connect-remote-desktop-client) are saved in snapshots. To prevent these apps from being saved in snapshots, add then to the app filtering list.
- - [remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows
+ - [Remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows
> [!Note]
> Like other Windows apps, such as the Snipping Tool, Recall won't store digital rights management (DRM) content.
From 614ef463b071d84d4dd626cca84024762808db4c Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 12 Nov 2024 14:53:16 -0800
Subject: [PATCH 031/165] update image
---
.../images/8908044-recall.png | Bin 1719851 -> 1948265 bytes
windows/client-management/manage-recall.md | 2 +-
2 files changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/images/8908044-recall.png b/windows/client-management/images/8908044-recall.png
index 92c93c46cb4255842b2e6944083c65ebadd63a1c..3ccca5ea9d5a5d7de506cdd50525145e0c3e55c3 100644
GIT binary patch
literal 1948265
zcmX6^bwHEf*B>D*Axfu+NS8Eh@!Ex18
z`VUk-!n6%M!MB!IlLvvSVn{J&_kicbPOtS`K_EVryC0l9xuhZx=r-@oOZoR+#(No_
z=}#0dZy|Dwj)Lurv7(`DxDPnFai5+RqzL1_qU;FDF^^{ZdMp;9{Pqc#{L2?_NFH=Y
zhCd-DWGb|*UpqK=^t`@Mx)41%71dt+yZBd5?$_wGvFoIfw$VyaL1y?ob$e`-#FAGA
z8=Vh7WiusF9kGHv9exK72$x>xUBYS*J7sqn4_RJ?2s80(_JoDE)FiVtt64b=#qJ_4
z+ZW(+n_8*TH`(%(Y-C-%iSR~EjWS-fyy&X};rC+vt*WK6y6&$#MHL-BvC`BW5(SK~
z<$aRt!HS$Ex}S}MiAicl-zHAIpjWYtv;O;Q{_*7=;m*DUF8==c+uw4RLC7Ar{rJw4
z;8~rQ1M+tTo5ReNP!QxGcACv-os0>{%Azz(C-7m^Vq-l?=d?3
z-aZLn!@Q)#ufP?0g7++Zm6myd_baW}r}6$7^HH}~Y1;1SG4*0redv1v+6JPD3V-93
z;e3)6|Byp9!Z-1QWiQ_wtSQGAek@_nu+^76yHd0$u-^Ulnal6ss(T+0%=syrSXfm23T{7;8Ru2x@v9V?YiAQKDkto|m@gEDl>6Pe&Ig8D3u
zDjrp9{=@cvo)-15<;*jl^5727d8SPnvO)r)z1K0NOCw;2j`{s1w1(HGS2VL~dg}cV
zKL~nnEbb;e2dzYS9)2G|3JxUC^0@vE4
zBz)$6Y)o%hTxwmUbYmdPTDI|HP;=(BG2@`3;^S|LKNGm1Ep&yy1k2-^8B6m6A=)jm
zCGc-i&$CozQpi3-RlRx5bJNHZi+H47p=Gyr(sy5>Oog0&
zHold2&#zT^_fWCu8#kyxT{RMJKc1r)^G0K~7ez`V>pCNpj?tsUXM7D&d{?YUct$e&
z_{U*z=5~m9!OpW^LOjA{GCYCzZ&fB?AI9R~+K88o`zIB*Y7dv1HF-j3>gUF{@y^ZWkd7}{Y1*L6c+{=&8NZgivh=hOdyH9W#o8>GZB{Qle%{GOpX=(&
zJ&EGj+$mpHhe0mwx&h4-0yDvVshaC`_L*h@%i)SeGH=F<_=277tY&3rnJG=4)+-Ax
z{{i_NwL!k{PGn+m!Q;BS#io(vl~;|Y$mT+sz!3Y&MJzQ&z$z;n1+gF8dur@?*mAM-
z1lzb2R5$)At(hd{DvD)LE5V1j>%U#>;OAAls@GvOCBOA93ra&m9!KBkG3fZo`x`@2
zWNhLyB%lOeJJalxt-dkmF}#zJ#x9>7rtO>!=pK{|=jr;nc}aT}(|A9NF`<1K&7K+=
z(wC^R$JEjb_sz0D&Fpf?KP3Ezt#YFR4~pll
z9-V3!a~D|I$?D2oFqB(wl?%iL+l2*WPYLCd&b7V0`XUsXzpix7b=)fPKACXB_b*%#
zSj%@4M7Z`$_zE-pA1b$RcaPU3((J1TM$Bd#8QS>{%AYBp9VvKAx9dt;(TEmsJ}&!kX+7E|kGQWcDq8RWH9xUMYpC(cSi
zmh!^9vdVY2lKr(#hq;Dl6C8LHE%ggz2Qp~}tlKop{32>|c~+o3rPVE)KGe)9Emr3u
zP04lF>pfCgLBckO>?z;a@b_Pi1Pp4ddgIq08x`(MM;>8T_FV+!8k
z6O8C=p(D(Uy)wLm*6YfhqaYc7HBdQ!d6LmFGdz{Y7&3U8*ADa4U{70k-=yk&QuEF<
zXRtoe&q=1ZMg&XruVCluf)%pS%=e|h%k~wMY=5x$l~1gU6ggR^Vfml5gVZ|u`G?_y
z!4g+F&h?t5BiGbR6xtj!BKw8p4BzW2Wps~Q1MkwYgS&yl>*UTsH=9O|Jf1_NY;TtX
zpYoKTjOBZxkK*pF(eOolYgrlTd%vW_r2MzuR>}E6sIrAoK79B~-9yNwZ3^)_&Fr&}
zj<-|)f7cKGkmDLwb`Thpy%KN}5===UYRiL|lssz*C5Vt7%W6Fe&MBt&K=!zK8=V2;
z4SLfH9`i|M>4!zrs9fPx52(pxbDd~fwH8Mj41^BQT)ffJRDKZNm~_#KLhNwYS(yu*
z*vD{BqTX3uIHMS2wwEoxT*djjLOKwi!07LqDSfi
z4O%|DxW6UoQK-9bXO_L|M(pHB08=b?D?9H88oin0rNo@kjZVwrp!kk|M3Bf;iw}=y
zToazI7Bg=whn}R)AY(V!^w8B$im$QwYE24QVn<*b=PBXih_f*0-|U~ufn?X{M`vwp
zdC++9z)WEA74Tk88h;k?FR~i92L0f!6VKb>&i&zH^K#eDXFSHA`QQ3Nnwr?#8Jy4g
ziN1|p`=8_(vY!V_@6N+Z3f?i?dYHX<-df7cOey@F984wnLFqZTutcLgyqeGhz0$hr
zFnu22a$H(4j;!eme4$;fs#z;{`Csb_k@J#Y?K_)Wmr+JC=3)vjX+tpfjvryn0F7&m&(
zWEJjf0^#b@{hp3swC!R^21*7pU5mEtUZ~R^Iy$z
zcqdJa$l_a$#Jc?{dF?d9$Z`vlQJJ{!XwA$@qDVs-)o&SslD13_FJUiZ#53N
zo3n($%gfGS&wXn9W>oJke#aR0g%F>@vv5s_bfxa+5%X-8L0$s2t{N$ALYq9p0
z@zY=$1+-`U0QOaI3LBA-v~+k?l`t6v1y^Q)hIT@fL6V-0_yUU^WR}$irMJXs|taxF>+^({0C8clVPdL6hi5ygJVhzAcTt
zCC$yvrK6{pFL{KO)Or#a7eHyL{ln=4B{=!zT=A`_O9
z3PYhDrKF@d4MtSB@Vb99%If+0FqXBmWX*bFab-Upkz6of;giQG#j16k_bfc;^y`2Q
zuc6?q*P7ZAEq)p6YZJwHJ6sN{rK*DUEL$C4%@g!&wT?Ti(v?)aTRzFD30}2ixmNYb
zQ<`r6`A)~ks8I4Z9N|XkZ%ET*6dQW4B;e{Xtl~6t$JWqB+I^-4L1Q9b`z?wo6&zrC
znTrFXzy7zLb1u^ivxKMSjuciTU_U}0BLY?fP}Y|TbdGh^%PT(ITFK4lGEYnp$KpdH
zdvlCC_7x3C@;|Ut*MZ$(rp|luWsdW*$$WLJXYpBlTTaHOn`bngLfvSzWRif<+zFmf
zSC_&*8fuXa1NtFQjWxbYC>)QOgV
zsKQ-a;}zL0vm8&HTMpOa^nMkg-No?c-p1x+L*&Pt=VUbocbpv5mU2
z%Nt|ynY{PpP@Z%DGfRUf^Ru^_TS*r92-(9#|26M5Z+gqYbGOrG%z
z1HTb=OBy5BnFKGAi6jM`seSt~MJnb&rG8lWL(r>NuY_DTRY9Mc{=O;s+gYk7Dhxcu
zmv{T%WXmI+fK027bFd?uX?ZT^#-<%3`q}}yz^m9|FTAej8Akptz@+7Y(Q|D%
zls_qs*@EK8O^C)WUHrfOnS8Fj`wGW^Y+HANysbu`zqERgCq>HjX?}iwrOU?PpB{UY
zv5wEhKfp!NzY`q$qbH6Vrvq@O3v_-^G$YPw+lC6+qjE<764$)HV!O4hh`AnY%@f6m
z2RjtDF`ssMF~OYJ&M3dEejTnRsBz4pe;esLV{MY;p0^L_&2&I|GFHV($R23#e6h2Lp{
zU;CeYqq3rrr^K$T0HBl!^Rbzkr;~eVP?Qm;jPr9gykBmI_PE5ZCgs>5Gd=%58zMh7
z{ku@zc|z7zpby$qrU1g0@IFb`TSD|?V*AmIZn%u!KdmA{$KvWgNzhh>{Cd6YtfzBa*q+wWEeh5Rhu
zhgr?JUw2#+vfBCNWAug>Dj(5NP@M|f;AMho}&HksEc+5JNNi5z^l8_qHe!&d
zs;X*gYx}_U<7n^JR^jQ$7j6X3$KllA@$p!Fcw^FX(L1A5m+f%ji=P@aEycKL0?4XsZbvogks(
z*iblYTT=-n1~xJUV4zPhsR5%B*r^tj$RfMUpaZvw`t;l^2Ry}Y8@
zN3Uj;Bw};7hb4}UxdZabKCFldE;eLsXO_o`4maAEFL}v{3Bwh?ZNyr|T?D?FdMqun
z^*doJoILFx`7}zwR^Vq(JYn^Kx`*TzCdhm>Ch-IR$)Tlsj?AFMA$0Qi&x!RP3mN&L
z1GwTHBXzMQaozl5bKC3yd!5SM+xzi!?=4FxvQ$+d-L|`GX>gE3ZM1qzxnbxBlba;;
zd{6IF&C4O~Oou!jRpoI9;z{8ic{j{sqv+Md(9}GGvy{PShl@p*f66tfnr~Eh|J^~E
zxkB`%7BWD1L4#tG8%Vw$0~A6>P%9zfzpid-9YPT)7*UODdrHU^hxq7
z7xpT;GPiVpxUllqC$RMh6B~?IKK^wYk!1%3cYhbjv2hWBqaYqL)pG_d|0C%&#|J)1
z-@pGi_RCNsyu0t(R;yu0K7XVF@169FW`3~B$Y$%U#6CO0r*bTnU)Rqvh)!kGdL)%LSmFjQu9nWA*9zYFKOn<>2`u
zDObBwm|&qTBX?lVACoEk`7T=U5;DU*)Zb6k+nbYBQIk~l@pY<|zR|mZ*Wp96r7C&P
zG9U43X|d~<(EuTk=)|SHH7}NBb5HwQOj4k#V!V&q`Q%4CEA-A$ntE7%#VMW5FJQWv
z=#7B{@*OsolC`PeLjFyfbt(|h{7i-W$He@%Is|x=?O;=A><)TpK*Uok;pTIacRdYt
z@o=D`DY|65^`MU|zpjP-5v_~8Jy};*S4w*N&jN-(KfG`I*%`z4tC}1Fe!M4rlU9;F
z5Y5vPm?pNfyQOerb8(t}=#%J-^4(UNJsvZdRMQNW_nCV9^SQ&%#3#csLOuKos`7N~
zISPyW7UX+EEDox{dt4LSnXKV#xG1fl!2k54;vtvcvyViWC|GlRzeJW#(hU2&xt$i(
zqxmOUED-a?PExx7+L=J%5|3~j7SkKlT%w+c3XLD-S#+XD9g4groqG8*`kNgx^FqTi
zesJ!ocY7I;+SSkIEfZ`wgOy-~_qUkNM4d!+aS&ryJIv08{F
z=-0c|&&HdAWKx`OI?d=Hw3NSVGe!eUWpR*Lc^Nakd
zQ({pSAuuLcVeeZQE(A`I5*NoSOY$}lCgCtj{J3lmHSA0YJ54&Bk+ojI64&MBSKbV0
z{_*q9E)P1*NF#0(7+-w$sC_pW?pl9;t@h7Dox2TheB|6>6RF`?>uw4nqT!qUef=g+
zZH%GwV<>CjG{(JhYwB=y+u#;A=sB_W!?qyQ7g+^gohzo|nTNjVt5CQ1F4=0z?{+M*
zuY^R}%${eHuVpo*$@z){Y?JYVy7nph3HzbJQDL*Pd;jKxZpYKI=cHPTN50$Efitdu
zkDAB*Gq!0t)QXRn2x}!ppIG|xJ$-4ZpcWyfnB4_Bvp3WZwO2BfNQAZjL~C+6?AIZL
zKTNP~%|9j&klSXiHeqkweAlkZ}PT({bDiPv${>2t^iM#v2SCpUG%a0lP(n!
ze6bYDczeVpi#h5NDbyaZqGJhPI=z`%E%>SXR6#-EgH@tb)D`hOpUadVZqZrT#HQhI
ztYD0y1N7$>MPFrDJd^
ziW{1*K_i>q{A$9M0PFm0^fyY)L%ET+e0{tK*7IJxPUL!wHx0`dSOd=vmQI6{2wXA(
z?ok?|orp(->+$!<&TK44_R3;Q&roXAM5W*wJZMu
z+%LV%VKcS(+$V*|n3%Pqg5$Qu&s`MDC^Z~dhR16SRH)$%=X%S8jB0+nCl(zYqu@M*
zNgFgDR0=1y7pnf5pY(LG;iq}sXJgkFcxTx%%6R#Kf{MhmjG9}itZ%SWIbm;bxA0+Vn2&?P)MUvQ;J
z_dWRc!T;>9^G2fXo5M^he4LNaN~&qU1C|fB?$;La7yblxm^KNE4NFp9-H;CrE+o9V
zs%AZdl<_6yp#xHLPp>Il%UHrWc;pq|
zMfST(G(5FtdqD|Rb-Vem7rD8JxjZ>4(tt53`ELx(x|Hw(E;^%W9a4^#kkyZ}76FsN
z?B}OddZ8X%rck?xw!0C?
zOO$CxfEq7d>ij>~Q8}m8u)ehcuB>j@bxWDtz!vAPX?;=yW;degf3AY~t~y=lLCUo?
zEjkl0kl^1$#%P#b9&e=`^sQZQ++D53&7H~os#jujAWxu9ud(lba9#6;n&eh?AP$I-*^O=5$WxBVxjR;*P%{Ac#3#?}o7yI|uuXxQ
za(}0!B04M650}Mv&)IK#$fTn)
z_@b5zv|HXpPJZ40W7aA;!)e)9boFQIKUE&Xwh->2t;OP<)pV-eGMqv#63C;qizS7uj?oi;CIAx-b#uWS={ka?KWKx;o(d@H
zH)07BgJzP-+;U$1vS+1zk13Q@U5mI9&+$F@1JQM@n55|jRrFCliq&v(BL|S0y7W3d-lhMj_e5USf4$-RBCsJ_9q8%ZUqa@
z-t(~Q)w>xi#|%TM**AyNLNAz(1Tb4@>Zi(p%u-FwdKI7x(It+-^8D>Pf
z)Scs%evO2t;l7FcS<}bTv=#;RY9UHoPem9-kP0>vwKbkTE^XLMo!!l=Xt#)wo91_(
zpzy}!3O?^OHmyJk!Y@x|ZTgr|sWYuO@$vCqXC)?KxiQkX$V^XgwCwSx?8tIjzdtW2
zUtVi#$kj;J!7T5$BpNHssn2|yGvThSeJ5y0;ATRuB>Lky-8?u8aA>LZ9BMAn=XGtt
zNV&s?iINDQ@L=fNlZc)w07r4ENT0;PtcLjOy5Ddy$KX-O64fnwG@Ytb;^UA@t(!LQ
zS^2JbVU*O=>`%Ek>iXpX7hg!;QHx&|mF{V=(Hv!Ux|9MiFoF7I>w3(w$;$B%Jeaql
znGBBI%{r=zVGjB6W2@5mZ)xk5t=IXlI$K0V+s)Oi+obiA&Sx9rUyN?4L(T_iOzHr3
zxJ~-g!uBlLi$AHOt$
z{`*vhgM$N&3WIb?S!di~>GopJJ%|h;VcW%v?S(ofRNm-X{aPzW2DN?7-=zA}IFse?
zX%2H9@hZoy%c%Swh_p1`p$~Gt3dlRk6%#-6=HWphbB`tD+l{UF=YG)Vg{FnwiKMONiUG4i0q>6ET!fa!6tl4?
zB_&YQ-R3v8Vb5ipfL*g1!U#i}B;S*3Mr}n0*%gxd5B
zY@Px3)fYjuOnUw7z>!Sf)eD2yLdCHi5UiG#W{lN|OBg>bL%Q$U-*dZ`|J^gVfzF
ztBK}5o$E=VfM0DhmQ^{FK|wFT>X-YTrBTQsr*We6{xc=jc*Z!fi`*IFZbviwi0jza
z(gJ1f;uGij=l#{HGRHX3Q4zrb4(b6oMh}6WmSV{|tS1bvTprad*#12A=rU%3kh(wafGOme~`-2>o~AP`^{W6%`>a
zhlCZm71uvEqci{X?6yPp1qJd9Vi-24oAcZAxV0_;Dx^8etQIoC=EWSsEx7Uap`s0m
zT}6xd&E;sCb1%L1YU!^Lbu8wzpuiO94Eg|-yM;eoA_c%S+_UZa1?C#zsZW7av@ZYO
zPRvCQ>PGi+7o_t9x-EI^$Lf=Bik-b>0hP9%iI1-|qA6LJ`_ocV!pV2b(z_M7{BSf3
zue3Zq2}(yw&_g7IsmyJ8y2sMZ8U4LeQvc^l+?6~h)n%A(G00)B71DS@T!S(i@mW*6
zQXmf!dybUq{i-zWz%8xnWtbqn8#bVd>!;En39Do6>V#X^H)3ZxZ+_yDzER1`fA)9T
zn{SSGEXUNYaKm4S93;57%UQn~UIK7F^X)`ab8}qUbU3^5&8_j%mgeIVQo+vJ`Td~%
zS_FN??6sKWZ2)Q2VJo!5_Zq!#GjETzH}n}0tVH!PDhqOf{k905C&D1A^-+L+xDWLs
zH9nd1Kbq3g;KbPDqpHPb9^W!pef0BVs(|e?9v!!sM4(Wp+UpqDk(}Q;N9fZ|9;)}c
z)zRzz#{Y?{b2BFYS84RBcKds~J4almof5SXoy36LTgCLm$K(s{@-R0x!ARu~JpnpK
z@3k)`@qTcL*Mw25r_3=L>1tE_Sb0IIk>(_Q^bHSI*y%C$A8g2OvgOIX9%ooWT^U$X
zHgbw_f?rEkRzR!y_xHtE=|>2+
zt#A<|lTLKO_c+201+ACktR#q2iGr>!oL(JvoD$k*J-7u3u!RZ7A)?M8HMSdEkqRU)XTEkHTh
zZPE7L2WvbyHKQ(&+~(j7_do{FyN$5jgZ^6~&})@!6mEjuF$dbM0%~so`xCVx2q%VL
z&u5`dva(_r9qVbh(vLVm?K%by!4U#iQsoVs66niO!S<{hH;(hA>qq<6i90KJO(b(o
zns~5XwO3CM6Q8T9;2#5qr^F{zM@3W#RRf91XAn+6wl)trW12%Pw__WYeA|9K$pESr
zxzEFXvx^024WIrg=#C^UxD1tf?b{jiE1ch#FVWsnQ!D%N$wIl>ZCixTcmaFzO3mtD
zwUrU1Z)!oP;W;g3^@3|LW$WeCLe#S_zw`Do1@*_%Ob2I;
zt=E&f9BwG5M`3!ZCoDF2qpCrM1tElM(B)k#nJ
zGCw%hNg}?jn^W~xA+#+AdO1K^L3qQDRq3FG_Ix>Y!##Hnw2%3nNc_P2b%ac0;DFE~
z>J{Nozfs7j2C&nVz!-VI(@F(lz$f3%7zE@T>T=Yd0U#Z66GQY9Tr+V@{!>)-M@VE1
z#jL|ksr4$W1eUnMcfSM`xYimm1jDLeR*{e{McNxOU?tdV=RFt=T~NX3o?u89C#}iX
zU!&6ZOUi2XACKH474Nkv$c!9<`3nQw%+L@!&wCWs1qomIVP?1aKfh!f3h!1ixr(cu
z2lAj=x^pkLR|n~Nx3(^Zg!Tp_dzTxI;#pY{U@zKkY}YGBhafF=FmbYp2eE+UEfeM-
zwdAN_)Q+ahkRbj@8+z;|0r8%{xKhiJW~fz^w0v_!n@S#nKE{!g{~BIQP@K`BUk1T
z-k%hzsNlZdUZ-W8!_I%!Sa~dmSLAAm5^I=4-6DbS{@DY}dSBmK
zT!dh^L>tQ8zHwW0ZUuaU>N;vwSRw^^-CmP-=*EB_KxdKepd7WLmUAEBXqf|j;@6)gTw#Q#}RgW7$`{UpFgHwtq$
z>`UohJ-j!pFsB7i=YbyDRU~bC#Hjzd)(6kUE%&3J;iHIsZ}cFQNjCtON11qts1vw{
zILvv)8@*=@{@$op(?PJimI8c}&T4`C#e#(=6Ogx_WM&9k5VWF$M_2QFTj)S{GuBNA
zIRb;)J?0$(Euz5>?&w$TthpuIdy<`zej_)g|o=`d;^${e90a3iHIb@_7dERL2F
zqXzU@S!B($(LgRyC_oU9I``UetvOsDrWGM~E819EeNJO%%_FQ=fJ+gg>N50%&DR+Y
zx7PO6ASG6JeAs2g3F_ozw4)Dl9$Q`q2HdFTokZWY0*Dk&vat)hy5x=IUgOY6n2-Rb
zEx8r{POxCE0NH_Ng;Dq(pfEvjN_?-&TVL+z>!muUZD5WtuA|+d6xbK5)=|hmnNb{V
zn0w8pqjE>L#<{-_iBMYIv4e31n*P<+?Kl`k+%GAu4nOV8Yr7JQ
zmcFt>FB6h;yGzE*xa*8JBKYVQ+iv{{*NPDs8sAn^!RA}MQ1ctiCHiV6y7O+g`XOZy
zeJ7r9D)8C%=*ssr2sJC_g>|MR{KgN1{<#Jeh@PFp=bI|8Sp<8>l~@D)FZ@Z#!IA>;
z@6Uy<1P7J41Ofh@dtajanp}#A^`^fMg;_KSvWS+Vk=g&vL5>}}o)48oj;6)L!jGKnV39gL#cNQM&UP(=&{ha-916?fe2LV1@nY4f)yWpR;00P
zfVc`dL2l)?P1KB(o=OaKc^3fso=Kx$8Q$k
zw~s;XYcY`Mwwtqxku1pVrC|N_L6cR&(l*9#{~?R7{k?-mS7OJjldk#=g^G^O(ZiUH
z+twoLb3s~*o$Kq|vtOg;JY+(?iS)Bhlb5p_!Hi~W*5x5OL(q*B^p+Au*LFcxxQZZ_
zv-PYD3K09&XaJUQKu5*8EhHMUs3)!0i-#5fD_vV#lRT(rUH&(^M6z2}$8yJio43`V
z?beWMsRbYty(s+#5M&4r2uSoaKq7rv3iPa*(XDop!oS>YT)^V{_?QC7skII^x5{14
zvn7M_Gs>z~@$K?Y8r<@qDbv>*omj8gw%5_$pS!K0J@w~*u;j7pFzb_MtzykF?@)LD
z&IsH#l(H*rm8OBz&;hMYz&VgR#A{bE#ys}B^+j|7Q}qRcL21yjvi8l+(!tPyhbxPR
zFs|~Jb7=q{^-^R!wbQ*iDJs`oJwTv8nR1L=8E&$*vo557DSV0UQA{>1;je4wHMu1P%ykc@+Po8sDX7OI9+G{`_cx~{?Kx@eZK!-jv
z^Hrm}CJ_!P0uJ>n1YTX>imt90SrQO1XroF(W+9criU#L9$T-@EvP8^7+wg$T75$S2
zp+I1IXQ~!!=lioAfLeL$SyaUuz-PnnUIOr0oBEUTrvDKXig1O=
zg(B*fE8y2MjxA?8p!R8C4_RkA^N24v;idbJG}P}M^B&F3G?Q>K!40p43@Py?F&3;H
z<4XSYciytP)R`M**Q9Pa4S{A5pLf%WP0f&K+m1pX{b22`nK6p_H6lgpiX7>oh`DyW
z{>%aL+pDBlD^X$&>tpd{DoFQXxIrV^mW>X*7^80nljqG|Sx2ru5`@zmU(D&Q#D~Jk
z>Xu-Hj*Z)_pwIku3%C_tmqSjSs6I2GgH#gx=NIZw=CG5UkTr+`zJ<3hnLvi_F6w>~
zzI2cziRL))*Ss*xHauELq+0#=WE=`#?8Z(1JKl?M
zkqqKhiW*JUGVR*FW{3DCBD=Xldca?}CWlc>8@j6HwtWXd=K;2W-7EVUN>#15?e9=$
zV(Y|)QcZBrgwIqzv8mCQJXK(AmqDP!{ZJ}Ot2rjde1WEb^B{ScE_##;K+PTQtg#jW
z6YIU_wDe_Sp1At_ySdPdyxYmFo5+*VTd7R1RboScB}kr>{;E2g9_`h$&Wcch`_pIo
z?QjD+qQbfBej6}%drL6bEp{nf@7KpwEUV-V+
zHNau6qu2B!ZOZ}bsXfIt54PU281bqF=|;Yh8sc#HRpD$xJ&tX^3EGJ|$E`U?$Uhl|
z-msF(ohnEkwR_@$0G}FlcLjVk9eSaH5k7Ii@s+7IE=;TYh_Vq<6}%K{B%Y_lRsIQ!XyrZkctB
zy&v6Nw1pncTEwi(w6&I&Jp|Gn|K?~`4B$K5yJOD4DBPHQ_hxe1a)A2aU9@{$ZRep+
zvTh&e-dmM0XvXeCyMRfLv@5^lhn=MHQsT>Rrtv?79APOG!`Q3}mukr#_{ElO1*GLX
zd-KVpRq(p7y?{OnfBE`FPlaF;uAt8fY2}>lNuF*%RTaJ0uEA1J1k5|^v^W7NYfZRU
zJMZe;^GNsULLCBT;D_Bsv?C$6oat_w&%b+PcZ~zf>Xt|j!OLt+o(nNfK&o85GmAVI
z{V9Ou!XpX*rGYJ|?SHQj+(Ay?wsm?iu=@9|_ixqHojPN_c!}O6P(2Z9l;T3
z8rW$rH4X@Z?ua?s9`$2EnmDn8mI0;EC9~uW0$*GTt}L94^xgWe%}b)XSuHA(o9TX8
zkM>e)$bQj)Z=TejH!@b*{}b`M63yx>fSh;((AN2qe2&ssz56EJ7%3X-40i!z%qp$RH^BpTJ)}xvj7lW2Z`0gTQnE=?EC2d
z>f!*qkJj+tJV8%cgR@ecz}BJr&SM>ieH3uF$LezXWK2%W>~yRqUuIek#KP(&wY0P(
z4+#5!n#UZi$@P_l(}6c~EyCoA1kg$(do343QH&08Wwm}ZON|JbqbMkhv8@di1NvOy
zw=q<|e?E^oz*~wC9g!u3NZ&kR!n9JX{4;O}OKx!!WP=T@wqCbB>ccL3`K`uhbx0vG
zWQfZHXUTPJs5xMgQWnkrGrQhD%C9?!0aoc@y2}o|*R>3J`>@0Tg02Ywi`kHO|5>s$TG}o^pc*=97);sLoh7$nmC>)xBM=
ze@GiX!t&4LFcw!2kG*pEejfiQbXbnmCmK#0rSdLeq*47XN?&8Cb`Crx_;f%XGriN`
znp@|rj8H+m^Hh`utZX4FPLHe@p}C?tWuH-FbQ$o=d@XZ4PY{Yh;(dtLh0H>sK!J
zcPZN!J(UC@=*5~D&IMY5=DIRGz+V>h87Fl@_+MCb1l*goDPW$@;$ne6xGUKKX^mO#
zkI2*A6a>O`^gn=o-M&F1Tz1R$r8LG!Dv_DK%bC73<^WGHMP_)|!!z$nV;M5EC!1VI
zzLpSLiHFb}k=vT?U*_Z`w1`}9v+zU@h+Wp})dSG2
zZq8&3$;HAi${7>593`t^Bj%Xb38+!5Qosvu?A49@R!B|uq~QtYm;FlMyW*nqt6VbB
z_5Otp;I+M~KWx3O90gbOZKgp50zoLRraf7Xs6h=wxzjO)Sx-dW3Xqh$QGK_Rz6T8j
zWD{B}UZ(Ug|84luY22INA^LO-BzGr_oO1Vt&TfA}pRSQAf-cUHT
z;~aL}MOJJq6}?daM+`<}39~7&0(j0HID|}JlbhGAM80YYKOZPnNKSysC$bCvR{e13
z@+F7tX|u^rQ}ElEP0<&iqpTE4c#T04;4I4A9ECzwZlmQ0EG#T07{A_rUL7*I`VSLI
zpR59{_+RqAy{6~|lpiSi`lb#ASTr#Pjt!6Q0w~Ps7AUx&(h$aztZ5R-cnQQjU|Zv^*5Nw-UI~%B
zT-TxsF_X!>`*;euQ=!a@1*16|-1Y_}mTV|l5Q;!xD&S_@6ISZb*S=dnLY;vkQtd6B
z72t(_Xmq2$JJf}!{F2m@hQPd9@ICYolaR*;-KD2=_w$BXkNGm;G^{EJ#02kr6LxJ^
z(bS3!6%#LSKCb%!$DUOlNbiC`9XmcHm
zR)4qq%q>d<%h&aOwaHaZ6{k%-q!8`@6aioY3j2C!YCH^h@|vUd!Pt!^=Av3x5Tp~QsQm&iJ!2s@EEW#m4
z{07m01!NAO4{-0M2NS_&y&Cf_G7i3Y2DJ9y-pA#sB(HX{UeaYY{L7cTD&&Z~roNjb
zfvXM953PPuBeJ_pd^{OahB_f5Drb38QLzJ?o_bJKOC^
z4X%aGB6U^3H3Za@0I)VHcWx6G7|7O5@q(`^Ke9Evk!&?r?4$)f)lvW5MOLH#!QsZw
zzUAx}YArrm!;f5Y*@y^eObfAm*uZT-A+Xhv{PcxKkcqAqH%7>q%GZ$pW^fSq>f2o6}Ll{+H
z&Zz`2oG*a41PRQI0TcKhVr>@yfg^eHXYxVl$tP8VjUTd8&O#KZm1gX@FC&ZBG7b|Q
zLva*9`vl=Ku5tsLqy~Ndu`+_wq~o_-F80v$)0zWSX)R7j?E%+R`mhK8PHm=R^D{b+w47jRZ=AXN?phhpXE7ykswSy*FZn;{
zu2shVdS&Ci&QaJw#3w)wT%?Ou_OXoiZAHEVEGe@4_W|6k>v_XL?FHB|Iu`nK~a5e97X9+=>};@Y3YzIrIC{E?pi=V1f*OV1VuumySrN&>F!(_
z7I@G8XWmbaGtMCQp7X@7t_85@tbks!3hF8L5oB7(>D-Z{2N3r-84vJdoxgSoK_)S5eYyQUqCBR5jHJNZg2`%qDv9cvn&1Jb)=X
z8xQfSw7Od@LH|TRq1^}p!IDt`FT{7Uq-?2qbcD9nsfXf0Wu60Q0Fj)|-pej~Y8#E-
z>$`81AY@7(&nLB!kr1*1ud9`?GOv?wou^30op_^-BcS}$V+Q?hkv@@-^1b2U(_z0=OVz;f4&Q3r5
zZ_D;_CHG6aFMsunp3~6cc^|+WpH2K5=*xc!L6b0XbrfVrE!&maRWV2&`{v-ru^<%7
z8riQw=~X}m`Kz+owO-7G@m|&UM?Pg#L4+=;kn|kyc~s4kGb%!w2NV)1vJvldRNl7++3E5k$X})#`n7fC-l|NPI
z(!-yf6a>Et#D7lL1llHZ2OeAyO32moYcryQvZUav4$jmX1Mf-4
z(uE5l)42mr1wW4&XKi6Q$9dN;BcBUdjGQJhZ%%NfQ3)46Y&V2F)kd-$mWmW#o!UYP4)i-1z>+|A6FHNLdNmJ1@F=!-C1VKiSjPUdGsJ}qgF~ELT%XRTji~hOPFSh$cUHE<0{9V7HP{xez#u`VrtwFTG5HRAGIL3A
zoz|CPgXm|3xsr5>!`Z>hU`u3i%uk@{i@)=OzKP1qgpi_A!5$$%sH^@sqjuhwrWZta
ztA6_a;HItMHiykQv>*c}xvF*zXl;8K@6Z4)m-w}vOk3ZX!0`Of^x9;}Kh&c)+x`Lv
zmE3raDAeGxFn^3WZaRcxHCWzMYZ0Y90vuuQH@e^XsFKjpz
zyc)%A2?K-_g*esrc7J-i!q6_}iEkgSKvUASw)4gmW}*OLMdW6
zp|y?z=sZc{&sT?+kiR*2RDx%}5WCWUsKVAXk*n{LLy}FZ4JV
z&v;iTAuTz2KvN=%%@=N!Mp+~-M;<}_u2%7rQjD&#U&*I1^uf59y$l8GXYSalps|O!
zzTDEd8-2kJO|!AQIkqlod}jwC;?@ikG!@ZxOp?5jo#_{RBUuNcSW-YU8h}s^_%^Le
zBLxLdpsE-C=lZ5bI|hhq2#)aS%1pH3Hxd<=r~Fi-4X_N37o$+Pm{f1?}Z^7-dsK%`{Q4;$ck
zAOQNcB#=FTVRY3_bh63cLeg@(FnI+S_@GFRX8eIfHe1zF(A!>!;Z?hAC=_xw@)`8S
z;H=(|{SkZM6Dr$nFDB5|umQ0~4<5tZ@nSacjIT&+Xeug7or+GAXeNGsPgMj?dc67!
zOIjbHHWSHG-0?OZ`BSw=8o^x1T?fm&&PHWV@>K(H08oPp@f(XNy_lV(7-j+5TNlI<
zWNOOobWk2iv$A3VfSlLs
zi^->UBRVO6hNoeS+1
zH@Xm8M%*R4nFw^FgeO+qFM_s#mP9X=AP3od{yurRT7I^Gr@N=e`6Q>Mn*k8$1xD8x
zgQ;)ua7C}E;1|0~E9CCn*sC|HQ<
zMv43Eqf5l5DMEhT*S8(}qb?=<3&nK@)k6q>lX-x?+X+3;%bar5J_8UI1%P%P2}Q5R
zJSBD`8&!iZtHIZA(Hsa37euEuv|xst{Fm>##oZWIAfh_*}{Hf^+?>uwtYQ
z@vmYaXC1_8uRjA9E|>79g^WvmJH~MybKziWwEBxbe$R<<;`;eY&K~D8O=?6G6crII
zwtLqFx4Te_Xy4$@#p(hFE;E8M0^$c!Fqj1cS5_`$bJ&2OppXj{?1=+bH!lR^FZ)y}
z|I-?X-JhtMJv-TK99|L5`Xl92MLCEZ7)AvlzCC*21E8HGfGi!x8a%Y>HXaY^+_YRV
z+O0`>cbv?@W`N!xq$dF8VI?5WlHLyUJ!);|p!gEbNCh4BH9cAF0z}Ay)A{5y-Fzkh
z%J<89Fr7M|8$CjT1L1AQfZ+v3<2pS@hppkMAov-F0v9t6wj3E^H`~7e_b2+*z|)`7
z5ZsK9Nd_5VNB&2*NPzRm
zrgERqcK$1YT62_OvTfvl&YxR<%Kh`(z?;t@KyzUuexKv=i)LJY&m=>MkqtvdNhuY(
z#gc)6!3i*OE0--T&k?5|>~Vz$HK4eFZk^c!EKosE6}zdGM&O&!cj+rBy}Ot*25^wl
z)ewM!DlDYKa)9m^v
z@Gag~-yP2t1SDNaC2{G4>F%}Xp+31+Yl9Plap+GNCBrJI-Q}P0*|S`GXtLwbcb|0R
z#vMhtXD{~ujn#32+l=;!nr4r8N{6Dve~1Nd1?F_x;?M>z{Bjd2MIdnI&mJQ5o9EMx
zOGeHcn#p1Tl#B3O|5D!E|Y!D>>nggR=YUHm^Fveck;-8z^NFa
zrvhw=WMS3R2Z7^2&y`8QuVtL3ACwIN5(m?$6m{`Dx@H9d3IyDY8yy1>Y3=Wp#nvzT
zsC+TTIdWNwCyyAkWKOeYr2Rb6IuLm`;kj)&y*d5J?mb;~my5T@oolLcTNnOfQIY=RN%I%lUm&lDL*tg5D0ru_`%k)o1hHj$GmkW+7(i~@}wpu(R7uW<*^^DEz
zIXur>64nHB3yE~QsqfH5Iu)$%iXQqwEGBz
zQP5ESN(5N
z#?u*izAWW-wmeVrPteqU+FtsCX$)n?aT>QJpUQn-ILN|@I@vQaLQqtwWDb=yh8JT^
z#{-cZZPP9H*a!*A)uCrg_!4~6W**W*fk5I;Qng!NAhf&9*F{HcUHgskdg;Ne!Zy9l*T45bH?hyP;6fs{Maf4{>Zw@TaG;)w%d
zT$nxl78hr%@73l#1Imn3@2zME86)duR5Ns1RVy+107r>uh
z1A0qS9=CvFMv$!@fWX*E)~S0TCVc+{3^G@1QPZn%O!m%c6OzZH7K?piqLcuHT|iBJ
z5V!39`aa#gJ0D>&bAqX=f(WAa0;4Ma``eZW<2n24ZbifTnscXBFd4tF%ycJRd&XH@xE^koq!6t5$=SGKDc}H25Hr)=MF1m0jSY6m<%Xqu6py)sy4uzL
z0)+721Tkv?L1#F9B#|j_l;1X<6oq@e0n|K&ir6_L!dZ!I{AHk|7K7X3>*{%lFZPEb
zn#MZ=)K%cOlwv_UM#!ara9%qda-$2dR@syOCZnJpN`EYbsAc9>v!o;7{?@3ldDc(=
zqQD5jzC9Ova~=Qo1C_}ByT-E|jACJb<*h_}wM{I$lj`BnR|8C&H_<2k|7p
z@fxAITBCZ1|6*DyUluyAIO7HRp)`B!L3~8p8Q*AeGZnUvN&f)t;!G+Sf+t
zo4D4PK=G1niM!+Y{JFBTY23?#z2~Wq=>3MROaVfw=WxPmSJqWg3QSHPyT6int;fka
zAA$YBk^hcDwX8-@b}h+)BFVmA3j^=K<>_e2JuAc}e1*}K=7S3U15lNK=!VLrjHD=o
z_WKp@jh*_f6WN}{F1h0ZNl%|g
zEl?~X6dcQ&X%7ik=0Cyek84|4Co}B_)Dcr%>_SH&yjn&S2o~`kzSUB>m5ziEcpC$b
zzjh;0@A+q%?(Xi=NiDtQj0U3WtvG~~8F3`|P8hBM!bybiecj*Gw9ub0rjkxYemALutRi#DIr=RY8ZGX2pKg)hV*a457FpKgDbX*Rn
zkJsy#I!(oHDHGxM(>jn#wq$*HNOU4TtqXR1$(FMxMd!KLvtmqj%}8xDo&fV~7oyPq*|nSm4CG0I6XXD~S;2U)?S}gwGw7
z-o>l&FsFz)iXPUkEnQ8s)iA&T$PsRI4|~B1Qhq=)Apr7HTY#jl404YE4es~wzCL;Q
zQ2_2rv+vP=w`>d85-o<(Lo+j6NP#@%?1Fp+;adjJITB1J$Rq!ZeS!S?F>9kGP4mUM
z<8rjnJ$5JRlPwU`1C~f!02>Z>zV2TVhJ*V6gaixNNC1T=f4JHjnz1QhE4!}X>p|32
zgm1Q`;X-hbI4ubLtEWKgNTVWjr=;(3oq&d<@40Y(fNXZT(1NBacE
zU4G9+eMJAh+B0$lRM3OLd0K%p@a`C&T8iKyqy<_A?gaX01By-)+ASF~UTJS^84z2?
zf%`P$rc4KI2Ld9*=ATbS<46HB;W!`FB5^l-$6ZV;w?
z)DrNVy#cNOTxq*A#<%umJGp89S(64|_pDA`<+XqX$*C(r8*p1W|BaKt{Po%QQ1=Um
z--#TsV;Tcr^6E&ywe3s8VQ`!gh>l(a(TXCOg>~fjock=DbPS
zc-9IUV$2%=?iGV8ip@8JWSQwoiTFQMet1;eaE}69+or!K+vn?CPm)^T*q2M0^YBy=
zOTG-hRe3nDJ*!NN&U_^SaMHA)rw9Ur2GMKe$A_M)L_`Mj_bFR#JtmlS+!ZH)1L>J-
zl+WlHPF?wqdF1!4S=Yf`;>GeCY*V2=u`dg$SS1ax^JF63Bex-Xa?<(iO!RxK1)`v>
zB7w$*W2slw9qzEjx6dB-gygatG3>jRA=WGX;*s(^0{jc(Rr<00f%}XcHZ@Praa9@F
z?4fBP3M_iiubH>fM4yAB;i;-2+sucF$3zYaR1)q}qxj_px?!hd@Mkfq50`(X5ckCd
zU}HcUBM9+>8Un3Z}7NGn{jEP}1F#=@NJy5lH+-2{rc151FfVcgu
zPPfqu9ngU||7~FQV57++#4%-1{u|@PUZ(P5r3_x^!PKPI(^cBpabu
zjMMB7WtI2+W%lEF__XU#}OO$qlIq3ndM;Aia4DYC(8
zxl_?>l*1cN-E?AQ__-vnbSv{^KKjquQo}$1wYOlmmQ+7V=6kB{#
zn3l*FhHak5djO!qY{5xy%VbW;BcTEaCtHD5JP=O>9)70KdTRqcSN(RVh=pBM>b6tf
zskflt&to~ff0Yy?xmCF1eaIx{qY<>+s+T9
zm5xi3F5S$I@}ov%XwA|WLWbv}J6mjY{bv%@dT&OwfK!D_+d%dQ$V3X}AbhIqbB&zx
zmMg|j`7fR^JmyDeTVJ@ml8VxgNn&FrcUsNp0$O-M))=+Ek}|dEc<@X5jTZ{ui-aNA
zQBomj9nnLZ7jx?<7ULE2pA~&0Vy3R$nO!b;gG%LvsWk7q7+2V}J=6KWHJR9U(HXN_
z>)6b1c8f8HePU@*8j0uU&b}=-2ub7@KXF=j#OPUBDQ~}cY984-$tZ65Y)Fip)G3WH
z%1q~4IDi35=<XP&8es*KV;gc+BhHOcf2r=V*8OVVnv#0v^cTMsEIYD%Di+}1_TjX!7bKl!XEJII(xK-JD2r@dHg
zyw{--JpaOsrlanRI9@B&==GmijuQTHVru|l)?@s0e--U=%=3HrSDa?77c?oDB11*M
z=F`}_{eymC#=&;8VBoX`J_lk#4#SsCNK?7>U*?Fb0w4<~Wu`uQl#Bz_CFT9;VEbYI
zes-1`#45|{ohuldFYo35&pqn>RI!CQ6Q&|e;@OYM2neO8NxNU~1b?-~PoC$N*s9o;
zh$|76^ngUPfJ~e
zmxErS3DxOluU<2Fdgw3|=5xgQ=N*VQ^bHYK*Bsw$!CVt^uq-2JpUq09N*==1zjEGh
zk*TMVFx5tVs#UoY_*Qmm<8e?6&2_5z6B`z+6!1m`^=!A4_wMmz+>X?}g6r#PRW$1D
zKZ-<39xf&(?LJJna?$oL4hAMr{&~i0dHNtB@OQu(Dh&J-M#>L^A$H*_UdIQY
zPj;dAr)2A2QUE%~BD!yr!lagAU-h_9r>;Cv$~)Xa*P5C^y6@M{#gvrkzdzlTlM)+o
z8w!g9`57?`B@@Uc-1mr7sGCfyX7vNXu;$mQ?}a<&Z2ndTV=3eu-&|BUwbGWUY7ubH
zp5b?Kh#ZYr`KzW%Ler2RH90e{9U$?2C_-}GEc`@`qI~98kGSf${3W=)GgS_H
z#N8y0$+t4%{M6QTW?
zgbA*+D%5E|fzMKR>ZtL<*_%eMy`_SBZX8o+;>c+L%4VHIvR)G`ZO^spF)2MiZ08Z8
z7f=0VRj1r6{B$IGwx6Gm?=#SHCa1@*jjnDew(Gqm(6BWgQd2Z3sle}_)lB-D!bvx0
zBkch>S*5R<^;PG7ml{zdyEl{Lu)$U5UivS4lX}3eA*R1K&l}#{&5+|IV;>LFR6f4n
z5U5EhxqcTf+Qn0(%l0e)`ON?Mu^g3Z;IBYoT`Iv=dY
zJIzncfVCDh&tG}2#E_)ggiVQo-x|IjB8S?Wp5930_6)^SS)GVRxSN=i{|tlKp`?C5
z^WAv0l({Ssx?CGoX+YFv_E5KQbcXys^W&!kR-*9Z@{!o@h3OjI(+ueE9!x**WVM_X
zV(QA$+)gWH52wPcU0i8O{r&{G)%Td<9d3vruv9X
zGs@*KLK~}^{>s3ZeffNiI+)3~tSqL(-q6n(tb)e`4l&re4tyc|2dKrEfp~a$V43hP
z#+I7~k9hSxcEY2qMnk8$SPRB6_-?nF&93k#FPFE|oLIwe@!^57xV|YC)5>I`^PvF)
zdlL@fju{G%FS>>9SMK2%%Iw#VGG~4sSZ4KS8U}95<~N%y&5|pXD-0Ac`w{A^@6xOK
zmW6Uxg+W5o2r`K=+F(u8Gxvs`knuEa2O
znxx=dD?x~QxZUykpY$t24x7en$%pM`RzIm8!pwYC&NiuI6VJ8>lgR!N#;-Cd$)^?=
z1GlMvh`!P>=w26=?3Qk@l{8>3xNGs2tDx{y%jxWuO
zq?~F~IHrMT%_DMc{L9+r+9$Ov~gXVQc4;`yF1tON)A|
zbu|V5{WV7agQ-V`L3$_Cu^OUuqnQ}pf*oVTpOS^TEMVMSB9%O^@7xE)!Ygh0$RE|<
z?XA4QADT2G7jVCzSo>SbW27Xiw=ryWYb>EXc0N*W+$?XrloAQ&n`sQS=-VojE(KP-
zdRA%v#}_|+4~IKW8jw~rzH})jg3wfqqMwOaCe+;G3OCm81bmstnQzi5rismKIc4*M
z4t+-G#@{7dcRBX!RlAXZrJ7c@hi<@xB{iRf=`Om^&U@)7)?kh5zfWYOO3so7JAML2
z*~yi{tax$85RBEQ$PasIhO}u~Ruvlf53x}NjZ2schc0MVw1P*Qvd?8?K7)CM70h^?
z>3`7Ex&M7
z-<^~3Ib2it#dX|O$jQV13Yzw~bTP0v@|z{A+4zXovnW7n>wP9TNgJ9s4K4k{aA{@-
z2$-otT_EQQ$H7sl%ietPnRA0aQust$@x$RbowA$ad=Sr^nZjSmXGlQc44y2ICz{aT
z`PnO+X_~zEHg6@_w}~NDpSY8ux4)T@+>x<|BKnTnhED@xe~UFw&qbTwRQEUM5FJ;gO)!oKn#
z1ww&UrIVU4@2&^&7JSX#cQ4Ha{g>^(PB)-#XuEXe80Im|;D
zr?8DTg};#Z{Z)ts`#W$m9Q>Y?j`o#Q>frW|jK2NzFf^MEhFsy=iwd=oV37HR1b_`4
za0VFia$iIxUYa>DCztkcfy95nQN7gTA+VT@#9@C_x8a#ktk^jDO`D3zZYR9~O^jYW
zj$Qhu(#8C2s*71Yz0nE9aVa~6*_^X)?(@xa(L^T_TjrsxdVg`m_bHMzM5d=f?x@-e
z(m>65tpw55BXK`LC5Zy5v|m|QIn|=Wzxvi3jbRYZjvx?^f=D;ivPBcGlz4yMYIqVh
z6|Y7meV`uof%Hk=-Aq=elwM}_yV;xmMf^?AA4aLK9(>eSw$ls4CvwhV$B|Kn)l$>K
z_2ON}Wz8F}^`gRdGpSdN8d$|Ad2>QkesXo#Hd&n_CPS^aBx35hI3B-JCA{e4RLHLAn%mD`N|Sim>}|c`^iClE+uH^{S79+o+;x2Hus@!QJ<)CDgnTIhb88~=B+2z06xSqzM~M8?EosWA0=jit}N
zB$ZMMtJ^0pq*@>W($;}(C9{Vu5S(lAaTg&JLMlMup&YlHL)yG6l+{Tz`
z@rv=8zl}ClehIsHrdi>LS1Itx5{mBFu+t_O)$AhO1#Ge)V7;?H;WM)L>q#oOoDFbyBE+A-=LKZ%
zS;3zVu1k(8Pu1LS7@Ab;`*st4V$zaX5VgPlB6BJ63>)!{h0e|=plf|>_n?j$i;bE|
zHuUzZ5zA>=-j%lD|NW}%pfZ50NJF}TYUK3=2$=yX2Cr^S5%blX*VyH+?0zXwi3dB@
zUqoJ_w$LgJ5s51Mpk2od64m~JsUS7l?uovV4Nfr<^Z6JNYIZQS?
zn9WP>W@vUcc*eWYb)l5OmA0CY9g4oDq|-PjkY86M&YZo$79~8gfv&jjEi;w0=gRbq
zva1tIAUk1WB+gtWBD#J#(L*cHj?G<>QNFq{g`+{qf$r^&3?{LJP)QC1gICB@JY9zP
zv$GD@pYN3wPD%_dA5GUkV=mDp8DH@ScJdm#ute_Z`RMnKwXp`^NoNE}FIL}F=ZzlB
zKq}&BAd)vH!Np@7k&P<@9|dCv`k+Z6hdmC~sxH`AItJ!8xkYM<-}2HwuK3rC&@H@(
z^AM=ttj^|MRQkqH%hLjT2eEs}Af}!iVn}iablgd1KH2-Y}mRmI2+AO&((ygQvSl=nWNMU4_CNd*$YU8bWyQ7~sVflq~
zEH8iCX{)mzT}jE~EdLojB`=L~WN-uva{mu)k(!~#5zQOaDpi171WQr)mw}oP|Khl-
z8DlPgjPZ)<%Ut3fzV_9(?|kp2`*6=);SDaYxV#U^kj|fmdYaU
zR!JLY+KOUr8Dam&Wu-k~c%_^v^I|@cI`$m;w26WjgM%Ni==(1&AMu{oMNm5~%x-rY
zi>`0dM%{ld@RTYfdsfp|=uB*c%0pvGS?<>Dh
zxROVFL!YIR*|n?LhlRVVWn;nQJToaij+?_n+L!!4d5zaILesD-sK!`i@_1l+iP$Lt
zJnwlpxQ4S%G-3vsdlZYg_r|56811x&YO5x-GdAW<%T2i&Kif1Oy|Q-u{?9KVgSICX
z0p$eHPCLSjHj+mXP2*F^fK#5)pe`rWs7Am(GF279@;+|6lxc;y^`vnNPyf@3~JWZi|S@k`f``PsapdP5)_pHzFE!Y>~`
zz5UM6Wr@SFI?9W3VnEq3jmjioN9*Y%Rr(ovi80kxkx>^;1=GRBP66Qp=bYAv@;qi`
z26ao?rx?FF;WS1Ht^_p)@`#R2Lw+u*9l3>}bEktdxom&s_bHmA0ouSYbP|Ry?ekoL
zWrTb3eeQZr@1N-`5=AL3?ZrRb)VC-}5J?g&Ie(O@`ke#e$$uYnFtU{qUm&_k61-hb
zbVJm#@}Ckla4jFqlFv8wYSJXaHsp~Wqz=-1o0@j|Ou?wu^4msF3A%z_>S6ok4KTi0
z!;510`fx4lK{(1k!e&1k|LF+GdU38k;XIH$so$as?;GOp;_vc(%B&mb=j#7cl}|sc
zV05cZ<|4<$>F-*0_jLwDLu&LU_Ae`Be!cqgOb
z^0B(8S%%=@s5C6&asSa(aaiat567EhPKB^?7}{!p`Rko1K<0jjP}ld184mWx^kv%q
z=xcG9KW(M&(1Xyg=c8!XhGW39CH&d^p%IA(!3mp^Huzc#C_XaTjd4vmd%Zn1*jjL@
zHAO1dM~IQgbD|7q;J@RIw5Ve1P@y38yLges$c4lT#k0JaX>x2F5|y|0+MX&6-#j+h
z$6M^nnI5_~MC5>oiBO~3`nW7JK7J=d)Y?=gt>Mv{bzn4hc%STjYl?;;h{GqWM%R{3R?r-lUruqG|4p}0y
z<ndL=Iosv-RZ<5ZZvw=T!f#IE-guY&haI$HFfTU(syb
z4a0h&6%$OI?*3h9Tzkrq4592IOE9{lQ1hI{5!#EK@Xc5r6ykI>9E`E4BE9gQ9c~$BWva)%KM`dul`wC`y@a1DXy=2qNmLqxE2r1r#dw~w4%$)XEOYT*Vy*$HuZf82MPXKyFq`FG(Ioks!hte_Waf;A7QumAOM!RUwm@l
z$OV)Q+3xC$Od@J35~)`TVPE`?#BBR-A((`>Sd;wRepYDK`U^wiu)&Joc}(L(<1aro
zmW2K-|1-6420q+|1Z6vkBA?)236#OJ%6h`2nho*0t_Z)j7u3(-vxDegU?giP
zL}b#E=C=efXd32OdOWH^=RdQndAY=xhEv>2=)I=tAEGaOtqb1{a&K1*FU*bMDThy#
z2&LECdLCE57AJuZ*$(+w?S>t!vt`;g%14Np=QSAqHh^7N%j`<~SRu39r|*9d-uxK=
zZ^m!jRg~#E$xT(DMNg@ZjauIA=-IuKD}PX~KC3KC9@DE-LDV?Zamw$FC76gg?dcEc
z#d^Z|_(dsq6)LeU%
zK7NMhFnfjI#|a^Slon6-hF{t^u6WbCLm>*Hau)g-`or*!%oSq-GQRv&CeA}^vH+>z
z*pR{MP&qruvGRloU!vz@_^jcpaXiCiz7JSe${y)B8JU)Wii8-F#bapCmY0(q9-cy~@w
z{+RpXb^SA`c99t3s}GNgh&F~I(fh;LI2cHrlpNS+GJd%@*I_?aiw0lpXoA+8j!Tdf
zYrhpFy?f#iAM@Mb9QKZq(JXW4OaA=21#F;wqJ}r}SuP~)X4|el^E~PZe{kbl6?v&D
zs>^FdHe`p&@mb&WKVvjb?q6e7$b!GwRL>l$TZ*Sl4>@NdlhRScpP;dxC9ft#|4;_WsjFr}@{-
zcTY>*y%NJI!~z*{S0~K}HiBO31z5P`)%O|6dM`VtjjgbWRfcRG<_df{*FJG|9^p1x}RLL*n@AJc<_c^{5(TaGfciK{n#@7Z)tyAMI<&W4}#w9CUoM*X)5_Foz8e~UmHG@P>K+*j
zm9{-#gwZmh+
zX&bB2hH8EwCsxqa5D6028b?K1___t92=tp5)=sM4D;&AB!Gp3czBwGtY2$%w;+aZx
z^H1${Q&D1Gi&s^4*W`2Dd}hLDN|zNpnai*Wpk-xuad;x}EIg!Hec5L)*g{wfv#%Pz
zX*9Ay@wBVOUvlR-CY-f}=gKR+eazp=OHpC@&IECe`x|Y)C-nWHzFx5KFL0%+anJ?)p`u!oMob+7xx9L_d9?iAODu>vGhQ6EEjZNL
zgcfzyjjh9cJjKktVJq7112yB+PNax_vwkjL9ZUaN(A;b2_q~5Q8mXc-#gs6p0|&ev
z^>QrA6k|HZY0u^rI>(!u{xi1By~KE<$BDU&=cyOHf{Ewps8Af{V!55sCO6qUk9Mz`
zOs(kP{a|4p$_o4L92)+&R;P46v(2x`brei-44$cnSy5NQLvyT0^AxPswEDm9hCZx8
z?pLZzB|o6y!Mu|!1^BR;ar^jve>FaGqDWjKiB*}-Y58ak^SuvOda)wkrw51c`EgKE}Tzc
z8{qS~oORcdo8flFBHxQqUj==uu`nflHu?76aQrj5`WfY`pCoUFce?NG{Ci0i!up|x
zd@ibqF^U6pZ@i7ZJR8-a**6Q`ixS39AS<4D`YWzlev#!4O}+L)B+kw>x7yUjmc86x
z_O58cR5X|Knx!ev7Y?KXSrbwEo-eNi9ZC?R;3~SJul5aE>dbLHogN#J?&)~SNB01H
zbmgo&`-ndIrYt3n-b7xTM`5thCY%jyv5O8Ys=;xiIWz2IdngiA4~o8KnBf8Diw@=c8z*{@-zfe-PAjYJ*ksLg!`pX4pADaUlMeD)siI8q4O^`u{Z
zlK%75TJV6)^FQw!qUv>Mpt7&|30=7Y1}EfmA|x7$@^=&Zl=4q6~<8Ol2yQ@V7fds
zZpzKe)}K(rOc6mo9J^xu?c=R&M(&IC?K&@ky3P;g`E?)q+!9=RZ&+xxb!8Puvhk6%
z-c+kU`mTs)Rx!pW*t%aNJTq}UeNxfppHDaHx8@mi(#&k@%r;M$b$C>k7
z*S$C<+V37oHUDe9_q~37dh+?jZ&@1*jf))yI4%N4O
zW39E+l@%H=K8#dyWORHa;d(`;O;3@M>7C!x#?72m0*~>#e
zlri=czJ;q?)VIVi#T(0M-f7h9g>DTT(m|*};zo`wq`dWGhk0G!(7GY2pS}`VHIHF&
z%)M1kG1)AgYNqMqqvP=W3H97LHI5AtV^n7i2heW>i6=l@8TOz>O%T3
zyZ(g>RpTBAOT!o&G^HtF;`P(^ve2;azmA4Safk=gsKDWq8Xx1F}azGeLuU8nl8?Typl
zL#eJA%%Xc>wgj6I$eGU8tUhxs&`HIs9mGtP@DNoNWb2{L<%|fZP1oE+z#@i-qRoUM
z#m-77#qJxgubXU<%tyB2FRF3ae-_LkNBFOC2faKcX^=zg*{W&K+}o5WhkKOV`o&I-
z_?LC%B6wUaf2EGB6c|4`r@<58vBLhp+%*UayJ5r+oaMI0#1!{jQGH{j|30{EEN#X{
zAFDq;WAkJ%tJ~lvTo1B!NXp5?l^doLf;Q%)HI9VkW95>rLgrnj(XBE3_x}b-llck9
z5>!8rT|5aQZ;4(ByH#E)HpL`bI1JgD2)Fad-D?yu5YrCHOMd(Qxw?quf}Z1P{RP6x$Q9RERm|m3
zqITPtXWG1mzH-HU_(^cB2q`Ws;XNds^a$0rd#fJO9vCln#dOHc#5OkV4#=vV7p3YG
zkL5`gI$lgYnhRp^KEnK`tvTxGj)qO)n3##B%^ReiO2>F@KduZBD50V$LfaWXuYOH9
zC82$N6&$8Y7UP!j^ETUB-kS&dZKyhm2UR#m8b(rz?B#}=X!NOlX5O4QA}Q?Gks0YI
zwt;86`#ydNH}pVlY~|p0#t6Pk0cTe5(GOW#z!P%dEgL
z6%WZg7V|i!sLJIM%AgnrYeQpsJ?l8ruK{UT9RI_@LD5GG?DgJmarL)2euc8r*8cWY
zf4%61?)F8+gmA=?Va9T45i--;kjj3pzIAVf(C#i>-66$jRyn<-9vtSTPc`;6e1`G+
z9vb|R0i}A5xga$P8&gnReN=y**x-)xZ!#;$yCF>l^a?^RyU?-lUOC3$3RnKsUV2;C
zB4{T~qVv0Nz)|&TQT+JzOp@a|C&h&Ai%NYRl%#K%zV(=@ObpuUJu-792u
zX2G^%jqoctY5Zo|&=-da%TD88?|Tvu>}Cn4YX1@ogZ<-h?>M7&wwJuQF1_+zzIIIt
zkI!sm-2JW>ADq;xpK7Oc!?JKiMVcMAvGmr@EG2DN*g}JZ{7T?^v4JSun?!Z1**`6C
zzN0g3FPmcPLhV&UW6Uga6}nzMd*x|o^PG$Vq$hdSq*=HZMi^$P3(3Wk?jN{SO;y*P
zEI~;T%Sqi#>f~eCe*0dl#_r&qNq-p4!B;D}iz$~!Z(tMH0g|HM4He|F1x6GH+&8L;+F4k3@D9T*K7R=iYb9bIU;)0PV|2m`}T5y*a{wg02IHuaf@xt
zTFO7be_(CeM-2scHwpf)n)HW-uEgo3b6|+$Z_TGUqhCTDQI1Cc#7q9G&6!wlQo|aD
zIsL0&{remJgJs4?p-qYC1h1*TeOkFuJ^eH4wDGFf2DGr{w*=XJ6SzU8Ga6;y<3;NC
zTx{Ns47Q8nVJMAzHquUdI{1(uG`6g98)DyoZW_grY_rXG!(!Z^E7w)bjo=S7649Z|
zhRf%0>WqEuh%+`gwGqtwn`)~loYGk+&sOYZ4teYlhLlAE(|x>2{dyaD_qNWL;YU$B
z@(qU}X)Kx-1&61`#it%tUt@_`+z9xDD20NU+sVJU^!|SF?{I#mTl9YuMeHT?h
zkd~J2ZX~3;M~xCe5b3UgG}7JOHAaJkbV;Y+DCrt8BuA(3eBS@yx4Zkf-+RwJ_Z)o7
zF>{s<4OCmhYK$?r=QC9osm1f7@xMp}aHYIc`jP$!2d{kZTSAc!52on(;fnbjb%~T^
z6)V#(8K*#CTum(_)K=*-#qxvn%pDL7>%*JAx
zCmSC5j-?v@{BF5!Omz&O{w>6(QCOr*aeaf>rZ-EM{D>G1b!(6FuH;BLf3wJxfoZq?_h;F^ULBZu6z-u8#n|4(bZ)|8O0QL8B70~q
zV}2E;R`}~*^d{f2ygTEYx>J9E>+VaV5jmdIj5s2#drsXOgyCPijvy+87(GnQI?Plv
zPhr5^-fsXCV&KdlWgW9`n7oca&>H8=k-?ibyVcjeN`ba21y6LJxXP3zex3ia=@j)^
zi-tA&)^6zW*aw3T)u21Le^{F!Gp6b$ordv}AVOc*xd_867QJSl-jNhEcV1K
zVS_cr`$x@8E5=FQ$=48m;=wX?Y9iwu{DHsafe>HQ)7$z}*V;gGVa9oscFcWhQv%F_
ztLm8W`aL#spIBfUm71cb_i7i}=VXQbGIOBj~ke
z@xK9|arWwd77f4=`$xpY)zC#7Ag`xm`BJZuwUkvIe1iNcPKg~ur&q{Q+pI|C(?W8W7Qn~Xu5~;4B>b72Rj=1>OtP#nh8$T-0t|c3Me7ya5lZgug?-)5X
zBtL4p5tpjyS}(9OTTITGlR-%srU@xh%ceAaZbRQDdrxS8kzt
z4M`2vs@hZ
z>*N$+(56ADqZbKFcX_uGIeTO@qqQ
zX52E3!u^NAxXNJwvc^Q`wVQyoU;b;lR0~n+o_<*5s5=dA5-RJ(ivJfh-5(!##x9CZ
z?n(>WAu2IWR|*GyH!IKf2+_RXfiY5|5KNp2RYc%Yg9m8@s0Q7@OX4N*fYePSAI{>m
zc(VYBXiJ=52+#@av)oI&tlt-|x~#Hp>zOL#p7Y6QoQ`ABQ$2HRd{tI0lb%R>z(JV?
z-d_I(v{VMdAP;o;IQ5p94T@@cCBn{y2RAgOjXYVD3ckYN3rNp(tJQueqV>XAid_>{}l
zUF`Z6;9ttvz%Xk-pKSW&n=0RTxIl1gROVp+ABoZ@Dq0WN^-NInq&(x-;+@^cR?^^d
z$DH$R{RKC1x|0-(K^5}PnEl_C?6f~*@6WGFix1IcsM-y%X)zBaXH%F7r~a)j?x2@X
zRWP9_xp-lc6;EuGc;UIuQC@T(bg}w9ihWRf`QN-ufvAoU#P~mcjgg1jnVrxyiQF!v
z^`D^HwbL$Gi3Xzl!7}8L+}2OE`bGMfY;0fkt_Sf|1-~yk@MrTQ+SgW{N_U_P)8@J^
z*X2%eh;D-TO$~9_-EQY);>*EBHHkl(nc$_2v#=_JPU+C8aQFq`3fg(U3ee<~L(&&b-E!+Mq3&ev|m{|io
zUwyL8+QQsMdFRIM%#MzqR#v%m8dt%E^c^N;NaH@r?q*|0WLz6tH2cDTKEjuYzRU}n
zMK9wAjC2w}i3IVE8g#_zB`XdQ=9qhtxihDpeR~XU@xYhRW0-A2cO`uctJ<%iZ(|pg
zKbro4rGMRel}8=|ggR?7Ks*nVR|0v5XD%Q7RuWxLVRq_V7n|v_@
z=1;27Tdm>m74?*(?e&bGz-Ul!?bg1l`v@Zm)sUHuWE7IH;Ffc(d+uZW1=%0Qtr)Lrsme8tSeVbRu
zm{-XX`q21lkwR_f+)qaFZcbe=0`c0QDK^DOHfr*-TMvCEViP?j{t8=%#@UU7ZL)n+
zfme`N4ga~?4ZoHj#5td2C#nNIT+W*^#i+5+Q}?591O4Rlwjj$vB4!+&o8B#_KBm~0
zIjgJ!cq3!ZA5dI_h9^ssZO42G-L^8`IyX$Et{a}hjFZz10ltb$&xSdlhl4~@?VVLV
z77O!h@bvK#m`3(}c1W>~9T@h)0OIWxY5A8e$5yujrp720We;Jw`Fs-N7{y2nocPE-
zW0IMWTa|&&&LDVZg8^CuXXdQ3EkWmG_|estZX2#v$J>@T6WN_m)Bs*1MEl5@U+lk7Qub281
zG*l30`Zei~I&m-Q-8tu-^$)zT%;R&dVG34bWD#LZ8y&;S_%MTzWKA^oAJez%m}*5Q
z<%`E}!EksH$H8yb^IM806BKqVS156#VZ_NtRomz<{M=_b_`!gx;jjqF0DE@}&{jSJ
zz}r$vo#)0hrBmcYQ~>ad{+mg!Pof1T^nt&hlxeXfC1DGc?NiaB<5D>JRv%0NnSGfn
zcM$}^)xnj3@VZvY!gSjPKIRqxrZ`l=CNg4N;cjsS(RXC1VPUHF$X{>{a(F#yxs+g(
zA{3UCIpIugBr|nxeTZ63^?~0aXh`Ei*9sVd9mN;%>h?XGbAdA@3jbjJa5_&3e0#gP
z)nN+%mwVog7<7bLBO`bWO)k?xGq~xY13x`JC@Fg(x5<)Wg^XDcm<@o);yp7qd;DIj
zg%_iTN#k7pFWG%iCUwqhQ!dH>B|DRg(S^3pORkAFo@wGBO#*m(k7zJ+V(J@H^`bw;
zX~P8^RBOHWAcknLSZ30w@(p7@unF>pdKxA|FIBB=6mCj-P7~FiK6nvo7252FRGg&4MY+&5
znAlZJ*DzqDLL4YkL<~FFfw6_Ojoh^o^Lu@h5SXfye6#&X6Dv3MoOL7&%{nJ*KXTP(
z_x3+V!fW!CD;co@p^-4*N(K@9GpSFIk&v5hiJ+ixNI}x<4OKxVNf-}>t+^f=(pIUl
zZ9z56djspIUr>jtF$B*|LAN{zFaz~jFyqy3K20ZUm-#$iD
z-Y+?U-eY4SQkn~N9lPs`wn`Xy>r(I
zT;=QhHT-?@+$Ct6+a^C9W>zWGmITT?(VWd}Ed<+UEV*l`T}JPzMed%$ohx
zlo)x=?5IlMw)Yg2!YE27YW{_VEm=0=u*^}1H*PYQT0pw3QB`w3iX;4U&QRQyk23OI
zP$k@O95-c3HpyC6;Mu5&W;I>omE_#5_+xRe6Akt_jz@9%uf^VekpaXsz!b3@
zphyERiv2v_s9fw!++yV~>!;M1eWF5X2jHUC4LM;is^p)pu*as7s>xv>-qK$rAr(X;
zPk}A}hFKWz){LzH9c*L4|p8Xg@XbKt!>
zb)Fw&H%GNUVR@#f
z7GJsuux{X
zEg!Q9AI0!I{f9;*7&
zi_roGty^U0_sEpl)Y;nYBD`ysGn;8`PRZ5Am}xgPnnRWon{%)of+EK4c}DYHI+D?s
z>2}%^chYhMpatLB4CLnA=(^s1Hx_$1)#}9^D1+zyVfM9U#fnEM)M_pYb)GvF$MlbN
z_7}vFuxpmtWw
z@37+;ZZvtN29`nVo%eEYCYB`GEC8(#g*0Tbs6~O{BFRYgMir|u%9c*IB(fK6t`@yPQjTzOuI8ypc`A8#WMVn2Xdkl2c}QasSwNzb$qT=bP2b
z%+IWq&pstZA3`om4BNL@k<5rz-CU!WGo1
zZyi<}#wYTdbM@!%nK2=Iegx46(H*6?^m9h%Ppy^
z@Si2d=B!vzV1Ti0j)u_nkaP^{L$?~O%uqx`(&ka7gMhObC~sZ^`T!gqbE3VYCNpVY
zZb;fOB^fJuxO%xGaiN9#$%WnD@{Sq3cVVG)|cFjEE6xQ(GHQ7<8
zw-c%|#X-01rB}HOYMqEl&0Fr~6th`M-JX8l1p-U0emRgZEU}$_OQe*KmNQG1#lg`m
z#I?U)I-z;h$XuQ(UKf=~iLeNzk8K>iSL=S7!QdV@@1=``g4&lY<@1F|;J-km$6zy^+zuE^Ra=Ufb$7=vll
z)~<_ta_m_kwPCP(v)kfIj`Ecmeu1*DGz~txryW!gkIG^5Ixd0)^``Gx51u&+34J9x
zi%iavws2?M?^?&y`eA9i=46-4w-v>mdoGviSbHI!RP`t9<@{7^b)5}w!&01#3(j|?
zzy>32%^_PB%f`Z+%3@g&-yRDRiN$g=@Tqv&xAMLvJ^nne9=Kd&HC8eyDj6EoJpBrZ01jIC^kU;>kz0~k^qaZUJ;PXafu<12
zB;UQOOoF~EcT=aKhLmvFnm4TVo||jW2G34UY8u%fL6(1Sge2aG@caqYzc)g>Fl6N}
z36V~L4(;)=fs*RC3GlhNRJ8qI`E527Iwzs8KqgRbTIuhal+CEwVnGeSs!@NhJWhU?
zgL^#p+)&Y$?tF2{>Q~+Ev4PiHh<$}xsQMK6ej^3=q2akqB6Y3o{xkBjNUGBIBPE-V
zjPbsvHUpBDRxr`We6|CGfI1$L-C=~Fk<>*b>HQa8+RiYZ;b*L=@{KO)9YX%a#?O2zk#&|ZrEB@0n`#?aV#GZW@WLc{I9lVN|`@D
z;{MKT?Vv2pcQl9Mamcdv?3Ask<6?`LOhKE#
z<^FwD4NSekqP-a>U_C;&vUuWi56?&~)Z@GqBJgr8wy{=(xkk7R2e&iqEIArDQ$vIn
zxbm#U!_uLksl<{kJ?4(j@f|{4{5IiU&EZ&Rf?rby_3oxuLeencSU>cbe*slY!D=Zo
zV?EhTN>Fo3VQP#OX7%Q}?0YCJuRt}uAsfcd96iM97YX=X7NgX+)->s6iba$C{KKzJ
z=xHs4WASWcImWLeghxlf1q8=aGihgw4_+n>P`5&mK(qMXU@Atw2w4l8I9x?Y
zl8Xa$rLGL%j?O8WmN-c3VH-2W2YSP2c}`%et`XHlx1Vf%`AURzVzb2l9TLJe$`X?y
zO*KO8m+ZwhJ(_k~$)3W%9~0gwsNsqH9^QDrDN9Bi+~A*lTPetZ+3(;dAtJMo2uV02i^j0Wl>^M3ytQ`e$o+JwoAuEAlgaFRrF^$)pK$}6t7;i
zQLMz{);6V9ZisHXN%$9Cv4b~1qrelNoqkl6zX6}5)sj7X?;Wk2jqEcN8wF@0)t
zkS}w+m;E0-tXVlRdoei6%UL<5TA0j
za{q-f!JL1odC8l~zF^Z*_O%IU6&ATu3v_x7PyV7|?7+RiAuQ3DGFRKM>5)sNW`p4v
zA6A>`9PV}Kp5WI$qO-ezA?}#Xe8An^l+pjpl8%Yv