mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'main' into aljupudi-6027362-improperacronyms-03
This commit is contained in:
Alekhya Jupudi
commit
5aa5d9662a
@ -111,7 +111,7 @@ Back up all your data before installing Windows 10 in S mode. Only personal file
|
||||
|
||||
Windows 10 in S mode doesn't support non-Azure Active Directory domain accounts. Before installing Windows 10 in S mode, you must have at least one of these administrator accounts:
|
||||
- Local administrator
|
||||
- Microsoft Account (MSA) administrator
|
||||
- Microsoft account administrator
|
||||
- Azure Active Directory administrator
|
||||
|
||||
> [!WARNING]
|
||||
|
||||
@ -50,10 +50,11 @@ You can create collections of apps within your private store. Collections allow
|
||||
You can add a collection to your private store from the private store, or from the details page for an app.
|
||||
|
||||
**From private store**
|
||||
|
||||
1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click your private store.</br>
|
||||
|
||||
|
||||
|
||||
3. Click **Add a Collection**.</br>
|
||||
|
||||
|
||||
@ -65,6 +66,7 @@ You can add a collection to your private store from the private store, or from t
|
||||
> New collections require at least one app, or they will not be created.
|
||||
|
||||
**From app details page**
|
||||
|
||||
1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click **Manage**, and then click **Products & services**.
|
||||
3. Under **Apps & software**, choose an app you want to include in a new collection.
|
||||
@ -84,12 +86,13 @@ If you've already added a Collection to your private store, you can easily add a
|
||||
1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click your private store.</br>
|
||||
|
||||
|
||||
|
||||
|
||||
3. Click the ellipses next to the collection name, and click **Edit collection**.
|
||||
4. Add or remove products from the collection, and then click **Done**.
|
||||
|
||||
You can also add an app to a collection from the app details page.
|
||||
|
||||
1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click **Manage**, and then click **Products & services**.
|
||||
3. Under **Apps & software**, choose an app you want to include in a new collection.
|
||||
|
||||
@ -45,7 +45,7 @@ You'll need to set up:
|
||||
- LOB publishers need to have an app in Microsoft Store, or have an app ready to submit to the Store.
|
||||
|
||||
The process and timing look like this:
|
||||
|
||||
|
||||
|
||||
## <a href="" id="add-lob-publisher"></a>Add an LOB publisher (Admin)
|
||||
Admins need to invite developer or ISVs to become an LOB publisher.
|
||||
|
||||
@ -861,7 +861,7 @@ Here's the list of corresponding Group Policy settings in HKLM\\Software\\Polici
|
||||
|DeferFeatureUpdates|REG_DWORD|1: defer feature updates<br><br>Other value or absent: don’t defer feature updates|
|
||||
|DeferFeatureUpdatesPeriodInDays|REG_DWORD|0-180: days to defer feature updates|
|
||||
|PauseFeatureUpdates|REG_DWORD|1: pause feature updates<br><br>Other value or absent: don’t pause feature updates|
|
||||
|ExcludeWUDriversInQualityUpdate|REG_DWORD|1: exclude WU drivers<br><br>Other value or absent: offer WU drivers|
|
||||
|ExcludeWUDriversInQualityUpdate|REG_DWORD|1: exclude Windows Update drivers<br><br>Other value or absent: offer Windows Update drivers|
|
||||
|
||||
Here's the list of older policies that are still supported for backward compatibility. You can use these older policies for Windows 10, version 1511 devices.
|
||||
|
||||
|
||||
@ -537,28 +537,32 @@ Supported operation is Exec only.
|
||||
|
||||
<a href="" id="provider-providerid-multiplesession-numallowedconcurrentusersessionforbackgroundsync"></a>**Provider/*ProviderID*/MultipleSession/NumAllowedConcurrentUserSessionForBackgroundSync**
|
||||
|
||||
Optional. This node specifies maximum number of concurrent user sync sessions in background. Default value is 25.
|
||||
Optional. This node specifies maximum number of concurrent user sync sessions in background.
|
||||
|
||||
The default value is dynamically decided by the client based on CPU usage.
|
||||
|
||||
The values are : 0= none, 1= sequential, anything else= parallel.
|
||||
|
||||
Supported operations are Get, Add, Replace and Delete.
|
||||
|
||||
Value type is integer. Only applicable for Windows 10 multi-session.
|
||||
Value type is integer. Only applicable for Windows Enterprise multi-session.
|
||||
|
||||
|
||||
<a href="" id="provider-providerid-multiplesession-numallowedconcurrentusersessionatuserlogonsync"></a>**Provider/*ProviderID*/MultipleSession/NumAllowedConcurrentUserSessionAtUserLogonSync**
|
||||
Optional. This node specifies maximum number of concurrent user sync sessions at User Login. Default value is 25.
|
||||
Optional. This node specifies maximum number of concurrent user sync sessions at User Login.
|
||||
|
||||
The default value is dynamically decided by the client based on CPU usage.
|
||||
|
||||
The values are : 0= none, 1= sequential, anything else= parallel.
|
||||
|
||||
Supported operations are Get, Add, Replace and Delete.
|
||||
|
||||
Value type is integer. Only applicable for Windows 10 multi-session.
|
||||
Value type is integer. Only applicable for Windows Enterprise multi-session.
|
||||
|
||||
<a href="" id="provider-providerid-multiplesession-intervalforscheduledretriesforusersession"></a>**Provider/*ProviderID*/MultipleSession/IntervalForScheduledRetriesForUserSession**
|
||||
Optional. This node specifies the waiting time (in minutes) for the initial set of retries as specified by the number of retries in `/<ProviderID>/Poll/NumberOfScheduledRetriesForUserSession`.
|
||||
|
||||
If IntervalForScheduledRetriesForUserSession is not set, then the default value is used. The default value is 1440. If the value is set to 0, this schedule is disabled.
|
||||
If IntervalForScheduledRetriesForUserSession is not set, then the default value is used. The default value is 0. If the value is set to 0, this schedule is disabled.
|
||||
|
||||
This configuration is only applicable for Windows Multi-session Editions.
|
||||
|
||||
@ -626,7 +630,7 @@ The status error mapping is listed below.
|
||||
|--- |--- |
|
||||
|0|Success|
|
||||
|1|Failure: invalid PFN|
|
||||
|2|Failure: invalid or expired device authentication with MSA|
|
||||
|2|Failure: invalid or expired device authentication with Microsoft account|
|
||||
|3|Failure: WNS client registration failed due to an invalid or revoked PFN|
|
||||
|4|Failure: no Channel URI assigned|
|
||||
|5|Failure: Channel URI has expired|
|
||||
|
||||
@ -27,12 +27,12 @@ The table below shows the applicability of Windows:
|
||||
|
||||
The EnterpriseDataProtection configuration service provider (CSP) is used to configure settings for Windows Information Protection (WIP), formerly known as Enterprise Data Protection. For more information about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip).
|
||||
|
||||
> [!Note]
|
||||
> To make WIP functional, the AppLocker CSP and the network isolation-specific settings must also be configured. For more information, see [AppLocker CSP](applocker-csp.md) and NetworkIsolation policies in [Policy CSP](policy-configuration-service-provider.md).
|
||||
> [!NOTE]
|
||||
> To make Windows Information Protection functional, the AppLocker CSP and the network isolation-specific settings must also be configured. For more information, see [AppLocker CSP](applocker-csp.md) and NetworkIsolation policies in [Policy CSP](policy-configuration-service-provider.md).
|
||||
|
||||
While WIP has no hard dependency on VPN, for best results you should configure VPN profiles first before you configure the WIP policies. For VPN best practice recommendations, see [VPNv2 CSP](vpnv2-csp.md).
|
||||
While Windows Information Protection has no hard dependency on VPN, for best results you should configure VPN profiles first before you configure the WIP policies. For VPN best practice recommendations, see [VPNv2 CSP](vpnv2-csp.md).
|
||||
|
||||
To learn more about WIP, see the following articles:
|
||||
To learn more about Windows Information Protection, see the following articles:
|
||||
|
||||
- [Create a Windows Information Protection (WIP) policy](/windows/security/information-protection/windows-information-protection/overview-create-wip-policy)
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip)
|
||||
@ -63,8 +63,8 @@ The root node for the Windows Information Protection (WIP) configuration setting
|
||||
<a href="" id="settings-edpenforcementlevel"></a>**Settings/EDPEnforcementLevel**
|
||||
Set the WIP enforcement level.
|
||||
|
||||
> [!Note]
|
||||
> Setting this value isn't sufficient to enable WIP on the device. Attempts to change this value will fail when the WIP cleanup is running.
|
||||
> [!NOTE]
|
||||
> Setting this value isn't sufficient to enable Windows Information Protection on the device. Attempts to change this value will fail when the WIP cleanup is running.
|
||||
|
||||
The following list shows the supported values:
|
||||
|
||||
@ -76,14 +76,13 @@ The following list shows the supported values:
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
<a href="" id="settings-enterpriseprotecteddomainnames"></a>**Settings/EnterpriseProtectedDomainNames**
|
||||
A list of domains used by the enterprise for its user identities separated by pipes ("|"). The first domain in the list must be the primary enterprise ID, that is, the one representing the managing authority for WIP. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. For example, the domains for all email accounts owned by the enterprise would be expected to appear in this list. Attempts to change this value will fail when the WIP cleanup is running.
|
||||
A list of domains used by the enterprise for its user identities separated by pipes ("|"). The first domain in the list must be the primary enterprise ID, that is, the one representing the managing authority for Windows Information Protection. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. For example, the domains for all email accounts owned by the enterprise would be expected to appear in this list. Attempts to change this value will fail when the WIP cleanup is running.
|
||||
|
||||
Changing the primary enterprise ID isn't supported and may cause unexpected behavior on the client.
|
||||
|
||||
> [!Note]
|
||||
> [!NOTE]
|
||||
> The client requires domain name to be canonical, otherwise the setting will be rejected by the client.
|
||||
|
||||
|
||||
Here are the steps to create canonical domain names:
|
||||
|
||||
1. Transform the ASCII characters (A-Z only) to lowercase. For example, Microsoft.COM -> microsoft.com.
|
||||
@ -242,7 +241,7 @@ For EFSCertificate KeyTag, it's expected to be a DER ENCODED binary certificate.
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is base-64 encoded certificate.
|
||||
|
||||
<a href="" id="settings-revokeonunenroll"></a>**Settings/RevokeOnUnenroll**
|
||||
This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 0 (Don't revoke keys), the keys won't be revoked and the user will continue to have access to protected files after unenrollment. If the keys aren't revoked, there will be no revoked file cleanup, later. Prior to sending the unenroll command, when you want a device to do a selective wipe when it's unenrolled, then you should explicitly set this policy to 1.
|
||||
This policy controls whether to revoke the Windows Information Protection keys when a device unenrolls from the management service. If set to 0 (Don't revoke keys), the keys won't be revoked and the user will continue to have access to protected files after unenrollment. If the keys aren't revoked, there will be no revoked file cleanup, later. Prior to sending the unenroll command, when you want a device to do a selective wipe when it's unenrolled, then you should explicitly set this policy to 1.
|
||||
|
||||
The following list shows the supported values:
|
||||
|
||||
@ -252,7 +251,7 @@ The following list shows the supported values:
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
<a href="" id="settings-revokeonmdmhandoff"></a>**Settings/RevokeOnMDMHandoff**
|
||||
Added in Windows 10, version 1703. This policy controls whether to revoke the WIP keys when a device upgrades from mobile application management (MAM) to MDM. If set to 0 (Don't revoke keys), the keys won't be revoked and the user will continue to have access to protected files after upgrade. This setting is recommended if the MDM service is configured with the same WIP EnterpriseID as the MAM service.
|
||||
Added in Windows 10, version 1703. This policy controls whether to revoke the Windows Information Protection keys when a device upgrades from mobile application management (MAM) to MDM. If set to 0 (Don't revoke keys), the keys won't be revoked and the user will continue to have access to protected files after upgrade. This setting is recommended if the MDM service is configured with the same WIP EnterpriseID as the MAM service.
|
||||
|
||||
- 0 - Don't revoke keys.
|
||||
- 1 (default) - Revoke keys.
|
||||
@ -265,7 +264,7 @@ TemplateID GUID to use for Rights Management Service (RMS) encryption. The RMS t
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is string (GUID).
|
||||
|
||||
<a href="" id="settings-allowazurermsforedp"></a>**Settings/AllowAzureRMSForEDP**
|
||||
Specifies whether to allow Azure RMS encryption for WIP.
|
||||
Specifies whether to allow Azure RMS encryption for Windows Information Protection.
|
||||
|
||||
- 0 (default) – Don't use RMS.
|
||||
- 1 – Use RMS.
|
||||
@ -278,7 +277,7 @@ When this policy isn't specified, the existing auto-encryption behavior is appli
|
||||
Supported operations are Add, Get, Replace and Delete. Value type is string.
|
||||
|
||||
<a href="" id="settings-edpshowicons"></a>**Settings/EDPShowIcons**
|
||||
Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles on the **Start** menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app.
|
||||
Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles on the **Start** menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the Windows Information Protection icon in the title bar of a WIP-protected app.
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) - No WIP overlays on icons or tiles.
|
||||
@ -287,7 +286,7 @@ The following list shows the supported values:
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
<a href="" id="status"></a>**Status**
|
||||
A read-only bit mask that indicates the current state of WIP on the Device. The MDM service can use this value to determine the current overall state of WIP. WIP is only on (bit 0 = 1) if WIP mandatory policies and WIP AppLocker settings are configured.
|
||||
A read-only bit mask that indicates the current state of Windows Information Protection on the Device. The MDM service can use this value to determine the current overall state of WIP. WIP is only on (bit 0 = 1) if WIP mandatory policies and WIP AppLocker settings are configured.
|
||||
|
||||
Suggested values:
|
||||
|
||||
@ -299,7 +298,7 @@ Bit 0 indicates whether WIP is on or off.
|
||||
|
||||
Bit 1 indicates whether AppLocker WIP policies are set.
|
||||
|
||||
Bit 3 indicates whether the mandatory WIP policies are configured. If one or more of the mandatory WIP policies aren't configured, the bit 3 is set to 0 (zero).
|
||||
Bit 3 indicates whether the mandatory Windows Information Protection policies are configured. If one or more of the mandatory WIP policies aren't configured, the bit 3 is set to 0 (zero).
|
||||
|
||||
Here's the list of mandatory WIP policies:
|
||||
|
||||
|
||||
@ -80,17 +80,17 @@ Since the [Poll](dmclient-csp.md#provider-providerid-poll) node isn’t provided
|
||||
|
||||
MAM on Windows supports the following configuration service providers (CSPs). All other CSPs will be blocked. Note the list may change later based on customer feedback:
|
||||
|
||||
- [AppLocker CSP](applocker-csp.md) for configuration of WIP enterprise allowed apps.
|
||||
- [AppLocker CSP](applocker-csp.md) for configuration of Windows Information Protection enterprise allowed apps.
|
||||
- [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) for installing VPN and Wi-Fi certs.
|
||||
- [DeviceStatus CSP](devicestatus-csp.md) required for Conditional Access support (starting with Windows 10, version 1703).
|
||||
- [DevInfo CSP](devinfo-csp.md).
|
||||
- [DMAcc CSP](dmacc-csp.md).
|
||||
- [DMClient CSP](dmclient-csp.md) for polling schedules configuration and MDM discovery URL.
|
||||
- [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) has WIP policies.
|
||||
- [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) has Windows Information Protection policies.
|
||||
- [Health Attestation CSP](healthattestation-csp.md) required for Conditional Access support (starting with Windows 10, version 1703).
|
||||
- [PassportForWork CSP](passportforwork-csp.md) for Windows Hello for Business PIN management.
|
||||
- [Policy CSP](policy-configuration-service-provider.md) specifically for NetworkIsolation and DeviceLock areas.
|
||||
- [Reporting CSP](reporting-csp.md) for retrieving WIP logs.
|
||||
- [Reporting CSP](reporting-csp.md) for retrieving Windows Information Protection logs.
|
||||
- [RootCaTrustedCertificates CSP](rootcacertificates-csp.md).
|
||||
- [VPNv2 CSP](vpnv2-csp.md) should be omitted for deployments where IT is planning to allow access and protect cloud-only resources with MAM.
|
||||
- [WiFi CSP](wifi-csp.md) should be omitted for deployments where IT is planning to allow access and protect cloud-only resources with MAM.
|
||||
@ -116,13 +116,13 @@ MAM policy syncs are modeled after MDM. The MAM client uses an Azure AD token to
|
||||
Windows doesn't support applying both MAM and MDM policies to the same devices. If configured by the admin, users can change their MAM enrollment to MDM.
|
||||
|
||||
> [!NOTE]
|
||||
> When users upgrade from MAM to MDM on Windows Home edition, they lose access to WIP. On Windows Home edition, we don't recommend pushing MDM policies to enable users to upgrade.
|
||||
> When users upgrade from MAM to MDM on Windows Home edition, they lose access to Windows Information Protection. On Windows Home edition, we don't recommend pushing MDM policies to enable users to upgrade.
|
||||
|
||||
To configure MAM device for MDM enrollment, the admin needs to configure the MDM Discovery URL in the DMClient CSP. This URL will be used for MDM enrollment.
|
||||
|
||||
In the process of changing MAM enrollment to MDM, MAM policies will be removed from the device after MDM policies have been successfully applied. Normally when WIP policies are removed from the device, the user’s access to WIP-protected documents is revoked (selective wipe) unless EDP CSP RevokeOnUnenroll is set to false. To prevent selective wipe on enrollment change from MAM to MDM, the admin needs to ensure that:
|
||||
In the process of changing MAM enrollment to MDM, MAM policies will be removed from the device after MDM policies have been successfully applied. Normally when Windows Information Protection policies are removed from the device, the user’s access to WIP-protected documents is revoked (selective wipe) unless EDP CSP RevokeOnUnenroll is set to false. To prevent selective wipe on enrollment change from MAM to MDM, the admin needs to ensure that:
|
||||
|
||||
- Both MAM and MDM policies for the organization support WIP.
|
||||
- Both MAM and MDM policies for the organization support Windows Information Protection.
|
||||
- EDP CSP Enterprise ID is the same for both MAM and MDM.
|
||||
- EDP CSP RevokeOnMDMHandoff is set to false.
|
||||
|
||||
|
||||
@ -68,7 +68,7 @@ manager: dansimp
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Specifies whether user is allowed to add non-MSA email accounts.
|
||||
Specifies whether user is allowed to add email accounts other than Microsoft account.
|
||||
|
||||
Most restricted value is 0.
|
||||
|
||||
@ -114,7 +114,7 @@ The following list shows the supported values:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services.
|
||||
Specifies whether the user is allowed to use a Microsoft account for non-email related connection authentication and services.
|
||||
|
||||
Most restricted value is 0.
|
||||
|
||||
@ -160,10 +160,10 @@ The following list shows the supported values:
|
||||
Added in Windows 10, version 1703. Allows IT Admins the ability to disable the "Microsoft Account Sign-In Assistant" (wlidsvc) NT service.
|
||||
|
||||
> [!NOTE]
|
||||
> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
|
||||
> If the Microsoft account service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
|
||||
|
||||
> [!NOTE]
|
||||
> If the MSA service is disabled, the Subscription Activation feature will not work properly and your users will not be able to “step-up” from Windows 10 Pro to Windows 10 Enterprise, because the MSA ticket for license authentication cannot be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app.
|
||||
> If the Microsoft account service is disabled, the Subscription Activation feature will not work properly and your users will not be able to “step-up” from Windows 10 Pro to Windows 10 Enterprise, because the Microsoft account ticket for license authentication cannot be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
@ -106,7 +106,7 @@ On a device where this policy is configured, the user specified in the policy wi
|
||||
> [!NOTE]
|
||||
>
|
||||
> - Some events such as major OS updates may require the specified user to logon to the device again to resume auto-logon behavior.
|
||||
> - Auto-logon is only supported for MSA and AAD users.
|
||||
> - Auto-logon is only supported for Microsoft account and AAD users.
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
@ -88,7 +88,7 @@ Specifies the ending time for retrieving logs.
|
||||
- Supported operations are Get and Replace.
|
||||
|
||||
<a href="" id="type"></a>**Type**
|
||||
Added in Windows 10, version 1703. Specifies the type of logs to retrieve. You can use this policy to retrieve the WIP learning logs.
|
||||
Added in Windows 10, version 1703. Specifies the type of logs to retrieve. You can use this policy to retrieve the Windows Information Protection learning logs.
|
||||
|
||||
- Value type is integer.
|
||||
- Supported operations are Get and Replace.
|
||||
|
||||
@ -30,7 +30,7 @@ The VPNv2 configuration service provider allows the mobile device management (MD
|
||||
Here are the requirements for this CSP:
|
||||
|
||||
- VPN configuration commands must be wrapped in an Atomic block in SyncML.
|
||||
- For best results, configure your VPN certificates first before pushing down VPN profiles to devices. If you're using Windows Information Protection (WIP) (formerly known as Enterprise Data Protection), then you should configure VPN first before you configure WIP policies.
|
||||
- For best results, configure your VPN certificates first before pushing down VPN profiles to devices. If you're using Windows Information Protection (WIP) (formerly known as Enterprise Data Protection), then you should configure VPN first before you configure Windows Information Protection policies.
|
||||
- Instead of changing individual properties, follow these steps to make any changes:
|
||||
|
||||
- Send a Delete command for the ProfileName to delete the entire profile.
|
||||
@ -541,9 +541,9 @@ If no inbound filter is provided, then by default all unsolicited inbound traffi
|
||||
Value type is chr. Supported operations include Get, Add, Replace, and Delete.
|
||||
|
||||
<a href="" id="vpnv2-profilename-edpmodeid"></a>**VPNv2/**<em>ProfileName</em>**/EdpModeId**
|
||||
Enterprise ID, which is required for connecting this VPN profile with a WIP policy. When this ID is set, the networking stack looks for this Enterprise ID in the app token to determine if the traffic is allowed to go over the VPN. If the profile is active, it also automatically triggers the VPN to connect. We recommend having only one such profile per device.
|
||||
Enterprise ID, which is required for connecting this VPN profile with a Windows Information Protection policy. When this ID is set, the networking stack looks for this Enterprise ID in the app token to determine if the traffic is allowed to go over the VPN. If the profile is active, it also automatically triggers the VPN to connect. We recommend having only one such profile per device.
|
||||
|
||||
Additionally when a connection is being established with Windows Information Protection (WIP)(formerly known as Enterprise Data Protection), the admin doesn't have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced config is needed) because the WIP policies and App lists automatically takes effect.
|
||||
Additionally when a connection is being established with Windows Information Protection (WIP)(formerly known as Enterprise Data Protection), the admin doesn't have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced config is needed) because the Windows Information Protection policies and App lists automatically takes effect.
|
||||
|
||||
Value type is chr. Supported operations include Get, Add, Replace, and Delete.
|
||||
|
||||
|
||||
@ -161,7 +161,7 @@ Value type is bool.
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="universaltelemetryclient-utcconfigurationdiagnosis-msaserviceenabled"></a>**UniversalTelemetryClient/UtcConfigurationDiagnosis/MsaServiceEnabled**
|
||||
A boolean value representing whether the MSA service is enabled. This service must be enabled for UTC data to be indexed with Global Device IDs.
|
||||
A boolean value representing whether the Microsoft account service is enabled. This service must be enabled for UTC data to be indexed with Global Device IDs.
|
||||
|
||||
Value type is bool.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ All that's required to use Quick Assist is suitable network and internet connect
|
||||
|
||||
### Authentication
|
||||
|
||||
The helper can authenticate when they sign in by using a Microsoft Account (MSA) or Azure Active Directory (Azure AD). Local Active Directory authentication isn't currently supported.
|
||||
The helper can authenticate when they sign in by using a Microsoft account (MSA) or Azure Active Directory (Azure AD). Local Active Directory authentication isn't currently supported.
|
||||
|
||||
### Network considerations
|
||||
|
||||
@ -36,7 +36,7 @@ Both the helper and sharer must be able to reach these endpoints over port 443:
|
||||
| Domain/Name | Description |
|
||||
|--|--|
|
||||
| `*.support.services.microsoft.com` | Primary endpoint used for Quick Assist application |
|
||||
| `*.login.microsoftonline.com` | Required for logging in to the application (MSA) |
|
||||
| `*.login.microsoftonline.com` | Required for logging in to the application (Microsoft account) |
|
||||
| `*.channelwebsdks.azureedge.net` | Used for chat services within Quick Assist |
|
||||
| `*.aria.microsoft.com` | Used for accessibility features within the app |
|
||||
| `*.api.support.microsoft.com` | API access for Quick Assist |
|
||||
|
||||
@ -15,7 +15,7 @@ ms.topic: troubleshooting
|
||||
|
||||
# What version of Windows am I running?
|
||||
|
||||
To determine if your device is enrolled in the [Long-Term Servicing Channel](/windows/deployment/update/waas-overview#servicing-channels) (LTSC, formerly LTSB) or the [General Availability Channel](/windows/deployment/update/waas-overview#servicing-channels) (SAC) you'll need to know what version of Windows 10 you're running. There are a few ways to figure this out. Each method provides a different set of details, so it’s useful to learn about all of them.
|
||||
To determine if your device is enrolled in the [Long-Term Servicing Channel](/windows/deployment/update/waas-overview#servicing-channels) (LTSC, formerly LTSB) or the [General Availability Channel](/windows/deployment/update/waas-overview#servicing-channels) (GA Channel) you'll need to know what version of Windows 10 you're running. There are a few ways to figure this out. Each method provides a different set of details, so it’s useful to learn about all of them.
|
||||
|
||||
## System Properties
|
||||
Click **Start** > **Settings** > **System** > click **About** from the bottom of the left-hand menu
|
||||
|
||||
@ -27,7 +27,7 @@ There are a few things to be aware of before you start using Cortana in Windows
|
||||
|
||||
- **Office 365 Trust Center.** Cortana in Windows 10, version 1909 and earlier, isn't a service governed by the [Online Services Terms](https://www.microsoft.com/en-us/licensing/product-licensing/products). [Learn more about how Cortana in Windows 10, versions 1909 and earlier, treats your data](https://support.microsoft.com/en-us/help/4468233/cortana-and-privacy-microsoft-privacy).
|
||||
|
||||
- Windows Information Protection (WIP). If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft Endpoint Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.
|
||||
- Windows Information Protection (WIP). If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). If you decide to use Windows Information Protection, you must also have a management solution. This can be Microsoft Intune, Microsoft Endpoint Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.
|
||||
|
||||
- **Troubleshooting tips.** If you run into issues, check out these [troubleshooting tips](/office365/troubleshoot/miscellaneous/issues-in-cortana).
|
||||
|
||||
|
||||
@ -429,8 +429,8 @@ Application is a container for settings that apply to a particular application.
|
||||
|LocalizedNames|An optional name displayed in the UI, localized by a language locale.|
|
||||
|LocalizedDescriptions|An optional template description localized by a language locale.|
|
||||
|Version|Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21).|
|
||||
|DeferToMSAccount|Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.|
|
||||
|DeferToOffice365|Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.|
|
||||
|DeferToMSAccount|Controls whether this template is enabled in conjunction with a Microsoft account or not. If Microsoft account syncing is enabled for a user on a machine, then this template will automatically be disabled.|
|
||||
|DeferToOffice365|Similar to Microsoft account, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.|
|
||||
|FixedProfile|Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.|
|
||||
|Processes|A container for a collection of one or more Process elements. For more information, see [Processes](#processes21).|
|
||||
|Settings|A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see **Settings** in [Data types](#data21)".|
|
||||
@ -448,8 +448,8 @@ Common is similar to an Application element, but it is always associated with tw
|
||||
|LocalizedNames|An optional name displayed in the UI, localized by a language locale.|
|
||||
|LocalizedDescriptions|An optional template description localized by a language locale.|
|
||||
|Version|Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21).|
|
||||
|DeferToMSAccount|Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.|
|
||||
|DeferToOffice365|Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.|
|
||||
|DeferToMSAccount|Controls whether this template is enabled in conjunction with a Microsoft account or not. If Microsoft account syncing is enabled for a user on a machine, then this template will automatically be disabled.|
|
||||
|DeferToOffice365|Similar to Microsoft account, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.|
|
||||
|FixedProfile|Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.|
|
||||
|Settings|A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see **Settings** in [Data types](#data21).|
|
||||
|
||||
|
||||
@ -41,9 +41,9 @@ The following table lists the minimum Windows 10 version that supports Delivery
|
||||
|
||||
| Device type | Minimum Windows version
|
||||
|------------------|---------------|
|
||||
| Computers running Windows 10 | Win 10 1511 |
|
||||
| Computers running Windows 10 | Windows 10 1511 |
|
||||
| Computers running Server Core installations of Windows Server | Windows Server 2019 |
|
||||
| Windows IoT devices | Win 10 1803 |
|
||||
| Windows IoT devices | Windows 10 1803 |
|
||||
|
||||
### Types of download content supported by Delivery Optimization
|
||||
|
||||
@ -51,19 +51,19 @@ The following table lists the minimum Windows 10 version that supports Delivery
|
||||
|
||||
| Windows Client | Minimum Windows version | HTTP Downloader | Peer to Peer | Microsoft Connected Cache (MCC)
|
||||
|------------------|---------------|----------------|----------|----------------|
|
||||
| Windows Update (feature updates quality updates, language packs, drivers) | Win 10 1511, Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Windows 10 Store files | Win 10 1511, Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Windows 10 Store for Business files | Win 10 1511, Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Windows Defender definition updates | Win 10 1511, Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Intune Win32 apps| Win 10 1709, Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Microsoft 365 Apps and updates | Win 10 1709, Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Edge Browser Updates | Win 10 1809, Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Configuration Manager Express updates| Win 10 1709 + Configuration Manager version Win 10 1711, Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Dynamic updates| Win 10 1903, Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| MDM Agent | Win 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Xbox Game Pass (PC) | Win 10 1809, Win 11 | :heavy_check_mark: | | :heavy_check_mark: |
|
||||
| Windows Package Manager| Win 10 1809, Win 11 | :heavy_check_mark: | | |
|
||||
| MSIX | Win 10 2004, Win 11 | :heavy_check_mark: | | |
|
||||
| Windows Update (feature updates quality updates, language packs, drivers) | Windows 10 1511, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Windows 10 Store files | Windows 10 1511, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Windows 10 Store for Business files | Windows 10 1511, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Windows Defender definition updates | Windows 10 1511, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Intune Win32 apps| Windows 10 1709, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Microsoft 365 Apps and updates | Windows 10 1709, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Edge Browser Updates | Windows 10 1809, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Configuration Manager Express updates| Windows 10 1709 + Configuration Manager version Windows 10 1711, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Dynamic updates| Windows 10 1903, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| MDM Agent | Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Xbox Game Pass (PC) | Windows 10 1809, Windows 11 | :heavy_check_mark: | | :heavy_check_mark: |
|
||||
| Windows Package Manager| Windows 10 1809, Windows 11 | :heavy_check_mark: | | |
|
||||
| MSIX | Windows 10 2004, Windows 11 | :heavy_check_mark: | | |
|
||||
|
||||
#### Windows Server
|
||||
|
||||
|
||||
@ -99,7 +99,7 @@ For Windows Update (WU) scans URLs that are used for update detection ([MS-WUSP]
|
||||
> [!Note]
|
||||
> For intranet WSUS update service URLs, we provide an option via Windows Update policy to select the proxy behavior.
|
||||
|
||||
For WU URLs that _aren't_ used for update detection, such as for download or reporting:
|
||||
For Windows Update URLs that _aren't_ used for update detection, such as for download or reporting:
|
||||
- User proxy is attempted.
|
||||
- If WUA fails to reach the service due to a certain proxy, service, or authentication error code, then the system proxy is attempted.
|
||||
|
||||
@ -116,7 +116,7 @@ For WU URLs that _aren't_ used for update detection, such as for download or rep
|
||||
|
||||
|Service|ServiceId|
|
||||
|-------|---------|
|
||||
|Unspecified / Default|WU, MU, or WSUS <br>00000000-0000-0000-0000-000000000000 |
|
||||
|Unspecified / Default|Windows Update, Microsoft Update, or WSUS <br>00000000-0000-0000-0000-000000000000 |
|
||||
|Windows Update|9482F4B4-E343-43B6-B170-9A65BC822C77|
|
||||
|Microsoft Update|7971f918-a847-4430-9279-4a52d1efe18d|
|
||||
|Store|855E8A7C-ECB4-4CA3-B045-1DFA50104289|
|
||||
|
||||
@ -81,7 +81,7 @@ Open `RunConfig.bat` and configure the following (assuming a first-run, with `ru
|
||||
| 51 | Unexpected exception when attempting to run Census.exe|
|
||||
| 52 | Could not find Census.exe|
|
||||
| 53 | There are conflicting CommercialID values.|
|
||||
| 54 | Microsoft Account Sign In Assistant (MSA) Service disabled.|
|
||||
| 54 | Microsoft account (MSA) Sign In Assistant Service disabled.|
|
||||
| 55 | Failed to create new registry path for SetDeviceNameOptIn|
|
||||
| 56 | Failed to create property for SetDeviceNameOptIn at registry path|
|
||||
| 57 | Failed to update value for SetDeviceNameOptIn|
|
||||
|
||||
@ -45,8 +45,8 @@ This section lists the error codes for Microsoft Windows Update.
|
||||
| 0x80243002 | `WU_E_INSTALLATION_RESULTS_INVALID_DATA` | The results of download and installation could not be read from the registry due to an invalid data format. |
|
||||
| 0x80243003 | `WU_E_INSTALLATION_RESULTS_NOT_FOUND` | The results of download and installation are not available; the operation may have failed to start. |
|
||||
| 0x80243004 | `WU_E_TRAYICON_FAILURE` | A failure occurred when trying to create an icon in the taskbar notification area. |
|
||||
| 0x80243FFD | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; WU client UI modules may not be installed. |
|
||||
| 0x80243FFE | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of WU client UI exported functions. |
|
||||
| 0x80243FFD | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; Windows Update client UI modules may not be installed. |
|
||||
| 0x80243FFE | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of Windows Update client UI exported functions. |
|
||||
| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. |
|
||||
| 0x8024043D | `WU_E_SERVICEPROP_NOTAVAIL` | The requested service property is not available. |
|
||||
|
||||
|
||||
@ -47,8 +47,8 @@ To understand the changes to the Windows Update architecture that UUP introduces
|
||||
>
|
||||
>Store apps aren't installed by USO, today they are separate.
|
||||
|
||||
- **WU Client/ UpdateAgent** - The component running on your PC. It's essentially a DLL that is downloaded to the device when an update is applicable. It surfaces the APIs needed to perform an update, including those needed to generate a list of payloads to download, as well as starts stage and commit operations. It provides a unified interface that abstracts away the underlying update technologies from the caller.
|
||||
- **WU Arbiter handle**- Code that is included in the UpdateAgent binary. The arbiter gathers information about the device, and uses the CompDB(s) to output an action list. It is responsible for determining the final "composition state" of your device, and which payloads (like ESDs or packages) are needed to get your device up to date.
|
||||
- **Windows Update Client/ UpdateAgent** - The component running on your PC. It's essentially a DLL that is downloaded to the device when an update is applicable. It surfaces the APIs needed to perform an update, including those needed to generate a list of payloads to download, as well as starts stage and commit operations. It provides a unified interface that abstracts away the underlying update technologies from the caller.
|
||||
- **Windows Update Arbiter handle**- Code that is included in the UpdateAgent binary. The arbiter gathers information about the device, and uses the CompDB(s) to output an action list. It is responsible for determining the final "composition state" of your device, and which payloads (like ESDs or packages) are needed to get your device up to date.
|
||||
- **Deployment Arbiter**- A deployment manager that calls different installers. For example, CBS.
|
||||
|
||||
Additional components include the following-
|
||||
|
||||
@ -42,7 +42,7 @@ The following table describes some log files and how to use them for troubleshoo
|
||||
|setupact.log|Post-upgrade (after OOBE):<br>Windows\Panther|Contains information about setup actions during the installation.|Investigate post-upgrade related issues.|
|
||||
|setuperr.log|Same as setupact.log|Contains information about setup errors during the installation.|Review all errors encountered during the installation phase.|
|
||||
|miglog.xml|Post-upgrade (after OOBE):<br>Windows\Panther|Contains information about what was migrated during the installation.|Identify post upgrade data migration issues.|
|
||||
|BlueBox.log|Down-Level:<br>Windows\Logs\Mosetup|Contains information communication between setup.exe and Windows Update.|Use during WSUS and WU down-level failures or for 0xC1900107.|
|
||||
|BlueBox.log|Down-Level:<br>Windows\Logs\Mosetup|Contains information communication between setup.exe and Windows Update.|Use during WSUS and Windows Update down-level failures or for 0xC1900107.|
|
||||
|Supplemental rollback logs:<br>Setupmem.dmp<br>setupapi.dev.log<br>Event logs (*.evtx)|$Windows.~BT\Sources\Rollback|Additional logs collected during rollback.|Setupmem.dmp: If OS bug checks during upgrade, setup will attempt to extract a mini-dump.<br>Setupapi: Device install issues - 0x30018<br>Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.|
|
||||
|
||||
## Log entry structure
|
||||
|
||||
@ -189,5 +189,5 @@ Also see the following sequential list of modern setup (mosetup) error codes wit
|
||||
- [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
|
||||
- [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/home?category=Windows10ITPro)
|
||||
- [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
|
||||
- [Win 7 to Win 10 upgrade error (0x800707E7 - 0x3000D)](https://answers.microsoft.com/en-us/windows/forum/all/win-7-to-win-10-upgrade-error-0x800707e7-0x3000d/1273bc1e-8a04-44d4-a6b2-808c9feeb020))
|
||||
- [Win 10 upgrade error: User profile suffix mismatch, 0x800707E7 - 0x3000D](https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/win-10-upgrade-error-user-profile-suffix-mismatch/0f006733-2af5-4b42-a2d4-863fad05273d?page=3)
|
||||
- [Windows 7 to Windows 10 upgrade error (0x800707E7 - 0x3000D)](https://answers.microsoft.com/en-us/windows/forum/all/win-7-to-win-10-upgrade-error-0x800707e7-0x3000d/1273bc1e-8a04-44d4-a6b2-808c9feeb020))
|
||||
- [Windows 10 upgrade error: User profile suffix mismatch, 0x800707E7 - 0x3000D](https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/win-10-upgrade-error-user-profile-suffix-mismatch/0f006733-2af5-4b42-a2d4-863fad05273d?page=3)
|
||||
|
||||
@ -298,7 +298,7 @@ Each rule name and its associated unique rule identifier are listed with a descr
|
||||
39. WimApplyExtractFailure – 746879E9-C9C5-488C-8D4B-0C811FF3A9A8
|
||||
- Matches a wim apply failure during wim extraction phases of setup. Will output the extension, path and error code.
|
||||
40. UpdateAgentExpanderFailure – 66E496B3-7D19-47FA-B19B-4040B9FD17E2
|
||||
- Matches DPX expander failures in the down-level phase of update from WU. Will output the package name, function, expression and error code.
|
||||
- Matches DPX expander failures in the down-level phase of update from Windows Update. Will output the package name, function, expression and error code.
|
||||
41. FindFatalPluginFailure – E48E3F1C-26F6-4AFB-859B-BF637DA49636
|
||||
- Matches any plug-in failure that setupplatform decides is fatal to setup. Will output the plugin name, operation and error code.
|
||||
42. AdvancedInstallerFailed - 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC
|
||||
|
||||
@ -57,15 +57,15 @@ X = unsupported <BR>
|
||||
| **Home > Pro for Workstations** |  |  |  |  |  |  |
|
||||
| **Home > Pro Education** |  |  |  |  |  |  |
|
||||
| **Home > Education** |  |  |  |  |  |  |
|
||||
| **Pro > Pro for Workstations** |  |  |  |  <br>(MSfB) |  |  |
|
||||
| **Pro > Pro Education** |  |  |  |  <br>(MSfB) |  |  |
|
||||
| **Pro > Education** |  |  |  |  <br>(MSfB) |  |  |
|
||||
| **Pro > Enterprise** |  |  |  |  <br>(1703 - PC)<br>(1709 - MSfB) |  |  |
|
||||
| **Pro for Workstations > Pro Education** |  |  |  |  <br>(MSfB) |  |  |
|
||||
| **Pro for Workstations > Education** |  |  |  |  <br>(MSfB) |  |  |
|
||||
| **Pro for Workstations > Enterprise** |  |  |  |  <br>(1703 - PC)<br>(1709 - MSfB) |  |  |
|
||||
| **Pro Education > Education** |  |  |  |  <br>(MSfB) |  |  |
|
||||
| **Enterprise > Education** |  |  |  |  <br>(MSfB) |  |  |
|
||||
| **Pro > Pro for Workstations** |  |  |  |  <br>(Microsoft Store for Business) |  |  |
|
||||
| **Pro > Pro Education** |  |  |  |  <br>(Microsoft Store for Business) |  |  |
|
||||
| **Pro > Education** |  |  |  |  <br>(Microsoft Store for Business) |  |  |
|
||||
| **Pro > Enterprise** |  |  |  |  <br>(1703 - PC)<br>(1709 - Microsoft Store for Business) |  |  |
|
||||
| **Pro for Workstations > Pro Education** |  |  |  |  <br>(Microsoft Store for Business) |  |  |
|
||||
| **Pro for Workstations > Education** |  |  |  |  <br>(Microsoft Store for Business) |  |  |
|
||||
| **Pro for Workstations > Enterprise** |  |  |  |  <br>(1703 - PC)<br>(1709 - Microsoft Store for Business) |  |  |
|
||||
| **Pro Education > Education** |  |  |  |  <br>(Microsoft Store for Business) |  |  |
|
||||
| **Enterprise > Education** |  |  |  |  <br>(Microsoft Store for Business) |  |  |
|
||||
|
||||
> [!NOTE]
|
||||
> - For information about upgrade paths in Windows 10 in S mode (for Pro or Education), check out [Windows 10 Pro/Enterprise in S mode](../windows-10-pro-in-s-mode.md)
|
||||
|
||||
@ -30,7 +30,7 @@ If you are also migrating to a different edition of Windows, see [Windows 10 edi
|
||||
|
||||
- **In-place upgrade from Windows 7, Windows 8.1, or [Windows 10 General Availability Channel](/windows/release-health/release-information)** to Windows 10 LTSC is not supported. Windows 10 LTSC 2015 did not block this in-place upgrade path. This issue was corrected in the Windows 10 LTSC 2016 release, which only allows data-only and clean install options.
|
||||
|
||||
You can upgrade from Windows 10 LTSC to Windows 10 General Availability Channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). You will need to use the Product Key switch if you want to keep your apps. If you don't use the switch, the option **Keep personal files and apps** option is grayed out. The command line would be `setup.exe /pkey xxxxx-xxxxx-xxxxx-xxxxx-xxxxx`, using your relevant Windows 10 SAC product key. For example, if using a KMS, the command line would be `setup.exe /pkey NPPR9-FWDCX-D2C8J-H872K-2YT43`.
|
||||
You can upgrade from Windows 10 LTSC to Windows 10 General Availability Channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). You will need to use the Product Key switch if you want to keep your apps. If you don't use the switch, the option **Keep personal files and apps** option is grayed out. The command line would be `setup.exe /pkey xxxxx-xxxxx-xxxxx-xxxxx-xxxxx`, using your relevant Windows 10 GA Channel product key. For example, if using a KMS, the command line would be `setup.exe /pkey NPPR9-FWDCX-D2C8J-H872K-2YT43`.
|
||||
|
||||
- **Windows N/KN**: Windows "N" and "KN" SKUs (editions without media-related functionality) follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.
|
||||
|
||||
|
||||
@ -14,6 +14,9 @@ msreviewer: hathind
|
||||
|
||||
# Add and verify admin contacts
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The Admin contacts blade isn't available during public preview. However, we'll use the admin contacts provided by you during public preview onboarding.
|
||||
|
||||
There are several ways that Windows Autopatch service communicates with customers. To streamline communication and ensure we're checking with the right people when you [submit a support request](../operate/windows-autopatch-support-request.md), you must provide a set of admin contacts when you onboard with Windows Autopatch.
|
||||
|
||||
> [!IMPORTANT]
|
||||
|
||||
@ -14,7 +14,7 @@ msreviewer: hathind
|
||||
|
||||
# Microsoft Edge
|
||||
|
||||
Windows Autopatch uses the [Stable channel](/deployedge/microsoft-edge-channels%22%20/l%20%22stable-channel) of Microsoft Edge.
|
||||
Windows Autopatch uses the [Stable Channel](/deployedge/microsoft-edge-channels#stable-channel) of Microsoft Edge.
|
||||
|
||||
## Device eligibility
|
||||
|
||||
@ -31,7 +31,7 @@ Microsoft Edge will check for updates every 10 hours. Quality updates occur week
|
||||
|
||||
Browser updates with critical security fixes will have a faster rollout cadence than updates that don't have critical security fixes to ensure prompt protection from vulnerabilities.
|
||||
|
||||
Devices in the Test device group receive feature updates from the [Beta channel](/deployedge/microsoft-edge-channels#beta-channel). This channel is fully supported and automatically updated with new features approximately every four weeks.
|
||||
Devices in the Test device group receive feature updates from the [Beta Channel](/deployedge/microsoft-edge-channels#beta-channel). This channel is fully supported and automatically updated with new features approximately every four weeks.
|
||||
|
||||
## Pausing and resuming updates
|
||||
|
||||
|
||||
@ -396,7 +396,7 @@ For the purposes of this demo, select **All** under the **MDM user scope** and s
|
||||
|
||||
## Register your VM
|
||||
|
||||
Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB). Both processes are shown here, but *only pick one* for the purposes of this lab. It's highly recommended that you use Intune rather than MSfB.
|
||||
Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB). Both processes are shown here, but *only pick one* for the purposes of this lab. It's highly recommended that you use Intune rather than Microsoft Store for Business.
|
||||
|
||||
### Autopilot registration using Intune
|
||||
|
||||
@ -430,7 +430,7 @@ Optional: see the following video for an overview of the process.
|
||||
|
||||
> [!video https://www.youtube.com/embed/IpLIZU_j7Z0]
|
||||
|
||||
First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](/microsoft-store/windows-store-for-business-overview) to create a new one.
|
||||
First, you need a Microsoft Store for Business account. You can use the same one you created above for Intune, or follow [these instructions](/microsoft-store/windows-store-for-business-overview) to create a new one.
|
||||
|
||||
Next, to sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) with your test account, select **Sign in** on the upper-right-corner of the main page.
|
||||
|
||||
@ -445,16 +445,16 @@ Select the **Add devices** link to upload your CSV file. A message appears that
|
||||
## Create and assign a Windows Autopilot deployment profile
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only *pick one for the purposes of this lab*:
|
||||
> Autopilot profiles can be created and assigned to your registered VM or device either through Intune or Microsoft Store for Business. Both processes are shown here, but only *pick one for the purposes of this lab*:
|
||||
|
||||
Pick one:
|
||||
- [Create profiles using Intune](#create-a-windows-autopilot-deployment-profile-using-intune)
|
||||
- [Create profiles using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb)
|
||||
- [Create profiles using Microsoft Store for Business](#create-a-windows-autopilot-deployment-profile-using-msfb)
|
||||
|
||||
### Create a Windows Autopilot deployment profile using Intune
|
||||
|
||||
> [!NOTE]
|
||||
> Even if you registered your device in MSfB, it still appears in Intune. Although, you might have to **sync** and then **refresh** your device list.
|
||||
> Even if you registered your device in Microsoft Store for Business, it still appears in Intune. Although, you might have to **sync** and then **refresh** your device list.
|
||||
|
||||
|
||||
|
||||
@ -533,13 +533,13 @@ Select **OK**, and then select **Create**.
|
||||
|
||||
If you already created and assigned a profile via Intune with the steps immediately above, then skip this section.
|
||||
|
||||
A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers the steps required to create and assign profiles in MSfB. These steps are also summarized below.
|
||||
A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers the steps required to create and assign profiles in Microsoft Store for Business. These steps are also summarized below.
|
||||
|
||||
First, sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/manage/dashboard) using the Intune account you initially created for this lab.
|
||||
|
||||
Select **Manage** from the top menu, then select **Devices** from the left navigation tree.
|
||||
|
||||
|
||||
|
||||
|
||||
Select the **Windows Autopilot Deployment Program** link in the **Devices** tile.
|
||||
|
||||
@ -548,17 +548,17 @@ To CREATE the profile:
|
||||
Select your device from the **Devices** list:
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
> 
|
||||
|
||||
On the Autopilot deployment dropdown menu, select **Create new profile**:
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
> 
|
||||
|
||||
Name the profile, choose your desired settings, and then select **Create**:
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
> 
|
||||
|
||||
The new profile is added to the Autopilot deployment list.
|
||||
|
||||
@ -567,12 +567,12 @@ To ASSIGN the profile:
|
||||
To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab. Then, select the profile you want to assign from the **Autopilot deployment** dropdown menu, as shown:
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
> 
|
||||
|
||||
To confirm the profile was successfully assigned to the intended device, check the contents of the **Profile** column:
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
> 
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The new profile is only applied if the device hasn't started and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device.
|
||||
@ -609,7 +609,7 @@ Windows Autopilot takes over to automatically join your device into Azure AD and
|
||||
|
||||
## Remove devices from Autopilot
|
||||
|
||||
To use the device (or VM) for other purposes after completion of this lab, you need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found at [Enroll Windows devices in Intune by using Windows Autopilot](/intune/enrollment-autopilot#create-an-autopilot-device-group), [Remove devices by using wipe, retire, or manually unenrolling the device](/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal), and below.
|
||||
To use the device (or VM) for other purposes after completion of this lab, you need to remove (deregister) it from Autopilot via either Intune or Microsoft Store for Business, and then reset it. Instructions for deregistering devices can be found at [Enroll Windows devices in Intune by using Windows Autopilot](/intune/enrollment-autopilot#create-an-autopilot-device-group), [Remove devices by using wipe, retire, or manually unenrolling the device](/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal), and below.
|
||||
|
||||
### Delete (deregister) Autopilot device
|
||||
|
||||
|
||||
@ -1584,9 +1584,9 @@ The following fields are available:
|
||||
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
|
||||
- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
|
||||
- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update (WU) updates to other devices on the same network.
|
||||
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
|
||||
- **WUPauseState** Retrieves WU setting to determine if updates are paused.
|
||||
- **WUPauseState** Retrieves Windows Update setting to determine if updates are paused.
|
||||
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
|
||||
|
||||
|
||||
@ -4281,7 +4281,7 @@ The following fields are available:
|
||||
- **DeviceModel** What is the device model.
|
||||
- **DeviceOEM** What OEM does this device belong to.
|
||||
- **DownloadPriority** The priority of the download activity.
|
||||
- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
|
||||
- **DownloadScenarioId** A unique ID for a given download used to tie together Windows Update and DO events.
|
||||
- **DriverPingBack** Contains information about the previous driver and system state.
|
||||
- **Edition** Indicates the edition of Windows being used.
|
||||
- **EventInstanceID** A globally unique identifier for event instance.
|
||||
|
||||
@ -1681,9 +1681,9 @@ The following fields are available:
|
||||
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
|
||||
- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
|
||||
- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update(WU) updates to other devices on the same network.
|
||||
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
|
||||
- **WUPauseState** Retrieves WU setting to determine if updates are paused.
|
||||
- **WUPauseState** Retrieves Windows Update setting to determine if updates are paused.
|
||||
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
|
||||
|
||||
|
||||
|
||||
@ -1829,9 +1829,9 @@ The following fields are available:
|
||||
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
|
||||
- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
|
||||
- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update (WU) updates to other devices on the same network.
|
||||
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
|
||||
- **WUPauseState** Retrieves WU setting to determine if updates are paused.
|
||||
- **WUPauseState** Retrieves Windows Update setting to determine if updates are paused.
|
||||
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
|
||||
|
||||
|
||||
@ -6126,7 +6126,7 @@ This event sends data regarding OS Updates and Upgrades from Windows 7.X, Window
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightData** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightData** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **HostOSBuildNumber** The build number of the previous operating system.
|
||||
- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
|
||||
- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
|
||||
@ -8188,7 +8188,7 @@ This event sends data specific to the FixAppXReparsePoints mitigation used for O
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightId** Unique identifier for each flight.
|
||||
- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
|
||||
- **MitigationScenario** The update scenario in which the mitigation was executed.
|
||||
@ -8210,7 +8210,7 @@ This event sends data specific to the FixupEditionId mitigation used for OS upda
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **EditionIdUpdated** Determine whether EditionId was changed.
|
||||
- **FlightId** Unique identifier for each flight.
|
||||
- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
|
||||
|
||||
@ -2574,9 +2574,9 @@ The following fields are available:
|
||||
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
|
||||
- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
|
||||
- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update (WU) updates to other devices on the same network.
|
||||
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
|
||||
- **WUPauseState** Retrieves WU setting to determine if updates are paused.
|
||||
- **WUPauseState** Retrieves Windows Update setting to determine if updates are paused.
|
||||
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
|
||||
|
||||
|
||||
@ -4236,7 +4236,7 @@ The following fields are available:
|
||||
- **FlightId** The ID of the Windows Insider build the device received.
|
||||
- **InstallDate** The date the driver was installed.
|
||||
- **InstallFlags** The driver installation flags.
|
||||
- **OptionalData** Metadata specific to WU (Windows Update) associated with the driver (flight IDs, recovery IDs, etc.)
|
||||
- **OptionalData** Metadata specific to Windows Update (WU) associated with the driver (flight IDs, recovery IDs, etc.)
|
||||
- **RebootRequired** Indicates whether a reboot is required after the installation.
|
||||
- **RollbackPossible** Indicates whether this driver can be rolled back.
|
||||
- **WuTargetedHardwareId** Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update.
|
||||
@ -7554,7 +7554,7 @@ This event sends data regarding OS Updates and Upgrades from Windows 7.X, Window
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightData** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightData** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **HostOSBuildNumber** The build number of the previous operating system.
|
||||
- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
|
||||
- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
|
||||
@ -9816,7 +9816,7 @@ This event sends data specific to the FixAppXReparsePoints mitigation used for O
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightId** Unique GUID that identifies each instances of setuphost.exe.
|
||||
- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
|
||||
- **MitigationScenario** The update scenario in which the mitigation was executed.
|
||||
@ -9838,7 +9838,7 @@ This event sends data specific to the FixupEditionId mitigation used for OS upda
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **EditionIdUpdated** Determine whether EditionId was changed.
|
||||
- **FlightId** Unique identifier for each flight.
|
||||
- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
|
||||
@ -9861,7 +9861,7 @@ This event sends data specific to the FixupWimmountSysPath mitigation used for O
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightId** Unique identifier for each flight.
|
||||
- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry.
|
||||
- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation.
|
||||
|
||||
@ -2775,10 +2775,10 @@ The following fields are available:
|
||||
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
|
||||
- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
|
||||
- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update (WU) updates to other devices on the same network.
|
||||
- **WULCUVersion** Version of the LCU Installed on the machine.
|
||||
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
|
||||
- **WUPauseState** Retrieves WU setting to determine if updates are paused.
|
||||
- **WUPauseState** Retrieves Windows Update setting to determine if updates are paused.
|
||||
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
|
||||
|
||||
|
||||
@ -4337,7 +4337,7 @@ The following fields are available:
|
||||
- **FlightId** The ID of the Windows Insider build the device received.
|
||||
- **InstallDate** The date the driver was installed.
|
||||
- **InstallFlags** The driver installation flags.
|
||||
- **OptionalData** Metadata specific to WU (Windows Update) associated with the driver (flight IDs, recovery IDs, etc.)
|
||||
- **OptionalData** Metadata specific to Windows Update (WU) associated with the driver (flight IDs, recovery IDs, etc.)
|
||||
- **RebootRequired** Indicates whether a reboot is required after the installation.
|
||||
- **RollbackPossible** Indicates whether this driver can be rolled back.
|
||||
- **WuTargetedHardwareId** Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update.
|
||||
@ -7722,7 +7722,7 @@ This event sends data regarding OS Updates and Upgrades from Windows 7.X, Window
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightData** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightData** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **HostOSBuildNumber** The build number of the previous operating system.
|
||||
- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
|
||||
- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
|
||||
@ -9395,7 +9395,7 @@ The following fields are available:
|
||||
|
||||
- **updaterCmdLine** The command line requested by the updater.
|
||||
- **updaterId** The ID of the updater that requested the work.
|
||||
- **wuDeviceid** WU device ID.
|
||||
- **wuDeviceid** Windows Update device ID.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkNonSystem
|
||||
@ -9840,7 +9840,7 @@ This event sends data specific to the FixAppXReparsePoints mitigation used for O
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightId** Unique identifier for each flight.
|
||||
- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
|
||||
- **MitigationScenario** The update scenario in which the mitigation was executed.
|
||||
@ -9862,7 +9862,7 @@ This event sends data specific to the FixupEditionId mitigation used for OS upda
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **EditionIdUpdated** Determine whether EditionId was changed.
|
||||
- **FlightId** Unique identifier for each flight.
|
||||
- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
|
||||
@ -9885,7 +9885,7 @@ This event sends data specific to the FixupWimmountSysPath mitigation used for O
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightId** Unique identifier for each flight.
|
||||
- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry.
|
||||
- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation.
|
||||
|
||||
@ -119,7 +119,7 @@ Collects Office metadata through UTC to compare with equivalent data collected t
|
||||
Applicable to all Win32 applications. Helps us understand the status of the update process of the office suite (Success or failure with error details).
|
||||
|
||||
- **build:** App version
|
||||
- **channel:** Is this part of SAC or SAC-T?
|
||||
- **channel:** Is this part of GA Channel or SAC-T?
|
||||
- **errorCode:** What error occurred during the upgrade process?
|
||||
- **errorMessage:** what was the error message during the upgrade process?
|
||||
- **status:** Was the upgrade successful or not?
|
||||
@ -355,14 +355,14 @@ The following fields are available:
|
||||
Initialization of Explorer is complete.
|
||||
|
||||
## Microsoft-Windows-Security-EFS-EDPAudit-ApplicationLearning.EdpAuditLogApplicationLearning
|
||||
For a device subject to Windows Information Protection policy, learning events are generated when an app encounters a policy boundary (for example, trying to open a work document from a personal app). These events help the WIP administrator tune policy rules and prevent unnecessary user disruption.
|
||||
For a device subject to Windows Information Protection policy, learning events are generated when an app encounters a policy boundary (for example, trying to open a work document from a personal app). These events help the Windows Information Protection administrator tune policy rules and prevent unnecessary user disruption.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **actiontype:** Indicates what type of resource access the app was attempting (for example, opening a local document vs. a network resource) when it encountered a policy boundary. Useful for Windows Information Protection administrators to tune policy rules.
|
||||
- **appIdType:** Based on the type of application, this field indicates what type of app rule a Windows Information Protection administrator would need to create for this app.
|
||||
- **appname:** App that triggered the event
|
||||
- **status:** Indicates whether errors occurred during WIP learning events
|
||||
- **status:** Indicates whether errors occurred during Windows Information Protection learning events
|
||||
|
||||
## Win32kTraceLogging.AppInteractivitySummary
|
||||
Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Desktop Analytics) to understand and improve application reliability on managed devices.
|
||||
|
||||
@ -84,7 +84,7 @@ For Windows 10 and Windows 11, the following MDM policies are available in the [
|
||||
1. MDM Policy: [Notifications/DisallowTileNotification](/windows/client-management/mdm/policy-csp-notifications). This policy setting turns off tile notifications. If you enable this policy setting applications and system features will not be able to update their tiles and tile badges in the Start screen. **Integer value 1**
|
||||
|
||||
1. **Mail synchronization**
|
||||
1. MDM Policy: [Accounts/AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountconnection). Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services. **Set to 0 (zero)**
|
||||
1. MDM Policy: [Accounts/AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountconnection). Specifies whether the user is allowed to use an Microsoft account for non-email related connection authentication and services. **Set to 0 (zero)**
|
||||
|
||||
1. **Microsoft Account**
|
||||
1. MDM Policy: [Accounts/AllowMicrosoftAccountSignInAssistant](/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountsigninassistant). Disable the Microsoft Account Sign-In Assistant. **Set to 0 (zero)**
|
||||
|
||||
@ -2292,10 +2292,10 @@ The following fields are available:
|
||||
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
|
||||
- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
|
||||
- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update (WU) updates to other devices on the same network.
|
||||
- **WULCUVersion** Version of the LCU Installed on the machine.
|
||||
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
|
||||
- **WUPauseState** Retrieves WU setting to determine if updates are paused.
|
||||
- **WUPauseState** Retrieves Windows Update setting to determine if updates are paused.
|
||||
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
|
||||
|
||||
|
||||
@ -6022,7 +6022,7 @@ This event sends data regarding OS Updates and Upgrades from Windows 7.X, Window
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightData** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightData** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **HostOSBuildNumber** The build number of the previous operating system.
|
||||
- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
|
||||
- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
|
||||
@ -6789,7 +6789,7 @@ The following fields are available:
|
||||
- **freeDiskSpaceInMB** Amount of free disk space.
|
||||
- **interactive** Informs if this action is caused due to user interaction.
|
||||
- **priority** The CPU and IO priority this action is being performed on.
|
||||
- **provider** The provider that is being invoked to perform this action (WU, Legacy UO Provider etc.).
|
||||
- **provider** The provider that is being invoked to perform this action (Windows Update , Legacy UO Provider etc.).
|
||||
- **update** Update related metadata including UpdateId.
|
||||
- **uptimeMinutes** Duration USO for up for in the current boot session.
|
||||
- **wilActivity** Wil Activity related information.
|
||||
@ -6988,7 +6988,7 @@ The following fields are available:
|
||||
- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. There is no value being reported in this field right now. Expected value for this field is 0.
|
||||
- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
|
||||
- **DeferredUpdates** UpdateIds which are currently being deferred until a later time.
|
||||
- **DriverExclusionPolicy** Indicates if policy for not including drivers with WU updates is enabled.
|
||||
- **DriverExclusionPolicy** Indicates if policy for not including drivers with Windows Update (WU) updates is enabled.
|
||||
- **DriverSyncPassPerformed** A flag indicating whether the driver sync is performed in a update scan.
|
||||
- **EventInstanceID** A globally unique identifier for event instance.
|
||||
- **ExcludedUpdateClasses** Update classifications being excluded via policy.
|
||||
@ -8139,7 +8139,7 @@ This event sends data specific to the FixAppXReparsePoints mitigation used for O
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightId** Unique identifier for each flight.
|
||||
- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
|
||||
- **MitigationScenario** The update scenario in which the mitigation was executed.
|
||||
@ -8161,7 +8161,7 @@ This event sends data specific to the FixupWimmountSysPath mitigation used for O
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
|
||||
- **FlightId** Unique identifier for each flight.
|
||||
- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry.
|
||||
- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation.
|
||||
|
||||
@ -2305,10 +2305,10 @@ The following fields are available:
|
||||
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
|
||||
- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
|
||||
- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
|
||||
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update (WU) updates to other devices on the same network.
|
||||
- **WULCUVersion** Version of the LCU Installed on the machine.
|
||||
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
|
||||
- **WUPauseState** Retrieves WU setting to determine if updates are paused.
|
||||
- **WUPauseState** Retrieves Windows Update setting to determine if updates are paused.
|
||||
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
|
||||
|
||||
|
||||
|
||||
@ -48,7 +48,7 @@ The Windows Server 2016 or later domain controller is handling 100 percent of al
|
||||
|
||||
|
||||
|
||||
Upgrading another domain controller to Windows Server 2016 or later distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016 or later, but the number of WHFB clients remains the same.
|
||||
Upgrading another domain controller to Windows Server 2016 or later distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016 or later, but the number of Windows Hello for Business clients remains the same.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -125,7 +125,7 @@ Before you continue with the deployment, validate your deployment progress by re
|
||||
|
||||
## Add users to the Windows Hello for Business Users group
|
||||
|
||||
Users must receive the Windows Hello for Business group policy settings and have the proper permission to enroll for the WHFB Authentication certificate. You can provide users with these settings and permissions by adding the group used synchronize users to the Windows Hello for Business Users group. Users and groups that are not members of this group will not attempt to enroll for Windows Hello for Business.
|
||||
Users must receive the Windows Hello for Business group policy settings and have the proper permission to enroll for the Windows Hello for Business Authentication certificate. You can provide users with these settings and permissions by adding the group used synchronize users to the Windows Hello for Business Users group. Users and groups that are not members of this group will not attempt to enroll for Windows Hello for Business.
|
||||
|
||||
|
||||
## Follow the Windows Hello for Business on premises certificate trust deployment guide
|
||||
|
||||
@ -50,7 +50,7 @@ This table includes all available attributes/elements for the **Log** element. T
|
||||
|Attribute/Element |Value type |Description |
|
||||
|----------|-----------|------------|
|
||||
|ProviderType |String |This is always **EDPAudit**. |
|
||||
|LogType |String |Includes:<ul><li>**DataCopied.** Work data is copied or shared to a personal location.</li><li>**ProtectionRemoved.** WIP protection is removed from a Work-defined file.</li><li>**ApplicationGenerated.** A custom audit log provided by an app.</li></ul>|
|
||||
|LogType |String |Includes:<ul><li>**DataCopied.** Work data is copied or shared to a personal location.</li><li>**ProtectionRemoved.** Windows Information Protection is removed from a Work-defined file.</li><li>**ApplicationGenerated.** A custom audit log provided by an app.</li></ul>|
|
||||
|TimeStamp |Int |Uses the [FILETIME structure](/windows/win32/api/minwinbase/ns-minwinbase-filetime) to represent the time that the event happened. |
|
||||
|Policy |String |How the work data was shared to the personal location:<ul><li>**CopyPaste.** Work data was pasted into a personal location or app.</li><li>**ProtectionRemoved.** Work data was changed to be unprotected.</li><li>**DragDrop.** Work data was dropped into a personal location or app.</li><li>**Share.** Work data was shared with a personal location or app.</li><li>**NULL.** Any other way work data could be made personal beyond the options above. For example, when a work file is opened using a personal application (also known as, temporary access).</li></ul> |
|
||||
|Justification |String |Not implemented. This will always be either blank or NULL.<br><br>**Note**<br>Reserved for future use to collect the user justification for changing from **Work** to **Personal**. |
|
||||
@ -160,7 +160,7 @@ Here are a few examples of responses from the Reporting CSP.
|
||||
|
||||
## Collect WIP audit logs by using Windows Event Forwarding (for Windows desktop domain-joined devices only)
|
||||
|
||||
Use Windows Event Forwarding to collect and aggregate your WIP audit events. You can view your audit events in the Event Viewer.
|
||||
Use Windows Event Forwarding to collect and aggregate your Windows Information Protection audit events. You can view your audit events in the Event Viewer.
|
||||
|
||||
**To view the WIP events in the Event Viewer**
|
||||
|
||||
|
||||
@ -65,12 +65,12 @@ The **Configure Windows Information Protection settings** page appears, where yo
|
||||
|
||||
## Add app rules to your policy
|
||||
|
||||
During the policy-creation process in Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
During the policy-creation process in Configuration Manager, you can choose the apps you want to give access to your enterprise data through Windows Information Protection. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
|
||||
The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.<p>Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don't get this statement, it's possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
|
||||
>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.<p>Care must be taken to get a support statement from the software provider that their app is safe with Windows Information Protection before adding it to your **App rules** list. If you don't get this statement, it's possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
|
||||
|
||||
### Add a store app rule to your policy
|
||||
For this example, we're going to add Microsoft OneNote, a store app, to the **App Rules** list.
|
||||
@ -278,7 +278,7 @@ For this example, we're going to add an AppLocker XML file to the **App Rules**
|
||||
The file is imported and the apps are added to your **App Rules** list.
|
||||
|
||||
### Exempt apps from WIP restrictions
|
||||
If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.
|
||||
If you're running into compatibility issues where your app is incompatible with Windows Information Protection (WIP), but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.
|
||||
|
||||
**To exempt a store app, a desktop app, or an AppLocker policy file app rule**
|
||||
|
||||
|
||||
@ -37,7 +37,7 @@ Apps can be enlightened or unenlightened:
|
||||
|
||||
- Windows **Save As** experiences only allow you to save your files as enterprise.
|
||||
|
||||
- **WIP-work only apps** are unenlightened line-of-business apps that have been tested and deemed safe for use in an enterprise with WIP and Mobile App Management (MAM) solutions without device enrollment. Unenlightened apps that are targeted by WIP without enrollment run under personal mode.
|
||||
- **Windows Information Protection-work only apps** are unenlightened line-of-business apps that have been tested and deemed safe for use in an enterprise with WIP and Mobile App Management (MAM) solutions without device enrollment. Unenlightened apps that are targeted by WIP without enrollment run under personal mode.
|
||||
|
||||
## List of enlightened Microsoft apps
|
||||
Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following:
|
||||
@ -75,10 +75,10 @@ Microsoft has made a concerted effort to enlighten several of our more popular a
|
||||
- Microsoft To Do
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft Visio, Microsoft Office Access, Microsoft Project, and Microsoft Publisher are not enlightened apps and need to be exempted from WIP policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioning.
|
||||
> Microsoft Visio, Microsoft Office Access, Microsoft Project, and Microsoft Publisher are not enlightened apps and need to be exempted from Windows Information Protection policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioning.
|
||||
|
||||
## List of WIP-work only apps from Microsoft
|
||||
Microsoft still has apps that are unenlightened, but which have been tested and deemed safe for use in an enterprise with WIP and MAM solutions.
|
||||
Microsoft still has apps that are unenlightened, but which have been tested and deemed safe for use in an enterprise with Windows Information Protection and MAM solutions.
|
||||
|
||||
- Skype for Business
|
||||
|
||||
@ -102,7 +102,7 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li
|
||||
| PowerPoint Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.PowerPoint<br>**App Type:** Universal app |
|
||||
| OneNote | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.OneNote<br>**App Type:** Universal app |
|
||||
| Outlook Mail and Calendar | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** microsoft.windowscommunicationsapps<br>**App Type:** Universal app |
|
||||
| Microsoft 365 Apps for enterprise and Office 2019 Professional Plus | Microsoft 365 Apps for enterprise and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.<br>We don't recommend setting up Office by using individual paths or publisher rules. |
|
||||
| Microsoft 365 Apps for enterprise and Office 2019 Professional Plus | Microsoft 365 Apps for enterprise and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for Windows Information Protection.<br>We don't recommend setting up Office by using individual paths or publisher rules. |
|
||||
| Microsoft Photos | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Windows.Photos<br>**App Type:** Universal app |
|
||||
| Groove Music | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.ZuneMusic<br>**App Type:** Universal app |
|
||||
| Microsoft Movies & TV | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.ZuneVideo<br>**App Type:** Universal app |
|
||||
|
||||
@ -22,7 +22,7 @@ ms.localizationpriority: medium
|
||||
**Applies to:**
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
This following list provides info about the most common problems you might encounter while running WIP in your organization.
|
||||
This following list provides info about the most common problems you might encounter while running Windows Information Protection in your organization.
|
||||
|
||||
- **Limitation**: Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration.
|
||||
- **How it appears**:
|
||||
@ -33,12 +33,12 @@ This following list provides info about the most common problems you might encou
|
||||
|
||||
We strongly recommend educating employees about how to limit or eliminate the need for this decryption.
|
||||
|
||||
- **Limitation**: Direct Access is incompatible with WIP.
|
||||
- **How it appears**: Direct Access might experience problems with how WIP enforces app behavior and data movement because of how WIP determines what is and isn’t a corporate network resource.
|
||||
- **Limitation**: Direct Access is incompatible with Windows Information Protection.
|
||||
- **How it appears**: Direct Access might experience problems with how Windows Information Protection enforces app behavior and data movement because of how WIP determines what is and isn’t a corporate network resource.
|
||||
- **Workaround**: We recommend that you use VPN for client access to your intranet resources.
|
||||
|
||||
> [!NOTE]
|
||||
> VPN is optional and isn’t required by WIP.
|
||||
> VPN is optional and isn’t required by Windows Information Protection.
|
||||
|
||||
- **Limitation**: **NetworkIsolation** Group Policy setting takes precedence over MDM Policy settings.
|
||||
- **How it appears**: The **NetworkIsolation** Group Policy setting can configure network settings that can also be configured by using MDM. WIP relies on these policies being correctly configured.
|
||||
@ -48,7 +48,7 @@ This following list provides info about the most common problems you might encou
|
||||
- **How it appears**: If Cortana is on the allowed list, some files might become unexpectedly encrypted after an employee performs a search using Cortana. Your employees will still be able to use Cortana to search and provide results on enterprise documents and locations, but results might be sent to Microsoft.
|
||||
- **Workaround**: We don’t recommend adding Cortana to your allowed apps list. However, if you wish to use Cortana and don't mind whether the results potentially go to Microsoft, you can make Cortana an Exempt app.
|
||||
|
||||
- **Limitation**: WIP is designed for use by a single user per device.
|
||||
- **Limitation**: Windows Information Protection is designed for use by a single user per device.
|
||||
- **How it appears**: A secondary user on a device might experience app compatibility issues when unenlightened apps start to automatically encrypt for all users. Additionally, only the initial, enrolled user’s content can be revoked during the unenrollment process.
|
||||
- **Workaround**: We recommend only having one user per managed device.
|
||||
|
||||
@ -67,14 +67,14 @@ This following list provides info about the most common problems you might encou
|
||||
|
||||
- **Limitation**: Changing your primary Corporate Identity isn’t supported.
|
||||
- **How it appears**: You might experience various instabilities, including but not limited to network and file access failures, and potentially granting incorrect access.
|
||||
- **Workaround**: Turn off WIP for all devices before changing the primary Corporate Identity (first entry in the list), restarting, and finally redeploying.
|
||||
- **Workaround**: Turn off Windows Information Protection for all devices before changing the primary Corporate Identity (first entry in the list), restarting, and finally redeploying.
|
||||
|
||||
- **Limitation**: Redirected folders with Client-Side Caching are not compatible with WIP.
|
||||
- **Limitation**: Redirected folders with Client-Side Caching are not compatible with Windows Information Protection.
|
||||
- **How it appears**: Apps might encounter access errors while attempting to read a cached, offline file.
|
||||
- **Workaround**: Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.
|
||||
|
||||
> [!NOTE]
|
||||
> For more info about Work Folders and Offline Files, see the [Work Folders and Offline Files support for Windows Information Protection blog](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). If you're having trouble opening files offline while using Offline Files and WIP, see [Can't open files offline when you use Offline Files and Windows Information Protection](/troubleshoot/windows-client/networking/error-open-files-offline-offline-files-wip).
|
||||
> For more info about Work Folders and Offline Files, see the [Work Folders and Offline Files support for Windows Information Protection blog](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). If you're having trouble opening files offline while using Offline Files and Windows Information Protection, see [Can't open files offline when you use Offline Files and Windows Information Protection](/troubleshoot/windows-client/networking/error-open-files-offline-offline-files-wip).
|
||||
|
||||
- **Limitation**: An unmanaged device can use Remote Desktop Protocol (RDP) to connect to a WIP-managed device.
|
||||
- **How it appears**:
|
||||
@ -83,23 +83,23 @@ This following list provides info about the most common problems you might encou
|
||||
- Local **Work** data copied to the WIP-managed device remains **Work** data.
|
||||
- **Work** data that is copied between two apps in the same session remains ** data.
|
||||
|
||||
- **Workaround**: Disable RDP to prevent access because there is no way to restrict access to only devices managed by WIP. RDP is disabled by default.
|
||||
- **Workaround**: Disable RDP to prevent access because there is no way to restrict access to only devices managed by Windows Information Protection. RDP is disabled by default.
|
||||
|
||||
- **Limitation**: You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer.
|
||||
- **How it appears**: A message appears stating that the content is marked as **Work** and the user isn't given an option to override to **Personal**.
|
||||
- **Workaround**: Open File Explorer and change the file ownership to **Personal** before you upload.
|
||||
|
||||
- **Limitation**: ActiveX controls should be used with caution.
|
||||
- **How it appears**: Webpages that use ActiveX controls can potentially communicate with other outside processes that aren’t protected by using WIP.
|
||||
- **How it appears**: Webpages that use ActiveX controls can potentially communicate with other outside processes that aren’t protected by using Windows Information Protection.
|
||||
- **Workaround**: We recommend that you switch to using Microsoft Edge, the more secure and safer browser that prevents the use of ActiveX controls. We also recommend that you limit the usage of Internet Explorer 11 to only those line-of-business apps that require legacy technology.
|
||||
|
||||
For more info, see [Out-of-date ActiveX control blocking](/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking).
|
||||
|
||||
- **Limitation**: Resilient File System (ReFS) isn't currently supported with WIP.
|
||||
- **How it appears**:Trying to save or transfer WIP files to ReFS will fail.
|
||||
- **Limitation**: Resilient File System (ReFS) isn't currently supported with Windows Information Protection.
|
||||
- **How it appears**:Trying to save or transfer Windows Information Protection files to ReFS will fail.
|
||||
- **Workaround**: Format drive for NTFS, or use a different drive.
|
||||
|
||||
- **Limitation**: WIP isn’t turned on if any of the following folders have the **MakeFolderAvailableOfflineDisabled** option set to **False**:
|
||||
- **Limitation**: Windows Information Protection isn’t turned on if any of the following folders have the **MakeFolderAvailableOfflineDisabled** option set to **False**:
|
||||
- AppDataRoaming
|
||||
- Desktop
|
||||
- StartMenu
|
||||
@ -116,10 +116,10 @@ This following list provides info about the most common problems you might encou
|
||||
|
||||
<br/>
|
||||
|
||||
- **How it appears**: WIP isn’t turned on for employees in your organization. Error code 0x807c0008 will result if WIP is deployed by using Microsoft Endpoint Configuration Manager.
|
||||
- **How it appears**: Windows Information Protection isn’t turned on for employees in your organization. Error code 0x807c0008 will result if Windows Information Protection is deployed by using Microsoft Endpoint Configuration Manager.
|
||||
- **Workaround**: Don’t set the **MakeFolderAvailableOfflineDisabled** option to **False** for any of the specified folders. You can configure this parameter, as described [Disable Offline Files on individual redirected folders](/windows-server/storage/folder-redirection/disable-offline-files-on-folders).
|
||||
|
||||
If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline.
|
||||
If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports Windows Information Protection, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after Windows Information Protection is already in place, you might be unable to open your files offline.
|
||||
|
||||
For more info about these potential access errors, see [Can't open files offline when you use Offline Files and Windows Information Protection](/troubleshoot/windows-client/networking/error-open-files-offline-offline-files-wip).
|
||||
|
||||
@ -134,7 +134,7 @@ This following list provides info about the most common problems you might encou
|
||||
- **How it appears**: Any attempt to encrypt a file in the Windows directory will return a file access denied error. But if you copy or drag and drop an encrypted file to the Windows directory, it will retain encryption to honor the intent of the owner.
|
||||
- **Workaround**: If you need to save an encrypted file in the Windows directory, create and encrypt the file in a different directory and copy it.
|
||||
|
||||
- **Limitation**: OneNote notebooks on OneDrive for Business must be properly configured to work with WIP.
|
||||
- **Limitation**: OneNote notebooks on OneDrive for Business must be properly configured to work with Windows Information Protection.
|
||||
- **How it appears**: OneNote might encounter errors syncing a OneDrive for Business notebook and suggest changing the file ownership to Personal. Attempting to view the notebook in OneNote Online in the browser will show an error and unable to view it.
|
||||
- **Workaround**: OneNote notebooks that are newly copied into the OneDrive for Business folder from File Explorer should get fixed automatically. To do this, follow these steps:
|
||||
|
||||
@ -150,6 +150,6 @@ This following list provides info about the most common problems you might encou
|
||||
|
||||
> [!NOTE]
|
||||
>
|
||||
> - When corporate data is written to disk, WIP uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity. One caveat to keep in mind is that the Preview Pane in File Explorer will not work for encrypted files.
|
||||
> - When corporate data is written to disk, Windows Information Protection uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity. One caveat to keep in mind is that the Preview Pane in File Explorer will not work for encrypted files.
|
||||
>
|
||||
> - Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
|
||||
@ -27,7 +27,7 @@ This list provides all of the tasks and settings that are required for the opera
|
||||
|Task|Description|
|
||||
|----|-----------|
|
||||
|Add at least one app of each type (Store and Desktop) to the **Protected apps** list in your WIP policy.|You must have at least one Store app and one Desktop app added to your **Protected apps** list. For more info about where this area is and how to add apps, see the **Add apps to your Protected apps list** section of the policy creation topics. |
|
||||
|Choose your WIP protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Allow Overrides**, **Silent**, or **Block**. For more info about where this area is and how to decide on your protection level, see the [Manage the WIP protection mode for your enterprise data](./create-wip-policy-using-configmgr.md#manage-the-wip-protection-level-for-your-enterprise-data) section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
|
||||
|Choose your Windows Information Protection protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Allow Overrides**, **Silent**, or **Block**. For more info about where this area is and how to decide on your protection level, see the [Manage Windows Information Protection mode for your enterprise data](./create-wip-policy-using-configmgr.md#manage-the-wip-protection-level-for-your-enterprise-data) section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
|
||||
|Specify your corporate identity.|This field is automatically filled out for you by Microsoft Intune. However, you must manually correct it if it’s incorrect or if you need to add additional domains. For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics.
|
||||
|Specify your network domain names.|Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics.|
|
||||
|Specify your enterprise IPv4 or IPv6 ranges.|Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the addresses for a valid IPv4 or IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics.|
|
||||
|
||||
@ -31,14 +31,14 @@ With the increase of employee-owned devices in the enterprise, there’s also an
|
||||
Windows Information Protection (WIP), previously known as enterprise data protection (EDP), helps to protect against this potential data leakage without otherwise interfering with the employee experience. WIP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. Finally, another data protection technology, Azure Rights Management also works alongside WIP to extend data protection for data that leaves the device, such as when email attachments are sent from an enterprise aware version of a rights management mail client.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>While WIP can stop accidental data leaks from honest employees, it is not intended to stop malicious insiders from removing enterprise data. For more details about the benefits WIP provides, see [Why use WIP?](#why-use-wip) later in this topic.
|
||||
>While Windows Information Protection can stop accidental data leaks from honest employees, it is not intended to stop malicious insiders from removing enterprise data. For more details about the benefits WIP provides, see [Why use WIP?](#why-use-wip) later in this topic.
|
||||
|
||||
## Video: Protect enterprise data from being accidentally copied to the wrong place
|
||||
|
||||
> [!Video https://www.microsoft.com/videoplayer/embed/RE2IGhh]
|
||||
|
||||
## Prerequisites
|
||||
You’ll need this software to run WIP in your enterprise:
|
||||
You’ll need this software to run Windows Information Protection in your enterprise:
|
||||
|
||||
|Operating system | Management solution |
|
||||
|-----------------|---------------------|
|
||||
@ -70,7 +70,7 @@ After the type of protection is set, the creating app encrypts the document so t
|
||||
Finally, there’s the risk of data leaking from your company when an employee leaves or unenrolls a device. Previously, you would simply erase all of the corporate data from the device, along with any other personal data on the device.
|
||||
|
||||
## Benefits of WIP
|
||||
WIP provides:
|
||||
Windows Information Protection provides:
|
||||
- Obvious separation between personal and corporate data, without requiring employees to switch environments or apps.
|
||||
|
||||
- Additional data protection for existing line-of-business apps without a need to update the apps.
|
||||
@ -79,12 +79,12 @@ WIP provides:
|
||||
|
||||
- Use of audit reports for tracking issues and remedial actions.
|
||||
|
||||
- Integration with your existing management system (Microsoft Intune, Microsoft Endpoint Configuration Manager, or your current mobile device management (MDM) system) to configure, deploy, and manage WIP for your company.
|
||||
- Integration with your existing management system (Microsoft Intune, Microsoft Endpoint Configuration Manager, or your current mobile device management (MDM) system) to configure, deploy, and manage Windows Information Protection for your company.
|
||||
|
||||
## Why use WIP?
|
||||
WIP is the mobile application management (MAM) mechanism on Windows 10. WIP gives you a new way to manage data policy enforcement for apps and documents on Windows 10 desktop operating systems, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune).
|
||||
Windows Information Protection is the mobile application management (MAM) mechanism on Windows 10. WIP gives you a new way to manage data policy enforcement for apps and documents on Windows 10 desktop operating systems, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune).
|
||||
|
||||
- **Change the way you think about data policy enforcement.** As an enterprise admin, you need to maintain compliance in your data policy and data access. WIP helps protect enterprise on both corporate and employee-owned devices, even when the employee isn’t using the device. When employees create content on an enterprise-protected device, they can choose to save it as a work document. If it's a work document, it becomes locally-maintained as enterprise data.
|
||||
- **Change the way you think about data policy enforcement.** As an enterprise admin, you need to maintain compliance in your data policy and data access. Windows Information Protection helps protect enterprise on both corporate and employee-owned devices, even when the employee isn’t using the device. When employees create content on an enterprise-protected device, they can choose to save it as a work document. If it's a work document, it becomes locally-maintained as enterprise data.
|
||||
|
||||
- **Manage your enterprise documents, apps, and encryption modes.**
|
||||
|
||||
@ -99,21 +99,21 @@ WIP is the mobile application management (MAM) mechanism on Windows 10. WIP give
|
||||
- **Deciding your level of data access.** WIP lets you block, allow overrides, or audit employees' data sharing actions. Hiding overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your protected apps list. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
|
||||
|
||||
|
||||
- **Data encryption at rest.** WIP helps protect enterprise data on local files and on removable media.
|
||||
- **Data encryption at rest.** Windows Information Protection helps protect enterprise data on local files and on removable media.
|
||||
|
||||
Apps such as Microsoft Word work with WIP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens WIP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies WIP to the new document.
|
||||
Apps such as Microsoft Word work with WIP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens WIP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies Windows Information Protection to the new document.
|
||||
|
||||
- **Helping prevent accidental data disclosure to public spaces.** WIP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your protected apps list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your protected apps list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the business cloud, while maintaining the encryption locally.
|
||||
- **Helping prevent accidental data disclosure to public spaces.** Windows Information Protection helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your protected apps list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your protected apps list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the business cloud, while maintaining the encryption locally.
|
||||
|
||||
- **Helping prevent accidental data disclosure to removable media.** WIP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t.
|
||||
- **Helping prevent accidental data disclosure to removable media.** Windows Information Protection helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t.
|
||||
|
||||
- **Remove access to enterprise data from enterprise-protected devices.** WIP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.
|
||||
- **Remove access to enterprise data from enterprise-protected devices.** Windows Information Protection gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.
|
||||
|
||||
>[!NOTE]
|
||||
>For management of Surface devices it is recommended that you use the Current Branch of Microsoft Endpoint Configuration Manager.<br>Microsoft Endpoint Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device.
|
||||
|
||||
## How WIP works
|
||||
WIP helps address your everyday challenges in the enterprise. Including:
|
||||
Windows Information Protection helps address your everyday challenges in the enterprise. Including:
|
||||
|
||||
- Helping to prevent enterprise data leaks, even on employee-owned devices that can't be locked down.
|
||||
|
||||
@ -124,7 +124,7 @@ WIP helps address your everyday challenges in the enterprise. Including:
|
||||
- Helping control the network and data access and data sharing for apps that aren’t enterprise aware
|
||||
|
||||
### Enterprise scenarios
|
||||
WIP currently addresses these enterprise scenarios:
|
||||
Windows Information Protection currently addresses these enterprise scenarios:
|
||||
- You can encrypt enterprise data on employee-owned and corporate-owned devices.
|
||||
|
||||
- You can remotely wipe enterprise data off managed computers, including employee-owned computers, without affecting the personal data.
|
||||
@ -134,21 +134,21 @@ WIP currently addresses these enterprise scenarios:
|
||||
- Your employees won't have their work otherwise interrupted while switching between personal and enterprise apps while the enterprise policies are in place. Switching environments or signing in multiple times isn’t required.
|
||||
|
||||
### <a href="" id="bkmk-modes"></a>WIP-protection modes
|
||||
Enterprise data is automatically encrypted after it’s loaded on a device from an enterprise source or if an employee marks the data as corporate. Then, when the enterprise data is written to disk, WIP uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity.
|
||||
Enterprise data is automatically encrypted after it’s loaded on a device from an enterprise source or if an employee marks the data as corporate. Then, when the enterprise data is written to disk, Windows Information Protection uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity.
|
||||
|
||||
Your WIP policy includes a list of trusted apps that are protected to access and process corporate data. This list of apps is implemented through the [AppLocker](/windows/device-security/applocker/applocker-overview) functionality, controlling what apps are allowed to run and letting the Windows operating system know that the apps can edit corporate data. Apps included on this list don’t have to be modified to open corporate data because their presence on the list allows Windows to determine whether to grant them access. However, new for Windows 10, app developers can use a new set of application programming interfaces (APIs) to create *enlightened* apps that can use and edit both enterprise and personal data. A huge benefit to working with enlightened apps is that dual-use apps, like Microsoft Word, can be used with less concern about encrypting personal data by mistake because the APIs allow the app to determine whether data is owned by the enterprise or if it’s personally owned.
|
||||
Your Windows Information Protection policy includes a list of trusted apps that are protected to access and process corporate data. This list of apps is implemented through the [AppLocker](/windows/device-security/applocker/applocker-overview) functionality, controlling what apps are allowed to run and letting the Windows operating system know that the apps can edit corporate data. Apps included on this list don’t have to be modified to open corporate data because their presence on the list allows Windows to determine whether to grant them access. However, new for Windows 10, app developers can use a new set of application programming interfaces (APIs) to create *enlightened* apps that can use and edit both enterprise and personal data. A huge benefit to working with enlightened apps is that dual-use apps, like Microsoft Word, can be used with less concern about encrypting personal data by mistake because the APIs allow the app to determine whether data is owned by the enterprise or if it’s personally owned.
|
||||
|
||||
>[!NOTE]
|
||||
>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
|
||||
|
||||
You can set your WIP policy to use 1 of 4 protection and management modes:
|
||||
You can set your Windows Information Protection policy to use 1 of 4 protection and management modes:
|
||||
|
||||
|Mode|Description|
|
||||
|----|-----------|
|
||||
|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.|
|
||||
|Allow overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log.|
|
||||
|Silent |WIP runs silently, logging inappropriate data sharing, without stopping anything that would’ve been prompted for employee interaction while in Allow overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.|
|
||||
|Off |WIP is turned off and doesn't help to protect or audit your data.<p>After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on. |
|
||||
|Block |Windows Information Protection looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.|
|
||||
|Allow overrides |Windows Information Protection looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log.|
|
||||
|Silent |Windows Information Protection runs silently, logging inappropriate data sharing, without stopping anything that would’ve been prompted for employee interaction while in Allow overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.|
|
||||
|Off |Windows Information Protection is turned off and doesn't help to protect or audit your data.<p>After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn Windows Information Protection back on. |
|
||||
|
||||
## Turn off WIP
|
||||
You can turn off all Windows Information Protection and restrictions, decrypting all devices managed by WIP and reverting to where you were pre-WIP, with no data loss. However, this isn’t recommended. If you choose to turn WIP off, you can always turn it back on, but your decryption and policy info won’t be automatically reapplied.
|
||||
|
||||
@ -25,7 +25,7 @@ ms.reviewer:
|
||||
|
||||
>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare).
|
||||
|
||||
We recommend that you add the following URLs to the Enterprise Cloud Resources and Neutral Resources network settings when you create a WIP policy. If you are using Intune, the SharePoint entries may be added automatically.
|
||||
We recommend that you add the following URLs to the Enterprise Cloud Resources and Neutral Resources network settings when you create a Windows Information Protection policy. If you are using Intune, the SharePoint entries may be added automatically.
|
||||
|
||||
## Recommended Enterprise Cloud Resources
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ Use Task Manager to check the context of your apps while running in Windows Info
|
||||
## Viewing the Enterprise Context column in Task Manager
|
||||
You need to add the Enterprise Context column to the **Details** tab of the Task Manager.
|
||||
|
||||
1. Make sure that you have an active WIP policy deployed and turned on in your organization.
|
||||
1. Make sure that you have an active Windows Information Protection policy deployed and turned on in your organization.
|
||||
|
||||
2. Open the Task Manager (taskmgr.exe), click the **Details** tab, right-click in the column heading area, and click **Select columns**.
|
||||
|
||||
@ -50,7 +50,7 @@ The **Enterprise Context** column shows you what each app can do with your enter
|
||||
|
||||
- **Personal.** Shows the text, *Personal*. This app is considered non-work-related and can't touch any work data or resources.
|
||||
|
||||
- **Exempt.** Shows the text, *Exempt*. WIP policies don't apply to these apps (such as, system components).
|
||||
- **Exempt.** Shows the text, *Exempt*. Windows Information Protection policies don't apply to these apps (such as, system components).
|
||||
|
||||
> [!Important]
|
||||
> Enlightened apps can change between Work and Personal, depending on the data being touched. For example, Microsoft Word 2016 shows as **Personal** when an employee opens a personal letter, but changes to **Work** when that same employee opens the company financials.
|
||||
|
||||
@ -78,12 +78,10 @@ sections:
|
||||
- question: |
|
||||
What is the WDAGUtilityAccount local account?
|
||||
answer: |
|
||||
WDAGUtilityAccount is part of Application Guard, beginning with Windows 10, version 1709 (Fall Creators Update). It remains disabled by default, unless Application Guard is enabled on your device. WDAGUtilityAccount is used to sign in to the Application Guard container as a standard user with a random password. It is NOT a malicious account. If *Run as a service* permissions are revoked for this account, you might see the following error:
|
||||
WDAGUtilityAccount is part of Application Guard, beginning with Windows 10, version 1709 (Fall Creators Update). It remains disabled by default, unless Application Guard is enabled on your device. WDAGUtilityAccount is used to sign in to the Application Guard container as a standard user with a random password. It is NOT a malicious account. It requires *Logon as a service* permissions to be able to function correctly. If this permission is denied, you might see the following error:
|
||||
|
||||
**Error: 0x80070569, Ext error: 0x00000001; RDP: Error: 0x00000000, Ext error: 0x00000000 Location: 0x00000000**
|
||||
|
||||
We recommend that you don't modify this account.
|
||||
|
||||
- question: |
|
||||
How do I trust a subdomain in my site list?
|
||||
answer: |
|
||||
|
||||
@ -26,9 +26,9 @@ This topic provides links to articles with information about what's new in each
|
||||
|
||||
## The Long-Term Servicing Channel (LTSC)
|
||||
|
||||
The following table summarizes equivalent feature update versions of Windows 10 LTSC and General Availability Channel (SAC) releases.
|
||||
The following table summarizes equivalent feature update versions of Windows 10 LTSC and General Availability Channel (GA Channel) releases.
|
||||
|
||||
| LTSC release | Equivalent SAC release | Availability date |
|
||||
| LTSC release | Equivalent GA Channel release | Availability date |
|
||||
| --- | --- | --- |
|
||||
| Windows 10 Enterprise LTSC 2015 | Windows 10, Version 1507 | 7/29/2015 |
|
||||
| Windows 10 Enterprise LTSC 2016 | Windows 10, Version 1607 | 8/2/2016 |
|
||||
|
||||
@ -201,7 +201,7 @@ New features in [Windows Hello for Business](/windows/security/identity-protecti
|
||||
|
||||
- Windows Hello is part of the account protection pillar in Windows Defender Security Center. Account Protection will encourage password users to set up Windows Hello Face, Fingerprint or PIN for faster sign-in, and will notify Dynamic lock users if Dynamic lock has stopped working because their device Bluetooth is off.
|
||||
|
||||
- You can set up Windows Hello from lock screen for MSA accounts. We've made it easier for Microsoft account users to set up Windows Hello on their devices for faster and more secure sign-in. Previously, you had to navigate deep into Settings to find Windows Hello. Now, you can set up Windows Hello Face, Fingerprint or PIN straight from your lock screen by clicking the Windows Hello tile under Sign-in options.
|
||||
- You can set up Windows Hello from lock screen for Microsoft accounts. We’ve made it easier for Microsoft account users to set up Windows Hello on their devices for faster and more secure sign-in. Previously, you had to navigate deep into Settings to find Windows Hello. Now, you can set up Windows Hello Face, Fingerprint or PIN straight from your lock screen by clicking the Windows Hello tile under Sign-in options.
|
||||
|
||||
- New [public API](/uwp/api/windows.security.authentication.web.core.webauthenticationcoremanager.findallaccountsasync) for secondary account SSO for a particular identity provider.
|
||||
|
||||
|
||||
@ -139,7 +139,7 @@ Windows Hello enhancements include:
|
||||
- Windows Hello is now supported as Fast Identity Online 2 (FIDO2) authenticator across all major browsers including Chrome and Firefox.
|
||||
- You can now enable passwordless sign-in for Microsoft accounts on your Windows 10 device by going to **Settings > Accounts > Sign-in options**, and selecting **On** under **Make your device passwordless**. Enabling passwordless sign in will switch all Microsoft accounts on your Windows 10 device to modern authentication with Windows Hello Face, Fingerprint, or PIN.
|
||||
- Windows Hello PIN sign-in support is [added to Safe mode](/windows-insider/archive/new-in-20H1#windows-hello-pin-in-safe-mode-build-18995).
|
||||
- Windows Hello for Business now has Hybrid Azure Active Directory support and phone number sign-in (MSA). FIDO2 security key support is expanded to Azure Active Directory hybrid environments, enabling enterprises with hybrid environments to take advantage of [passwordless authentication](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Expanding Azure Active Directory support for FIDO2 preview to hybrid environments](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-azure-active-directory-support-for-fido2-preview-to/ba-p/981894).
|
||||
- Windows Hello for Business now has Hybrid Azure Active Directory support and phone number sign-in (Microsoft account). FIDO2 security key support is expanded to Azure Active Directory hybrid environments, enabling enterprises with hybrid environments to take advantage of [passwordless authentication](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Expanding Azure Active Directory support for FIDO2 preview to hybrid environments](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-azure-active-directory-support-for-fido2-preview-to/ba-p/981894).
|
||||
- With specialized hardware and software components available on devices shipping with Windows 10, version 20H2 configured out of factory, Windows Hello now offers added support for virtualization-based security with supporting fingerprint and face sensors. This feature isolates and secures a user's biometric authentication data.
|
||||
- Windows Hello multi-camera support is added, allowing users to choose an external camera priority when both external and internal Windows Hello-capable cameras are present.
|
||||
- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD.
|
||||
|
||||
@ -145,7 +145,7 @@ The OS uninstall period is a length of time that users are given when they can o
|
||||
- Windows Hello is now [password-less on S-mode](https://www.windowslatest.com/2018/02/12/microsoft-make-windows-10-password-less-platform/).
|
||||
- Support for S/MIME with Windows Hello for Business and APIs for non-Microsoft identity lifecycle management solutions.
|
||||
- Windows Hello is part of the account protection pillar in Windows Defender Security Center. Account Protection will encourage password users to set up Windows Hello Face, Fingerprint or PIN for faster sign in, and will notify Dynamic lock users if Dynamic lock has stopped working because their phone or device Bluetooth is off.
|
||||
- You can set up Windows Hello from lock screen for MSA accounts. We’ve made it easier for Microsoft account users to set up Windows Hello on their devices for faster and more secure sign-in. Previously, you had to navigate deep into Settings to find Windows Hello. Now, you can set up Windows Hello Face, Fingerprint or PIN straight from your lock screen by clicking the Windows Hello tile under Sign-in options.
|
||||
- You can set up Windows Hello from lock screen for Microsoft accounts. We’ve made it easier for Microsoft account users to set up Windows Hello on their devices for faster and more secure sign-in. Previously, you had to navigate deep into Settings to find Windows Hello. Now, you can set up Windows Hello Face, Fingerprint or PIN straight from your lock screen by clicking the Windows Hello tile under Sign-in options.
|
||||
- New [public API](/uwp/api/windows.security.authentication.web.core.webauthenticationcoremanager.findallaccountsasync#Windows_Security_Authentication_Web_Core_WebAuthenticationCoreManager_FindAllAccountsAsync_Windows_Security_Credentials_WebAccountProvider_) for secondary account SSO for a particular identity provider.
|
||||
- It is easier to set up Dynamic lock, and WD SC actionable alerts have been added when Dynamic lock stops working (ex: phone Bluetooth is off).
|
||||
|
||||
|
||||
@ -32,7 +32,7 @@ To download and install Windows 10, version 2004, use Windows Update (**Settings
|
||||
|
||||
- Windows Hello PIN sign-in support is [added to Safe mode](/windows-insider/archive/new-in-20H1#windows-hello-pin-in-safe-mode-build-18995).
|
||||
|
||||
- Windows Hello for Business now has Hybrid Azure Active Directory support and phone number sign-in (MSA). FIDO2 security key support is expanded to Azure Active Directory hybrid environments, enabling enterprises with hybrid environments to take advantage of [passwordless authentication](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Expanding Azure Active Directory support for FIDO2 preview to hybrid environments](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-azure-active-directory-support-for-fido2-preview-to/ba-p/981894).
|
||||
- Windows Hello for Business now has Hybrid Azure Active Directory support and phone number sign-in (Microsoft account). FIDO2 security key support is expanded to Azure Active Directory hybrid environments, enabling enterprises with hybrid environments to take advantage of [passwordless authentication](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Expanding Azure Active Directory support for FIDO2 preview to hybrid environments](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-azure-active-directory-support-for-fido2-preview-to/ba-p/981894).
|
||||
|
||||
### Windows Defender System Guard
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user